Apps burndown (controller 0.321.0 released): R-1097, R-1102, R-1101, R-1095, R-1098 closed; R-1103 opened; build-hub.sh 1.25.0

build-hub.sh refuses an existing tag and an unanswered registry (test_build_hub_push_once.sh, red-proved).
Register 179 -> 175. R-1067 stays BLOCKED: Tester-2 reports 0.292.0. Design notes in 02 and 07; STATUS;
evidence audits/burndown-apps-2026-10-16/; REPORT-burndown-apps-2026-10-16.md.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/02-controller-module-map.md

@@ -542,6 +542,20 @@ database with no lock timeout), verifies new=200 and admin/admin refused, stores
 start. Spike: `audits/logins-folders-2026-10-16/P1b`. FileBrowser still asks for its own login the first time; one
 sign-in for both is R-1100.
 
+**[DESIGN] A stored FileBrowser password is checked before it is offered (v0.321.0, R-1101).** In `generated`, the
+page asks FileBrowser whether the stored value still logs in; only FileBrowser's own 401/403 counts as refused (a
+FileBrowser that does not answer is not a refusal — an unproven refusal must not tell the household its password
+changed). Refused → „A Fájlkezelőben megváltoztattad a jelszót, ezért a doboz már nem ismeri." and „Új jelszó
+beállítása". The page no longer tells the household to change FileBrowser's password, and FileBrowser's own update
+notice and „Install app" prompt are switched off in its config (the box updates it; it is opened from the dashboard).
+
+**[DESIGN] The Data tab's backup part is ONE section (v0.321.0).** „Biztonsági mentés": an „Éjszakai mentés" row, the
+2nd copy's state as rows, what the 2nd copy is, its form. Plain words — no „off-drive", no „PBS", no
+„DB/konfiguráció" (pinned by `TestAppData_OneBackupSection`).
+
+**[DESIGN] An installed app's install address goes to its settings tab (v0.321.0, R-1095)** — 302, GET only, like the
+`/stacks/{name}/deploy` bridge.
+
 **[DESIGN] „Fájlok ↗" — one of the app's folders, in FileBrowser.** The header button opens the folder with the library
 role, else the first declared folder, else (a media app) the first present drive's `media` folder; built only with
 `fileBrowserLink` (PathEscape). The data tab lists each drive's media folders the app uses (Sonarr `tv`, Radarr

documentation/architecture/07-backup-architecture.md

@@ -553,6 +553,13 @@ a normal night: nothing. A box off for weeks: one catch-up when it returns; the
 running all along. An upgrade from an older release: the ledger is seeded, the first missed night after it is the
 first one made up.
 
+**[FACT, 2026-10-16, R-1097] An image's own anonymous VOLUME is in no backup.** The app backup takes the named volumes the
+compose DECLARES (`backup.ResolveDockerVolumeNames`) and the drive folders it binds; a path the image keeps in its
+`VOLUME` that the compose does not mount lands in an anonymous volume and is taken by nothing. Measured with RomM's saves
+(`/romm/assets`) on demo-hp; fixed with a named volume, and catalog gate `image-volumes` keeps a measured registry of such
+paths (`audits/burndown-apps-2026-10-16/P1/`). A survey of every running container on demo-hp found no other data path
+in an anonymous volume (PrivateBin's are temp folders).
+
 ### 6.2 Coverage per app class — and an unresolved count
 
 **[FACT]** Of 53 catalog templates, **52 keep data in Docker named volumes**; exactly **13** carry a