# REPORT — v0.280.0: the setup gate (decision 46); "I changed it" (R-710); password fields off the page (R-709); a special-character generator (2026-09-29)

Architecture: `felhom.eu/documentation/architecture/09-update-architecture.md` §3 decisions 45–46, `01-topology-and-trust.md`
§5. Evidence: `felhom.eu/documentation/audits/login-gate-2026-09-29/`. Session report: `felhom.eu/REPORT-login-gate-2026-09-29.md`.

- **Built only after the spike passed** (`B/B-VERDICT.md`). `setup_gate: true` → a fresh install writes
  `<stacks>/traefik/dynamic/setup-gate-<app>.yml` BEFORE the first start (forwardAuth on every router the app's labels
  publish, priority 100000 + rule length); the answerer (`/__felhom_gate/auth`, before the host check) lets through only
  a host-bound gate cookie, minted after a valid dashboard session on `felhom.<domain>/__gate/start` (60 s one-use token).
  The loop (20 s) opens a gate when `setup_done_probe:` flips; „Kész, beállítottam" opens one without a probe.
- **Tests:** stacks `TestSetupGate_*` (9), `TestGenerateValue_PasswordWithASpecialCharacter`; web `TestSetupGate_*` (4),
  `TestSetupGatePage_*`, `TestKnownLogin_*`, `TestR709_*`. `go build`, `go vet`, `go test ./...` green; controller gates
  green; parity fixtures: 4 new cases, 6 deploy fixtures regenerated (diff = the R-709 lines and the generator only).
- **Red-proofs RP1–RP16**, each seen failing on an assertion (`C/redproofs/`).
- **Live on 9202** (drill catalog): immich, n8n, audiobookshelf (probe), uptime-kuma (button) — 0 app answers to a
  stranger before each gate opened; the household in 0.2 s; a restart kept a closed gate and the household's pass;
  immich's phone-app API unchanged after. mealie, wger, calibre-web: default refused, generated signs in.
  R-709: the revealed value is not in the settings page. **Delivered:** floor 0.280.0; demo-hp and demo-felhom run it;
  demo-hp's "I changed it" pressed on bookstack and calibre-web (the operator's ruling).
- **Not live:** a restore of a gated app (test only; R-648 forbids the whole-box backup a drill would need).
- MinAgent 0.131.0 (unchanged).