REPORT: v0.243.0 FileBrowser password, per-tier backup page, tier skip, OOM visibility

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,53 +1,36 @@
-# REPORT — controller v0.242.0: a removed app is listed with its kept backup, and five small ones (2026-09-13 night)
+# REPORT — controller v0.243.0: a real file-manager password, a truthful backup page, no stop for a missing tier (2026-09-15)
 
-*Overwritten each run. This records the most recent implementation only.*
+Task: *before the volunteer — the big night's P1 fixes*, Parts B, C, E.2 (controller half). **MinAgent: 0.131.0.**
+Architecture: `07-backup-architecture.md` §6, `02-controller-module-map.md` (settings after install).
 
-> **Nightly session under `.claude/rules/unprompted-work.md`.** Architecture read and named:
-> `felhom.eu/documentation/architecture/07-backup-architecture.md` (§6.3 restore destination, the
-> R-237 store-keyed list rule) and `09-update-architecture.md` (holds). Shipped as **v0.242.0**
-> (`d698ce3`), delivered by the managed floor with the declared MinAgent 0.129.0: demo-hp +16 s,
-> demo-felhom +17 s; hand-set on the scratch guest 9202 (the one place that is allowed). Evidence:
-> `felhom.eu/documentation/audits/v0242-2026-09-14/`.
+## R-513 — FileBrowser password
+Measured first (B.1): the config key / env var sets the password but re-applies it on every start (a hand-set password
+is overwritten); the API (`PUT /api/users?id=…` + `X-Password: <current>`) changes it once. Shipped the API path for
+fresh and existing boxes: probe admin/admin → 200: generate, set, verify new=200 and admin=401, store encrypted →
+`generated`; 401 → `operator`; unreachable → nothing recorded. App page shows user `admin` + reveal (R-254 rules).
+**Live:** 9202 (default) → generated, reveal 200 (16 chars), revealed=200 / admin=401 / wrong=401. 9201 (hand-set) →
+first probe failed on DNS before the network join (retried), then `operator` at 08:52:10Z, untouched. Public
+`files.enkisfelhom.hu` admin → 401. *One invalid run first (empty credential read) — marked in the evidence.*
 
-## What changed
+## R-517 / R-518 — backup page and tier skip
+Per tier: newest success, failed attempt under it, „nincs beállítva" for absent storage; „Naprakész" and the remote tick
+from successes only; a tier with absent storage is skipped before anything stops (`backup_tier_skipped`). Button copy
+tells the real downtime. **Live on 9201:** local and PBS rows „✓ … Naprakész", remote tick on a real PBS success. Found
+live: the top card printed „0 B" for a size read back from storage → fixed to „–" on `main` (d3eacbb), **unreleased**.
+Not live-measured: the absent-storage and failed-PBS states (unit-proven; making them on a demo box means removing its
+PBS storage).
 
-- **R-487 (P2)** — `backup.ListRemovedAppUnits` walks `backups/primary/` on the system path and every
-  connected registered drive and returns the units whose app is not deployed. The Mentések page lists
-  them after the deployed rows („Eltávolítva — visszaállítható", one action: *Visszaállítás a
-  mentésből* = `POST /backup/restore`), the Visszaállítás picker lists them in their own group,
-  `GET /api/backup/snapshots` answers for them, and `RestoreFromRecoveryUnit` opens the unit where it
-  sits (`primaryUnitDirFor`) — a unit kept on a data drive was unreachable before. The claim text is
-  registered with the retrieval-promise gate as conditional on the readable unit.
-- **R-491 (P2)** — `removeStack` clears an UPDATE hold (`Settings.ClearUpdateHold`), never an R-379
-  restore hold. Logged.
-- **R-490** — `/api/system/info` mounted exactly ahead of the web layer's `/api/system/` prefix;
-  `systemInfo` reads the default storage path like every other reader of the empty global. Nil-safe
-  on the syncer. **The global's deletion is R-492.**
-- **R-489** — `volumes_removed` is the before/after difference of the project's volumes, `[]` when
-  none. **Measured limit, row kept open:** the listing filters on the compose project label and a
-  volume recreated by a unit restore (`docker volume create`) carries none — compose removes it, the
-  response says `[]`. A fresh compose volume is reported.
-- **R-476** — `Tier2Coverage.UnitDataDate`: a refreshed leg is dated by its newest dump, a preserved
-  package keeps the manifest date (R-403).
-- **R-456** — the boot-orphan rule pinned by a test; design unchanged.
+## R-514 — OOM visibility
+`State.OOMKilled` read for running app containers → dashboard „Memória elfogyott" + `app_oom`. **Not proven live:**
+in the LXC guest Docker reported neither a restart-OOM nor a child-process OOM (R-528). The task's tag text
+„… — újraindítva" was not used: the controller does not restart the app.
 
-## Proof
+## Red-proofs
+PUT removed → admin/admin still logs in; operator branch removed → page does not say who set it; attempt-as-success →
+size lost; skip disabled → manual run starts felhom-pbs, scheduled run stops an app; OOM filter inverted → killed worker
+hidden; size flag removed → „would print a size it does not know".
 
-- Red-proofs (each a compiling mutation that made its test fail, restored byte-identical):
-  `rp-v242-*.txt` — R-487 ×6 (lister inert, picker 404, wrong unit dir, row not built, row not
-  rendered, picker not rendered), R-491, R-490 ×2, R-489, R-476.
-- Full gate green before the build (`go build/vet/test ./...`, `controller_gates.py --fast`).
-- Live on 9202 (endpoint-level, the exact endpoints the UI invokes; no browser on DooPlex): an
-  opengist throwaway — `GET /api/system/info` 200 with the drive figures; a seeded update hold
-  cleared by the removal (log line + store), the app redeployed by the restore without refusal; the
-  removed app's row, badge, form, picker option and snapshot API all present, „Visszaállítás a
-  mentésből" reinstalled it running in 9.1 s; two captures under one definition dated the Tier-2
-  confirm by the second capture's dump (22:58 against a manifest from 22:52). First pass was refused
-  409 (a running app must be stopped first) and repeated; the R-489 cause was then isolated in a
-  third pass (`19-R489-cause.txt`).
-
-## Teardown (three layers)
-
-Machine: the opengist throwaway removed with data and backups, no volume and no unit left; the
-scratch guest 9202 persists on purpose with filebrowser + traefik + the controller. Host: nothing
-changed. Hub: floor raised to 0.242.0 (that is the delivery), nothing else touched.
+## Delivery
+Image `felhom-controller:0.243.0` built from `843b319`. Hub floor for **demo-hp only** 0.243.0 + declared MinAgent
+0.131.0 → `managed floor SERVED … from declared`; 9201 on 0.243.0 in 19 s. Scratch 9202 set by hand (its disposition).
+demo-felhom not moved (its agent is 0.130.0, the floor would hold). Full suite green before each commit.