Gate rollout 2026-09-29 afternoon: 32/34 gated, sign-up blocks (decision 47 + CC mechanism), R-713; R-707/R-711/R-713 closed, R-714..R-716 opened; STATUS, CONTEXT, report

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/01-topology-and-trust.md

@@ -136,7 +136,9 @@ the dashboard's own `/__gate/start`). The controller is in an app's request path
 open, the gate's traefik router is removed and the app is reached exactly as without it. The gate decides who creates
 the first admin. **Who may sign up afterwards** is `09` §3 decision 47 (operator ruling 2026-09-29): once the first admin
 exists, open sign-up is closed; only the admin adds people, from the app's own user page. An app that cannot close it
-says so on its page.
+says so on its page. Mechanism (controller ≥ 0.281.0): the box keeps a small traefik router on the app's own sign-up
+address once the gate opens, answered "sign-up is closed" by the controller; the household opens it for 15 minutes
+from the app page to let a family member in. The controller is in THAT address's path only.
 
 ---
 

documentation/architecture/09-update-architecture.md

@@ -515,7 +515,18 @@ R-636's louder repeated alarm.
     the household's first admin exists, a stranger can no longer make an account; only the admin adds people, from the
     app's own user page, and the app page says how. Where an app cannot close sign-up, it stays in the catalog and its
     page says plainly that anyone who finds the address can make an account; STATUS asks the operator about it.
-    Mechanism and per-app proof: *(filled in by the 2026-09-29 afternoon session)*.
+    **Mechanism — decided by CC unattended 2026-09-29, operator may reverse.** *How does the box close sign-up in apps
+    that keep the switch only in their own admin settings?* Options: (a) per-app switches — an env read at start plus a
+    restart, or the app's admin API; (b) a box-side block of the app's own sign-up address once the gate opens, with a
+    household window to let a family member in. Costs: (a) measured impossible for most — opengist and wishlist keep
+    it only in their admin settings (no env, no CLI), vikunja has an env but then no way to add a user except its CLI;
+    (b) one more traefik router per app, and a family member joins through a 15-minute window instead of an in-app
+    invite. **Chose (b)**: it works the same for every app, needs no credentials and no restart, and leaves installed
+    apps untouched (only an app whose gate this box opened gets a block). Built in controller v0.281.0
+    (`internal/stacks/signup_block.go`): the block goes up before the gate comes down; a failed write keeps the gate
+    closed. **Proven on 9202:** 11 apps let a stranger sign up after the setup and refused it with the block; 11 more
+    refuse by themselves; the window let a family member in and closed again. wanderer cannot be gated yet (R-714).
+    Evidence `audits/gate-rollout-2026-09-29/`.
     Same day, operator: CC changes the admin passwords of demo-hp's installed bookstack and calibre-web and stores them
     in the operator's credentials file (not in any repo).