Night 2026-10-17: restore keeps the DB password (R-1106, 07 §7.4), restic 0.19.1, hardening; 8 rows closed, 7 filed; evidence

STATUS.md

@@ -2,10 +2,12 @@
 
 **Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
 
-**Updated 2026-10-16 (evening).** Controller 0.323.0 (Debian 13, its own pinned backup program restic 0.18.1, the new file-sharing image) runs on the three test boxes; **every other box waits for tonight's off-site backups** — `REPORT-debian13-restic-2026-10-16.md`. **Earlier (midday):** Controller 0.319.0 (the app page in panels, the login in one panel) is the floor, MinAgent 0.158.1 — `REPORT-app-page-tuning-2026-10-16.md`. **Earlier (morning):** Storage identity build B shipped: agent 0.158.1 and golden 0.318.0 vouched by you, controller 0.318.0 is the floor (MinAgent 0.158.1), installer 1.33.0 published — new one-disk boxes get their own data area. Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
+**Updated 2026-10-17 (night).** Controller 0.324.0 runs on the three test boxes: a restore now brings the database password back with the data (your 1A), restic 0.19.1 (your 2A), dashboard hardening — `REPORT-night-2026-10-17.md`. The update for every box: see „What we work on". **Earlier (2026-10-16 evening):** 0.323.0, Debian 13 — `REPORT-debian13-restic-2026-10-16.md`. **Earlier (midday):** Controller 0.319.0 (the app page in panels, the login in one panel) is the floor, MinAgent 0.158.1 — `REPORT-app-page-tuning-2026-10-16.md`. **Earlier (morning):** Storage identity build B shipped: agent 0.158.1 and golden 0.318.0 vouched by you, controller 0.318.0 is the floor (MinAgent 0.158.1), installer 1.33.0 published — new one-disk boxes get their own data area. Open items: see `documentation/backlog/OPEN-ITEMS.md`. Older notes, day by day:
 `documentation/backlog/STATUS-HISTORY.md`. Reports: `REPORT-night-2026-10-14.md`, `REPORT-immich-rollout-2026-10-14.md`, `REPORT-seo-felho-tarhely-2026-10-14.md`, `REPORT-immich-repair-2026-10-14.md`, `REPORT-power-cut-fixes-2026-10-14.md`, `REPORT-night-power-2026-10-13.md`, `REPORT-poweroff.md`.
 
 ## What works
+- **A restore brings the database password back with the data** (controller 0.324.0, your decision 1A): remove an app, install it again, restore it — the app opens its own data (proven on demo-hp with Rallly and Grimmory, off-site and on-box, and through „use my kept data"). A backup without the password is refused before anything changes, with a plain sentence. Backup program restic 0.19.1 (your 2A): old and new copies read both ways; scanner findings in it 50 → 19.
+- **The dashboard is harder to attack** (0.324.0): no sending the browser to another site after sign-in, no framing, parallel password guesses counted, 12-character minimum, reset-code requests limited, sign-out needs a token (the old sign-out link did nothing), a password change ends every family and gate session.
 - **The box's backup program is now chosen, not inherited** (controller 0.323.0, 2026-10-16): restic 0.18.1, checked by its signature and fingerprint at every build, on Debian 13. Every way the box reads restic was compared old vs new with real outputs; old copies stay readable by the new program and new copies by the old one (on demo-hp's real store). The file-sharing image has 0 known high holes (was 48), and the same household password still works after the change.
 - **The hub's key can no longer open anything on a box** (controller 0.322.0, 2026-10-16): the settings route is gone, and every former door answers 401 even with the box's own key. Every box that reports answers only over https (35 names). The controller and the hub (0.156.0, deployed at your yes) are built on a supported Go (1.27.2): known Go weaknesses in each 62 → 1; the hub has 0 high findings.
 - **RomM game saves are in the backup now** (2026-10-16, catalog): a save survived a backup, a removal and a restore on demo-hp, byte for byte. Eight apps no longer claim „a known, shared password" (your D10 = A). If someone changes the file manager's password in the file manager, the box notices and offers a new one (controller 0.321.0).
@@ -36,8 +38,7 @@
 - Tester 2 has never made an off-site check (R-862). The scratch box cannot read the drill catalog (R-992).
 
