v0.324.0 released to the three test boxes: CHANGELOG live results, CONTEXT, REPORT

CHANGELOG.md

@@ -31,6 +31,14 @@ night brief 2026-10-16 → 17 (felhom.eu `REPORT-night-2026-10-17.md`).
   2026-02-25). **R-976** — a password change or reset ends every dashboard, family and setup-gate session (the gate key
   is rotated and saved); a family app cookie carries a per-app token, never the session. Tests `TestR983_*`,
   `TestR976_*`, each red-proved. 135 i18n parity fixtures re-captured (the sign-out control; one minlength), 22 unchanged.
+- **Live on demo-hp 9201 (rc.1, the dashboard's own posts):** Rallly (Postgres) and Grimmory (MariaDB) removed,
+  reinstalled and restored — off-site path: marker row (+ books file) back, healthy, the app's and the dump user's DB
+  logins work (last night: crash loop and hold); on-box path (Rallly) the same; a unit without its password over a newer
+  install refused with the app untouched; „use my kept data" (Grimmory) the same. restic: copies made by 0.14.0, 0.18.1
+  and 0.19.1 on demo-hp's real store each restored byte-identical by all three; after a 0.19.1 prune (scratch store)
+  0.14.0 still lists, checks and restores. Scanner: critical 3 (2) → 1 (0), high 122 (52) → 93 (23). Headless Chrome on
+  the public address: sign in, `X-Frame-Options: DENY`, POST sign-out, family gate (Grimmory), setup gate (Rallly).
+  Released by per-box floors to Tester 1, demo-hp, demo-felhom (21:52 UTC), box walk green.
 
 ## v0.323.0 — Debian 13 with restic pinned outside the OS, re-proven; felhom-samba 1.2.0 on Alpine 3.24.2 (2026-10-16)
 

CONTEXT.md

@@ -7,7 +7,17 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-10-16 (v0.323.0 — Debian 13, restic 0.18.1 pinned outside the OS and re-proven, felhom-samba 1.2.0)
+Last updated: 2026-10-17 (v0.324.0 — the DB password comes back with the data, restic 0.19.1, dashboard hardening)
+
+> **2026-10-17 (night) — v0.324.0 RELEASED to the three test boxes (per-box floors, 21:52 UTC).** R-1106 / R-127 b
+> (operator decision 1A): `appbackup.DBCredentialVars` + `DBDataVolumes`; `backup/restore_dbcreds.go` (pure
+> `planDBCredentials`, `dbCredentialPlanFor`, `offsiteCredentialOverlay`); `unitRestoreEnv` refuses a DB credential it
+> cannot source and O4 never generates one; the same-version off-site restore writes the snapshot's password via the
+> optional `secretValueSetter` → `stacks.SetStackSecretValues` (load-then-save; also marks the reinstall's `type:
+> password` logins as restored — R-926). R-1107: restic 0.19.1 pinned; fixtures for three versions. R-1108, R-1065,
+> R-1017 (+ `userdataKept` fix), R-983 (6), R-976 (2) — written by two helper sessions in detached worktrees, merged
+> and reviewed here. Proven live on demo-hp. The global floor waits on tonight's off-site runs on 0.324.0 (felhom.eu
+> STATUS). Next: R-1096 (Redis plan in `audits/night-restore-2026-10-17/P6/`), R-1109…R-1115.
 
 > **2026-10-16 (evening) — v0.323.0 RELEASED to the three test boxes ONLY (per-box floors); the GLOBAL floor stays
 > 0.322.0 until each test box has made one real night's off-site backup on 0.323.0** (the brief's rule; the check and

REPORT.md

@@ -1,39 +1,36 @@
-# REPORT — v0.323.0: Debian 13, restic 0.18.1 pinned outside the OS and re-proven, felhom-samba 1.2.0 (2026-10-16)
+# REPORT — v0.324.0: the database password comes back with the data; restic 0.19.1; hardening; three fixes (2026-10-17)
 
-Brief: „the controller on Debian 13 with a pinned restic, re-proven; the Samba image rebuilt". Full report, in plain
-words: felhom.eu `REPORT-debian13-restic-2026-10-16.md`. Evidence: felhom.eu `documentation/audits/debian13-restic-2026-10-16/`.
+Night brief 2026-10-16 → 17 (operator decisions 1A, 2A). Full report in plain words: felhom.eu `REPORT-night-2026-10-17.md`.
+Evidence: felhom.eu `documentation/audits/night-restore-2026-10-17/`.
 
