v0.281.0: 'Done' asks the probe first; sign-up closed after the first admin (decision 47); R-713 code-bound values refused, ${NAME|base64}

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -1933,6 +1933,15 @@ that folder is never a dead end, and an install never runs into it silently (R-6
   owns, and opens a gate whose probe says done; the household's „Kész, beállítottam" (`POST /apps/<slug>/setup-gate/open`)
   opens one without a probe. Opening writes the record, then removes the file. A restore keeps the record; a kept-data
   load never gates. Code: `internal/stacks/setup_gate.go`, `internal/web/setup_gate.go`.
+  **v0.281.0:** the household's press asks the probe first and refuses while it says "not done" or cannot be read; an
+  app without a probe confirms in the page first.
+- **Sign-up closed after the first admin (v0.281.0, decision 47)** — `.felhom.yml` `signup_block:` (traefik matcher).
+  When the gate opens, `signup-block-<app>.yml` goes up first (replacePath → `/__felhom_gate/signup-closed`, the
+  controller's refusal page / 403 JSON), then the gate comes down. The app page's sign-up card shows
+  `app_info.add_people` and „Regisztráció megnyitása 15 percre" (`POST /apps/<slug>/signup-window`, 15 min; the loop
+  restores the block). Never on an app this box did not gate. Code: `internal/stacks/signup_block.go`.
+- **R-713 (v0.281.0).** `after_install` refuses a code-bound value holding a quote, backslash, `$`, `{`, `}`, backtick
+  or line break; `${NAME|base64}` passes any value safely.
 - **R-709 (v0.280.0).** An installed app's `type: password` value is not in its settings page; the eye fetches it.
 - **`generate: password:N:special` (v0.280.0)** — a lower, an upper, a digit and one of `-_.!@#%+=` (calibre-web's policy).
 - **R-704 (v0.278.0).** A new install (plain or "use my kept data") drops an update or crash-loop hold left by an EARLIER