diff --git a/CONTEXT.md b/CONTEXT.md
index ba27d759..f01f5452 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -16,6 +16,14 @@
> and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
+> **2026-09-29 afternoon — operator ruling decision 47 (R-711 option A) + one CC-unattended decision (operator may
+> reverse):** sign-up is closed by a box-side block of the app's own sign-up address once the gate opens, with a
+> household 15-minute window (`internal/stacks/signup_block.go`, `.felhom.yml` `signup_block:` + `app_info.add_people`)
+> — per-app switches were measured unusable. Controller **v0.281.0** (the press asks the probe first; sign-up block;
+> R-713 `${NAME|base64}`), floor 0.281.0. Catalog `6faf432`: 32 of 34 class-4 apps gated (9 by probe), 11 sign-up
+> blocks, claper base64. Not gated: wanderer (R-714). Open: R-715 (probe shapes), R-716 (installed apps keep open
+> sign-up — operator). Report: `REPORT-gate-rollout-2026-09-29.md`.
+
> **2026-09-29 — operator rulings:** (1) CC changed the admin passwords of demo-hp's installed bookstack and calibre-web
> (stored in the operator's credentials file as `DEMO_HP_BOOKSTACK_*` / `DEMO_HP_CALIBRE_*`, values never in a repo);
> (2) decision 46 — the setup gate is SPIKED first. **The spike PASSED** (`audits/login-gate-2026-09-29/B/B-VERDICT.md`);
diff --git a/REPORT-gate-rollout-2026-09-29.md b/REPORT-gate-rollout-2026-09-29.md
new file mode 100644
index 00000000..dfcd1712
--- /dev/null
+++ b/REPORT-gate-rollout-2026-09-29.md
@@ -0,0 +1,90 @@
+# REPORT — 2026-09-29 afternoon: the setup gate on the other 30 apps; "Done" asks the app first; open sign-up closed after the first admin; claper's password never in code
+
+Architecture read first: `09` §3 decisions 45–47, `01-topology-and-trust.md` §5, `audits/login-gate-2026-09-29/B/B-VERDICT.md`,
+`app-catalog-felhom.eu/FIRST-ADMIN.md`, rows R-707, R-711, R-713. Controller **v0.281.0** (one release). Floor 0.281.0;
+both demo boxes run it. Catalog `6faf432`. Evidence: `documentation/audits/gate-rollout-2026-09-29/`
+(0 = Part 0, A, B = per-app, C = sign-up, D = claper, redproofs).
+
+## The Parts
+
+| Part | Step | State | Note |
+|---|---|---|---|
+| — | decision 47 recorded first | done | `09` §3 + `01` §5 before any work |
+| 0 | installed app never gated by a catalog change | done — **holds** | 9202: vikunja installed ungated and set up, then the drill catalog added `setup_gate: true`, synced, two loop ticks, a controller restart: still answered strangers, no gate file, no record (`0/P0-1`, `P0-2`). Code: the gate is set only in `DeployStack`. Pinned by `TestSignupBlock_NeverOnAnAppThisBoxDidNotGate` (RP23). After the live push, the demo boxes' installed class-4 apps (adventurelog, docmost, opengist, romm; opengist) got no gate and no block (`0/P0-3`) |
+| A1 | "Done" asks the probe first | done | refuses while the app says not done and when it cannot be read (409 + the sentence). Live: zipline pressed before its setup → 409, twice (`A/`, `B/B2-zipline-probe-before.txt`) |
+| A2 | confirm for an app without a probe | done | in-page `felhomConfirm` with the sentence (native confirm is banned by a gate) |
+| A3 | tests + red-proofs | done | RP17, RP18 |
+| B | the gate on the other 30 | done — **28 gated (25 fully proven, 3 opening not provable here), 2 not gated** | per-app table below |
+| C1 | spike: how sign-up can be closed | done, **mechanism changed** | opengist, wishlist: only in their own admin settings; vikunja: an env, but then no way to add a user but its CLI. Chosen: a box-side block of the app's own sign-up address + a household 15-minute window (CC-unattended decision, `09` §3 decision 47) |
+| C2 | per app | done | 11 apps let a stranger sign up after the setup → blocked and refused; 11 more refuse by themselves; window proven (gitea, calcom, vikunja) and closes again (gitea, calcom) |
+| C3 | apps that cannot close sign-up | **1: wanderer** | not gated at all (R-714) — STATUS asks |
+| D | R-713 | done | code-bound values refused; `${NAME|base64}`; claper proven live with a typed password holding `"` and `#{` (default refused, typed signs in). RP24 |
+
+**Recommendation not followed, one line why (standing rule 4):** the ruling says "only the admin adds people, from the
+app's own user page"; for apps with no such page (opengist, vikunja, termix, sparkyfitness, adventurelog) the page
+says to open sign-up for 15 minutes instead — the only way a family member can join those apps at all.
+
+### Part B / C — one row per app (9202, controller 0.281.0, drill catalog)
+
+| app | gate proven (stranger refused · household reached setup · opened · answered after) | opened by | sign-up after the setup |
+|---|---|---|---|
+| actualbudget | yes | probe `data.bootstrapped` (M) | refused by the app |
+| komga | yes | probe `isClaimed` (M) | refused by the app |
+| jellyfin | yes | probe `StartupWizardCompleted` (M) | refused by the app |
+| romm | yes | probe `SYSTEM.SHOW_SETUP_WIZARD` (M) | refused by the app |
+| zipline | yes | probe `/api/server/public firstSetup` (M) | refused by the app (`userRegistration: false`) |
+| termix | yes | probe `setup_required` (M) | **was open → blocked** |
+| emby | yes | button | refused by the app |
+| navidrome | yes | button (no JSON status) | refused by the app |
+| ghost | yes | button (status is a list — R-715) | refused by the app |
+| home-assistant | yes | button (status is a list — R-715) | refused by the app |
+| gitea | yes | button | **was open → blocked** |
+| docmost | yes | button | no public sign-up |
+| calcom | yes | button | **was open (a stranger's account was created) → blocked** |
+| tandoor | yes | button | "Sign Up Closed" by the app |
+| gramps-web | yes | button (its status answers 405 — R-715) | answered 500 → blocked anyway |
+| adventurelog | yes | button | **was open → blocked** |
+| homebox | yes | button | **was open → blocked** |
+| papra | yes | button | **was open → blocked** |
+| sparkyfitness | yes | button | **was open → blocked** |
+| vikunja | yes | button | **was open → blocked**; window let a family member in |
+| opengist | yes | button | **was open → blocked** |
+| wishlist | yes | button | **was open → blocked** |
+| radarr, sonarr | yes | button | single user; their API key was public BEFORE the setup — the gate hides it |
+| recipe-importer | yes | button | our own app, open until a password is set — the confirm says so |
+| seerr | stranger refused, household reached setup | **opening not proven** (needs a media server) | not measured |
+| outline | stranger refused, household reached setup | **opening not proven** (needs e-mail / SSO) | not measured |
+| rallly | stranger refused, household reached setup | **opening not proven** (e-mail) | not measured |
+| wanderer | **not gated** | — | open (R-714) |
+| plant-it | not installable (`lifecycle: abandoned`); the template carries the gate | — | — |
+
+## Claims in the brief that turned out wrong (or right), named
+
+- **"A catalog change never gates an installed app"** — **right** (measured on 9202 and read on both demo boxes).
+- **"14 of the 34 have a probe"** — **wrong**: 9 have a probe that works (3 from the morning, 6 today); 3 more have a
+ status the box cannot read (ghost, home-assistant — lists; gramps-web — 405, R-715); zipline's upstream route was
+ wrong (`/api/setup` answers 403 after the setup; `/api/server/public` works).
+- **"The first admin is the first registered user on opengist and wishlist"** — **right** (measured: the household's
+ sign-up became the admin; after it, a stranger could still sign up).
+- **"Each app in R-711's list can close sign-up"** — **wrong** as a per-app switch: opengist and wishlist keep it only
+ in their admin settings, vikunja only as a start-up env; and wanderer cannot be closed at all today. The box-side
+ block closes all but wanderer.
+- **"An env switch needs a restart"** — **right** for vikunja (read at start); not used — the block needs no restart.
+- **"Register 346 rows"** — was **350** at the start of this session (the morning session ended at 350).
+
+## Also found
+
+- A probe that never flips blocks the household's press (fail closed; measured on gramps-web) → R-715.
+- calcom created a stranger's account after the setup (measured) — closed.
+- Apps installed before today keep their open sign-up (demo boxes only) → R-716, needs an operator word.
