felhom-controller/REPORT.md

# REPORT — v0.316.x: the app page as one column; one image per version number (2026-10-15)

## 1. Baselines

| Repo | `main` at start | Version | → |
|---|---|---|---|
| felhom-controller | `8339206` | v0.315.0 | **v0.316.0 → .1 → .2 built; .3 committed, NOT built (§6)** |
| felhom.eu | `340804f9` (docs only) | — | — |

Architecture read first: `02-controller-module-map.md` „The app page", `09-update-architecture.md`,
the `felhom-ui-design` skill, and the controller's `CLAUDE.md` + `.claude/rules/*`.

Built and tested on DooPlex in an isolated scratch clone; edited on the Windows workstation. The
browser work is on the workstation, which is the reason CC runs here.

## 2. PART 0 — the diagnosis, before any fix

**Verdict: (a) a cache.** Full evidence: `felhom.eu/documentation/audits/app-page-2026-10-15b/P0/VERDICT.md`.

**(b) is ruled out.** Exactly one guest ran 0.315.0 — demo-hp 9201 — on digest
`sha256:8887343011d6…`, identical to the registry's 0.315.0 at the time of measuring. The **global
floor is 0.314.0** (read from the hub's `/configuration`), so no box could have taken 0.315.0 by
itself. demo-hp 9202 and felhom-pve (N100) 9201 are both on 0.314.0; Tester 1 (`c11-appliance`) was
unreachable and, by the floor, cannot be on 0.315.0.

**The mechanism, in four measured facts:**

1. `layout.html` asked for `/static/style.css?v={{.Version}}` → `?v=0.315.0` for **all three**
   different 0.315.0 builds (`e66d466`, `fe0228c`, `db52f5a`); the first had no `.app-tabs` rules.
2. The origin sends **no validator**: measured on the box, `ETag present = 0`,
   `Last-Modified present = 0`. A cached copy cannot be revalidated — only expire.
3. Cloudflare caches that URL (`cf-cache-status: HIT`, `age: 99 → 100` over three requests) and
   **rewrites the browser TTL from the origin's `max-age=3600` to `max-age=14400`** — four hours.
4. The session's first request returned **`cf-cache-status: EXPIRED`**, which only happens when the
   edge holds an entry that has aged past its TTL.

**What is true now, and the caveat stated rather than glossed:** origin, edge and box agree
byte-for-byte (`sha256 c1774f63…` both sides) and all carry the rules; the page itself is never
cached (`DYNAMIC`). The specific stale object is **no longer observable** — the first probe forced
its revalidation, which is what `EXPIRED` records — so I cannot show a `HIT` whose body lacks
`.app-tabs`. What is shown is every precondition, the proof an aged entry existed, and the
elimination of the only other candidate. No cache was purged by hand.

## 3. Boxes on 0.315.0, with digests

| Box | tag | digest | now |
|---|---|---|---|
| demo-hp 9201 | 0.315.0 | `8887343011d6` | **0.316.2** |
| demo-hp 9202 | 0.314.0 | — | unchanged |
| felhom-pve (N100) 9201 | 0.314.0 | — | unchanged |
| Tester 1 (`c11-appliance`) | unreachable | — | cannot be on 0.315.0 (floor 0.314.0) |

## 4. Files changed, commits on `main`

| Commit | What |
|---|---|
| `9cc7ffc` | build.sh refuses a repeated push; `assetTag` per build; every shell uses it; harness normalises it |
| `7f3e58f` | the one-column layout (the approved mockup) |
| `48d8674` | v0.316.0 CHANGELOG + the push-once fact in the rule file |
| `006ceab` | **v0.316.1** — the asset tag reaches the dashboard pages |
| `f908eee` | the settings tab loses the install page's boxes |
| `9e68e52` | two more data-tab leftovers |
| `8c7aa10` | **v0.316.3** CHANGELOG |
| felhom.eu `b6638ac4`, `22cd7c51` | the design docs, the audit, R-1080 closed, R-1081 filed |

Main files: `controller/build.sh`, `scripts/test_build_push_once.sh`, `internal/web/server.go`,
`asset_tag_test.go`, `app_layout_test.go`, `templates/{style.css,app_shell,app_settings,app_data,app_guide,app_logs,app_fields,deploy}.html`,
both locale files, `i18n_parity_test.go`, `i18n_wiring_test.go`.

