Apps burndown (controller 0.321.0 released): R-1097, R-1102, R-1101, R-1095, R-1098 closed; R-1103 opened; build-hub.sh 1.25.0

build-hub.sh refuses an existing tag and an unanswered registry (test_build_hub_push_once.sh, red-proved).
Register 179 -> 175. R-1067 stays BLOCKED: Tester-2 reports 0.292.0. Design notes in 02 and 07; STATUS;
evidence audits/burndown-apps-2026-10-16/; REPORT-burndown-apps-2026-10-16.md.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,16 @@
 
 ---
 
+## 2026-10-16 — apps burndown (controller v0.321.0, catalog `326f846`, agent script `dd8b2ac`, hub build script)
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-1097** | **RomM keeps the household's saves in an anonymous Docker volume, outside the backup.** (P3) | CLOSED 2026-10-16 — **measured first** on demo-hp 9201: every RomM backup held romm_config, romm_db_data, romm_redis_data and no saves; the app backup takes only compose-declared named volumes (`backup.ResolveDockerVolumeNames`). Catalog `326f846`: `romm_assets:/romm/assets` in the compose and both `steps/` files; gate `image-volumes` (measured registry, decoys, red-proved). **Proven:** a save written into `/romm/assets` → the by-day night chain wrote `romm_romm_assets.tar` → RomM removed (keeping backups, the volume went) → restored from the backups page → the save back byte-identical (sha256). No one-time copy: operator 2026-10-16, no RomM saves worth keeping; the hub shows RomM only on demo-hp. | `audits/burndown-apps-2026-10-16/P1/` |
+| **R-1102** | **Eight apps said „starts with a known, shared password" about a generated or typed login.** (P3) | CLOSED 2026-10-16 — operator decision **D10 = A**: `app_info.default_creds` removed (hu + en) from grafana, gokapi, kimai, code-server, nzbget, nextcloud, transmission, prowlarr; copy freeze re-captured with the reason; `D10NoFalseKnownLogin` red-proved. **Live** on demo-hp: none of the eight shows the line on its app page or install page; the login panel gives its answer. **Reasoning kept:** the user name „admin" stays in the first steps of grafana, gokapi, nzbget, transmission; no live control exists any more (these eight were the only apps that showed the line) — `known_login_test.go` is the mechanism control. | `audits/burndown-apps-2026-10-16/live/d10-check.txt` |
+| **R-1101** | **FileBrowser's stored password went stale when changed in FileBrowser, and the page said to change it.** (P4) | CLOSED 2026-10-16 — **controller v0.321.0**: the „change it" line is gone for FileBrowser; in `generated` the page asks FileBrowser first (only its own 401/403 counts; not answering is not a refusal) and, refused, says so and offers „Új jelszó beállítása", which accepts that case. Red-proved both ways. Also: FileBrowser's own update banner and „Install app" prompt switched off in the rendered config (`disableUpdateCheck`, `disablePWAInstall`), checked in the browser. | `audits/burndown-apps-2026-10-16/browser/report.json` |
+| **R-1095** | **`/apps/{slug}/install` still opened for an installed app.** (P4) | CLOSED 2026-10-16 — **controller v0.321.0**: GET answers 302 to `/apps/{slug}/settings` (POST untouched); red-proved; **live** in the browser. The installed-only template branches stay — R-1103. | `audits/burndown-apps-2026-10-16/browser/report.json` |
+| **R-1098** | **The hub build did not refuse a version already in the registry.** (P3) | CLOSED 2026-10-16 — `scripts/build-hub.sh` v1.25.0 refuses before the build when the tag exists, and when the registry cannot say (the controller `build.sh` rule); `scripts/test_build_hub_push_once.sh`, 6 cases, red-proved (5 fail with the check removed). The agent's `release-agent.sh` had the check but let an unreachable registry through: now only a clean 404 proceeds (`test_release_push_once.sh`, red-proved). No hub image, no deploy. | `audits/burndown-apps-2026-10-16/redproof/` |
+
 ## 2026-10-16 — RomM, Ghost, withdrawn controller builds (catalog `fb18471`, hub v0.155.0)
 
 | Row | What | Closed | Evidence |