+
+## Rows
+
+Closed: R-707, R-711, R-713. Opened: R-714 (wanderer), R-715 (probe shapes), R-716 (installed apps' sign-up, operator).
+**Register 350 → 353 rows.**
+
+## Teardown
+
+Machines: 9202 — every test app removed through the product (the scratch drive keeps some app folders, R-442's
+refusal as before); no gate or block file left; back on the live catalog; the drill catalog reset to live `main`.
+Demo boxes — read only (plus the floor). Host: nothing. Hub: floor 0.281.0. ep0: untouched.
diff --git a/STATUS.md b/STATUS.md
index a1c3fb2c..7aa4ec60 100644
--- a/STATUS.md
+++ b/STATUS.md
@@ -1,26 +1,25 @@
# STATUS — what works, what's broken, what's next
-**Updated 2026-09-29 morning. Both demo boxes run controller 0.280.0 and host agent 0.137.0. Hub 0.125.0. New installs get golden 0.276.0 with agent 0.137.0.**
+**Updated 2026-09-29 afternoon. Both demo boxes run controller 0.281.0 and host agent 0.137.0. Hub 0.125.0. New installs get golden 0.276.0 with agent 0.137.0.**
-**Decisions today** (yours, recorded): I changed the HP box's two demo passwords. The "gate" was tested first, and built only because the test passed.
+**Decisions today.** Yours: after an app's first admin exists, strangers can no longer sign up. Mine (you may reverse it): most apps have no switch the box can flip to close sign-up. So the box blocks just the app's sign-up address after the setup. The household can open it for 15 minutes from the app page, so a family member can join.
**What I did, and it worked.**
-- **The HP box's bookstack and calibre-web have new admin passwords.** They are in your credentials file, under names starting `DEMO_HP_`. The old shared passwords no longer work. Their pages no longer warn.
-- **The gate test passed.** A new app whose first visitor would become its admin is now closed to strangers until you set it up. A stranger sees a page that says "This app is waiting for its first setup. Sign in to the Felhom dashboard." You, signed in to the dashboard, go straight in. It adds about 2 ms.
-- **The gate opens by itself** when the app says it has an admin (immich, n8n, audiobookshelf: within 30 seconds of the setup). For an app that cannot say it, you press "Kész, beállítottam" on the app page (uptime-kuma).
-- **After it opens, nothing of it is left.** immich's phone-app login worked unchanged.
-- **Every app that started with a known password now gets its own random one**: mealie, wger and calibre-web joined claper and bookstack.
-- **Small fixes:** wger's login did not work from any browser (fixed). romm and zipline no longer show a login that does not exist. grafana refuses to start without its password. Installed apps' passwords are no longer inside the settings page's code; the eye button fetches them.
-- **New button on the app page:** "Megváltoztattam" / "I changed it", under a known default login.
+- **The gate is on 32 of the 34 apps where the first visitor would become the admin.** On a new install a stranger gets only the gate page. You, signed in to the dashboard, go straight to the setup. I tested every one on the scratch box.
+- **9 apps open the gate by themselves** when their setup is done. The rest open with the "Done" button.
+- **The "Done" button now asks the app first.** If the app says "not done", the button refuses. I tested it on zipline before its setup.
+- **Strangers can no longer sign up after the setup.** 11 apps let anyone make an account; the box now blocks that. 11 more refuse strangers by themselves. The 15-minute window works and closes again by itself.
+- **claper's password step is safe** for passwords with unusual characters. I tested one with a quote mark in it.
+- **Apps already installed were not closed.** I checked this first, and again on both demo boxes after the update.
**What is not done.**
-- **30 apps still let the first visitor create the admin.** Each needs the gate switched on and tested. That is the next sessions' work, as you chose.
-- **About a dozen apps still allow open sign-up after the setup.** The gate does not change that. Written down.
-- **I did not test a restore of a gated app live.** It needs a whole-box backup, which test runs must not do. The code keeps the gate's state through a restore, and a test checks it.
+- **wanderer is not closed.** Its web part calls its own database through the public address, and a gate would block that call. So a stranger can still create its admin and sign up. It needs a small design change.
+- **seerr, outline and rallly** are closed to strangers. I could not test the opening, because it needs a media server or e-mail.
+- **3 apps have a "setup done" signal the box cannot read yet** (ghost, home-assistant, gramps-web). They use the button for now.
-**Costs you should know** (no decision needed): while an app is still closed, its phone app cannot reach it, and it stops answering if the controller is down. "Kész, beállítottam" trusts you: pressed too early, the app opens before you set it up.
-
-**Rows.** 4 opened, 4 closed. The list went from 346 to 350 rows.
+**Rows.** 3 opened, 3 closed, plus 1 for you. The list went from 350 to 353 rows.
**What needs you.**
-1. **D4, the image copies, the Peti leftovers:** unchanged. If you do nothing, nothing changes.
+1. **wanderer:** (A) keep it in the catalog until I fix it; its page now says plainly that anyone who finds the address can make an account (I recommend A; the fix is small). (B) Hide it from new installs until fixed. If you do nothing: A.
+2. **Apps installed before today on the demo boxes** (adventurelog, opengist) still allow open sign-up. (A) Add a one-time "close sign-up now" button for installed apps. (B) Leave them; only the demo boxes have such installs. If you do nothing: B.
+3. **D4, the image copies, the Peti leftovers:** unchanged. If you do nothing, nothing changes.
diff --git a/documentation/architecture/01-topology-and-trust.md b/documentation/architecture/01-topology-and-trust.md
index 4edb34e3..752c225f 100644
--- a/documentation/architecture/01-topology-and-trust.md
+++ b/documentation/architecture/01-topology-and-trust.md
@@ -136,7 +136,9 @@ the dashboard's own `/__gate/start`). The controller is in an app's request path
open, the gate's traefik router is removed and the app is reached exactly as without it. The gate decides who creates
the first admin. **Who may sign up afterwards** is `09` §3 decision 47 (operator ruling 2026-09-29): once the first admin
exists, open sign-up is closed; only the admin adds people, from the app's own user page. An app that cannot close it
-says so on its page.
+says so on its page. Mechanism (controller ≥ 0.281.0): the box keeps a small traefik router on the app's own sign-up
+address once the gate opens, answered "sign-up is closed" by the controller; the household opens it for 15 minutes
+from the app page to let a family member in. The controller is in THAT address's path only.
---
diff --git a/documentation/architecture/09-update-architecture.md b/documentation/architecture/09-update-architecture.md
index 32235643..c2298985 100644
--- a/documentation/architecture/09-update-architecture.md
+++ b/documentation/architecture/09-update-architecture.md
@@ -515,7 +515,18 @@ R-636's louder repeated alarm.
the household's first admin exists, a stranger can no longer make an account; only the admin adds people, from the
app's own user page, and the app page says how. Where an app cannot close sign-up, it stays in the catalog and its
page says plainly that anyone who finds the address can make an account; STATUS asks the operator about it.
- Mechanism and per-app proof: *(filled in by the 2026-09-29 afternoon session)*.
+ **Mechanism — decided by CC unattended 2026-09-29, operator may reverse.** *How does the box close sign-up in apps
+ that keep the switch only in their own admin settings?* Options: (a) per-app switches — an env read at start plus a
+ restart, or the app's admin API; (b) a box-side block of the app's own sign-up address once the gate opens, with a
+ household window to let a family member in. Costs: (a) measured impossible for most — opengist and wishlist keep
+ it only in their admin settings (no env, no CLI), vikunja has an env but then no way to add a user except its CLI;
+ (b) one more traefik router per app, and a family member joins through a 15-minute window instead of an in-app
+ invite. **Chose (b)**: it works the same for every app, needs no credentials and no restart, and leaves installed
+ apps untouched (only an app whose gate this box opened gets a block). Built in controller v0.281.0
+ (`internal/stacks/signup_block.go`): the block goes up before the gate comes down; a failed write keeps the gate
+ closed. **Proven on 9202:** 11 apps let a stranger sign up after the setup and refused it with the block; 11 more
+ refuse by themselves; the window let a family member in and closed again. wanderer cannot be gated yet (R-714).
+ Evidence `audits/gate-rollout-2026-09-29/`.
