felhom-controller/REPORT.md

REPORT — v0.326.0: FileBrowser's default password checked at every FileBrowser start; the decoy suite is a gate (2026-10-17)

Brief „Tester 1 back on the live catalog, decoy suites, memory limits, FileBrowser" (Parts 4–5; Part 2's runner change). Full report: felhom.eu REPORT-tester1-limits-filebrowser-2026-10-17.md. Evidence: felhom.eu documentation/audits/tester1-limits-filebrowser-2026-10-17/.

1. What changed

• R-977: internal/stacks/filebrowser_password.go — the default-login probe runs once per FileBrowser run (the container's StartedAt), not once per box; a new run gets ~20 s to answer. The household's own password is never touched. Comment „before a claim there is no tunnel" corrected (false).
• R-1116: scripts/controller_gates.py row gate-decoys (full run, blocking).

2. Tests (each red-proved)

TestFileBrowserAdmin_R977_DefaultBackOnANewRunIsReplaced, TestFileBrowserAdmin_R977_NewRunIsWaitedForInTheSameTick; test_controller_gates.py pins the new runner row. Full suite green; controller_gates.py --fast green.

3. Live (scratch 9202, FileBrowser + its data volume removed, the box brings it back)

0.324.0: default login 200 for 10 minutes, the box keeps „generated". rc.1: replaced 1 s after the controller start, and after a second re-create — but 5 minutes after FileBrowser came back (probed while starting). rc.2: replaced 2 s after FileBrowser came back. No page changed: every i18n fixture byte-identical.

4. Observations

1. The FileBrowser window on rc.1 was one base-stack round (5 min), not seconds. NOT-A-FINDING: fixed in rc.2 (same release).
2. The tunnel runs before the claim, and the claim needs it. FILED: R-1126