v0.165.0: REPORT — live validation on 9201 (§13, all checks pass, token redacted)

REPORT.md

@@ -79,9 +79,40 @@ Test count (internal/web): +14 (share_test.go). Full `go test ./...` green befor
 
 ## Deployed version + live validation (§13)
 
-_Filled after build + deploy to guest 9201 — see the transcripts below (token redacted throughout)._
+Built `0.165.0` on DooPlex (digest `sha256:df3b5920…`), pushed, deployed to guest 9201 via the
+bootstrap service. `docker ps`: `gitea.dooplex.hu/admin/felhom-controller:0.165.0 Up (healthy)`.
 
-<!-- LIVE-VALIDATION -->
+**Method (stated per the no-browser rule):** all checks invoke the exact endpoints the UI invokes,
+via `docker exec felhom-controller curl http://localhost:8080/…` — `localhost` passes
+CatchAllMiddleware, so the full server pipeline runs (only rendering is skipped). Admin steps use the
+real `/login` (302 + session cookie); the guest surface is hit with NO session. **The live token is
+redacted throughout (first 4 chars + length only).**
+
+1. **Enable + guest happy path (Scenario A):** `GET /s/<token>` (no session) → `200`, headers
+   `X-Robots-Tag: noindex, nofollow` + `Referrer-Policy: no-referrer` + `Cache-Control: no-store`;
+   the `Indítópult` heading renders; **no admin chrome** (`class="sidebar"`, `nav-links`, `/logout`,
+   version, `alert-banner` all absent).
+2. **Wrong / disabled token (Scenario B):** `GET /s/WRONGTOKEN…` → `404 [404 page not found]`;
+   an authenticated `GET /definitely-no-such-route` (the mux default case) → `404 [404 page not found]`
+   — **byte-identical** (status + body).
+3. **Optional password gate (Scenario C):** setting the password stored `launcher_share_password_hash`
+   (separate field). `GET /s/<token>` (no cookie) → the password gate. Correct password → `303` +
+   `felhom_share` gate cookie → a subsequent cookie-bearing GET renders the launcher directly (no
+   gate). Five wrong POSTs → `Hibás jelszó` each; the **6th → `Túl sok sikertelen…` (rate-limited)**.
+4. **Rotation (Scenario D):** `POST /launcher/share/rotate` → old token `GET` = `404`, new token
+   `GET` = `200`.
+5. **QR:** `GET /launcher/share/qr.png` **with** admin session → `200 image/png` (valid PNG magic
+   `89 50 4e 47`); **without** session → `302 → /login?next=/launcher/share/qr.png`. Decode method:
+   PNG validated by magic bytes + content-type; the encoded string is `https://<host>/s/<token>` **by
+   construction** (the handler builds exactly that) — a phone scan was not run (no browser/scanner on
+   DooPlex).
+6. **Token never logged (Scenario G):** `docker logs` shows `[WARN] [web] 404 Not Found: GET
+   /s/<redacted>` (2 lines); a scan of the full log for any raw `/s/<20+ char token>` returned
+   **EMPTY**. (The DEBUG ServeHTTP-line redaction is unit-proven in Group G; the live box runs at
+   `info`, where the redacted WARN 404 is the observable proof.)
+7. **Cleanup:** `POST /launcher/share/disable` → both `launcher_share_token` and
+   `launcher_share_password_hash` cleared in `settings.json` — the box is left in the shipped default
+   (sharing OFF). Post-run `docker ps`: still `Up (healthy)`.
 
 ## Accepted residuals (no code action)