v0.280.0: the setup gate (decision 46); R-710 'I changed it' + absent-record window; R-709 password fields off the page; password:N:special generator

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/life_records.go

@@ -32,6 +32,11 @@ func carryLifeRecords(logger *log.Logger, name string, prior, cfg *AppConfig) {
 	cfg.LastUpdateUndone = prior.LastUpdateUndone
 	cfg.LastAutoUpdate = prior.LastAutoUpdate
 	cfg.AfterInstall = prior.AfterInstall // v0.279.0: what the install's one-time command did stays true after a restore
+	// v0.280.0 (decision 46): the setup gate is the app's life here too. A restore never re-gates an app whose gate
+	// opened; a gate that was still closed stays closed (its probe opens it if the restored data is set up).
+	// No prior record (a removed app, kept data, a rebuilt guest) = no gate: the data comes back with its admin.
+	cfg.SetupGate = prior.SetupGate
+	cfg.DefaultLogin = prior.DefaultLogin
 	if n := len(prior.EarlierConversionCopies); prior.ConversionCopy != nil || n > 0 {
 		cur := ""
 		if prior.ConversionCopy != nil {