REPORT: hub v0.49.0 edit-a train — results, red-proofs, deploy verification, operator follow-ups

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TZc5w5jDhFLv6qDC32KN5v

REPORT.md

@@ -2,14 +2,61 @@
 
 > **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
 
-## DRILL — Day-0 on the Demo-VM (nested PVE) + escrow/auto-confirm first firing — 2026-07-12
+## Hub v0.49.0 — Edit tab merge (edit-a), scoped auto-refresh, + two riders — 2026-07-12
 
-**Full report: [`documentation/audits/DRILL-day0-vm-2026-07-12.md`](documentation/audits/DRILL-day0-vm-2026-07-12.md).** Supervised drill (Viktor + CC), ~15:15–17:09 CEST, on a throwaway nested PVE 9.2.2 VM (qm 300 on felhom-pve) against hub customer `demo-vm-felhom` / `enkisfelhom.hu`. No code changes; two runbook docs corrected (day0-install.md A.2 anonymous-fetch wording; RUNBOOK-escrow-ceremony.md's false "identity-only ≥0.80.0" claim + `age` prereq).
+**⚠ VERSION NOTE (deviation from the spec):** the task targeted **v0.48.0**, but hub v0.48.0
+(`app_start_failed` allowlist, CAMPAIGN-3 Task D) had **already shipped and was the live manifest
+tag** when this train started. A published tag is never re-pointed (pinned-version discipline), so
+this train shipped as **v0.49.0**. Everything else is per spec.
 
