v0.324.0 released to the three test boxes: CHANGELOG live results, CONTEXT, REPORT

CONTEXT.md

@@ -7,7 +7,17 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-10-16 (v0.323.0 — Debian 13, restic 0.18.1 pinned outside the OS and re-proven, felhom-samba 1.2.0)
+Last updated: 2026-10-17 (v0.324.0 — the DB password comes back with the data, restic 0.19.1, dashboard hardening)
+
+> **2026-10-17 (night) — v0.324.0 RELEASED to the three test boxes (per-box floors, 21:52 UTC).** R-1106 / R-127 b
+> (operator decision 1A): `appbackup.DBCredentialVars` + `DBDataVolumes`; `backup/restore_dbcreds.go` (pure
+> `planDBCredentials`, `dbCredentialPlanFor`, `offsiteCredentialOverlay`); `unitRestoreEnv` refuses a DB credential it
+> cannot source and O4 never generates one; the same-version off-site restore writes the snapshot's password via the
+> optional `secretValueSetter` → `stacks.SetStackSecretValues` (load-then-save; also marks the reinstall's `type:
+> password` logins as restored — R-926). R-1107: restic 0.19.1 pinned; fixtures for three versions. R-1108, R-1065,
+> R-1017 (+ `userdataKept` fix), R-983 (6), R-976 (2) — written by two helper sessions in detached worktrees, merged
+> and reviewed here. Proven live on demo-hp. The global floor waits on tonight's off-site runs on 0.324.0 (felhom.eu
+> STATUS). Next: R-1096 (Redis plan in `audits/night-restore-2026-10-17/P6/`), R-1109…R-1115.
 
 > **2026-10-16 (evening) — v0.323.0 RELEASED to the three test boxes ONLY (per-box floors); the GLOBAL floor stays
 > 0.322.0 until each test box has made one real night's off-site backup on 0.323.0** (the brief's rule; the check and