diff --git a/CONTEXT.md b/CONTEXT.md
index c5811df..80cbcc5 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -24,7 +24,14 @@ Last updated: 2026-10-15 (v0.315.0 — one app page with four tabs, the catalog
 > **Found by a red-proof, and worth remembering:** the after-start handler's „the catalog must have DECLARED this field"
 > check could be deleted with the whole suite green — and a POST for an undeclared field then reached Plex and opened the
 > setup gate. Two guards that look like one are two tests.
-> Not yet validated: the operator's own look at the page in a browser, and a real Plex claim through the new card.
+> **Two defects the whole test suite could not see, both found in Chrome on the workstation** (this is
+> the case for CC running on Windows): the tab bar had no CSS at all and the hero logo was unsized,
+> because the shell invented class names beside ones the design system already had rules for; and the
+> log tab's `<script>` was never closed, so the page rendered, every marker matched, and the live log
+> poller was dead ("SyntaxError: Unexpected token '<'"). A marker proves a string is present, not that
+> the browser will run it. `TestAppPage_ScriptTagsAreBalanced` now pins the second on all seven URLs.
+> Live on demo-hp 9201; the floor stays 0.314.0 until all three test boxes have taken it.
+> Not yet validated: the operator's own look at the page, and a real Plex claim through the new card.
 
 > **2026-10-15 (evening) — v0.314.0, the floor since 13:11 UTC (raised by CC's token after the three test boxes; no golden).**
 > A restore puts the setup gate back as it was (`internal/stacks/restore_gate.go`, felhom.eu `09` §3 decision 253, R-1057);
diff --git a/REPORT.md b/REPORT.md
index c5ca15f..ee50266 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -43,7 +43,11 @@ WITH CRLF; a blanket normalisation rewrote all six on the first attempt.
 
 | Commit | What |
 |---|---|
-| (see `git log`) | v0.315.0 — the whole slice in one commit, because the template split, the routes and the fixtures cannot be green apart |
+| `e66d466` | v0.315.0 — the slice: tabs, routes, the after-start registry, the guide, the Pi removal, the fixtures. One commit, because the template split, the routes and the fixtures cannot be green apart |
+| `fe0228c` | style the tab bar; reuse the hero classes that already have rules (**found in a browser**) |
+| `db52f5a` | close the log tab's `<script>`; `TestAppPage_ScriptTagsAreBalanced` (**found in a browser**) |
+
+Baseline `85f65c7` -> `db52f5a`. felhom.eu `06e7cf8c` -> `5d4538cc` (docs).
 
 ## 4. Tests and red-proofs
 
@@ -81,6 +85,7 @@ the subject.**
 | F | guide gate `Rendered` → `Sections` | `TestGuide_RenderRules` FAILS |
 | G | install Vissza → `/stacks` | `TestInstallPage_BackGoesToApp` FAILS |
 | H | `deepCopyStack` stops cloning the guide | `TestDeepCopyStackMetaSharesNoReference` FAILS, naming `Guide.Sections` and `Guide.FAQ` |
+| I | remove `</script>` from `app_logs.html` again | `TestAppPage_ScriptTagsAreBalanced` FAILS: "logs: 3 `<script>` opened, 2 closed" |
 | 1–3 | `Rendered()` without `checked_version`; `overlayGuide` replacing the FAQ whole; `WithAddress` skipping the guide | the three matching `TestGuide_*` FAIL |
 
 **E2 is the finding of this session.** The handler has two guards that look like one: the field must
@@ -97,16 +102,50 @@ it.
 capturing `go test`'s own `$?`: **`GO_TEST_RC=0`, 37 packages `ok`, zero `FAIL` lines.** The
 „exit codes that lie" trap, hit and corrected in-session.
 
+**TWO DEFECTS THE SUITE COULD NOT SEE, both found in a browser.** This is the case for Claude in
+Chrome running on the workstation, and it is worth stating plainly: every endpoint-level marker
+passed on both.
+
+1. **The tab bar had no CSS and the logo was unsized.** The shell was written with new class names -
+   `app-hero`, `app-hero-logo`, `app-tabs` - and the first two duplicate names the design system
+   already has rules for (`app-info-hero`, `app-info-logo`), while the third had none at all. The
+   page answered 200, carried every `data-*` marker, and showed four bare underlined links and a
+   logo filling a third of the screen. Fixed in `fe0228c`: the shell reuses the existing hero
+   classes, and the tab bar is styled to design system v2 - measured live in the browser as
+   `display: flex`, `border-bottom 1px rgb(34,52,79)` (`--line`), active `rgb(46,168,245)`
+   (`--blue-bright`) on `rgb(15,27,46)` (`--bg-1`), radius 2px.
+2. **The log tab's `<script>` was never closed, so the live poller was dead.** The body was lifted
+   out of `logs.html` by line range and the range stopped one line short. `html/template` parsed it,
+   the page rendered, and `TestAppPage_EachTabRendersItsOwnContent` found
+   `setInterval(window.fetchLogs` exactly where it expected it - **because the text was there.**
+   Chrome refused the block with "SyntaxError: Unexpected token '<'" and the log never refreshed.
+   Fixed in `db52f5a`, with `TestAppPage_ScriptTagsAreBalanced` red-proved.
+
+   **The lesson, in the project's own terms:** a marker proves a string is present; it does not
+   prove the browser will execute it. The positive observable is
+   `typeof window.fetchLogs === "function"`, which is what the live check now reads.
+
 ## 5. Test count
 
-`internal/web` + `internal/stacks` test functions: **1 063 → 1 084** (+21: 12 new functions, 9 of them
-sub-tested). Parity CASES: 145 → 148.
+`internal/web` + `internal/stacks` test functions: **+22** (13 new functions). Parity CASES: 145 -> 148.
 
 ## 6. Deployed versions
 
-**Nothing is deployed yet.** The image is built and pushed in §9 below; the floor is NOT raised — per
-`.claude/rules/unprompted-work.md` item 6 that waits until it has run on Tester 1, demo-hp and
-demo-felhom through the normal update path with a green box walk.
+| Box | Before | Now |
+|---|---|---|
+| demo-hp guest 9201 | 0.314.0 | **0.315.0**, `Up ... (healthy)` |
+| Tester 1, demo-felhom | 0.314.0 | unchanged - not touched |
+
+Image `gitea.dooplex.hu/admin/felhom-controller:0.315.0`, built three times from a clean tree
+(`git status --porcelain` empty and HEAD == origin/main each time) as the two browser findings were
+fixed. **The floor is NOT raised**: per `.claude/rules/unprompted-work.md` item 6 that waits until it
+has run on Tester 1, demo-hp and demo-felhom through the normal update path with a green box walk on
+all three. demo-hp is one of the three, not the gate.
+
+**For anyone rebuilding the same version:** the stylesheet's cache key is `?v={{.Version}}` with
+`max-age=3600`, so a second build of 0.315.0 serves new CSS under a key the browser already holds. It
+cost twenty minutes here. It cannot reach a household - a released version is built once - so it is
+recorded, not filed.
 
 ## 7. NOT yet live-validated
 
@@ -121,14 +160,62 @@ demo-felhom through the normal update path with a green box walk.
 
 ## 8. Evidence
 
-`/mnt/5_hdd/felhom.eu/evidence/app-page-2026-10-15/` on DooPlex, copied at the end of each phase:
-`gates.txt` (the runner, all green), `decoys.txt` (53 decoys), `fullgate.txt` (`go test ./...` with
-its own exit code), `redproofs.txt`, and `live/` (§9).
+`/mnt/5_hdd/felhom.eu/evidence/app-page-2026-10-15/` on DooPlex, copied off the boxes at the end of
+each phase and before the scratch clone was deleted: `gates/` (the runner all green, 53 decoys,
+`go test ./...` with its own exit code), `live/` (every page fetched in the endpoint walk, cookie
+jars stripped) and `browser/` (four screenshots for the operator).
 
