CONTEXT + REPORT: v0.332.0 is the floor (R-1100 one sign-in, R-1151 escrow confirm)

CONTEXT.md

@@ -1,6 +1,15 @@
 # CONTEXT.md — Project Memory
 
 
+> **2026-10-19 (day) — v0.332.0 is the floor (MinAgent 0.158.1): one sign-in for the file manager (R-1100, D16) and the
+> typed-back escrow confirm (R-1151).** Every dashboard folder link → `fileBrowserOpenLink` → `GET /__files/open` (pass:
+> 60 s, one use, host + session bound; none for `Sec-Fetch-Site: cross-site`) → traefik forwardAuth `GET
+> /__felhom_gate/files` (`web/files_sso.go`) swaps it at `/_felhom/sso` for the host-only `felhom_files` cookie and then sets
+> the per-box SECRET header (`infra.LoadOrCreateFileBrowserSSOHeader`, `<data>/filebrowser-sso-header`, NEVER logged)
+> naming `felhom-household`. **A forwardAuth answer's redirect must be ABSOLUTE** (traefik resolves a relative Location
+> against the auth server — rc.2 sent browsers to `http://felhom-controller:8080/…`). Escrow: the claim sends
+> `{"defer_upload": true}`; `/api/escrow/confirm` forwards the two typed words; an agent < 0.160.0 needs no confirm.
+> Residuals R-1155 (FileBrowser's own token), R-1161 (the „live code" wording). felhom.eu `REPORT-day-2026-10-19.md`.
 > **2026-10-18 (evening) — v0.331.0: OnlyOffice opens and saves from FileBrowser (`server.internalUrl`) and Nextcloud
 > (`DocumentServerInternalUrl` with its slash); a FileBrowser restart runs the R-1126 gate at once (R-1018); a removal deletes volumes still labelled with the
 > app's project that the definition no longer declares (R-1117).** MinAgent 0.158.1.