app page tuning round 2: P0 cause (Calibre-Web installed before its password field), controller 0.319.0 released, 02 layout rules (style A, login panel, empty-value rule), R-1095 opened, STATUS

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/architecture/02-controller-module-map.md

@@ -477,26 +477,50 @@ does not get to vouch for a version, so an overlay can neither set nor clear it.
 **[DESIGN] Guide text is DATA.** Plain text through `html/template` — no markdown, no raw HTML — so
 a step containing a tag is shown as the characters its author typed.
 
-#### The app page's layout (v0.316.0, operator-approved mockup 2026-10-15)
+#### The app page's layout (v0.319.0, operator-approved 2026-10-16, section style A)
 
-**[DESIGN]** Five rules; the first three are the mockup, the last two are what they imply.
+**[DESIGN]** The mockup canvas „Felhom app oldal — egy oszlop" (Settings screen), operator-approved
+2026-10-16 with section style **A — panels**. It replaces v0.316.0's hairline sections: with the hero,
+the tab bar and every section on the same page background, the operator found the page flat — nothing
+told one section from the next.
 
 1. **One column of one width** (820px; the log tab alone is full width, because log lines are long).
-   Boxes of differing widths read as a page assembled by accident, which is what v0.315.0 looked like.
-2. **A section is a hairline, not a card** — `padding: 28px 0` with a bottom `--line-soft`, no
-   background, no border, no radius. A card says „this is a thing you act on", and most of an app
-   page is a thing you READ; a card there is a promise the content cannot keep.
-3. **A box means something, and there are exactly two.** Blue (`--blue` on `--blue-dim`) when the app
-   is WAITING for the household — an after-start value; amber (`--warn` on `--warn-dim`) when
-   something is RISKY, such as a backup sharing a disk with the data it protects. The
-   exception-colour principle, applied to shape as well as colour. Nothing informational is boxed.
-4. **The hero is not a box**: a 64px logo tile, the name, the tagline, hairline chips (state,
-   lifecycle, update) and meta text (the address, the last automatic update). The tab bar is links
-   with a 2px `--blue-bright` underline under the open one — no pills, no fills.
-5. **A success is not a banner.** The automatic-update SUCCESS line is meta text in the hero. It
-   asked nothing of the household, so it is a date. Everything that DOES need a decision — a failed
-   update, a hold, lost files, a missing drive, an interrupted install — stays a banner above the
-   tabs, which is R-571's placement rule and is unchanged.
+   Every panel is the column's full width — no narrower inner card. Boxes of differing widths read as
+   a page assembled by accident.
+2. **The hero is a panel** (`--bg-1`, `--line` border, 20px 24px, 16px above it; the logo tile on
+   `--bg-2`). Its content is unchanged: the name, the tagline, the chips, the meta text.
+3. **The tab bar is a panel** (`--bg-1`, 4px inside, 16px above, 20px below). A tab is 10px 18px,
+   15px/600 in `--text-2`; the open tab is filled `--bg-2` with a 2px `--blue-bright` underline.
+4. **Every section is a panel, ONE style on every surface** — the four tabs and the install page,
+   never mixed: `--bg-1`, `--line` border, `18px 24px 22px`, 16px apart; the title 17px/700 18px from
+   the top edge with a `--line-soft` rule under it. The install page's form groups (`.form-section`)
+   and its progress panel are drawn by the same rule. Pinned by `TestAppPage_OneSectionStyleEverywhere`.
+5. **Colour still means something.** A panel is neutral. Blue (`--blue` on `--blue-dim`) is the app
+   WAITING for the household; amber (`--warn` on `--warn-dim`) is something RISKY. The callouts keep
+   their colours, inside a panel or as their own.
+6. **A success is not a banner.** The automatic-update SUCCESS line is meta text in the hero.
+   Everything that DOES need a decision — a failed update, a hold, lost files, a missing drive, an
+   interrupted install — stays a banner above the tabs (R-571's placement rule, unchanged).
+
+**[DESIGN] „Belépés az alkalmazásba" — the login in one panel.** The settings tab shows the app's
+login name and password side by side (stacked under 720px). A login field is a `type: password`
+field plus, when the template has one, the `secret` or `text` field with the same prefix and
+`USER`/`USERNAME`/`EMAIL` (`web/app_login.go`); a password with no clean pair stands alone. Values are
+fetched on demand (R-254, R-709) — the page learns only whether one is stored.
+
+**[DESIGN] The empty-value rule.** A login field the box holds no value for is a SENTENCE („A doboz
+ennél a telepítésnél nem mentett jelszót. A belépéshez azt használd, amit az alkalmazásban
+beállítottál."), never an eye: the reveal endpoint answers 404 for it, a refusal the household could
+only meet by pressing. The page and the endpoint decide „stored" with ONE function
+(`storedValuePresent`). Measured cause of the case that earned it: an app installed before its
+template gained a `type: password` field — `InjectMissingFields` never fills one
+(`audits/app-page-tuning-2026-10-16/P0`).
+
+**[DESIGN] „Cím és kulcsok" is rows, not the install form.** The settings tab does not re-render the
+install wizard's fields: the address is the „Cím" row, the storage is a „Tárhely: <név>" row, every
+other install answer and generated key is a row (keys keep their eye). The read-only hint sits under
+the title. `/apps/{slug}/install` opened for an installed app still renders the form read-only, with
+its secret guards.
 
 **[DESIGN] The stylesheet's address changes with every build.** Every shell links
 `/static/style.css?v={{.AssetTag}}`, where the tag hashes version + `GitCommit` + `BuildTime` and