 ## What we work on
-- **Tomorrow (2026-10-17), the next session: finish the 0.323.0 release (R-1105).** For each test box read the off-site result: `ssh <host> "pct exec 9201 -- python3 -c \"import json;o=json.load(open('/var/lib/docker/volumes/felhom-controller-data/_data/data/settings.json'))['offbox'];print(o['last_status'],o['last_success'])\""` with `<host>` = `demo-hp`, `felhom-pve`, `root@192.168.0.154`. All three `ok` with a time after 2026-10-17T00:00Z → raise the global floor (the `felhom-build-deploy` skill, step 5: `min_controller_version=0.323.0`, `min_agent=0.158.1`, expect `303` → `flash=floor_set`), read it back with the WAL, then clear the three per-box floors (`POST /customers/<id>/floor`, both fields empty). Any box not `ok` → no floor; find out why first. After 2026-10-18 14:16 UTC (demo-hp's next clean-up window): check that the old restic (image 0.322.0) still lists and restores demo-hp's store (`audits/debian13-restic-2026-10-16/tools/rx.sh`).
-- A reinstalled database app restored from the off-site copy comes back with the old database password and does not start (R-1106, with R-127 (b)); needs a design.
+- **The update for every box (R-1105, R-1107) waits on tonight's off-site backups on 0.324.0.** The night session checks from 02:45 UTC and raises the floor if all three are `ok`. If it could not, the morning check is: `ssh <host> "pct exec 9201 -- python3 -c \"import json;o=json.load(open('/var/lib/docker/volumes/felhom-controller-data/_data/data/settings.json'))['offbox'];print(o['last_status'],o['last_success'])\""` for `demo-hp`, `felhom-pve`, `root@192.168.0.154`; all `ok` after 2026-10-17T00:00Z on 0.324.0 → global floor `min_controller_version=0.324.0`, `min_agent=0.158.1` (`felhom-build-deploy` step 5), read back with the WAL, clear the three per-box floors. After 2026-10-18 14:16 UTC: the old restic still reads demo-hp's store after its first 0.19.1 prune (`audits/night-restore-2026-10-17/tools/rx.sh`).
 - The power-cut findings still open (R-1004, R-1005, R-1010, R-1012, R-1013).
 - Media apps on every drive (R-1023): live with the 0.313.0 floor — every drive in every media app, a new drive made ready by the box, a pulled drive loses nothing, a safe removal lets go first and the drive comes back by itself.
 
@@ -54,7 +55,6 @@
 | D7 | R-990, R-989 | Rule yes / no / later on the forum ideas (`audits/forum-research-2026-10-12/FELHOM.md` §5) and the selfh.st ideas (`audits/selfhst-survey-2026-10-12/FELHOM.md` §6) | — | — | nothing changes; the research ages | — |
 | D8 | R-206 | Install DooPlex's Docker settings from git (restarts Docker), and prune the build cache weekly: yes or no? | **Yes, in a quiet window** | — | a rebuild of DooPlex still has the settings in git | — |
 | D9 | R-1062 | The N100's USB drive is also its whole-box backup drive. Split it in two anyway? | **No — keep one drive**; the lived-in box keeps its nightly whole-box backup | Split: the box loses its local whole-box backup (or add a second drive first) | it stays one drive; multi-drive tests stay on Tester 1 | — |
-| D10 | R-1107 | The new backup program restic 0.18.1 (your brief's choice) brings 50 fixable scanner findings, because restic built it with an old Go. Move to restic 0.19.1 (19 findings, 0 critical)? | **Yes, 0.19.1** — one more version step with the same re-proof (about two hours; the tests are ready) | Stay on 0.18.1: no work; the scanner keeps counting 50 that are inside restic | 0.18.1 stays; nothing breaks; the count stays | — |
 
 ## Waiting on you — do
 - **Nézd meg a demo-hp-n a Calibre-Web „Adatok és mentés" fülét és a Fájlkezelőt** (`felhom.enkisfelhom.hu`, controller 0.321.0, minden dobozon kiadva). A mentés egy részben, egyszerű szavakkal; a Fájlkezelő nem kér frissítést és nem ajánl „Install app"-ot.