Bug bash 2: 11 bugs in Stacks, Alerts, Docker, skins and the installer, fixed and verified (BUGS.md)

Stacks: deploy with every compose file (labels from inspect, not comma-joined ps);
refuse a stale overwrite; empty list without Docker. Alerts: firing state survives a
restart without re-announcing; vanished alerts are recorded as cleared with the reason;
rule values validated; 200 rules. Docker: 404 for a removed container's logs. Skins: four
palettes lifted to readable contrast. Phone: bigger toggles and swatches. Installer:
deploy republishes; an older published build is never installed silently.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

BUGS.md

@@ -212,3 +212,70 @@ and `every=` values on the sensor API; phone drawer, key bar and picker.
     the same unconditionally, Ctrl+Insert / Shift+Insert too. It rides the browser's own
     copy and paste events, which xterm already answers, so it works over plain http on the
     LAN where `navigator.clipboard` does not exist; bracketed paste is honoured.
+
+
+# Bug bash 2 — 2026-09-19 (evening): Alerts, Docker, Stacks, skins, the installer
+
+Same method as the morning: a scratch instance with the real fleet behind it, headless
+Chromium at 1440 px and iPhone size. A sweep of all 13 pages on all four machines (errors,
+failed requests, overflow, tap targets) plus a contrast measurement of every skin; then
+scripted use of the new features on throwaway containers and stacks — a multi-file stack, a
+file edited behind the editor's back, two actions at once, a chatty log, odd container
+names, containers stopped and removed while open, every kind of bad alert rule, a rule's
+whole life (fire, narrow, pause, delete, survive a restart), token scope and hostile paths
+on the new APIs — and a regression of terminals, Files, widgets, deep links and colours.
+
+## Bugs — all ✅ fixed and verified by the script that found them
+
+1. ✅ **Deploying a stack made of several compose files dropped all but the first.** A stack
+   deployed with `-f compose.yaml -f compose.override.yaml` was redeployed from
+   `compose.yaml` alone, so everything the override set silently vanished from the new
+   container. Two causes: only the first file was used, and the file list was read from
+   `docker ps`, which joins labels with commas — the list is itself comma-separated, so it
+   arrived truncated. Labels now come from `inspect`; every file is resolved, shown as a
+   chip, editable, validated together and passed to compose in order.
+2. ✅ **A compose file changed on disk after you opened it was silently overwritten** (Dockhand,
+   or a second tab). The editor now hands back the checksum it was given; a mismatch is a
+   409 that says so, keeps your text, and offers to reload.
+3. ✅ **Stacks on a machine without Docker answered 500.** An empty list.
+4. ✅ **Every hub restart re-fired every firing alert** — and every deploy is a restart, so a
+   phone would have been told about the same failed service on each one. What is firing is
+   now kept in `state.json` and carried on, with its original start time.
+5. ✅ **An alert whose rule was paused, deleted or narrowed just vanished**, leaving "firing" in
+   the history forever and no word to the phone. It is now recorded (and sent) as cleared,
+   with the reason: "rule paused", "rule deleted", "no longer watched".
+6. ✅ **Nonsense rule values were accepted**: `null`, an object, `cpu.usage > ninety` (which can
+   never be true, and would never say so), `true` with `<`. Refused, each with its reason.
+7. ✅ **No limit on rules** — 3000 were accepted, each checked on every machine every 15 s. 200.
+8. ✅ **Logs of a container that no longer exists answered 500.** 404.
+9. ✅ **Four skins had text under 3:1 contrast**: Nord's red; Catppuccin Latte's muted text and
+   green; Solarized Dark's body text, muted text and red; Solarized Light's body text,
+   muted text, accent and green. Each colour kept its hue and was moved to a readable value
+   (measured: all thirteen skins now pass, body text ≥ 7:1).
+10. ✅ **Phone: the alert toggles (28 px) and the colour swatches (26 px) were under 30 px.**
+11. ✅ **The public installer had fallen four builds behind the fleet** (v65 published, v69
+    running), so `curl … | sh` on an up-to-date machine "upgraded" it backwards. `make
+    deploy` now republishes, and the installer compares versions: an older build is called
+    older, defaults to No, and unattended runs refuse it without `HAMLAB_ALLOW_DOWNGRADE=1`.
+
+## Checked and fine
+
+A second stack action while one runs (409); `../` and encoded tricks in stack names;
+shell metacharacters in container names, `since` and actions; `rm` / `kill` / `down` are
+not actions; a read-only token is refused on every Docker, Stacks and Alerts endpoint,
+directly and through the hub; container names with dots and underscores still get live
+CPU and memory; a log at five lines a second follows with no gaps or duplicates; a
+container stopped or removed while open updates itself; an alert rule's XSS name renders
+as text; per-machine firing, the rail badge, webhook and ntfy delivery; terminals, Files,
+widgets over container sensors, deep links, tab titles and machine colours all unchanged.
+No native browser dialogs anywhere; no page errors on any of 100 page loads.
+
+## Found by the alerts themselves
+
+`core` has one real alert firing: **`zfs-import-cache.service` fails at every boot** — `core`
+has the ZFS tools and no pool, so there is nothing to import. Harmless, but it will sit on
+the rail as "1" until the unit is disabled or the rule is narrowed. Left alone.
+
+## Quality of life — proposed, not built (waiting on Mitchell)
+
+See the list sent with this pass.