REPORT: hub v0.47.0 live validation ALL PASS (contrast + tabs + dr-drill deletions + offsite probe)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vvz1NCu22p8dGkRCpeX9re

REPORT.md

@@ -58,17 +58,35 @@ for-online proof, comment added), SECRET-LEAK assertions, pubkey-title + empty-h
 - Deploy = the `manifests/hub.yaml` bump in `95d71fe`; ArgoCD hard-refresh → deliberate sync (Application CR patch).
 - Verify: `sync=Synced health=Healthy`; `deployment "hub" successfully rolled out`; deploy image `gitea.dooplex.hu/admin/felhom-hub:0.47.0`; startup log clean (all checkers initialized, `Listening on :8080`, 2026-07-11 21:41 CEST).
 
-### 7. Live validation (method: claude-in-chrome against hub.felhom.eu)
+### 7. Live validation — ALL PASS (method: claude-in-chrome driving hub.felhom.eu with the operator's logged-in session, 2026-07-11 ~22:00)
 
-- Serving confirmed: hub.felhom.eu responds post-rollout (login page renders; pod log + image verified via kubectl as above).
-- **BLOCKED — operator login required:** hub web sessions are in-memory, so the 0.47.0 rollout
-  invalidated every session; the operator password gate is CC-uncrossable by policy. Pending items
-  (exact spec §13 list) once a logged-in Chrome session exists:
-  1. `/hosts/demo-felhom-01` Diagnostics View/Download button contrast screenshot (Scenario F);
-  2. `/customers/demo-felhom` tabs + `#tab=events` deep-link + auto-refresh tab persistence + Host tab + sticky strip + narrow viewport;
-  3. delete `dr-drill-host` and `dr-drill-host3` end-to-end (impact preview → type-to-confirm → escrow checkbox if flagged) + wg-peer convergence on `/offsite` within one reconciler tick — do NOT touch `demo-felhom-01` / `peti-felhom-86d37d`;
-  4. `/offsite` ep0 card + bad-CIDR edit probe (expect 400; no real value changed, no second real endpoint).
-- The same flows are covered by unit/render tests (Scenarios A–E); the live pass is confirmatory.
+1. **Button contrast (Scenario F) — PASS.** `/hosts/demo-felhom-01` Diagnostics View/Download:
+   computed style verified `color: rgb(10,18,32)` (--bg-0) on `background: rgb(46,168,245)`
+   (--blue-bright); screenshot shows readable labels. Caveat found first: the browser served a
+   CACHED pre-fix style.css (`max-age=3600`, no cache-bust param) — `fetch('/style.css')` cached
+   copy lacked `:not(.btn)`, `{cache:'reload'}` copy had it; a hard reload fixed it (see §9).
+2. **Customer tabs — PASS.** `/customers/demo-felhom`: 8 tabs render, only the active panel
+   visible (`body.js-tabs` set); `#tab=events` deep-link activates Events; `location.reload()`
+   (the auto-refresh mechanism) preserves the hash and the Events panel stays active; Host tab
+   rendered the shared body for BOTH hosts then bound to the customer (demo-felhom-01 ONLINE +
+   dr-drill-host NO REPORT — the list design proven live) with cross-links; sticky strip pinned
+   at `top:0` at scrollY=2000 (`position: sticky` computed). Mobile: at a 390px container the
+   tab nav scrolls horizontally (scrollWidth 725 > clientWidth 342), does not wrap, and the body
+   never scrolls horizontally (window resize was blocked by the maximized window — verified via
+   container-width constraint instead).
+3. **Sanctioned deletions — PASS.** `/hosts` before: 4 hosts. `dr-drill-host` → danger-zone card
+   (host NO REPORT), Remove → impact preview "0 guest row(s), 0 host report(s), 0 agent log
+   bundle(s). Host status: pending." + escrow checkbox (both drill hosts HAD escrow rows) →
+   ticked + retyped id → 303 to `/hosts`, host gone. Repeated for `dr-drill-host3`. `/hosts`
+   after: exactly `demo-felhom-01` (ONLINE) + `peti-felhom-86d37d` (DOWN) — untouched. Neither
+   drill host had a bound wg peer (impact preview showed none), so there was no `/offsite`
+   convergence to observe; the peer table was unchanged (still the 2 real peers).
+4. **Offsite — PASS.** ep0 card renders (address, truncated pubkey w/ title, subnet
+   10.77.0.0/24, PBS 10.77.0.1:8007, **Peers in subnet: 2**), deferral note visible, peer table
+   shows the Endpoint column (ep0). Bad-CIDR probe through the real edit form (`epEdit('ep0')` +
+   subnet `10.99.0.0/240`, posted with the form's own CSRF payload) → **400 "Invalid tunnel
+   subnet (CIDR, e.g. 10.77.0.0/24) — nothing stored."**; re-fetch confirmed ep0's subnet intact
+   and the bad value absent. No real value changed; no second endpoint created.
 
 ### 8. NOT live-validated (by design)
 
@@ -77,6 +95,8 @@ for-online proof, comment added), SECRET-LEAK assertions, pubkey-title + empty-h
 
 ### 9. Observations (documented, not acted on)
 
+- **`/style.css` is served with `max-age=3600` and no cache-bust param** — after a deploy, browsers can render with the previous CSS for up to an hour (live-observed: the contrast fix looked unfixed until a hard reload). A `?v={{hubVersion}}` on the stylesheet link would eliminate this class of false-negative.
+- **A never-reported host renders its CUSTOMER's storage targets/log bundles**: `hostDetailData` reads `GetLatestHostReportJSON(host.CustomerID)`, so dr-drill-host (no report ever) displayed demo-felhom-01's storage table and the customer-scoped controller bundle. Pre-existing `handleHostDetail` behavior (customer-keyed report lookup), merely surfaced by two hosts sharing a customer — worth a per-host report scope someday.
 - `146d165` (parallel session) demonstrates that `git add -A` doc commits in a shared repo can ship another session's mid-mutation WIP — worth a convention note (stage explicit paths).
 - `hostInstallVersion` in `web/configs.go` still says `1.12.0` while host-install is at v1.13.0 (display-only constant; out of scope here).
 - Hub web sessions live in process memory — every deploy logs every operator out; a persisted session store would remove the "revalidate after each rollout" friction.