 ## 1. What changed
 
-- `controller/Dockerfile`: a `restic` stage fetches the official restic 0.18.1 binary and checks the signed `SHA256SUMS`
-  (vendored key, `third_party/restic/`), the published sum and the per-arch sum pinned in the file. Runtime
-  `debian:13.7-slim` (digest); Docker repo codename from `/etc/os-release`. Removed packages the binary never runs:
-  postgres and mysql clients, sqlite3, fdisk, e2fsprogs, parted, sshpass.
-- `infra-images/samba/Dockerfile`: Alpine 3.24.2 (digest). `SambaImage` → `felhom-samba:1.2.0` (pushed once).
-  `scripts/build-samba-image.sh` refuses a reused tag, an unanswerable registry and a dirty/unpushed tree.
-- Comments in `internal/backup/offbox_{capture,progress,proof,window}.go` corrected to what was measured on both versions.
+- **R-1106 / R-127 (b) / R-926:** a restore puts back the database password the data was saved with
+  (`internal/backup/restore_dbcreds.go`, `restore_unit.go`, `offbox_reconstitute.go`; `internal/appbackup/dbservices.go`;
+  `stacks.SetStackSecretValues`). Refusal `err.backup.restore_no_db_password` (HU/EN). Design: felhom.eu `07` §7.4.
+- **R-1107:** restic 0.19.1 (Dockerfile ARGs; fixtures `internal/backup/testdata/restic/{0.14.0,0.18.1,0.19.1}`).
+- **R-1108** (samba), **R-1065** (Plex claim → wiring), **R-1017** (guard + `userdataKept` fix).
+- **R-983** (six items) and **R-976** (two items): `internal/web` auth, family gate, setup gate, claim; templates.
 
 ## 2. Tests (each red-proved)
 
-- `TestR1105_ResticIsPinnedOutsideTheOS` (`cmd/controller`): fails on the old Dockerfile and on four single mutations.
-- `TestR1105_EachResticFailureKeepsItsClass`, `_InitRaceIsStillSuccess`, `_TheJSONTheCodeReadsStillParses`,
-  `_TheForgetPlanOnlyEverKeepsMore` (`internal/backup`): REAL outputs of 0.14.0 and 0.18.1 in `testdata/restic/`, through
-  the code's own parsers and classifiers. Six mutations, each convicted.
-- `scripts/test_samba_build_push_once.sh`: 6 cases; 4 fail on the old script.
-- Full suite green; `controller_gates.py --fast` green.
+`TestR1106_*` (backup 7, stacks 1; six mutations + one), `TestR1105_*` over three versions, `TestSambaPassword_*`,
+`TestPlexClaim_TriggersMediaWiring`, `TestNoBareDrivePathToUserdataDir`, `TestRemoveStack_R800_UserdataKeptOnSystemDrive`,
+`TestR983_*`, `TestR976_*`. Full suite green; `controller_gates.py --fast` green. 135 i18n fixtures re-captured, 22 unchanged.
 
 ## 3. Live
 
-demo-hp 9201 on rc.1 (code identical to the release): both restore directions byte-identical on the real store; the
-off-site run (dumps + push, live progress) ok; the drill's row and file came back from the off-site copy; Samba 1.1.0 →
-1.2.0 with the same household password, every discovery daemon answering. Released by per-box floors to Tester 1,
-demo-hp, demo-felhom (19:25 UTC), box walk green. **The global floor waits for each box's first night on 0.323.0.**
+demo-hp 9201 on rc.1: off-site, on-box, refusal and kept-data restore paths with Rallly and Grimmory; restic three-way
+on the real store; headless Chrome through the public address. Released to Tester 1, demo-hp, demo-felhom by per-box
+floors (21:52 UTC), box walk green.
 
 ## 4. Observations
 
-1. The forget plan of restic 0.17+ keeps each group's oldest snapshot while monthly slots are unused. NOT-A-FINDING: it only ever keeps more; pinned by `TestR1105_TheForgetPlanOnlyEverKeepsMore`, written into felhom.eu `07` §6.8.
-2. A reinstalled database app restored from the off-site copy is unusable (old volume, new password). FILED: R-1106
-3. The official restic 0.18.1 binary adds 50 fixable scanner findings. FILED: R-1107
-4. A share added before the first household password is not exported. FILED: R-1108
-5. A plain `restic restore` writes a lock on both versions; a comment said it did not. NOT-A-FINDING: comment corrected; the nightly proof uses `--no-lock`.
-6. `build.sh --push` also pushes `:latest` for an rc tag. NOT-A-FINDING: nothing pulls `:latest`; boxes run a named tag and the update button reads X.Y.Z tags.
+1. A share renamed at the same path is never applied to a running samba. FILED: R-1109
+2. Two sibling path helpers are called with drive-named arguments, unguarded. FILED: R-1110
+3. The share-password and escrow limiters count a try after the password check. FILED: R-1111
+4. Family sessions are stored raw, not as a fingerprint. FILED: R-1112
+5. Each `/__family/start` pass with a household session creates a new family session. FILED: R-1113
+6. `controller_gates.py` cannot pass in a worktree outside `git/`. FILED: R-1114
+7. Grimmory's on-box restore after its books were removed refused. NOT-A-FINDING: by design (R-479); its route is „use my kept data", proven.
+8. The launcher logs 404s for SVG app logos. NOT-A-FINDING: it falls back to the PNG; the same assets were in 0.322.0.