Same day, operator: CC changes the admin passwords of demo-hp's installed bookstack and calibre-web and stores them
in the operator's credentials file (not in any repo).
diff --git a/documentation/audits/gate-rollout-2026-09-29/0/P0-1-install-ungated.txt b/documentation/audits/gate-rollout-2026-09-29/0/P0-1-install-ungated.txt
new file mode 100644
index 00000000..57a361bd
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/0/P0-1-install-ungated.txt
@@ -0,0 +1,5 @@
+09:35:51 live catalog vikunja: setup_gate = None
+09:35:51 deploy -> 202
+09:35:57 state running | gate record None
+09:36:07 the household sets vikunja up (register the first user) -> 200
+09:36:07 stranger GET /api/v1/info -> 200 {"version":"v2.6.0","frontend_url":"https://p0-vik.enkisfelh
diff --git a/documentation/audits/gate-rollout-2026-09-29/0/P0-2-gate-added-after.txt b/documentation/audits/gate-rollout-2026-09-29/0/P0-2-gate-added-after.txt
new file mode 100644
index 00000000..10182325
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/0/P0-2-gate-added-after.txt
@@ -0,0 +1,4 @@
+09:36:46 drill catalog synced: vikunja setup_gate = True
+09:36:46 waiting 50 s = two ticks of the gate loop
+09:37:40 after the catalog added setup_gate: stranger API -> 200 '{"version":"v2.6.0","frontend_' | browser -> 200 gate page False | gate file absent | record None | gate card on the app page False
+09:38:23 after a controller restart: stranger API -> 200 '{"version":"v2.6.0","frontend_' | browser -> 200 gate page False | gate file absent | record None | gate card on the app page False
diff --git a/documentation/audits/gate-rollout-2026-09-29/0/P0-3-demo-boxes-after-push.txt b/documentation/audits/gate-rollout-2026-09-29/0/P0-3-demo-boxes-after-push.txt
new file mode 100644
index 00000000..b4735f34
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/0/P0-3-demo-boxes-after-push.txt
@@ -0,0 +1,14 @@
+# READ-ONLY, 2026-09-29 ~09:23Z, after catalog 6faf432 synced: installed class-4 apps on the demo boxes (controller 0.281.0) — no gate file, no block file, no gate record, no gate/sign-up card. Part 0 on real boxes.
+== hp 09:22:57
+dynamic: controller.yml serverstransports.yml
+adventurelog: synced template setup_gate=1 signup_block=1 | app.yaml gate record=0
+docmost: synced template setup_gate=1 signup_block=0 | app.yaml gate record=0
+opengist: synced template setup_gate=1 signup_block=1 | app.yaml gate record=0
+romm: synced template setup_gate=1 signup_block=0 | app.yaml gate record=0
+== felhom-pve 09:23:01
+dynamic: controller.yml serverstransports.yml
+opengist: synced template setup_gate=1 signup_block=1 | app.yaml gate record=0
+demo-hp adventurelog: state running | gate record None | gate card on page False | sign-up card False
+demo-hp docmost: state running | gate record None | gate card on page False | sign-up card False
+demo-hp opengist: state running | gate record None | gate card on page False | sign-up card False
+demo-hp romm: state running | gate record None | gate card on page False | sign-up card False
diff --git a/documentation/audits/gate-rollout-2026-09-29/A/A-live-press-before-setup.txt b/documentation/audits/gate-rollout-2026-09-29/A/A-live-press-before-setup.txt
new file mode 100644
index 00000000..5967d7c8
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/A/A-live-press-before-setup.txt
@@ -0,0 +1,3 @@
+10:19:24 zipline: catalog now carries its status check; the app still says firstSetup=true
+10:19:24 PART A LIVE: 'Done' pressed BEFORE the setup -> 409 {'data': None, 'error': 'Az alkalmazás szerint még nincs kész az első beállítás. Hozd létre a fiókodat, aztán próbáld újra.', 'ok': False}
+10:19:27 zipline files=[setup-gate-zipline.yml] record={'state': 'closed', 'since': '2026-09-29T08:15:56Z', 'hosts': ['r-zipline.enkisfelhom.hu']}
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B1-after.txt b/documentation/audits/gate-rollout-2026-09-29/B/B1-after.txt
new file mode 100644
index 00000000..6e805112
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B1-after.txt
@@ -0,0 +1,8 @@
+10:09:49 actualbudget AFTER, stranger browser -> 200 200 r-actualbudget.enkisfelhom.hu/ | gate page False | len 4256
+10:09:49 komga AFTER, stranger browser -> 200 200 r-komga.enkisfelhom.hu/ | gate page False | len 1236
+10:09:49 navidrome AFTER, stranger browser -> 200 302 r-navidrome.enkisfelhom.hu/ -> 200 r-navidrome.enkisfelhom.hu/app/ | gate page False | len 2848
+10:09:50 jellyfin AFTER, stranger browser -> 200 302 r-jellyfin.enkisfelhom.hu/ -> 200 r-jellyfin.enkisfelhom.hu/web/ | gate page False | len 5331
+10:09:50 emby AFTER, stranger browser -> 200 302 r-emby.enkisfelhom.hu/ -> 200 r-emby.enkisfelhom.hu/web/index.html | gate page False | len 14937
+10:09:50 ghost AFTER, stranger browser -> 200 200 r-ghost.enkisfelhom.hu/ | gate page False | len 17379
+10:09:50 home-assistant AFTER, stranger browser -> 200 assistant.enkisfelhom.hu/ -> 200 r-home-assistant.enkisfelhom.hu/onboarding.html | gate page False | len 3235
+10:09:50 romm AFTER, stranger browser -> 200 200 r-romm.enkisfelhom.hu/ | gate page False | len 5485
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B1-deploy.txt b/documentation/audits/gate-rollout-2026-09-29/B/B1-deploy.txt
new file mode 100644
index 00000000..8ab861d7
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B1-deploy.txt
@@ -0,0 +1,26 @@
+10:03:32 actualbudget deploy -> 202
+10:03:35 [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/komga']
+10:03:35 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
+10:03:36 komga deploy -> 202
+10:03:39 [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/navidrome']
+10:03:39 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
+10:03:39 navidrome deploy -> 202
+10:03:43 [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/jellyfin']
+10:03:43 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
+10:03:43 jellyfin deploy -> 202
+10:03:47 [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/emby']
+10:03:47 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
+10:03:47 emby deploy -> 202
+10:03:47 ghost deploy -> 202
+10:03:47 home-assistant deploy -> 202
+10:03:52 [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/romm']
+10:03:52 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
+10:03:52 romm deploy -> 202
+10:03:57 actualbudget state running | files=[setup-gate-actualbudget.yml] record={'state': 'closed', 'since': '2026-09-29T08:03:32Z', 'hosts': ['r-actualbudget.enkisfelhom.hu']}
+10:04:22 komga state running | files=[setup-gate-komga.yml] record={'state': 'closed', 'since': '2026-09-29T08:03:36Z', 'hosts': ['r-komga.enkisfelhom.hu']}
+10:04:26 navidrome state running | files=[setup-gate-navidrome.yml] record={'state': 'closed', 'since': '2026-09-29T08:03:39Z', 'hosts': ['r-navidrome.enkisfelhom.hu']}
+10:04:30 jellyfin state running | files=[setup-gate-jellyfin.yml] record={'state': 'closed', 'since': '2026-09-29T08:03:43Z', 'hosts': ['r-jellyfin.enkisfelhom.hu']}
+10:04:34 emby state running | files=[setup-gate-emby.yml] record={'state': 'closed', 'since': '2026-09-29T08:03:47Z', 'hosts': ['r-emby.enkisfelhom.hu']}
+10:06:18 ghost state running | files=[setup-gate-ghost.yml] record={'state': 'closed', 'since': '2026-09-29T08:03:47Z', 'hosts': ['r-ghost.enkisfelhom.hu']}
+10:06:21 home-assistant state running | files=[setup-gate-home-assistant.yml] record={'state': 'closed', 'since': '2026-09-29T08:03:47Z', 'hosts': ['r-home-assistant.enkisfelhom.hu']}
+10:06:24 romm state running | files=[setup-gate-romm.yml] record={'state': 'closed', 'since': '2026-09-29T08:03:52Z', 'hosts': ['r-romm.enkisfelhom.hu']}
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B1-household.txt b/documentation/audits/gate-rollout-2026-09-29/B/B1-household.txt
new file mode 100644
index 00000000..ead10b6f
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B1-household.txt
@@ -0,0 +1,8 @@
+10:06:32 actualbudget HOUSEHOLD -> 200 in 0.20s | > 302 r-actualbudget.enkisfelhom.hu/__felhom_gate/cb -> 200 r-actualbudget.enkisfelhom.hu/ | gate page False | app says 'Actual'
+10:06:33 komga HOUSEHOLD -> 200 in 0.56s | __gate/start -> 302 r-komga.enkisfelhom.hu/__felhom_gate/cb -> 200 r-komga.enkisfelhom.hu/ | gate page False | app says 'Komga'
+10:06:33 navidrome HOUSEHOLD -> 200 in 0.25s | __felhom_gate/cb -> 302 r-navidrome.enkisfelhom.hu/ -> 200 r-navidrome.enkisfelhom.hu/app/ | gate page False | app says 'Navidrome'
+10:06:33 jellyfin HOUSEHOLD -> 200 in 0.27s | u/__felhom_gate/cb -> 302 r-jellyfin.enkisfelhom.hu/ -> 200 r-jellyfin.enkisfelhom.hu/web/ | gate page False | app says 'Jellyfin'
+10:06:34 emby HOUSEHOLD -> 200 in 0.35s | u/ -> 302 r-emby.enkisfelhom.hu/web/index.html -> 200 r-emby.enkisfelhom.hu/web/index.html | gate page False | app says 'ac8466a1b4d5'
+10:06:34 ghost HOUSEHOLD -> 200 in 0.65s | __gate/start -> 302 r-ghost.enkisfelhom.hu/__felhom_gate/cb -> 200 r-ghost.enkisfelhom.hu/ | gate page False | app says 'Ghost'
+10:06:35 home-assistant HOUSEHOLD -> 200 in 0.25s | 02 r-home-assistant.enkisfelhom.hu/ -> 200 r-home-assistant.enkisfelhom.hu/onboarding.html | gate page False | app says 'Home Assistant'
+10:06:35 romm HOUSEHOLD -> 200 in 0.20s | u/__gate/start -> 302 r-romm.enkisfelhom.hu/__felhom_gate/cb -> 200 r-romm.enkisfelhom.hu/ | gate page False | app says 'RomM'
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B1-open-by-probe.txt b/documentation/audits/gate-rollout-2026-09-29/B/B1-open-by-probe.txt
new file mode 100644
index 00000000..b82c97be
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B1-open-by-probe.txt
@@ -0,0 +1,4 @@
+10:09:08 actualbudget gate OPENED by probe 5s after the sync | files=[] record={'state': 'open', 'since': '2026-09-29T08:03:32Z', 'hosts': ['r-actualbudget.enkisfelhom.hu'], 'opened_at': '2026-09-29T08:09:02Z', 'opened_by': 'probe'}
+10:09:11 jellyfin gate OPENED by probe 8s after the sync | files=[] record={'state': 'open', 'since': '2026-09-29T08:03:43Z', 'hosts': ['r-jellyfin.enkisfelhom.hu'], 'opened_at': '2026-09-29T08:09:02Z', 'opened_by': 'probe'}
+10:09:14 komga gate OPENED by probe 11s after the sync | files=[] record={'state': 'open', 'since': '2026-09-29T08:03:36Z', 'hosts': ['r-komga.enkisfelhom.hu'], 'opened_at': '2026-09-29T08:09:02Z', 'opened_by': 'probe'}
+10:09:17 romm gate OPENED by probe 14s after the sync | files=[] record={'state': 'open', 'since': '2026-09-29T08:03:52Z', 'hosts': ['r-romm.enkisfelhom.hu'], 'opened_at': '2026-09-29T08:09:02Z', 'opened_by': 'probe'}
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B1-press.txt b/documentation/audits/gate-rollout-2026-09-29/B/B1-press.txt
new file mode 100644
index 00000000..6e2b5ec9
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B1-press.txt
@@ -0,0 +1,8 @@
+10:09:28 emby PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:09:33 emby files=[] record={'state': 'open', 'since': '2026-09-29T08:03:47Z', 'hosts': ['r-emby.enkisfelhom.hu'], 'opened_at': '2026-09-29T08:09:28Z', 'opened_by': 'household'}
+10:09:34 navidrome PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:09:39 navidrome files=[] record={'state': 'open', 'since': '2026-09-29T08:03:39Z', 'hosts': ['r-navidrome.enkisfelhom.hu'], 'opened_at': '2026-09-29T08:09:34Z', 'opened_by': 'household'}
+10:09:39 ghost PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:09:44 ghost files=[] record={'state': 'open', 'since': '2026-09-29T08:03:47Z', 'hosts': ['r-ghost.enkisfelhom.hu'], 'opened_at': '2026-09-29T08:09:39Z', 'opened_by': 'household'}
+10:09:44 home-assistant PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:09:49 home-assistant files=[] record={'state': 'open', 'since': '2026-09-29T08:03:47Z', 'hosts': ['r-home-assistant.enkisfelhom.hu'], 'opened_at': '2026-09-29T08:09:44Z', 'opened_by': 'household'}
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B1-probe-after.txt b/documentation/audits/gate-rollout-2026-09-29/B/B1-probe-after.txt
new file mode 100644
index 00000000..ad3a5152
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B1-probe-after.txt
@@ -0,0 +1,7 @@
+10:07:58 actualbudget PROBE http://actualbudget:5006/account/needs-bootstrap -> {"status":"ok","data":{"bootstrapped":true,"loginMethod":"password","availableLoginMethods":[{"method":"password","active":1,"displayName":"Password"}],"multiuser":false}}
+10:08:01 komga PROBE http://komga:25600/api/v1/claim -> {"isClaimed":true}
+10:08:04 jellyfin PROBE http://jellyfin:8096/System/Info/Public -> {"LocalAddress":"http://172.18.0.12:8096","ServerName":"8ac2a93e4b5e","Version":"10.11.11","ProductName":"Jellyfin Server","OperatingSystem":"","Id":"05c9b4551b80435fbd2f3447eb66c88f","StartupWizardCompleted":true}
+10:08:07 emby PROBE http://emby:8096/emby/System/Info/Public -> {"LocalAddresses":[],"RemoteAddresses":[],"ServerName":"ac8466a1b4d5","Version":"4.11.0.3","Id":"b9ba6aa3b18240ff8dd530a4b7f64da6"}
+10:08:11 ghost PROBE http://ghost:2368/ghost/api/admin/authentication/setup/ -> {"setup":[{"status":true}]}
+10:08:14 home-assistant PROBE http://home-assistant:8123/api/onboarding -> [{"step":"user","done":true},{"step":"core_config","done":false},{"step":"analytics","done":false},{"step":"integration","done":false}]
+10:08:17 romm PROBE http://romm:8080/api/heartbeat -> {"SYSTEM":{"VERSION":"5.3.1","GIT_BRANCH":null,"SHOW_SETUP_WIZARD":true},"METADATA_SOURCES":{"ANY_SOURCE_ENABLED":true,"IGDB_API_ENABLED":false,"SS_API_ENABLED":false,"SS_DEV_CREDENTIALS_SET":true,"MOBY_API_ENABLED":false,"STEAMGRIDDB_API_ENABLED":false,"RA_API_ENABLED":false,"LAUNCHBOX_API_ENABLED":false,"HASHEOUS_API_ENABLED":false,"PLAYMATCH_API_ENABLED":false,"TGDB_API_ENABLED":false,"FLASHPOI
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B1-probe-before.txt b/documentation/audits/gate-rollout-2026-09-29/B/B1-probe-before.txt
new file mode 100644
index 00000000..70fb7b9f
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B1-probe-before.txt
@@ -0,0 +1,18 @@
+10:06:57 actualbudget PROBE http://actualbudget:5006/account/needs-bootstrap -> {"status":"ok","data":{"bootstrapped":false,"loginMethod":"password","availableLoginMethods":[],"multiuser":false}}
+10:07:00 komga PROBE http://komga:25600/api/v1/claim -> {"isClaimed":false}
+10:07:04 navidrome PROBE http://navidrome:4533/app/ ->
+
+
+
+
+
+
+ {"LocalAddress":"http://172.18.0.12:8096","ServerName":"8ac2a93e4b5e","Version":"10.11.11","ProductName":"Jellyfin Server","OperatingSystem":"","Id":"05c9b4551b80435fbd2f3447eb66c88f","StartupWizardCompleted":false}
+10:07:10 emby PROBE http://emby:8096/emby/System/Info/Public -> {"LocalAddresses":[],"RemoteAddresses":[],"ServerName":"ac8466a1b4d5","Version":"4.11.0.3","Id":"b9ba6aa3b18240ff8dd530a4b7f64da6"}
+10:07:14 ghost PROBE http://ghost:2368/ghost/api/admin/authentication/setup/ -> {"setup":[{"status":false}]}
+10:07:17 home-assistant PROBE http://home-assistant:8123/api/onboarding -> [{"step":"user","done":false},{"step":"core_config","done":false},{"step":"analytics","done":false},{"step":"integration","done":false}]
+10:07:20 romm PROBE http://romm:8080/api/heartbeat -> {"SYSTEM":{"VERSION":"5.3.1","GIT_BRANCH":null,"SHOW_SETUP_WIZARD":true},"METADATA_SOURCES":{"ANY_SOURCE_ENABLED":true,"IGDB_API_ENABLED":false,"SS_API_ENABLED":false,"SS_DEV_CREDENTIALS_SET":true,"MOBY_API_ENABLED":false,"STEAMGRIDDB_API_ENABLED":false,"RA_API_ENABLED":false,"LAUNCHBOX_API_ENABLED":false,"HASHEOUS_API_ENABLED":false,"PLAYMATCH_API_ENABLED":false,"TGDB_API_ENABLED":false,"FLASHPOI
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B1-setup.txt b/documentation/audits/gate-rollout-2026-09-29/B/B1-setup.txt
new file mode 100644
index 00000000..ed57daf1
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B1-setup.txt
@@ -0,0 +1,9 @@
+10:07:51 actualbudget HOUSEHOLD SETUP through the gate -> 200 {"status":"ok","data":{"token":""}}
+10:07:52 komga HOUSEHOLD SETUP through the gate -> 200 {"id":"0RRVKEAXSX4E9","email":"family@spike.hu","roles":["ADMIN","FILE_DOWNLOAD","KOBO_SYNC","KOREADER_SYNC","PAGE_STREA
+10:07:53 jellyfin HOUSEHOLD SETUP through the gate -> 204 steps [204, 200, 204, 204]
+10:07:53 emby HOUSEHOLD SETUP through the gate -> 204 steps [204, 200, 204]
+10:07:53 navidrome HOUSEHOLD SETUP through the gate -> 200 {"id":"3RisVGNCdqxjjWlZfeIzHz","isAdmin":true,"name":"Family","subsonicSalt":"","subsonicToken":""
+10:07:54 ghost HOUSEHOLD SETUP through the gate -> 201 {"users":[{"id":"6abb716794aafd0001b8c3af","name":"Family","slug":"family","email":"family@spike.hu","profile_image":nul
+10:07:54 home-assistant HOUSEHOLD SETUP through the gate -> 200 {"auth_code":""}
+10:07:54 romm HOUSEHOLD SETUP through the gate -> 403 CSRF token verification failed
+10:08:30 romm HOUSEHOLD SETUP through the gate -> 201 {"id":1,"username":"family","email":"family@spike.hu","enabled":true,"role":"admin","permission_group_id":null,"oauth_sc
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B1-stranger-signup-after.txt b/documentation/audits/gate-rollout-2026-09-29/B/B1-stranger-signup-after.txt
new file mode 100644
index 00000000..fef49ab0
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B1-stranger-signup-after.txt
@@ -0,0 +1,8 @@
+10:10:08 actualbudget STRANGER retries POST /account/bootstrap after the setup -> 400 '{"status":"error","reason":"already-bootstrapped"}'
+10:10:08 komga STRANGER retries POST /api/v1/claim after the setup -> 400 '{"timestamp":"2026-09-29T08:10:08.765+00:00","status":400,"error":"Bad'
+10:10:08 jellyfin STRANGER retries POST /Startup/User after the setup -> 401 ''
+10:10:08 emby STRANGER retries POST /emby/Startup/User after the setup -> 401 'Access token is invalid or expired.'
+10:10:08 navidrome STRANGER retries POST /auth/createAdmin after the setup -> 403 '{"error":"Cannot create another first admin"}'
+10:10:08 ghost STRANGER retries POST /ghost/api/admin/authentication/setup/ after the setup -> 403 '{"errors":[{"message":"Setup has already been completed.","context":nu'
+10:10:09 home-assistant STRANGER retries POST /api/onboarding/users after the setup -> 403 '{"message":"User step already done"}'
+10:10:09 romm STRANGER retries POST /api/users after the setup -> 403 '{"detail":"Forbidden"}'
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B1-stranger.txt b/documentation/audits/gate-rollout-2026-09-29/B/B1-stranger.txt
new file mode 100644
index 00000000..10d57d6a
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B1-stranger.txt
@@ -0,0 +1,8 @@
+10:06:31 actualbudget STRANGER browser -> 200 302 r-actualbudget.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:06:31 komga STRANGER browser -> 200 302 r-komga.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:06:31 navidrome STRANGER browser -> 200 302 r-navidrome.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:06:31 jellyfin STRANGER browser -> 200 302 r-jellyfin.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:06:31 emby STRANGER browser -> 200 302 r-emby.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:06:31 ghost STRANGER browser -> 200 302 r-ghost.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:06:31 home-assistant STRANGER browser -> 200 302 r-home-assistant.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:06:32 romm STRANGER browser -> 200 302 r-romm.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B2-after.txt b/documentation/audits/gate-rollout-2026-09-29/B/B2-after.txt
new file mode 100644
index 00000000..b8c502f0
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B2-after.txt
@@ -0,0 +1,5 @@
+10:21:50 zipline AFTER, stranger browser -> 200 301 r-zipline.enkisfelhom.hu/ -> 200 r-zipline.enkisfelhom.hu/dashboard | gate page False | len 6405
+10:21:50 gitea AFTER, stranger browser -> 200 200 r-gitea.enkisfelhom.hu/ | gate page False | len 14539
+10:21:50 docmost AFTER, stranger browser -> 200 200 r-docmost.enkisfelhom.hu/ | gate page False | len 2644
+10:21:50 calcom AFTER, stranger browser -> 200 307 r-calcom.enkisfelhom.hu/ -> 200 r-calcom.enkisfelhom.hu/auth/login | gate page False | len 343294
+10:21:50 tandoor AFTER, stranger browser -> 200 302 r-tandoor.enkisfelhom.hu/ -> 200 r-tandoor.enkisfelhom.hu/accounts/login/ | gate page False | len 5063
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B2-deploy.txt b/documentation/audits/gate-rollout-2026-09-29/B/B2-deploy.txt
new file mode 100644
index 00000000..133ec795
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B2-deploy.txt
@@ -0,0 +1,16 @@
+10:15:56 zipline deploy -> 202
+10:15:56 gitea deploy -> 202
+10:15:56 seerr deploy -> 202
+10:15:56 tandoor deploy -> 202
+10:15:57 calcom deploy -> 202
+10:15:57 docmost deploy -> 202
+10:15:57 outline deploy -> 202
+10:15:57 rallly deploy -> 202
+10:17:47 zipline state running | files=[setup-gate-zipline.yml] record={'state': 'closed', 'since': '2026-09-29T08:15:56Z', 'hosts': ['r-zipline.enkisfelhom.hu']}
+10:17:50 gitea state running | files=[setup-gate-gitea.yml] record={'state': 'closed', 'since': '2026-09-29T08:15:56Z', 'hosts': ['r-gitea.enkisfelhom.hu']}
+10:17:58 seerr state running | files=[setup-gate-seerr.yml] record={'state': 'closed', 'since': '2026-09-29T08:15:56Z', 'hosts': ['r-seerr.enkisfelhom.hu']}
+10:18:01 tandoor state running | files=[setup-gate-tandoor.yml] record={'state': 'closed', 'since': '2026-09-29T08:15:56Z', 'hosts': ['r-tandoor.enkisfelhom.hu']}
+10:18:04 calcom state running | files=[setup-gate-calcom.yml] record={'state': 'closed', 'since': '2026-09-29T08:15:56Z', 'hosts': ['r-calcom.enkisfelhom.hu']}
+10:18:07 docmost state running | files=[setup-gate-docmost.yml] record={'state': 'closed', 'since': '2026-09-29T08:15:57Z', 'hosts': ['r-docmost.enkisfelhom.hu']}
+10:18:10 outline state running | files=[setup-gate-outline.yml] record={'state': 'closed', 'since': '2026-09-29T08:15:57Z', 'hosts': ['r-outline.enkisfelhom.hu']}
+10:18:13 rallly state running | files=[setup-gate-rallly.yml] record={'state': 'closed', 'since': '2026-09-29T08:15:57Z', 'hosts': ['r-rallly.enkisfelhom.hu']}
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B2-household.txt b/documentation/audits/gate-rollout-2026-09-29/B/B2-household.txt
new file mode 100644
index 00000000..c54b37f0
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B2-household.txt
@@ -0,0 +1,8 @@
+10:18:22 zipline HOUSEHOLD -> 200 in 0.25s | _felhom_gate/cb -> 301 r-zipline.enkisfelhom.hu/ -> 200 r-zipline.enkisfelhom.hu/dashboard | gate page False | app says 'Zipline'
+10:18:22 gitea HOUSEHOLD -> 200 in 0.24s | __gate/start -> 302 r-gitea.enkisfelhom.hu/__felhom_gate/cb -> 200 r-gitea.enkisfelhom.hu/ | gate page False | app says 'Installation - Gitea: Git with a cup of '
+10:18:23 seerr HOUSEHOLD -> 200 in 1.25s | hom.hu/__felhom_gate/cb -> 307 r-seerr.enkisfelhom.hu/ -> 200 r-seerr.enkisfelhom.hu/setup | gate page False | app says 'Setup - Jellyseerr'
