app-catalog-felhom.eu/REPORT.md

REPORT — the first new apps through the checklist (2026-10-01, night)

Full session report: felhom.eu/REPORT-new-apps-2026-10-01.md; evidence felhom.eu/documentation/audits/new-apps-2026-10-01/ (fit table FIT.md).

• wger hidden (lifecycle: hidden, 55b8c8a) until R-762 and R-763 are fixed; read back on 9202: not on the app list.
• Published, each with a complete onboarding/<app>.md and its first proven ladder step (bench swap 0 + 9202):
  • Radicale (195129c) — CalDAV/CardDAV, upstream image; the login file is written on the FIRST start only (R-765: rewritten at every start, a restore after a remove locked the household out — fixed before publishing).
  • Karakeep (882ac14) — bookmarks + crawler (Chrome) + search; AI off unless the household enters a key; setup gate, sign-up closed twice; web memory raised to 1536M on measurements.
  • Dawarich (72247a3) — location history, PostGIS 17; the seeded known login replaced by after_install behind the install hold; SECRET_KEY_BASE a data_key.
• Grimmory not published: a stranger's 5 wrong sign-ins lock every visitor out for 15 min (hard-coded, one address behind the tunnel) — R-775, the operator's word. Its template waits in the evidence wip/grimmory/; its fixture (Grimmory) is in upgrade_fixtures_box.py.
• Not built on the fit check: Grimoire, MeTube, Pinchflat; Invidious and moonlight-web fit only.
• Fixtures added: Radicale, Karakeep, Dawarich, Grimmory. Gates: catalog_gates.py --fast OK on every push; the runtime volume gate CLEAN for each published app (bench).