-## 9. Live validation
+## 9. Live validation - demo-hp guest 9201, 0.315.0
 
-Endpoint-level on demo-hp through the endpoints the UI invokes, **plus a real browser** — Claude in
-Chrome runs on this workstation, which is why CC runs here. Both are recorded in `live/`.
+The OMV work another session is running tonight is on demo-hp's guests **9310/9311**; 9201 was free.
+N100 was left alone (the media-stack session has it).
+
+**Endpoint-level, authenticated, through the endpoints the UI invokes.** Every assertion is on an
+ASCII `data-*` marker with a positive and a negative control - an accented Hungarian pattern through
+`ssh -> pct exec -> bash` returns a false `0` that reads exactly like the markup being gone.
+
+| Checked | Result |
+|---|---|
+| all five tab URLs on an installed app | 200 each |
+| content per tab | run card / data tab / guide / poller each on exactly one tab; the bar on all four |
+| the selected tab per URL | `/apps/x`->settings, `/settings`->settings, `/data`->data, `/guide`->guide, `/logs`->logs; `aria-current="page"` once |
+| the header | **0** `stackAction(` before the hero; the Mukodes card offers restart+stop for a running app |
+| a not-installed app | no tab bar, no run card, one Telepites; all four tab suffixes **302 -> `/apps/grocy`** |
+| the five old URLs | 302 each, to `/logs`, `/data`, `/data`, `/settings`, `/install`; **0 of them 301**; `?raw=1` carried through; the tab answers `text/plain` |
+| POST `/stacks/adventurelog/backup` | **303 -> `/apps/adventurelog/data?flash=flash.tier2.saved`** - the save ran and came back to the tab holding the form |
+| after-start POSTs (with a CSRF token) | unknown field 404, unknown app 404, **a registered env var on the wrong app 404**; without a token 403, which is what proves the 404s are the handler's |
+| Pi / x86 badges | 0 across every page fetched; `meta-badge` (22) and `Alkalmaz` (42) as positive controls |
+| the guide | `data-guide-missing` on the guide tab, no rendered guide - no catalog template carries one yet |
+| the install wizard | Vissza and Megsem both `href="/apps/grocy"` |
+| negative controls | unknown app, unknown tab suffix and unknown stack name all 404 |
+
+**Plex's card is absent, and the reason was read rather than assumed:** its template declares
+`after_start` and `PLEX_CLAIM`, and its gate is `state: open` since 2026-10-15T08:45:53Z - the
+operator's real claim (R-1060). `Needed()` is therefore false, which is the
+`TestAfterStart_CardHiddenWhenNotNeeded` branch. A positive control would mean un-claiming the
+operator's real Plex server; not done.
+
+**The data tab's Tier-2 section, with both controls:** `adventurelog` and `bookstack` keep their data
+on the system disk and get the honest `data-system-backup="same_disk"` sentence and no target picker
+(the `app_data_not_hdd_same_disk` branch); `paperless-ngx`, `plex` and `calibre-web` are HDD apps and
+each gets the real save form. A missing form on one app was a branch, not a defect - checked before
+it was reported.
+
+**In a real browser** (Claude in Chrome; four screenshots in `evidence/.../browser/`): the settings,
+data and logs tabs and the not-installed view all render correctly; the tab bar's computed style
+matches the design tokens; `window.fetchLogs` is a function on the log tab and refreshing the log
+works; **the console is clean on a fresh load**. "Elso lepesek" on Grocy's page shows the household's
+own address (`kamra.enkisfelhom.hu`), so R-498 travels through the new page.
+
+## 9b. Teardown - three layers, stated
+
+- **Machine:** nothing provisioned. The probe scripts, the fetched pages and the password file are
+  removed from guest 9201 and from demo-hp (0 leftovers, verified). The password went file->file, was
+  never printed, and no copy reached Windows or git.
+- **Host:** the DooPlex scratch clone (`scratch/cc-apptabs`) and the `felhom.eu` sibling symlink the
+  shared gates need are deleted; the shared checkout two other sessions are using was never dirtied.
+  Evidence was copied off first.
+- **Hub:** nothing created. No customer, no floor change.
 
 ## 10. Parity fixtures (the §9 exception), by name