## 5. Tests and red-proofs

| # | Break | Result |
|---|---|---|
| B1 | the whole registry check deleted | 5 of 6 cases fail; a present tag builds AND pushes |
| B2 | an unreachable registry treated as absent | the two unanswered-registry cases fail |
| C1 | `assetTag` from the version only | `TestAssetTag_ChangesPerBuild` fails on both same-version cases |
| C2 | one shell back on `?v={{.Version}}` | `TestAssetTag_EveryShellUsesIt` fails naming layout.html |
| C3 | `addShellAssetData` removed from `executeTemplate` | `TestAssetTag_ReachesTheRenderedPage` fails: empty buster on four pages |
| D1 | the auto-update success banner restored | `TestAppPage_AutoUpdateSuccessIsMetaNotBanner` fails |
| D2 | one tab loses its column | `TestAppPage_OneColumnLayout` fails naming the tab |
| D3 | a section drawn as a card again | same test fails on two tabs |
| E | an informational section drawn as a blue callout | `TestAppPage_CalloutsOnlyForAskAndWarn` fails on both counts |

New: `TestBuildScript_RefusesExistingTag` (six cases, real script, fake docker),
`TestAssetTag_{ChangesPerBuild,EveryShellUsesIt,ReachesTheRenderedPage}`,
`TestAppPage_{OneColumnLayout,AutoUpdateSuccessIsMetaNotBanner,CalloutsOnlyForAskAndWarn}`.

Full gate: `go build ./... && go vet ./... && go test ./...` → **exit 0, 37 packages ok, zero
failures**, measured with `go test`'s own exit code (not a pipeline's). All controller gates OK; 53
decoys behaved.

## 6. Deployed — and what is NOT

**demo-hp guest 9201 runs `0.316.2`, healthy.** Tester 1 and demo-felhom untouched. The **floor stays
0.314.0** — raising it needs all three test boxes and a green box walk.

**v0.316.3 is committed and pushed to git but NOT built.** Between the 0.316.2 build and this one,
another session's work in progress appeared in the shared DooPlex build clone (15 modified files,
the physical-disk storage work, R-1074..R-1079). The clean-tree gate forbids building over it and I
will not stash or revert another session's work. Every build I did make printed `porcelain=0` first.

What 0.316.3 adds, and therefore what the operator will NOT see tonight: on the data tab,
„Biztonsági mentés" is still drawn as a card, and the 2nd-copy heading still reads „2. mentés
beállítása — AdventureLog". Both are cosmetic; everything else is live.

## 7. The browser check, through the PUBLIC address

Chrome on the workstation, `https://felhom.enkisfelhom.hu`, **normal loads — no hard refresh**:

- The stylesheet URL is `?v=20540d81` (an 8-hex per-build tag, not a version, not empty), and the
  loaded sheet carries the `.app-tabs` rules. **This is the fix working:** before it, the same page
  needed a hand-forced refetch.
- `.app-tab-active` computes `border-bottom: 2px rgb(46,168,245)` = `--blue-bright`; the column is
  `max-width: 820px`; the hero has `border-top-width: 0px`.
- Across settings / data / guide / logs / plex / grocy / install: **1 column each, 1 `aria-current`
  on an installed app and 0 on a not-installed one, 0 `.app-info-card`, 0 success banners.**
- Data tab: exactly **1 amber callout** (the same-disk warning). Settings, guide, grocy: **0 blue,
  0 amber** — correct, nothing is asked and nothing is risky.
- **Console clean on a fresh load.**

Screenshots: `felhom.eu/documentation/audits/app-page-2026-10-15b/browser/`.

