Family gate session close: B4 on demo-hp (real internet: member in, stranger 401; remove with data), REPORT-family-gate-2026-10-02, STATUS, R-800 (remove-with-data keeps userdata, operator), CONTEXT; register 436

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT-family-gate-2026-10-02.md

@@ -0,0 +1,77 @@
+# REPORT — the family gate built; Grimmory and MeTube published; every app's licence read (2026-10-02)
+
+Brief: "the family gate, built (controller + catalog), Grimmory and MeTube published behind it; every app's licence read;
+SparkyFitness's licence ruling recorded; one controller release and a golden bake". Architecture read:
+`01-topology-and-trust.md` §5 (the family-gate paragraph is new), `09` §3 decisions 46, 47, 63, 64, 65.
+Evidence root: `documentation/audits/family-gate-2026-10-02/`.
+
+| Part | State | One line |
+|---|---|---|
+| **A** — the controller | **DONE** | v0.287.0: family members with own logins, a door per family app, anchored exceptions, the Család card. Exit items 1–5 live on 9202. |
+| **B** — the catalog | **DONE** | Format + gate `family-gate`; Grimmory (4 e-reader exceptions) and MeTube (none) published (catalog `96829d0`) with complete records; on 9202 and demo-hp through the product. |
+| **C** — licences | **DONE** | 58 templates, every image, one table (`audits/licences-2026-10-02/TABLE.md`); short list in STATUS; nothing hidden or changed. |
+| **D** — SparkyFitness | **DONE (not sent)** | Request drafted (`audits/licences-2026-10-02/EMAIL-DRAFT-sparkyfitness.md`); decision 65 + trigger in STATUS. |
+| **E** — release | **DONE** | Floor 0.287.0 (min_agent 0.131.0), both demo boxes in ~25 s; golden 0.287.0 baked, round-tripped, vouched; currency gate OK. Phone test SKIPPED (operator not present). |
+
+Not stopped between sessions: Part A was proven live on 9202 before Part B started (`A/items.txt`).
+
+## Claims in the brief, checked
+
+- **"The family session is separable with the existing cookie scheme"** — right, with one addition: a separate cookie
+  name (`felhom_family`) scoped to `Path=/__family` and a separate store; RequireAuth never reads it (test
+  `TestFamilyGate_MemberPassesButNeverTheDashboard`, red-proof RP-F1; live: the member's cookies at `/launcher` → the
+  dashboard login, also through the real internet).
+- **"Grimmory's e-reader paths keep their own auth behind an exception"** — right, measured per path as a stranger
+  through the simulated tunnel: OPDS 401 (Grimmory's), Kobo made-up token 401, KOReader wrong key 401, Komga API 401;
+  the right credentials 200; look-alikes (`/api/v1/opdsx`, `/api/koreaderx`, `../`) → the gate.
+- **"MeTube's websocket passes forwardAuth"** — right: a member's upgrade → 101; a stranger's websocket and polling → 401.
+- **"Whether n8n's licence limits paid services"** — partly: own internal or personal use is allowed; providing it to
+  others is allowed only free of charge for non-commercial purposes. Pulling the unchanged image onto the household's
+  box is arguably not that — a grey zone, now an operator row (R-791).
+
+## Proof
+
+- **Controller:** suites green; red-proofs RP-F1..F7 (`A/RP-F-family-gate-mutants.txt`). Live (`A/items.txt`): a stranger
+  0 app answers of 36; members in; reset/remove/logout end access at the next request; a stranger's 7 guesses lock only
+  the stranger; controller down → 500, never the app; the gate costs 0.49 ms. **Through the real internet on demo-hp**
+  (`B4/member-internet.txt`): a member's browser → the family sign-in → MeTube; logout → refused; a stranger 401.
+- **Catalog:** `catalog_gates.py grimmory` and `metube` exit 0 on the bench, every gate OK (`B/catalog-gates-*.txt`).
+  Decoys of the new gate seen red (`B/family-gate-decoys-red.txt`).
+- **Stranger per exception (Grimmory):** `A/items.txt` item 4; R-775 re-measured: 6 tries → the gate's 401, then the
+  household signs in 200 — the 15-minute lock can no longer be aimed from outside.
+- **9202 lifecycle** (`B/box/`): Grimmory step 3.4.1 → 3.5.0 behind the gate (58.5 s, book read back); MeTube fresh
+  install (a stranger's 63 polls: 404 → 401, never the app), step .28 → .29 (34.9 s), night backup, remove keeping data,
+  restore (64.8 s / 38.5 s), seeds read back, the gate files and the stranger's refusal back by themselves.
+- **demo-hp, live catalog** (`B4/`): both installed through the product, strangers 401 through the real internet and
+  the LAN, removed with data; the apps were removed after (STATUS asks whether to keep them).
+
+## Found on the way (all register rows)
+
+- **R-801 (P2, fixed in the catalog):** the volume-persistence gate never sent a request to ANY app — it read the port
+  from label values, the port is in the label name. Fixed (`routed_ports()`), red-proofed (`B/RP-R801-routed-ports.txt`).
+  **A re-sweep of all 58 templates is owed.** Before the fix MeTube answered UNDETERMINED; after, CLEAN with its own
+  download (`B/volume-persistence-after-R801.txt`).
+- **R-800 (P2, operator):** "remove with data" keeps an app's files in userdata, and the dialog does not say so.
+- R-788 (`APP_EXERCISE`), R-796 (MeTube's send-to helpers cannot pass the gate), R-797 (rule 3 not checkable in CI),
+  R-798 (Grimmory's dead env line), R-799 (fixture field). Licence rows R-789..R-795.
+- Harness only (no row): box_walk cached "not gated" while an app had no router (fixed); Cloudflare refuses Python's
+  user agent (error 1010) — a test client detail, the box was never reached.
+
+## Rows and gates
+
+- **Register 422 → 436:** closed R-767, R-780, R-787; updated R-775 (narrowed), R-784 (decided B, draft ready),
+  R-788; opened R-788..R-801 (14).
+- **Releases:** controller v0.287.0 (one release). Catalog `96829d0` (+ the record amendment). Golden 0.287.0.
+- **CI by head_sha:** catalog 96829d0 → job 1201 success; felhom.eu e6d1ebd → 1200 success; controller 9821690 → 1199
+  success (all pushes of the session green).
+- `unproven.py --summary`: unchanged (not walked 35 of 55).
+
+## Teardown
+
+- **9202:** both apps removed (keep-data remove; the harness removed its own test folders by hand — R-442 refuses
+  with-data there); back on the live catalog (`A/repoint-drill.txt` controls); family members anna/bela remain on 9202's
+  card (scratch box, harmless).
+- **Bench 9401:** rebuilt and destroyed four times; `pct list` 9201 + 9202 only; nvme-scratch back to its baseline.
+- **demo-hp 9201:** apps removed, test files removed by hand, the test member removed (`B4/teardown.txt`).
+- **Hub:** the floor and the artifact manifest changed on purpose; nothing else. **Secrets:** scratch files shredded at
+  the end; evidence scanned for every secret value used (0 hits, positive control 1).