-### Headlines
+### Baseline / commits
 
-- **The whole arc ran to completion on a fresh box:** appliance-mode Day-0 (agent 0.85.0 + golden 0.120.0, both sha-verified, "Day-0 provision SUCCESS"), guest at floor 0.120.0 at FIRST report with zero manual steps, ActualBudget deployed through the tunnel, escrow ceremony sealed (R with Viktor only), **AUTO-CONFIRM FIRST LIVE FIRING: pending → escrowed in ~7.5 min with zero clicks**, offsite backup (1 snapshot, 14 s) **and the verification-restore round-trip proven** (48K payload decrypted back from the Storage Box).
-- **F-4 (HIGH): G10 is unclosable** — no operator-set dashboard password path exists in shipped code (hub has no per-customer `password_hash` UI/API; controller's open-state page defers to the operator; Day-0 preseeded setup skips the wizard's password form). Every fresh box's dashboard stays OPEN on the internet. Blocks the tester onboarding gate.
-- **F-6 (HIGH): identity-only escrow ceremony was never implemented** — on a no-PBS box (the documented appliance standard) the offsite escrow chain can never complete. Mid-drill fork (Viktor): attached the **PBS DR tier (ep0)** instead, which live-rehearsed Peti's exact pending sequence — wrapper+`age` prep → `wg_tunnel.enabled` → hands-free WG peer registration → hub PBS-DR enable (WG-first dependency guard works) → apply-bridge fresh path (consume-once → K born → escrow seed) → ceremony → auto-confirm.
-- Fresh-box installer gaps found live: `felhom-pbs-apply` binary not shipped (F-7), `age` not installed (F-10), root-owned `guests/` parents break the non-root agent's lanresolver (F-3, live-fixed; **demo host likely has the same latent state**), silent root@pam rotation surprises the operator (F-8), version strings disagree ×3 (F-1).
-- Snapshots on qm 300 for re-drills: `pre-day0-clean` / `post-install` / `post-drill`. Demo 9201, Peti's hub entry, demo offbox untouched.
+- Baseline: `3e949bc` (spec said `0ed87f5`; the one extra commit was docs-only, `git diff 0ed87f5..3e949bc -- hub/` empty — no hub code drift).
+- `e740147` — Part 1: `config_form_body` sub-template + `configFormData` builder (behavior-neutral).
+- `2e03de1` — Part 2: Edit tab merge, danger zone, header cleanup, 302, redirect anchors, server-side required fields, Group A/B tests.
+- `1d94b1a` — Parts 3+4: scoped auto-refresh, style.css cache-bust (all 11 templates), CLAUDE.md `git add -A` ban, Group C/D tests.
+- `b1ab0ea` — Part 5: CHANGELOG v0.49.0, REUSE.md rows, CONTEXT.md, `manifests/hub.yaml` → 0.49.0.
+
+### Files touched
+
+`hub/internal/web/{configs.go, pbsdr.go}`, `hub/internal/web/templates/{config_form.html, config_form_body.html(new), customer_unified.html, +9 templates (cache-bust line only)}`, tests `{customer_edit_tab_test.go(new), refresh_cachebust_test.go(new), customer_tabs_test.go, pbsdr_test.go}`, docs `{hub/CHANGELOG.md, REUSE.md, CONTEXT.md, CLAUDE.md, REPORT.md}`, `manifests/hub.yaml`.
+
+### Test results (all green: `go build ./... && go vet ./... && go test ./...` per commit)
+
+- web package: **54 tests** (43 before → +11 new: Group A ×2, Group B ×3 + 7-case anchor table, Group C ×1, Group D ×1); full repo 13 packages ok.
+- **Group A** — Edit panel renders form (`action=/configs/c1/edit`) + Controller Update + Geo + Danger zone; forms are siblings (no `<form` inside the config form's extent); stored overrides populate inputs; header has no edit link; Block/Delete **count == 1** page-wide; blocked customer → Unblock.
+- **Group B** — B1: GET `/configs/{id}/edit` → 302 `/customers/{id}#tab=edit` (unknown id still 404). B2: `/configs/new` chrome + create round-trip unchanged. B3: invalid update → 200 standalone re-render, error shown, **submitted values preserved, stored values absent, nothing saved**. B4/B5: anchor table — update/block/unblock/offsite-reissue/offsite-freeze → `#tab=edit`, regen-password → `#tab=setup`, delete → `/configs?flash=deleted` (pbsdr-reissue also anchored → `#tab=edit`; same surface, noted as a spec+1).
+- **Group C** — `data-live-tabs="overview,applications,events,host"` on the nav; script pins: `getAttribute('data-live-tabs')`, delegated `input`/`change` dirty listeners, `settings→edit` alias ×2 (tabs + refresh scripts), `(paused)` hint element, 60000/`hub_auto_refresh`/toggle survivors.
+- **Group D** — six rendered pages carry `/style.css?v=test` and no bare `/style.css"`.
+
+### Red-proofs (all three ran mutate → FAIL → revert → green)
+
+1. **B3 typed-values**: error path switched to `nil` overrides → "SUBMITTED value lost / stored value rendered" → FAIL ✓.
+2. **Header count**: old header Block/Delete restored → count = 2 → FAIL ✓ (Contains alone would have passed).
+3. **Cache-bust**: `offsite.html` reverted to bare link → both assertions FAIL ✓.
+
+### Deploy (GitOps)
+
+- Image `gitea.dooplex.hu/admin/felhom-hub:0.49.0` built+pushed on 180.
+- ArgoCD hard-refresh → sync: `sync=Synced`, rollout ok, pod image = `felhom-hub:0.49.0`, clean startup log (checkers seeded, `Listening on :8080`) at 17:40:50 CEST.
+
+### Live validation — BLOCKED on operator login (unit coverage stands in)
+
+The hub UI is operator-password-gated and the automation browser profile had no active session
+(navigate → `/login`); CC does not enter passwords by policy. **Operator follow-up (5 min), after
+logging in at hub.felhom.eu:**
+
+1. `/customers/demo-felhom#tab=edit` — form renders populated; type 1 char in any text field, wait 70 s → **no reload**; switch to Overview → reload resumes next tick.
+2. `#tab=settings` lands on Edit; `(paused)` shows on Edit, absent on Overview.
+3. Save Changes with NO edits → returns to Edit tab with the "updated" flash. Do NOT change real values; do NOT exercise Block/Delete live.
+4. Hard-reload once; confirm `style.css?v=0.49.0` in the network tab.
+
+**NOT live-validated** (unit tests only): Block/Delete flows, the validation-error re-render, the 70 s no-reload probe, the `?v=0.49.0` network check.
+
+### Observations (candidates, not done)
+
+- Customer delete still uses `confirm()` (relocated as-is) — **type-to-confirm retrofit** is the known follow-up.
+- The customer-keyed report lookup → cluster-mode arc (pre-existing note) unchanged.
+- `handleConfigUpdate` had NO validation-error path before this task (the spec described it as existing); the required-fields check (Display Name + Domain, the form's `required` twins) was added to give B3 its trigger — `pbsdr_test.postUpdate` amended to supply them.
+- Workspace-root `E:\git\CLAUDE.md` and the other repos' CLAUDE.md files still carry `git add -A` snippets — flag for their own sessions (out of scope here, per spec).
+- The hub operator password gate means browser validation always needs a Viktor-logged-in session; consider a read-only CC credential if live UI validation should become routine.