**Scenario E's blue callout was NOT exercised live.** Plex's setup gate is open (the operator's real
claim, R-1060), so `Needed()` is false and the card is correctly hidden. Showing it live would mean
un-claiming the operator's real Plex server; not done. The branch is covered by
`TestAppPage_CalloutsOnlyForAskAndWarn` against a harness Plex with a closed gate.

## 8. Fixtures replaced, by name

Recaptured (the pages this task restyles, per the standing exception): `app_settings_*` ×21,
`app_data_*` ×9, `app_guide_*` ×4, `app_logs`, `deploy_new{,_blocked,_memory_blocked}`. **All other
fixtures are byte-identical** — and now permanently so against build identity: the harness
normalises the asset tag on both sides of the comparison, as it already did for the per-session CSRF
token, so a build can no longer churn 148 files.

## 9. NOT yet validated

1. **The operator's look** at AdventureLog and Plex on demo-hp through the public address — asked
   for in STATUS. The layout judgement is theirs.
2. **v0.316.3's two cosmetic fixes** (§6) — committed, unbuilt, so unseen.
3. **A blue callout in a real browser** (§7).

## 10. Teardown — three layers

- **Machine:** nothing provisioned, no app installed, no throwaway Plex. Probe scripts and fetched
  pages removed from DooPlex `/tmp`.
- **Host:** the scratch clone and the `felhom.eu` sibling symlink are deleted. The shared DooPlex
  checkout was never written to by me — which is how I could tell the other session's work from
  mine. `build.sh` in the build directory is now a symlink to the repo's (deliberate, §11), with the
  stale copy kept beside it.
- **Hub:** nothing created; no floor change.

## 11. Observations

- **FILED: R-1081** — the registry's `0.315.0` no longer holds the 0.315.0 release. **I did this**,
  and the cause is worth stating plainly: I put the guard in `controller/build.sh` in the repo, but
  the documented release command runs `$FELHOM_ROOT/build/felhom-controller/build.sh`, which was a
  **separate copy taken 2026-07-18**. The very first thing I did with the new refusal — run it
  against a real existing tag to prove it fires — therefore rebuilt and re-pushed 0.315.0 a fourth
  time, with v0.316.0's code under it. A guard added to a script the runbook does not execute is the
  seam-built-but-never-wired class, and I shipped one while fixing another. Root cause fixed in the
  session (symlink), then the refusal proven from the documented path. No box is affected.
- **NOT-A-FINDING (fixed in session):** the asset tag shipped dead in 0.316.0 — every shell asked for
  it, the template test passed, and the dashboard path never set it, so the first live load rendered
  `?v=` (empty, i.e. a constant). Found in a browser; `TestAssetTag_ReachesTheRenderedPage` now
  asserts the rendered value, not the markup.
- **NOT-A-FINDING (fixed in session):** `app_row_dedup_gate` convicted my `.app-row`, correctly —
  that class already means „a row in the app list". Renamed `.app-field-row`; an over-broad rename
  briefly took the list's own rule with it and was restored.
- **NOT-A-FINDING:** `page.title.tier2_config`-style leftovers — the 2nd-copy heading's locale key
  carries „— {{.DisplayName}}" because it was a page title. New key `app_page.second_backup`.
- **Register: 169 before → 170 after; 1 opened (R-1081), 1 opened-and-closed (R-1080).**
- **System poster:** no fact in `felhom-system-poster.facts.md` changed. Neither file edited;
  nothing added to STATUS about it.
- **Instruction files:** `.claude/rules/unprompted-work.md` item 6 in **all four** versioned copies
  gains „a version number is pushed once", stated as a fact about what the build now enforces, not
  as a new rule. The workspace-root copy is unversioned and not on this machine.