Gate rollout 2026-09-29 afternoon: 32/34 gated, sign-up blocks (decision 47 + CC mechanism), R-713; R-707/R-711/R-713 closed, R-714..R-716 opened; STATUS, CONTEXT, report

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -515,7 +515,18 @@ R-636's louder repeated alarm.
     the household's first admin exists, a stranger can no longer make an account; only the admin adds people, from the
     app's own user page, and the app page says how. Where an app cannot close sign-up, it stays in the catalog and its
     page says plainly that anyone who finds the address can make an account; STATUS asks the operator about it.
-    Mechanism and per-app proof: *(filled in by the 2026-09-29 afternoon session)*.
+    **Mechanism — decided by CC unattended 2026-09-29, operator may reverse.** *How does the box close sign-up in apps
+    that keep the switch only in their own admin settings?* Options: (a) per-app switches — an env read at start plus a
+    restart, or the app's admin API; (b) a box-side block of the app's own sign-up address once the gate opens, with a
+    household window to let a family member in. Costs: (a) measured impossible for most — opengist and wishlist keep
+    it only in their admin settings (no env, no CLI), vikunja has an env but then no way to add a user except its CLI;
+    (b) one more traefik router per app, and a family member joins through a 15-minute window instead of an in-app
+    invite. **Chose (b)**: it works the same for every app, needs no credentials and no restart, and leaves installed
+    apps untouched (only an app whose gate this box opened gets a block). Built in controller v0.281.0
+    (`internal/stacks/signup_block.go`): the block goes up before the gate comes down; a failed write keeps the gate
+    closed. **Proven on 9202:** 11 apps let a stranger sign up after the setup and refused it with the block; 11 more
+    refuse by themselves; the window let a family member in and closed again. wanderer cannot be gated yet (R-714).
+    Evidence `audits/gate-rollout-2026-09-29/`.
     Same day, operator: CC changes the admin passwords of demo-hp's installed bookstack and calibre-web and stores them
     in the operator's credentials file (not in any repo).