+10:18:24 tandoor HOUSEHOLD -> 200 in 0.41s | u/__felhom_gate/cb -> 302 r-tandoor.enkisfelhom.hu/ -> 200 r-tandoor.enkisfelhom.hu/setup/ | gate page False | app says 'Cookbook Setup'
+10:18:25 calcom HOUSEHOLD -> 200 in 1.53s | /login -> 307 r-calcom.enkisfelhom.hu/auth/setup -> 200 r-calcom.enkisfelhom.hu/auth/setup | gate page False | app says 'Setup | Cal.com'
+10:18:25 docmost HOUSEHOLD -> 200 in 0.21s | te/start -> 302 r-docmost.enkisfelhom.hu/__felhom_gate/cb -> 200 r-docmost.enkisfelhom.hu/ | gate page False | app says 'Docmost'
+10:18:26 outline HOUSEHOLD -> 200 in 0.24s | te/start -> 302 r-outline.enkisfelhom.hu/__felhom_gate/cb -> 200 r-outline.enkisfelhom.hu/ | gate page False | app says 'Outline'
+10:18:26 rallly HOUSEHOLD -> 200 in 0.25s | gate/start -> 302 r-rallly.enkisfelhom.hu/__felhom_gate/cb -> 200 r-rallly.enkisfelhom.hu/ | gate page False | app says 'Home'
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B2-open.txt b/documentation/audits/gate-rollout-2026-09-29/B/B2-open.txt
new file mode 100644
index 00000000..a1c2a8b4
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B2-open.txt
@@ -0,0 +1,5 @@
+10:21:29 zipline gate OPENED by probe 20s after the sync | files=[] record={'state': 'open', 'since': '2026-09-29T08:15:56Z', 'hosts': ['r-zipline.enkisfelhom.hu'], 'opened_at': '2026-09-29T08:21:22Z', 'opened_by': 'probe'}
+10:21:29 gitea PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:21:34 docmost PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:21:39 calcom PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:21:44 tandoor PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B2-probe-after.txt b/documentation/audits/gate-rollout-2026-09-29/B/B2-probe-after.txt
new file mode 100644
index 00000000..567baab5
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B2-probe-after.txt
@@ -0,0 +1,12 @@
+10:19:58 zipline PROBE http://zipline:3000/api/setup -> {"error":"E9001: Forbidden","code":9001,"statusCode":403}
+10:20:01 docmost PROBE http://docmost:3000/api/workspace/public ->
+
+
+
+
+
+
+ Docmost
+ {"version":"1.27.0"}
+10:20:08 gitea PROBE http://gitea:3000/api/v1/settings/api -> {"max_response_items":50,"default_paging_num":30,"default_git_trees_per_page":1000,"default_max_blob_size":10485760,"default_max_response_size":104857600}
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B2-probe-before.txt b/documentation/audits/gate-rollout-2026-09-29/B/B2-probe-before.txt
new file mode 100644
index 00000000..f4ba4a38
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B2-probe-before.txt
@@ -0,0 +1,14 @@
+10:18:42 zipline PROBE http://zipline:3000/api/setup -> {"firstSetup":true}
+10:18:45 seerr PROBE http://seerr:5055/api/v1/settings/public -> {"initialized":false,"applicationTitle":"Jellyseerr","applicationUrl":"","hideAvailable":false,"hideBlacklisted":false,"localLogin":true,"mediaServerLogin":true,"jellyfinExternalHost":"","jellyfinForgotPasswordUrl":"","movie4kEnabled":false,"series4kEnabled":false,"discoverRegion":"","streamingRegion":"","originalLanguage":"","mediaServerType":4,"partialRequestsEnabled":true,"enableSpecialEpisodes
+10:18:48 docmost PROBE http://docmost:3000/api/workspace/public -> {"message":"Workspace not found","error":"Not Found","statusCode":404}
+10:18:51 gitea PROBE http://gitea:3000/api/v1/version -> Not Found. Go to default page.
+10:18:55 tandoor PROBE http://tandoor:80/api/ ->
+
+
+ Bad Request (400)
+
+
+
Bad Request (400)
+
+
+10:18:58 calcom PROBE http://calcom:3000/api/auth/setup ->
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B2-setup.txt b/documentation/audits/gate-rollout-2026-09-29/B/B2-setup.txt
new file mode 100644
index 00000000..4df812fd
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B2-setup.txt
@@ -0,0 +1,5 @@
+10:19:42 zipline HOUSEHOLD SETUP through the gate -> 200 {"firstSetup":true,"user":{"id":"cmumeo944000201niiki0m8ei","username":"family","createdAt":"2026-09-29T08:19:42.243Z","
+10:19:42 docmost HOUSEHOLD SETUP through the gate -> 200 {"data":{"id":"01a0ec3f-8b7e-7c62-915f-31cb204c90a7","name":"Family","description":null,"logo":null,"hostname":null,"cus
+10:19:43 calcom HOUSEHOLD SETUP through the gate -> 200 {"message":"First admin user created successfully."}
+10:19:48 gitea HOUSEHOLD SETUP through the gate -> 200 after POST: 200 /
+10:19:48 tandoor HOUSEHOLD SETUP through the gate -> 200 after POST: 302 /setup/ -> 200 /accounts/login/
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B2-stranger-signup-after.txt b/documentation/audits/gate-rollout-2026-09-29/B/B2-stranger-signup-after.txt
new file mode 100644
index 00000000..2060df9a
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B2-stranger-signup-after.txt
@@ -0,0 +1,13 @@
+zipline POST /api/auth/register -> 400 {"error":"E1037: User registration is disabled","code":1037,"statusCode":400}
+gitea GET /user/sign_up -> 200 404 {"message":"Cannot POST /api/auth/register","error":"Not Found","statusCode":404}
+docmost POST /api/auth/signup -> 404 {"message":"Cannot POST /api/auth/signup","error":"Not Found","statusCode":404}
+calcom GET /signup -> 200 201 {"message":"Created user"}
+tandoor GET /accounts/signup/ -> 200 Sign Up Closed 308
+calcom GET /signup -> 200
+calcom GET /api/auth/signup -> 405
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B2-stranger.txt b/documentation/audits/gate-rollout-2026-09-29/B/B2-stranger.txt
new file mode 100644
index 00000000..101e2326
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B2-stranger.txt
@@ -0,0 +1,8 @@
+10:18:20 zipline STRANGER browser -> 200 302 r-zipline.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:18:20 gitea STRANGER browser -> 200 302 r-gitea.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:18:21 seerr STRANGER browser -> 200 302 r-seerr.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:18:21 tandoor STRANGER browser -> 200 302 r-tandoor.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:18:21 calcom STRANGER browser -> 200 302 r-calcom.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:18:21 docmost STRANGER browser -> 200 302 r-docmost.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:18:21 outline STRANGER browser -> 200 302 r-outline.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:18:21 rallly STRANGER browser -> 200 302 r-rallly.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B2-zipline-probe-before.txt b/documentation/audits/gate-rollout-2026-09-29/B/B2-zipline-probe-before.txt
new file mode 100644
index 00000000..4a8bc61a
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B2-zipline-probe-before.txt
@@ -0,0 +1,4 @@
+zipline FRESH install, before the setup: "features":{"oauthRegistration":false
+zipline FRESH install, before the setup: "userRegistration":false}
+zipline FRESH install, before the setup: "firstSetup":true
+10:33:01 zipline (fresh): 'Done' pressed before the setup -> 409 {'data': None, 'error': 'Az alkalmazás szerint még nincs kész az első beállítás. Hozd létre a fiókodat, aztán próbáld új
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3a-deploy.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3a-deploy.txt
new file mode 100644
index 00000000..27226340
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3a-deploy.txt
@@ -0,0 +1,15 @@
+10:34:01 adventurelog deploy -> 202
+10:34:02 homebox deploy -> 202
+10:34:02 papra deploy -> 202
+10:34:02 plant-it deploy -> 409 {'ok': False, 'error': 'Ez az alkalmazás jelenleg nem telepíthető.'}
+10:34:02 sparkyfitness deploy -> 202
+10:34:02 vikunja deploy -> 202
+10:34:02 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['SUBDOMAIN_DB']
