Day 2026-10-19: agent 0.160.0 (released, not vouched), controller 0.332.0 floor (one sign-in R-1100, escrow confirm R-1151), hub 0.159.0 deployed (R-1150, R-1154), R-1153 not a defect, old-restic check passed; register 168 -> 166 (closed 10, opened R-1155..R-1162)

documentation/architecture/02-controller-module-map.md

@@ -539,8 +539,28 @@ state (both demo boxes) the panel says „Ezt a jelszót te állítottad be a F
 the press. The box uses FileBrowser's own CLI (`set -u admin,<pw>`) with the server STOPPED (the CLI opens the
 database with no lock timeout), verifies new=200 and admin/admin refused, stores the value encrypted and records
 `generated`; a failed verify leaves `operator`. Not the `FILEBROWSER_ADMIN_PASSWORD` env: it re-applies on every
-start. Spike: `audits/logins-folders-2026-10-16/P1b`. FileBrowser still asks for its own login the first time; one
-sign-in for both is R-1100.
+start. Spike: `audits/logins-folders-2026-10-16/P1b`. Since v0.332.0 the folder links open FileBrowser without its own
+login (the next paragraph); `admin`'s password is the fallback and the operator's way in.
+
+**[DESIGN] One sign-in for the file manager (v0.332.0, R-1100, operator decision D16 = yes 2026-10-19; spike
+`audits/proxyauth-spike-2026-10-18/DESIGN-NOTE.md`).** Every dashboard link to a FileBrowser folder goes to
+`/__files/open?to=<path>` on the dashboard host, which — for a signed-in, not-cross-site request — mints a pass (60 s,
+one use, bound to `files.<domain>` and to the session) and sends the browser to `files.<domain>/_felhom/sso`. traefik
+asks the controller before every FileBrowser request (forwardAuth `felhom-files-sso` → `/__felhom_gate/files`, the setup
+gate's handshake): the pass becomes the host-only `felhom_files` cookie (a value derived from the session's fingerprint
+for that host — the R-976 shape); a valid cookie → 200 with the box's **secret header** naming FileBrowser user
+`felhom-household`; no cookie → 200 without it (FileBrowser's own password); a stale cookie (sign-out, password change)
+→ both cookies cleared, back to the dashboard. **Why a secret header name:** FileBrowser trusts the header blindly and
+every app container reaches `filebrowser:80` directly — measured: a forged fixed-name header from an app logged in. The
+name (`X-Felhom-User-<32 hex>`, per box, 0600 in the data dir) is written only into FileBrowser's config and traefik's
+route (`authResponseHeaders`, which strips a client's copy); never a log, a page or a report. **Why not a parent-domain
+cookie:** every app subdomain is third-party code and would receive the dashboard session. **What stays:** `admin` is a
+password user (R-513's reveal and reset, the R-1126 gate unchanged); the header user is a separate FileBrowser user whose
+rights come from the box's userDefaults (change, add, delete, share, download — not admin, not API); FileBrowser's logout
+goes to the dashboard. Residual: FileBrowser's own 2-hour token for the header user is cleared with the files cookie,
+but a browser that lost only the files cookie keeps it until it expires. Measured live on all three test boxes
+(`audits/day-2026-10-19/P2/`, `P4/`): opened at the folder with no login; forged headers refused through traefik and
+from an app container; a sign-out asks again.
 
 **[DESIGN] A stored FileBrowser password is checked before it is offered (v0.321.0, R-1101).** In `generated`, the
 page asks FileBrowser whether the stored value still logs in; only FileBrowser's own 401/403 counts as refused (a
@@ -562,8 +582,9 @@ role, else the first declared folder, else (a media app) the first present drive
 `movies`, the players both, a download client its `media_library.folder`) with NO backup sentence — the bind's class
 there means „not this app's data", which is not the class-driven „temporary, not backed up". **A folder whose drive
 is not bound into FileBrowser now is text, never a link** (`drivePresent` = the same gates the FileBrowser sync
-applies). The button never promises one click: FileBrowser's router brings a cold visitor back to the folder after its
-login (measured in the headless browser, `audits/logins-folders-2026-10-16/browser/`).
+applies). Since v0.332.0 the button opens the folder signed in (one sign-in, above); on a box without it, FileBrowser's
+router brings a cold visitor back to the folder after its login (measured in the headless browser,
+`audits/logins-folders-2026-10-16/browser/`).
 
 **[DESIGN] „Cím és kulcsok" is rows, not the install form.** The settings tab does not re-render the
 install wizard's fields: the address is the „Cím" row, the storage is a „Tárhely: <név>" row, every