# REPORT — v0.326.0: FileBrowser's default password checked at every FileBrowser start; the decoy suite is a gate (2026-10-17)

Brief „Tester 1 back on the live catalog, decoy suites, memory limits, FileBrowser" (Parts 4–5; Part 2's runner
change). Full report: felhom.eu `REPORT-tester1-limits-filebrowser-2026-10-17.md`. Evidence: felhom.eu
`documentation/audits/tester1-limits-filebrowser-2026-10-17/`.

## 1. What changed

- **R-977:** `internal/stacks/filebrowser_password.go` — the default-login probe runs once per FileBrowser run (the
  container's StartedAt), not once per box; a new run gets ~20 s to answer. The household's own password is never
  touched. Comment „before a claim there is no tunnel" corrected (false).
- **R-1116:** `scripts/controller_gates.py` row `gate-decoys` (full run, blocking).

## 2. Tests (each red-proved)

`TestFileBrowserAdmin_R977_DefaultBackOnANewRunIsReplaced`, `TestFileBrowserAdmin_R977_NewRunIsWaitedForInTheSameTick`;
`test_controller_gates.py` pins the new runner row. Full suite green; `controller_gates.py --fast` green.

## 3. Live (scratch 9202, FileBrowser + its data volume removed, the box brings it back)

0.324.0: default login 200 for 10 minutes, the box keeps „generated". rc.1: replaced 1 s after the controller start, and
after a second re-create — but 5 minutes after FileBrowser came back (probed while starting). rc.2: replaced 2 s after
FileBrowser came back. No page changed: every i18n fixture byte-identical.

## 4. Observations

1. The FileBrowser window on rc.1 was one base-stack round (5 min), not seconds. NOT-A-FINDING: fixed in rc.2 (same release).
2. The tunnel runs before the claim, and the claim needs it. FILED: R-1126