R-1052 closed: a new box from the public ISO (golden 0.313.0) reached the floor 0.314.0 by itself, 2 min 52 s after the bind (throwaway customer Tester3, VM removed)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/CLOSED-ITEMS.md

@@ -32,6 +32,7 @@
 |---|---|---|---|
 | **R-1057** | **A restore of a REMOVED gated app came back without its setup gate, even from a backup made before the setup.** (P2 — raised from P3 by the reviewer 2026-10-15) | CLOSED 2026-10-15 — **controller v0.314.0** (`09` §3 decision 253): the per-app backup records the gate; a restore puts it back as it was (closed then → closed now, file first; open then → open; no record → closed until the probe or „Kész"). Unit tests red-proved by ten mutations. **Live on 9202** (rc.1): Prowlarr installed, no account, the Update's per-app backup, remove keeping backups, restore → a stranger got `/ping` 401, `/` 302 to the gate, `/initialize.json` 401; the household 200; the box's log: „restored with its setup gate CLOSED — it was closed when the backup was taken (R-1057)"; „Kész" then opened it. Before the fix the same walk gave the stranger 200. Plex: the same rule, proven by a unit test with Plex's gate shape (no live Plex restore). | `audits/gate-restore-2026-10-15/9202/restore.txt`, `02-controller-log.txt` |
 | **R-1053** | **A box on an `-rc` tag was never moved by the floor.** (P3) | CLOSED 2026-10-15 — **controller v0.314.0**: `util.ParseVersionPre` puts `X.Y.Z-rc.N` below `X.Y.Z` for the floor only; the button never offers a test build; an unreadable version WARNs once per change. **Live:** Tester 1 put on 0.314.0-rc.1 by hand (rc.4 runs the old check and could never leave by itself), then the floor 0.314.0 moved it: „Post-update startup: update successful (0.314.0-rc.1 → 0.314.0)" at 13:09:38 UTC. | `audits/gate-restore-2026-10-15/release/01-tester1-rc1.txt`, `03-boxes-move.txt` |
+| **R-1052** | **A fresh box installed from a golden older than the floor reaching the floor at first boot was not proven.** (P3) | CLOSED 2026-10-15 — proven: a VM on demo-hp from the public ISO 1.29.0 (golden 0.313.0), bound to the throwaway customer Tester3 through the mailed link, moved to the floor 0.314.0 by itself — initiated_by „auto-floor", 2 min 52 s after the bind, 10 min 49 s after Install, before the household claimed the dashboard; read from the hub's reports AND the box's own self-update record. The domain was a reserved placeholder (`tester3.test`); the floor path does not need a working domain. The operator deletes customer Tester3 (session only). | `audits/gate-restore-2026-10-15/newbox/` |
 | **R-1060** | **On controller 0.313.0 the Plex claim button could never work: Plex refused the code with 401 because the box called it as `http://plex:32400`.** (P2) | CLOSED 2026-10-15 — **controller v0.314.0**: every Plex call by the container's address (`mediawire.PlexURL`). **Live on demo-hp 9201** with the operator's fresh code, through the dashboard's own claim call: 200 `claimed: true` in 11.8 s; the box: „claimed — the setup gate is open"; `/identity` „claimed":true; the gate file gone; a stranger meets Plex's own sign-in (`/web/index.html` 200, `/library/sections` 401 without a token); one library wiring run: `plex=done(2)` (`FSEventLibraryUpdatesEnabled=1`, `FSEventLibraryPartialScanEnabled=1`). A fifth call by name — the health probe's `/identity` — is harmless (Plex answers it to anyone). | `audits/gate-restore-2026-10-15/plex9201/01-fake-code.txt`, `02-claim.txt` |
 | **R-1023** | **Build: media apps see every drive, and the box says when they must restart.** (P2) | CLOSED 2026-10-15 — delivered by controller v0.313.0 and the floor; its last step was Tester 1 off the test build (R-1053): Tester 1 runs the release 0.314.0 since 13:09:38 UTC, moved by the floor by itself. | `audits/gate-restore-2026-10-15/release/03-boxes-move.txt`, `audits/media-build-2026-10-15/` |
 | **R-1058** | **Prowlarr installed AFTER Sonarr/Radarr was not linked until „Bekötés most".** (P3) | CLOSED 2026-10-15 — **controller v0.314.0**: Prowlarr's own start runs the media wiring (`linkOnlyApps`). **Live on 9202** (rc.1): Sonarr first, then Prowlarr → „a media app came up: prowlarr", Sonarr in Prowlarr's Apps ~40 s later, no button; a second run „unchanged"; Prowlarr's connection test 200. Catalog `e67aad4` and the website card drop the button sentence. | `audits/gate-restore-2026-10-15/9202/link.txt` |