Grimmory tested but held (R-775): its fixture added; CHANGELOG, CONTEXT, REPORT for the night's new apps

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,15 +1,19 @@
-# REPORT — the new-app checklist: in the catalog, a gate, piloted on wger (2026-10-01, evening)
+# REPORT — the first new apps through the checklist (2026-10-01, night)
 
-Full session report: `felhom.eu/REPORT-new-app-checklist-2026-10-01.md`; evidence
-`felhom.eu/documentation/audits/new-app-checklist-2026-10-01/`.
+Full session report: `felhom.eu/REPORT-new-apps-2026-10-01.md`; evidence `felhom.eu/documentation/audits/new-apps-2026-10-01/`
+(fit table `FIT.md`).
 
-- **`NEW-APP-CHECKLIST.md`** reviewed: 60 rows in 10 groups (draft 53); 7 added, 16 sharpened, 9 wrong claims fixed.
-- **`onboarding/_TEMPLATE.md`** (one line per id) and **`onboarding/wger.md`** (the pilot; 11 open rows, each a register row).
-- **Gate `onboarding`** (`scripts/check-onboarding.py`, `--fast`: hook + CI). The 53 published apps are exempt by name.
-  16 decoys judged right; 5 deliberately broken versions of the gate each turned the decoy suite red.
-- **`onboarding/EXISTING-APPS-GAPS.md`** from `scripts/onboarding_gaps.py` (read only).
-- **The pilot:** the draft caught R-752 and R-755 as written; it missed R-737 (its "how" logged in on the web form only)
-  and R-738 for a NEW app (nothing to update at the newest tag). Rows 1.4/1.6 sharpened, 1.7/3.9 added — now all four.
-  The new rows then found three live wger defects: R-762, R-763, R-764. No template was changed.
-- Gates: `catalog_gates.py --fast` OK (11); `test_gate_decoys.py` 121 OK; `test_catalog_gates.py` OK;
-  `decoy_coverage_gate.py` 0 unaccounted.
+- **wger hidden** (`lifecycle: hidden`, `55b8c8a`) until R-762 and R-763 are fixed; read back on 9202: not on the app list.
+- **Published, each with a complete `onboarding/<app>.md` and its first proven ladder step (bench swap 0 + 9202):**
+  - **Radicale** (`195129c`) — CalDAV/CardDAV, upstream image; the login file is written on the FIRST start only
+    (R-765: rewritten at every start, a restore after a remove locked the household out — fixed before publishing).
+  - **Karakeep** (`882ac14`) — bookmarks + crawler (Chrome) + search; AI off unless the household enters a key; setup gate,
+    sign-up closed twice; web memory raised to 1536M on measurements.
+  - **Dawarich** (`72247a3`) — location history, PostGIS 17; the seeded known login replaced by `after_install` behind the
+    install hold; `SECRET_KEY_BASE` a data_key.
+- **Grimmory not published:** a stranger's 5 wrong sign-ins lock every visitor out for 15 min (hard-coded, one address
+  behind the tunnel) — R-775, the operator's word. Its template waits in the evidence `wip/grimmory/`; its fixture
+  (`Grimmory`) is in `upgrade_fixtures_box.py`.
+- **Not built on the fit check:** Grimoire, MeTube, Pinchflat; Invidious and moonlight-web fit only.
+- Fixtures added: `Radicale`, `Karakeep`, `Dawarich`, `Grimmory`. Gates: `catalog_gates.py --fast` OK on every push; the
+  runtime volume gate CLEAN for each published app (bench).