docs: v0.61.0 CHANGELOG + README (F1 mem/F17 restore/F5 route) + FIXSPEC statuses + REPORT

CHANGELOG.md

@@ -1,5 +1,51 @@
 ## Changelog
 
+### v0.61.0 — live-drive Batch 1 (+F17) fixes (2026-06-14)
+
+Controller-side fixes triaged in `LIVE-DRIVE-FIXSPEC-2026-06-14.md` from the 2026-06-14 live-drive
+findings. Each fix has a regression test that fails on the pre-fix code. Built, deployed to demo guest
+9201, and the key fixes live-verified. (F9, F20-BUG2, F20-BUG3 are the SUPERVISED agent/golden next
+session — not in this batch.)
+
+- **F17 (CRITICAL) — per-app restore now replays the captured `.sql` DB dump.** `RestoreFromRecoveryUnit`
+  (and the `RestoreApp` fallback) repopulated Docker volume tars but NEVER replayed the captured
+  `<stack>-<dbtype>.sql`, so DB-resident data did not come back. New `appbackup.ImportDump` (read-side
+  counterpart to `DumpOne`, reuses `DiscoveredDB`'s own discovered credentials) + `backup.reimportDBDumps`
+  replay the dump AFTER volume restore + stack bring-up, so the logical dump **wins** over any volume-tar
+  copy of the DB (operator-chosen precedence). Volume-restore and DB-import failures now **surface** (the
+  restore returns an error) instead of a swallowed WARN. **Live-validated** on guest 9201: a marker row
+  dropped after backup was restored by `/backup/restore` (log: "replayed 1 DB dump(s)"). Reuse note:
+  `ImportDump` lives in `appbackup` (the DB-domain package) — `appexport→appbackup` already exists so
+  reusing appexport's unexported copies would cycle; appbackup is the clean shared home.
+- **F1 (HIGH) — guest RAM cap read from the Docker daemon; deploy guard uses committed memory.** The
+  controller container reported the Proxmox host's 16 GB (no lxcfs in the container; its own cgroup is
+  unlimited — the 2 GB cap is on the LXC ancestor), defeating the deploy memory-headroom hard-block.
+  `system` now sources the cap from `docker info` MemTotal (the daemon runs in the LXC → reports the
+  guest's real RAM; cgroup limit still preferred when present). The deploy guard now uses the controller's
+  own committed-app memory (sum of running mem requests) for "used" — accurate and cheap — instead of
+  host RSS. `/api/system/info` reports the guest cap + committed used. **Live-verified:** `total_mem_mb`
+  2048 (was 15771).
+- **F20-BUG1 (HIGH) — `agentapi.FormatDisk` surfaces the agent's error.** A failed format (agent 502
+  "device is mounted", `ok:false`, `data:null`) fell through to `return out, nil`, so the web layer
+  reported a zero-value result as `ok:true` — a failed DESTRUCTIVE op read as success. Now returns a
+  non-nil error on any non-2xx/`ok:false` that is not a recognized refusal (403/needs-confirmation).
+- **F5 (HIGH) — broken healthcheck → 404, two parts.** (catalog, `app-catalog-felhom.eu`) uptime-kuma's
+  healthcheck pointed at a v1-era `node /app/extra/healthcheck.mjs` absent in `:2`, so the container
+  stayed unhealthy and Traefik withheld the route (404 though running) — fixed to the v2 compiled
+  `extra/healthcheck` binary + 180s start_period. (dashboard) new `routeUnpublished` helper + a distinct
+  "URL nem elérhető – útvonal nincs publikálva" indicator on the dashboard/stacks cards for
+  unhealthy/restarting deployed apps (operator decision: keep gating the route, surface it distinctly).
+  **Live-verified:** uptime-kuma healthy → route publishes → status URL 302 (was 404).
+- **F8 (LOW-MED) — `controller.yaml` persisted 0600.** It holds infra credentials (cf/hub tokens) in
+  plaintext; the Hub config-apply handler wrote 0644. New `writeConfig0600` enforces 0600 even on a
+  pre-existing 0644 file.
+- **F6 (LOW) — deploy POST reports "started", not "deployed".** The deploy runs async (UI polls); the
+  POST now returns 202 Accepted + "Telepítés elindítva…" so API/script consumers aren't told a deploy
+  finished before it has.
+- **F7 (LOW) — dashboard state lag.** `status-refresh` tightened 30s → 10s (cheap docker-ps refresh).
+- **F4 (TRIVIAL) — `GET /api/stacks/rescan`** now returns 405 + `Allow: POST` instead of the misleading
+  "stack not found: rescan" fall-through.
+
 ### v0.60.0 — M25 data-race fix (backlog-Medium cleanup) (2026-06-13)
 
 Backlog-Medium reconciliation from the 2026-06-13 BUGHUNT reconcile. M4/M5/M6 verified already FIXED