wanderer: first step says anyone can make an account (decision 47; not gated, R-714)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

FIRST-ADMIN.md

@@ -81,7 +81,7 @@ asks the probe first where there is one. Open sign-up is closed by the box after
 | **uptime-kuma** | 4 | first visitor creates admin (socket.io `setup`) | **setup gate**, no HTTP probe → the household's „Kész, beállítottam" | **GATED** — catalog, 2026-09-29 | **M 9202**: gate held across a controller restart; the press opened it (second press 409). The proof pressed WITHOUT doing the socket.io setup — the press trusts the household |
 | vaultwarden | 1 | `ADMIN_TOKEN` generated; invite-only (R-512) | – | fine | R |
 | **vikunja** | 4 | open registration | **setup gate**, opened by the household's press („Kész, beállítottam", confirm first); sign-up closed by the box after the setup: `/api/v1/register` | **GATED** — catalog, 2026-09-29 (decisions 46–47) | **M 9202**: stranger → gate page / 401; household reached the first-setup screen; gate opened after the setup; the app answered after (`felhom.eu/documentation/audits/gate-rollout-2026-09-29/`) |
-| wanderer | 4 | `PUBLIC_DISABLE_SIGNUP=false` | NOT gated: its web part calls its own database host through the public name, which a gate would refuse (the household could not finish the setup); open sign-up (`PUBLIC_DISABLE_SIGNUP=false`) and PocketBase's own first-run screen on the second host — R-714 | open — **needs a design** | R; measured the call on 9202 |
+| wanderer | 4 | `PUBLIC_DISABLE_SIGNUP=false` | NOT gated: its web part calls its own database host through the public name, which a gate would refuse (the household could not finish the setup); open sign-up (`PUBLIC_DISABLE_SIGNUP=false`) and PocketBase's own first-run screen on the second host — R-714 | open — **needs a design**; its first step says plainly that anyone who finds the address can make an account (decision 47) | R; measured the call on 9202 |
 | **wger** | 3 | `admin / adminadmin` | (b) Django `set_password`, password as `sys.argv[1]` | **FIXED** — catalog, 2026-09-29; + R-712 (a browser's https Origin was refused by CSRF) | **M 9202**: fresh install — default refused, generated signs in (302), wrong refused, with the browser's https Origin |
 | **wishlist** | 4 | first sign-up is admin | **setup gate**, opened by the household's press („Kész, beállítottam", confirm first); sign-up closed by the box after the setup: `/signup` | **GATED** — catalog, 2026-09-29 (decisions 46–47) | **M 9202**: stranger → gate page / 401; household reached the first-setup screen; gate opened after the setup; the app answered after (`felhom.eu/documentation/audits/gate-rollout-2026-09-29/`) |
 | **zipline** | 4 | v4 sets up on first run; the stale `admin / zipline` note is **removed** (2026-09-29) | **setup gate**, opened by probe `/api/server/public` → `firstSetup` = false; the app itself refuses a stranger's second first-admin / sign-up call | **GATED** — catalog, 2026-09-29 (decisions 46–47) | **M 9202**: stranger → gate page / 401; household reached the first-setup screen; gate opened after the setup; the app answered after (`felhom.eu/documentation/audits/gate-rollout-2026-09-29/`) |

scripts/copy_freeze/hu.json

@@ -1079,7 +1079,7 @@
   },
   "wanderer": {
    "app_info.first_steps[0]": "Nyisd meg a hike.DOMAIN címet a böngészőben",
-   "app_info.first_steps[1]": "Hozd létre a fiókodat",
+   "app_info.first_steps[1]": "Hozd létre a fiókodat azonnal a telepítés után. Figyelem: ebben az alkalmazásban bárki, aki megtalálja a címet, fiókot hozhat létre.",
    "app_info.first_steps[2]": "Importálj egy GPX fájlt vagy tervezz új útvonalat",
    "app_info.first_steps[3]": "Fedezd fel a térképes megjelenítést",
    "app_info.tagline": "Túra tervező - útvonalak, GPX nyomok és domborzati térképek",

templates/wanderer/.felhom.yml

@@ -69,11 +69,12 @@ app_info:
 
   first_steps:
     - 'Nyisd meg a hike.DOMAIN címet a böngészőben'
-    - 'Hozd létre a fiókodat'
+    - 'Hozd létre a fiókodat azonnal a telepítés után. Figyelem: ebben az alkalmazásban bárki, aki megtalálja a címet, fiókot hozhat létre.'
     - 'Importálj egy GPX fájlt vagy tervezz új útvonalat'
     - 'Fedezd fel a térképes megjelenítést'
 
 
+# `09` §3 decision 47: wanderer cannot close sign-up or be gated yet (R-714) — the first step says so plainly.
 # --- Controller-side health probe ---
 healthcheck:
   checks:
@@ -96,7 +97,7 @@ i18n:
         - 'Share a route with other people'
       first_steps:
         - 'Open hike.DOMAIN in your browser'
-        - 'Create your account'
+        - 'Create your account right after the install. Note: in this app, anyone who finds the address can make an account.'
         - 'Import a GPX file, or plan a new route'
         - 'Have a look at the map view'
     deploy_fields: