docs: supervisor (03), node_* ruling (08, CONTEXT), per-tier page + tier skip (07), self-bind triggers + PBS-DR lifecycle (05), settings after install (02), park + No TLS Verify runbooks, volunteer prerequisites

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-09-15 10:42:53 +02:00
parent d8cd4d4412
commit 4c4e3b3a3f
9 changed files with 109 additions and 1 deletions
@@ -601,3 +601,15 @@ measured; that the restore writes to that path is read, not measured.
  catalog's version within 15 minutes (observed). Any "don't touch deployed apps" rule loses that.
 - `up -d`-on-restart is what injects `app.yaml` env into a running stack. Reverting to
  `docker compose restart` would silently stop doing that.
+
+## App settings after install [DESIGN, recorded 2026-09-15]
+
+**An installed app's settings are read-only on its page** („Ez az alkalmazás már telepítve van. Az alábbi
+beállítások csak olvashatók.", `deploy.html`). This is a design, not an oversight: a changed value would
+need a guarded re-deploy that nothing performs. **Finding (2026-09-15):** the catalog field flag
+`locked_after_deploy` (`stacks/metadata.go`) is parsed and read by **no** controller code — every field
+is read-only after install whatever the catalog says. So a page must never tell a household to change
+a value after install. **Vaultwarden (R-512)** follows the design instead of breaking it: registration
+is closed by default and the household is invited from the admin panel, measured to work without mail
+(stranger 400, invite 200, invited 200).
+