# felhom.eu — task reports

> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).

## Hub v0.49.0 — Edit tab merge (edit-a), scoped auto-refresh, + two riders — 2026-07-12

**⚠ VERSION NOTE (deviation from the spec):** the task targeted **v0.48.0**, but hub v0.48.0
(`app_start_failed` allowlist, CAMPAIGN-3 Task D) had **already shipped and was the live manifest
tag** when this train started. A published tag is never re-pointed (pinned-version discipline), so
this train shipped as **v0.49.0**. Everything else is per spec.

### Baseline / commits

- Baseline: `3e949bc` (spec said `0ed87f5`; the one extra commit was docs-only, `git diff 0ed87f5..3e949bc -- hub/` empty — no hub code drift).
- `e740147` — Part 1: `config_form_body` sub-template + `configFormData` builder (behavior-neutral).
- `2e03de1` — Part 2: Edit tab merge, danger zone, header cleanup, 302, redirect anchors, server-side required fields, Group A/B tests.
- `1d94b1a` — Parts 3+4: scoped auto-refresh, style.css cache-bust (all 11 templates), CLAUDE.md `git add -A` ban, Group C/D tests.
- `b1ab0ea` — Part 5: CHANGELOG v0.49.0, REUSE.md rows, CONTEXT.md, `manifests/hub.yaml` → 0.49.0.

### Files touched

`hub/internal/web/{configs.go, pbsdr.go}`, `hub/internal/web/templates/{config_form.html, config_form_body.html(new), customer_unified.html, +9 templates (cache-bust line only)}`, tests `{customer_edit_tab_test.go(new), refresh_cachebust_test.go(new), customer_tabs_test.go, pbsdr_test.go}`, docs `{hub/CHANGELOG.md, REUSE.md, CONTEXT.md, CLAUDE.md, REPORT.md}`, `manifests/hub.yaml`.

### Test results (all green: `go build ./... && go vet ./... && go test ./...` per commit)

- web package: **54 tests** (43 before → +11 new: Group A ×2, Group B ×3 + 7-case anchor table, Group C ×1, Group D ×1); full repo 13 packages ok.
- **Group A** — Edit panel renders form (`action=/configs/c1/edit`) + Controller Update + Geo + Danger zone; forms are siblings (no `<form` inside the config form's extent); stored overrides populate inputs; header has no edit link; Block/Delete **count == 1** page-wide; blocked customer → Unblock.
- **Group B** — B1: GET `/configs/{id}/edit` → 302 `/customers/{id}#tab=edit` (unknown id still 404). B2: `/configs/new` chrome + create round-trip unchanged. B3: invalid update → 200 standalone re-render, error shown, **submitted values preserved, stored values absent, nothing saved**. B4/B5: anchor table — update/block/unblock/offsite-reissue/offsite-freeze → `#tab=edit`, regen-password → `#tab=setup`, delete → `/configs?flash=deleted` (pbsdr-reissue also anchored → `#tab=edit`; same surface, noted as a spec+1).
- **Group C** — `data-live-tabs="overview,applications,events,host"` on the nav; script pins: `getAttribute('data-live-tabs')`, delegated `input`/`change` dirty listeners, `settings→edit` alias ×2 (tabs + refresh scripts), `(paused)` hint element, 60000/`hub_auto_refresh`/toggle survivors.
- **Group D** — six rendered pages carry `/style.css?v=test` and no bare `/style.css"`.

### Red-proofs (all three ran mutate → FAIL → revert → green)

1. **B3 typed-values**: error path switched to `nil` overrides → "SUBMITTED value lost / stored value rendered" → FAIL ✓.
2. **Header count**: old header Block/Delete restored → count = 2 → FAIL ✓ (Contains alone would have passed).
3. **Cache-bust**: `offsite.html` reverted to bare link → both assertions FAIL ✓.

### Deploy (GitOps)

- Image `gitea.dooplex.hu/admin/felhom-hub:0.49.0` built+pushed on 180.
- ArgoCD hard-refresh → sync: `sync=Synced`, rollout ok, pod image = `felhom-hub:0.49.0`, clean startup log (checkers seeded, `Listening on :8080`) at 17:40:50 CEST.

### Live validation — BLOCKED on operator login (unit coverage stands in)

The hub UI is operator-password-gated and the automation browser profile had no active session
(navigate → `/login`); CC does not enter passwords by policy. **Operator follow-up (5 min), after
logging in at hub.felhom.eu:**

1. `/customers/demo-felhom#tab=edit` — form renders populated; type 1 char in any text field, wait 70 s → **no reload**; switch to Overview → reload resumes next tick.
2. `#tab=settings` lands on Edit; `(paused)` shows on Edit, absent on Overview.
3. Save Changes with NO edits → returns to Edit tab with the "updated" flash. Do NOT change real values; do NOT exercise Block/Delete live.
4. Hard-reload once; confirm `style.css?v=0.49.0` in the network tab.

**NOT live-validated** (unit tests only): Block/Delete flows, the validation-error re-render, the 70 s no-reload probe, the `?v=0.49.0` network check.

### Observations (candidates, not done)

- Customer delete still uses `confirm()` (relocated as-is) — **type-to-confirm retrofit** is the known follow-up.
- The customer-keyed report lookup → cluster-mode arc (pre-existing note) unchanged.
- `handleConfigUpdate` had NO validation-error path before this task (the spec described it as existing); the required-fields check (Display Name + Domain, the form's `required` twins) was added to give B3 its trigger — `pbsdr_test.postUpdate` amended to supply them.
- Workspace-root `E:\git\CLAUDE.md` and the other repos' CLAUDE.md files still carry `git add -A` snippets — flag for their own sessions (out of scope here, per spec).
- The hub operator password gate means browser validation always needs a Viktor-logged-in session; consider a read-only CC credential if live UI validation should become routine.