+10:34:03 wanderer deploy -> 202
+10:35:47 adventurelog state unhealthy | files=[setup-gate-adventurelog.yml] record={'state': 'closed', 'since': '2026-09-29T08:34:01Z', 'hosts': ['r-adventurelog.enkisfelhom.hu']}
+10:35:50 homebox state running | files=[setup-gate-homebox.yml] record={'state': 'closed', 'since': '2026-09-29T08:34:02Z', 'hosts': ['r-homebox.enkisfelhom.hu']}
+10:35:53 papra state running | files=[setup-gate-papra.yml] record={'state': 'closed', 'since': '2026-09-29T08:34:02Z', 'hosts': ['r-papra.enkisfelhom.hu']}
+10:45:59 plant-it state not_deployed | files=[] record=None
+10:46:02 sparkyfitness state running | files=[setup-gate-sparkyfitness.yml] record={'state': 'closed', 'since': '2026-09-29T08:34:02Z', 'hosts': ['r-sparkyfitness.enkisfelhom.hu']}
+10:46:05 vikunja state running | files=[setup-gate-vikunja.yml] record={'state': 'closed', 'since': '2026-09-29T08:34:02Z', 'hosts': ['r-vikunja.enkisfelhom.hu']}
+10:46:08 wanderer state unhealthy | files=[setup-gate-wanderer.yml] record={'state': 'closed', 'since': '2026-09-29T08:34:03Z', 'hosts': ['hike-db.enkisfelhom.hu', 'r-wanderer.enkisfelhom.hu']}
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3a-endpoints.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3a-endpoints.txt
new file mode 100644
index 00000000..a1972999
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3a-endpoints.txt
@@ -0,0 +1,5 @@
+adventurelog http://adventurelog:80/auth/is-registration-disabled/ -> {"is_disabled":false,"message":"Registration is disabled. Please contact the administrator if you need an account."}
+homebox http://homebox:7745/api/v1/status -> {"health":true,"versions":null,"title":"Homebox","message":"Track, Manage, and Organize your Things","build":{"version":"v0.26.2","commit":"e01dd737238a3fa7e1a6454b37de6c6fc88c86e4","buildTime":""},"latest":{"version":"v0.26.2","date":"2026-06-14 01:57:51 +000
+papra http://papra:1221/api/config -> {"config":{"version":"26.6.2","gitCommitSha":"cf0deb70cf7954853058b65d07b4cdebc84b916a","gitCommitDate":"2026-09-01T18:24:46+02:00","auth":{"isEmailVerificationRequired":false,"isPasswordResetEnabled":true,"isRegistrationEnabled":true,"showLegalLinksOnAuthPage
+sparkyfitness http://sparkyfitness-server:3010/api/auth/settings ->
+vikunja http://vikunja:3456/api/v1/info -> {"version":"v2.6.0","frontend_url":"https://r-vikunja.enkisfelhom.hu/","motd":"","link_sharing_enabled":true,"max_file_size":"20MB","max_items_per_page":50,"available_migrators":["vikunja-file","ticktick","wekan","csv","planka"],"task_attachments_enabled":true
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3a-household.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3a-household.txt
new file mode 100644
index 00000000..d477c398
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3a-household.txt
@@ -0,0 +1,7 @@
+10:46:10 adventurelog HOUSEHOLD -> 200 in 0.29s | > 302 r-adventurelog.enkisfelhom.hu/__felhom_gate/cb -> 200 r-adventurelog.enkisfelhom.hu/ | gate page False | app says 'AdventureLog'
+10:46:10 homebox HOUSEHOLD -> 200 in 0.20s | te/start -> 302 r-homebox.enkisfelhom.hu/__felhom_gate/cb -> 200 r-homebox.enkisfelhom.hu/ | gate page False | app says ' 200 in 0.20s | __gate/start -> 302 r-papra.enkisfelhom.hu/__felhom_gate/cb -> 200 r-papra.enkisfelhom.hu/ | gate page False | app says 'Papra - Document archiving and sharing p'
+10:46:10 plant-it HOUSEHOLD -> 404 in 0.05s | 404 r-plant-it.enkisfelhom.hu/ | gate page False | app says '404 page not found '
+10:46:10 sparkyfitness HOUSEHOLD -> 200 in 0.20s | 302 r-sparkyfitness.enkisfelhom.hu/__felhom_gate/cb -> 200 r-sparkyfitness.enkisfelhom.hu/ | gate page False | app says 'SparkyFitness'
+10:46:10 vikunja HOUSEHOLD -> 200 in 0.20s | te/start -> 302 r-vikunja.enkisfelhom.hu/__felhom_gate/cb -> 200 r-vikunja.enkisfelhom.hu/ | gate page False | app says 'Vikunja'
+10:46:10 wanderer HOUSEHOLD -> 404 in 0.05s | 404 r-wanderer.enkisfelhom.hu/ | gate page False | app says '404 page not found '
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3a-press.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3a-press.txt
new file mode 100644
index 00000000..3e00c182
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3a-press.txt
@@ -0,0 +1,5 @@
+10:48:30 adventurelog PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:48:36 homebox PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:48:41 papra PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:48:46 sparkyfitness PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
+10:48:52 vikunja PRESS 'Done' -> 200 {'data': {'opened': True}, 'error': '', 'ok': True}
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3a-remove.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3a-remove.txt
new file mode 100644
index 00000000..171bae85
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3a-remove.txt
@@ -0,0 +1,24 @@
+10:50:04 [X] stop -> 200 {'ok': True, 'message': 'Stack adventurelog stop completed'}
+10:50:36 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'adventurelog', 'volumes_removed': ['adventurelog_adventurelog_media', 'adventurelog_adventurelog_postgres_data'], 'hdd_paths_r
+10:50:44 [X] after remove: deployed=False leftovers='/opt/docker/stacks/adventurelog'
+10:50:45 [X] stop -> 200 {'ok': True, 'message': 'Stack homebox stop completed'}
+10:51:16 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'homebox', 'volumes_removed': ['homebox_homebox_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alk
+10:51:25 [X] after remove: deployed=False leftovers='/opt/docker/stacks/homebox'
+10:51:26 [X] stop -> 200 {'ok': True, 'message': 'Stack papra stop completed'}
+10:51:57 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'papra', 'volumes_removed': ['papra_papra_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazá
+10:52:06 [X] after remove: deployed=False leftovers='/opt/docker/stacks/papra'
+10:52:07 [X] stop -> 200 {'ok': True, 'message': 'Stack sparkyfitness stop completed'}
+10:52:39 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'sparkyfitness', 'volumes_removed': ['sparkyfitness_sparkyfitness_backup', 'sparkyfitness_sparkyfitness_db_data', 'sparkyfitnes
+10:52:47 [X] after remove: deployed=False leftovers='/opt/docker/stacks/sparkyfitness'
+10:52:47 [X] stop -> 200 {'ok': True, 'message': 'Stack vikunja stop completed'}
+10:53:19 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'vikunja', 'volumes_removed': ['vikunja_vikunja_data', 'vikunja_vikunja_db'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [
+10:53:28 [X] after remove: deployed=False leftovers='/opt/docker/stacks/vikunja'
+10:53:29 [X] stop -> 200 {'ok': True, 'message': 'Stack wanderer stop completed'}
+10:54:00 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'wanderer', 'volumes_removed': ['wanderer_wanderer_data', 'wanderer_wanderer_meili_data', 'wanderer_wanderer_plugins', 'wandere
+10:54:09 [X] after remove: deployed=False leftovers='/opt/docker/stacks/wanderer'
+10:54:09 [X] stop -> 200 {'ok': True, 'message': 'Stack gitea stop completed'}
+10:54:41 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'gitea', 'volumes_removed': ['gitea_gitea_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': 'Az alkalmazá
+10:54:49 [X] after remove: deployed=False leftovers='/opt/docker/stacks/gitea'
+10:55:00 [X] stop -> 200 {'ok': True, 'message': 'Stack calcom stop completed'}
+10:55:32 [X] remove (with drive data) -> 200 {'ok': True, 'data': {'removed': 'calcom', 'volumes_removed': ['calcom_calcom_postgres_data'], 'hdd_paths_removed': [], 'hdd_paths_preserved': [], 'hdd_note': '
