docs: REPORT — v0.126.3 wizard-CSRF section (root cause, latency-via-claim-arc, red-proof, deploy)

REPORT.md

@@ -1,4 +1,22 @@
-# REPORT — v0.126.0/.1/.2: UI uniformity bundle (shared app-list rows, infra identity, restore-form polish, mojibake + dedup gates, honest stale line)
+# REPORT — v0.126.0–.3: UI uniformity bundle + the claimed-box wizard CSRF fix
+
+## v0.126.3 (2026-07-13, same supervised session) — storage wizard CSRF on claimed boxes
+
+First live hit during the agent-0.87.0 drill wizard leg (operator session): the wizard OFFERED
+the hot-added disk (the 0.87.0 fix works in the UI), but POST /api/storage/init died with
+"CSRF token missing or invalid" (controller log: `token mismatch`). Root cause:
+`storageWizardPageHandler` rendered /storage/init + /storage/attach via raw `render()` — the
+ONLY raw-render page handler left — so the csrf-meta token was EMPTY, and the wizard's fetch()
+posts exactly that token. LATENT until the claim arc: an unclaimed box skips CsrfProtect
+entirely, so the wizard had never run against a password-gated box. Fix: `executeTemplate`
+(CSRF auto-injection). Regression test `TestStorageWizardPages_CarrySessionCSRFToken` renders
+both wizard pages with a REAL session and asserts the meta carries the session token;
+red-proven (render() swap → both cases fail on the empty meta). Deployed drill + demo
+(0.126.3 healthy both); the restart clears in-memory sessions → operator re-login required.
+
+---
+
+# v0.126.0/.1/.2: UI uniformity bundle (shared app-list rows, infra identity, restore-form polish, mojibake + dedup gates, honest stale line)
 
 **Date:** 2026-07-13 · **Version:** controller v0.126.2 LIVE (from v0.125.0; .1/.2 are same-session live-QA fixes) · **MinAgent:** 0.81.0 (UNCHANGED) · **Floor:** untouched (0.122; the recorded rule stands — never halt above 0.124.0 without the strand fix) · Controller-only, presentation-layer — NO backup/toggle/engine behavior change (render tests pin the action markup).