felhom-controller/REPORT.md

REPORT — v0.324.0: the database password comes back with the data; restic 0.19.1; hardening; three fixes (2026-10-17)

Night brief 2026-10-16 → 17 (operator decisions 1A, 2A). Full report in plain words: felhom.eu REPORT-night-2026-10-17.md. Evidence: felhom.eu documentation/audits/night-restore-2026-10-17/.

1. What changed

• R-1106 / R-127 (b) / R-926: a restore puts back the database password the data was saved with (internal/backup/restore_dbcreds.go, restore_unit.go, offbox_reconstitute.go; internal/appbackup/dbservices.go; stacks.SetStackSecretValues). Refusal err.backup.restore_no_db_password (HU/EN). Design: felhom.eu 07 §7.4.
• R-1107: restic 0.19.1 (Dockerfile ARGs; fixtures internal/backup/testdata/restic/{0.14.0,0.18.1,0.19.1}).
• R-1108 (samba), R-1065 (Plex claim → wiring), R-1017 (guard + userdataKept fix).
• R-983 (six items) and R-976 (two items): internal/web auth, family gate, setup gate, claim; templates.

2. Tests (each red-proved)

TestR1106_* (backup 7, stacks 1; six mutations + one), TestR1105_* over three versions, TestSambaPassword_*, TestPlexClaim_TriggersMediaWiring, TestNoBareDrivePathToUserdataDir, TestRemoveStack_R800_UserdataKeptOnSystemDrive, TestR983_*, TestR976_*. Full suite green; controller_gates.py --fast green. 135 i18n fixtures re-captured, 22 unchanged.

3. Live

demo-hp 9201 on rc.1: off-site, on-box, refusal and kept-data restore paths with Rallly and Grimmory; restic three-way on the real store; headless Chrome through the public address. Released to Tester 1, demo-hp, demo-felhom by per-box floors (21:52 UTC), box walk green.

4. Observations

1. A share renamed at the same path is never applied to a running samba. FILED: R-1109
2. Two sibling path helpers are called with drive-named arguments, unguarded. FILED: R-1110
3. The share-password and escrow limiters count a try after the password check. FILED: R-1111
4. Family sessions are stored raw, not as a fingerprint. FILED: R-1112
5. Each /__family/start pass with a household session creates a new family session. FILED: R-1113
6. controller_gates.py cannot pass in a worktree outside git/. FILED: R-1114
7. Grimmory's on-box restore after its books were removed refused. NOT-A-FINDING: by design (R-479); its route is „use my kept data", proven.
8. The launcher logs 404s for SVG app logos. NOT-A-FINDING: it falls back to the PNG; the same assets were in 0.322.0.