docs: v0.123.0 polish batch — CHANGELOG + REPORT + CONTEXT + REUSE (felhomConfirm pattern, new gates)

Claude-Session: https://claude.ai/code/session_01GzammAMzsJTgpQHqxwM2bC
2026-07-13 08:47:58 +02:00
parent b482860c03
commit df7ad378f4
4 changed files with 106 additions and 43 deletions
@@ -1,5 +1,40 @@
 ## Changelog

+### v0.123.0 — polish batch: F-15 instant reset codes, F-11 inline confirms, Tier-3 "Távoli mentés" rename, zero-toggle honesty (2026-07-13) — MinAgent: 0.81.0
+
+Four independent fixes from the take-two drill + operator review. Live-validated on the drill box
+(qm 300 guest 9201) and demo 9201; hub v0.52.0 is the F-15 counterpart (an old hub's bare
+reset-request response is a clean no-op — no coupling gate needed).
+
+- **F-15 instant reset codes** (`internal/web/claim.go`): `requestHubResetCode` now parses the
+  hub's reset-request RESPONSE (`{claim: {code_hash, generation, issued_at}}`, hub ≥0.52.0) and
+  applies it through the SAME generation-guarded consumer as the report ACK
+  (`report.ClaimSync.Reconcile`) — the emailed code works the moment it lands instead of after
+  the next ACK (~15 min; the take-two "Hibás vagy lejárt kód" failure). Replay/older-generation
+  responses can never downgrade the active hash (guard reused, not reimplemented). Live re-run of
+  the exact failure path: code applied 1 s after the request, accepted on first try.
+- **F-11 inline confirms** (`layout.html` + templates): every native `confirm()` (an OS-modal
+  that freezes browser automation) replaced by the LIGHT inline two-step — `felhomConfirm(el, q,
+  onYes)` swaps the trigger in place to "kérdés + Igen/Mégse"; form buttons opt in via
+  `data-confirm="…"` (submitted with `requestSubmit`, so formaction/name-value survive).
+  Converted: offbox restore-to-verify, tier2 restore, whole-guest backup, app data migrate,
+  debug simulate-disconnect + DR trigger, deploy stale-data delete (keeps its DOUBLE
+  acknowledgement, chained inline). New gate `scripts/native_confirm_gate.py` (zero native
+  confirm/prompt in templates; red-proven).
+- **Tier-3 rename** (`backups.html`, `offbox_handlers.go`, `backup/offbox.go`): customer-facing
+  "NAS-mentés" branding → **"Távoli mentés"** (the productized target is the Storage Box; the
+  tier concept is offsite). Manual-target form generalized to any SFTP target ("Cél címe (IP
+  vagy hosztnév — NAS vagy SFTP-kiszolgáló)", "Tároló útvonala a célgépen"). The "Hálózati
+  tárhely" NAS network-storage feature keeps its device-truthful wording (different feature).
+  Python sweep (multibyte rule) + committed gate `scripts/offbox_rename_gate.py` (red-proven).
+- **Zero-toggle honesty** (`backup/offbox.go`, `handlers.go`, `backups.html`): a configured +
+  escrowed offbox with ZERO toggled apps shows "Nincs távoli mentésre jelölt alkalmazás — jelölj
+  ki legalább egyet." on the toggle list, and a run in that state reports "Sikeres — nincs
+  mentésre jelölt alkalmazás" via LastWarning instead of bare success (red-proven unit test).
+- **Dev-box fix**: `atomicPromoteTar` fsyncs via an O_RDWR handle — read-only fsync is refused on
+  Windows, which kept the two F7 atomic-dump tests permanently red on the dev box (Linux
+  behavior unchanged).
+
 ### v0.122.0 — customer-claim password gate (closes DRILL-day0-vm F-4/F-5) (2026-07-12) — MinAgent: 0.81.0

 The customer sets + OWNS the dashboard password; the old "no password → open dashboard" is gone.