felhom-controller/REPORT.md

REPORT — controller, 2026-10-08 (evening): the operator's decision sheet D1, D3, D4, D8 on main, unreleased

No release, no delivery today (kernel night 8→9). Everything ships with tomorrow's release, together with the hub of the same day (D1's wire fields). MinAgent unchanged (0.131.0). Rulings: 09 §3 decisions 185–194.

Part	What	Tests	Red-proof seen
D1 (R-314, R-279)	Operator actions in the report reply — a closed list of four; anything else refused	TestOpActions_*, TestOpActions_ClosedList, scheduler RunNow tests	stop not applied in the running manager; same id ran 3×; unknown action called jobs; an added action fails the closed-list test
D4 (R-35)	Sign-ins survive a restart; only sha256(cookie) on disk; password fingerprint; a failed revoking save removes the file	TestR35_* (8)	restart lost the cookie; file held the cookie; password change / failed logout save revived the session
D3 (R-79, dashboard)	Six health producers carry a bundle key; wire text unchanged	TestR79_*	all 6 keys empty; one key removed → English household saw Hungarian
D8 (R-893, first half)	Failed off-site replay after a moved definition / replaced volume → live definition back, app held (restore_mixed), honest sentence, operator line	TestR893_* (2)	the app was started on a mixed state; definition not written back

Small fixes without a row: ExtendAbandon could move a deletion earlier or edit the box date in the hub phase; StopAbandon reported success while the hub's deletion stayed pending; the reply read limit 4 KiB → 64 KiB; TestR650_NoBareDockerExec raced a vanishing temp file.

Security review of the session's commits (automatic): two findings on D4 (a failed save could revive an ended session) — fixed and red-proved (TestR35_PasswordChangeRevokesEvenIfSaveFailed, TestR35_FailedLogoutSaveRemovesFile).

Gates: go build/vet/test ./... green; controller_gates.py --fast green. Machines: none touched. Live proofs (tomorrow, scratch 9202, after the releases): see felhom.eu/REPORT-day3-2026-10-08.md.