CONTEXT + REPORT: v0.332.0 is the floor (R-1100 one sign-in, R-1151 escrow confirm)

CONTEXT.md

@@ -1,6 +1,15 @@
 # CONTEXT.md — Project Memory
 
 
+> **2026-10-19 (day) — v0.332.0 is the floor (MinAgent 0.158.1): one sign-in for the file manager (R-1100, D16) and the
+> typed-back escrow confirm (R-1151).** Every dashboard folder link → `fileBrowserOpenLink` → `GET /__files/open` (pass:
+> 60 s, one use, host + session bound; none for `Sec-Fetch-Site: cross-site`) → traefik forwardAuth `GET
+> /__felhom_gate/files` (`web/files_sso.go`) swaps it at `/_felhom/sso` for the host-only `felhom_files` cookie and then sets
+> the per-box SECRET header (`infra.LoadOrCreateFileBrowserSSOHeader`, `<data>/filebrowser-sso-header`, NEVER logged)
+> naming `felhom-household`. **A forwardAuth answer's redirect must be ABSOLUTE** (traefik resolves a relative Location
+> against the auth server — rc.2 sent browsers to `http://felhom-controller:8080/…`). Escrow: the claim sends
+> `{"defer_upload": true}`; `/api/escrow/confirm` forwards the two typed words; an agent < 0.160.0 needs no confirm.
+> Residuals R-1155 (FileBrowser's own token), R-1161 (the „live code" wording). felhom.eu `REPORT-day-2026-10-19.md`.
 > **2026-10-18 (evening) — v0.331.0: OnlyOffice opens and saves from FileBrowser (`server.internalUrl`) and Nextcloud
 > (`DocumentServerInternalUrl` with its slash); a FileBrowser restart runs the R-1126 gate at once (R-1018); a removal deletes volumes still labelled with the
 > app's project that the definition no longer declares (R-1117).** MinAgent 0.158.1.

REPORT.md

@@ -1,24 +1,17 @@
-# REPORT — controller v0.331.0 (2026-10-18 evening): the OnlyOffice links, live-walked and fixed (R-1018)
+# REPORT — controller v0.332.0 (2026-10-19, day brief)
 
-Task: the evening brief of 2026-10-18, Part 2 (felhom.eu `REPORT-evening-2026-10-18.md`). Evidence: felhom.eu
-`documentation/audits/onlyoffice-2026-10-18/`.
+**Shipped and the floor for every box** (03:24 UTC, MinAgent 0.158.1, after Tester 1, demo-hp and demo-felhom took it by the
+normal update path and the box walk was green on all three).
 
-**The walk** (scratch 9202 on 0.330.0, OnlyOffice 9.4.0 + Nextcloud 34.0.4 installed through the dashboard API, headless
-Chrome through the box's public names mapped to 9202):
+- **One sign-in for the file manager (R-1100, operator D16).** „Fájlok ↗" goes through the dashboard's one-time pass to a
+  host-only files cookie; traefik's forwardAuth then sets the box's secret header naming FileBrowser user
+  `felhom-household`. FileBrowser opens at the folder with no login; a dashboard sign-out asks again; forged headers are
+  refused through traefik and from an app container (only the box's secret name, the control, gets in). Fixed before the
+  release: a relative redirect in the forwardAuth answer (traefik pointed it at the controller), a cross-site pass and
+  dot-segments in `to` (a security review).
+- **The typed-back escrow confirm (R-1151):** the wizard sends the two words to the agent (≥ 0.160.0), which stores the new
+  package only then; an older agent needs no confirm.
 
-| Path | Before the fix | After |
-|---|---|---|
-| FileBrowser → open a .docx | editor frame loads, the document never does: OnlyOffice's fetch of `https://files.<domain>/…` → 403 (the public name leads to another box) | opens, edits, saves: the file on the drive reads „R1018 BEFORE EDITED-FB-1849" |
-| Nextcloud → open a .docx | opens and edits; „All changes saved" — but the save is lost: Nextcloud fetches `http://onlyoffice:80cache/…` | the file in Nextcloud reads „… EDITED-NC-1847" |
-| switch the link on / off | files.<domain> 502 for 4 min 8 s / 3 min 38 s | the gate runs at the restart |
-| OnlyOffice stopped | FileBrowser: no editor; Nextcloud: `/apps/onlyoffice/<id>` 404 — the revoke-on-stop rule holds | — |
-
-**Fixes** (each red-proofed — the fix removed, the test failed with the wrong value, restored):
-1. FileBrowser config: `server.internalUrl: "http://filebrowser:80"` — `TestFileBrowserConfig_R1018_InternalURLIsTheContainer`.
-2. Nextcloud: `DocumentServerInternalUrl = http://onlyoffice:80/` — `TestNextcloudApply_R1018_InternalAddressesTakeAPath`.
-3. `RestartStack("filebrowser")` runs the R-1126 gate — `TestRestartStack_R1018_FileBrowserPublishedAgainAtOnce`.
-
-4. `RemoveStack` removes the volumes still labelled with the app's project after `compose down --volumes` (R-1117: a
-   volume a template dropped survived „remove with data" on 9202) — `TestR1117_RemoveDeletesALabelledVolumeTheDefinitionNoLongerDeclares`.
-
-Gates: `go build/vet/test ./...` green; `controller_gates.py --fast` green. Fixtures: none changed.
+Tests and red-proofs: `CHANGELOG.md` v0.332.0. Live evidence: felhom.eu `documentation/audits/day-2026-10-19/` P1 (escrow),
+P2 (one sign-in), P4 (release). Fixtures changed (named): `escrow_first`, `escrow_receremony`. Full report: felhom.eu
+`REPORT-day-2026-10-19.md`.