v0.282.0: after_setup (the app's own sign-up switch), close sign-up now (decision 49), probes read lists + done_status (R-715)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,25 @@
+## v0.282.0 — the app's own sign-up switch after the setup (after_setup); "close sign-up now" (decision 49); probes read lists and a "done" status (R-715) (2026-09-29 evening)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `app_info.close_signup_text`,
+`app_info.close_signup_btn`, `app_info.signup_native_failed`, `app_info.signup_window_restart`,
+`err.setup_gate.close_signup_not_offered` (hu + en). Evidence: `felhom.eu/documentation/audits/signup-lock-2026-09-29/`.
+
+- **`after_setup:`** (`.felhom.yml`): `env: {SIGNUP_CLOSED: "true"}` (or a command, with after_install's argv-safe
+  rules). Run once when the gate opens — after the address block is up — merged into the app's env and ONE
+  `compose up -d`. Measured: 9 of the 11 apps with a block have their own switch, all read from the environment; 6 of
+  them refuse even the household's first admin while it is on, so it goes on AFTER the setup. Two locks now: the app's
+  own switch and the address block. An installed version whose compose does not read the variable is reported, never
+  recorded as locked. The household's 15-minute window lifts both (one restart) and the loop closes both again (one
+  more). A failed switch retries at most every 30 minutes; the page says so; the block holds.
+- **"Close sign-up now" (decision 49):** an installed app whose template has a lock and whose install has none (an
+  app installed before decision 47) shows one sentence and one press (`POST /apps/<slug>/close-signup`). It writes a
+  lock record (`opened_by: close-signup` — never a closed gate), the address block, then the app's own switch.
+  Offered once. The box never applies it by itself.
+- **R-715:** a probe's `field` may index a list (`setup.0.status`, `0.done`); `done_status:` counts a fixed non-200
+  answer as done (gramps-web's 405); any other non-200 stays "cannot read" (fail closed).
+- Tests: `TestAfterSetup_*`, `TestCloseSignup_*`, `TestCloseSignupPage_*`, `TestProbe_ListIndexesAndADoneStatus`.
+  Red-proofs RP25–RP30, each seen failing on an assertion.
+
 ## v0.281.0 — "Done" asks the app first; open sign-up closed once the first admin exists; a password is never read as code (2026-09-29)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `signup_closed.page_title`,