v0.331.0: OnlyOffice opens and saves from FileBrowser and Nextcloud; FileBrowser back at once after a restart (R-1018)

FileBrowser config carries server.internalUrl http://filebrowser:80 (OnlyOffice fetched the public files address and got 403);
Nextcloud's DocumentServerInternalUrl gets its trailing slash (every save was lost: http://onlyoffice:80cache/...);
RestartStack("filebrowser") runs the R-1126 gate at once (files.<domain> was 502 for up to 5 min after the link switched).
Each red-proofed. MinAgent 0.158.1.

CHANGELOG.md

@@ -1,3 +1,29 @@
+## v0.331.0 — OnlyOffice opens and SAVES from FileBrowser and Nextcloud; FileBrowser is back at once after a restart (R-1018) (2026-10-18)
+
+**MinAgent: 0.158.1** — the floor's, carried (not above the vouched agent 0.159.2). Nothing here calls a new agent route.
+No golden (`09` §3 decision 250). Task: the evening brief of 2026-10-18 (felhom.eu `REPORT-evening-2026-10-18.md`).
+Found by the first live walk of the OnlyOffice links since the move to Proxmox (scratch 9202, headless Chrome through the
+box's public names; felhom.eu `audits/onlyoffice-2026-10-18/`).
+
+- **FileBrowser → OnlyOffice could not open a document.** FileBrowser built the download and save URLs it hands
+  OnlyOffice from the request's host, `https://files.<domain>` — a trip out through the tunnel and back (on demo-hp it
+  reached another box: 403). FileBrowser's config now carries `server.internalUrl: "http://filebrowser:80"` (used by
+  integrations only, gtstef/filebrowser:1.5.6-stable `onlyOffice.go`); OnlyOffice reaches it by name on traefik-public,
+  where the R-1126 gate puts it. Every box's FileBrowser config changes once, so FileBrowser is re-created once.
+  `TestFileBrowserConfig_R1018_InternalURLIsTheContainer`.
+- **Nextcloud → OnlyOffice lost every edit.** `DocumentServerInternalUrl` was `http://onlyoffice:80` with no slash, and
+  Nextcloud's connector appends paths: it fetched `http://onlyoffice:80cache/files/…` and logged „Track: … status 2
+  error", while the editor said „All changes saved". Now `http://onlyoffice:80/` (as `StorageUrl` already was). The occ
+  list is a function (`nextcloudApplyCommands`), so the test reads the values the apply really sends.
+  `TestNextcloudApply_R1018_InternalAddressesTakeAPath`. A box with the link already on gets the value at OnlyOffice's
+  or Nextcloud's next start (the link re-applies then).
+- **files.<domain> answered 502 for up to 5 minutes after the link switched on or off** (its Apply and Revoke restart
+  FileBrowser, and a re-created FileBrowser starts off traefik-public — R-1126 — until the next base-stack round;
+  measured 4 min 8 s and 3 min 38 s). `RestartStack("filebrowser")` now runs the gate at once, in the background, like
+  the mounts sync. `TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce`.
+- Red-proofs: each fix removed → its test fails with the wrong value (felhom.eu `audits/onlyoffice-2026-10-18/redproof-fix{1,2,3}.txt`).
+- No page changed; every fixture byte-identical.
+
 ## Unreleased (2026-10-18) — CI workflow: the failure mail links the public run page, by run id (R-1135); no code change
 
 `.gitea/workflows/gates.yml`, the alarm step: the mail's run link is now `https://gitea.dooplex.hu/<repo>/actions/runs/<run id>`.