+10:55:41 [X] after remove: deployed=False leftovers='/opt/docker/stacks/calcom'
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3a-setup.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3a-setup.txt
new file mode 100644
index 00000000..23dce3c3
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3a-setup.txt
@@ -0,0 +1,10 @@
+10:47:43 adventurelog HOUSEHOLD SETUP through the gate -> 403
+
+
+
+ 204
+10:47:43 papra HOUSEHOLD SETUP through the gate -> 200 {"token":"","user":{"name":"Family","email":"family@spike.hu","emailVerified":false,"ima
+10:47:43 sparkyfitness HOUSEHOLD SETUP through the gate -> 404
+10:47:44 vikunja HOUSEHOLD SETUP through the gate -> 200 {"id":1,"name":"","username":"family","created":"2026-09-29T08:47:44Z","updated":"2026-09-29T08:47:44.100197843Z"}
+
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3a-stranger-signup-before-block.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3a-stranger-signup-before-block.txt
new file mode 100644
index 00000000..6dd5bf03
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3a-stranger-signup-before-block.txt
@@ -0,0 +1,5 @@
+10:48:57 adventurelog STRANGER sign-up -> 200 closed-answer=False '{"type":"redirect","status":302,"location":"/"}'
+10:48:57 homebox STRANGER sign-up -> 204 closed-answer=False ''
+10:48:58 papra STRANGER sign-up -> 200 closed-answer=False '{"token":"","user":{"name":"'
+10:48:58 sparkyfitness STRANGER sign-up -> 200 closed-answer=False '{"token":"","user":{"name":"'
+10:48:58 vikunja STRANGER sign-up -> 200 closed-answer=False '{"id":2,"name":"","username":"stranger6b31","created":"2026-'
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3a-stranger.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3a-stranger.txt
new file mode 100644
index 00000000..50834fce
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3a-stranger.txt
@@ -0,0 +1,7 @@
+10:46:08 adventurelog STRANGER browser -> 200 302 r-adventurelog.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:46:08 homebox STRANGER browser -> 200 302 r-homebox.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:46:09 papra STRANGER browser -> 200 302 r-papra.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:46:09 plant-it STRANGER browser -> 404 404 r-plant-it.enkisfelhom.hu/ gate-page=False | API POST -> 404 '404 page not found\n'
+10:46:09 sparkyfitness STRANGER browser -> 200 302 r-sparkyfitness.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:46:09 vikunja STRANGER browser -> 200 302 r-vikunja.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start gate-page=True | API POST -> 401 '{"error":"this app is waiting for its first setup"}'
+10:46:09 wanderer STRANGER browser -> 404 404 r-wanderer.enkisfelhom.hu/ gate-page=False | API POST -> 404 '404 page not found\n'
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3b-after.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3b-after.txt
new file mode 100644
index 00000000..9a60076a
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3b-after.txt
@@ -0,0 +1,7 @@
+11:05:22 opengist AFTER, stranger browser -> 200 302 r-opengist.enkisfelhom.hu/ -> 200 r-opengist.enkisfelhom.hu/-/all | gate page False | len 15769
+11:05:23 wishlist AFTER, stranger browser -> 200 307 r-wishlist.enkisfelhom.hu/ -> 200 r-wishlist.enkisfelhom.hu/login | gate page False | len 9593
+11:05:23 termix AFTER, stranger browser -> 200 200 r-termix.enkisfelhom.hu/ | gate page False | len 2981
+11:05:23 gramps-web AFTER, stranger browser -> 200 302 r-gramps-web.enkisfelhom.hu/ -> 200 felhom.enkisfelhom.hu/__gate/start | gate page True | len 1824
+11:05:23 radarr AFTER, stranger browser -> 200 302 r-radarr.enkisfelhom.hu/ -> 200 r-radarr.enkisfelhom.hu/login | gate page False | len 10020
+11:05:23 sonarr AFTER, stranger browser -> 200 302 r-sonarr.enkisfelhom.hu/ -> 200 r-sonarr.enkisfelhom.hu/login | gate page False | len 9654
+11:05:23 recipe-importer AFTER, stranger browser -> 200 recipe-importer.enkisfelhom.hu/ -> 200 r-recipe-importer.enkisfelhom.hu/settings | gate page False | len 14057
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3b-deploy.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3b-deploy.txt
new file mode 100644
index 00000000..c8632c82
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3b-deploy.txt
@@ -0,0 +1,18 @@
+10:56:29 opengist deploy -> 202
+10:56:29 wishlist deploy -> 202
+10:56:30 termix deploy -> 202
+10:56:30 gramps-web deploy -> 202
+10:56:34 [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/radarr']
+10:56:34 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
+10:56:34 radarr deploy -> 202
+10:56:38 [1] made the drive paths this app requires: ['/mnt/felhom-drives/scratch_hdd/userdata/sonarr']
+10:56:38 [1] required fields filled beyond DOMAIN/SUBDOMAIN: ['HDD_PATH']
+10:56:38 sonarr deploy -> 202
+10:56:38 recipe-importer deploy -> 202
+10:56:42 opengist state running | files=[setup-gate-opengist.yml] record={'state': 'closed', 'since': '2026-09-29T08:56:29Z', 'hosts': ['r-opengist.enkisfelhom.hu']}
+10:56:56 wishlist state running | files=[setup-gate-wishlist.yml] record={'state': 'closed', 'since': '2026-09-29T08:56:29Z', 'hosts': ['r-wishlist.enkisfelhom.hu']}
+10:57:21 termix state running | files=[setup-gate-termix.yml] record={'state': 'closed', 'since': '2026-09-29T08:56:30Z', 'hosts': ['r-termix.enkisfelhom.hu']}
+10:58:40 gramps-web state running | files=[setup-gate-gramps-web.yml] record={'state': 'closed', 'since': '2026-09-29T08:56:30Z', 'hosts': ['r-gramps-web.enkisfelhom.hu']}
+10:58:43 radarr state running | files=[setup-gate-radarr.yml] record={'state': 'closed', 'since': '2026-09-29T08:56:34Z', 'hosts': ['r-radarr.enkisfelhom.hu']}
+10:58:47 sonarr state running | files=[setup-gate-sonarr.yml] record={'state': 'closed', 'since': '2026-09-29T08:56:38Z', 'hosts': ['r-sonarr.enkisfelhom.hu']}
+10:58:49 recipe-importer state running | files=[setup-gate-recipe-importer.yml] record={'state': 'closed', 'since': '2026-09-29T08:56:38Z', 'hosts': ['r-recipe-importer.enkisfelhom.hu']}
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3b-household.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3b-household.txt
new file mode 100644
index 00000000..e7306341
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3b-household.txt
@@ -0,0 +1,7 @@
+10:59:04 opengist HOUSEHOLD -> 200 in 0.26s | /__felhom_gate/cb -> 302 r-opengist.enkisfelhom.hu/ -> 200 r-opengist.enkisfelhom.hu/-/all | gate page False | app says 'All gists - Opengist'
+10:59:05 wishlist HOUSEHOLD -> 200 in 0.60s | m.hu/ -> 302 r-wishlist.enkisfelhom.hu/login -> 200 r-wishlist.enkisfelhom.hu/setup-wizard | gate page False | app says ' {"allowed":true}
+gramps-web http://gramps-web:5000/api/token/create_owner/ -> {"error": {"code": 405, "message": "Users already exist"}}
+radarr http://radarr:7878/initialize.json ->
+sonarr http://sonarr:8989/initialize.json ->
diff --git a/documentation/audits/gate-rollout-2026-09-29/B/B3b-probe-before.txt b/documentation/audits/gate-rollout-2026-09-29/B/B3b-probe-before.txt
new file mode 100644
index 00000000..4d13ddf0
--- /dev/null
+++ b/documentation/audits/gate-rollout-2026-09-29/B/B3b-probe-before.txt
@@ -0,0 +1,8 @@
+gramps-web http://gramps-web:5000/api/metadata/ -> {"message":"Missing JWT in headers or query_string (Missing Authorization Header; Missing 'jwt' query paramater)"}
+termix http://termix:8080/users/registration-allowed -> {"allowed":true}
+termix http://termix:8080/users/setup-required -> {"setup_required":true}
+wishlist http://wishlist:3000/api/setup ->