Family gate session close: B4 on demo-hp (real internet: member in, stranger 401; remove with data), REPORT-family-gate-2026-10-02, STATUS, R-800 (remove-with-data keeps userdata, operator), CONTEXT; register 436

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,61 +2,69 @@
 
 **Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
 
-**Updated 2026-10-01 (late night). Both demo boxes run controller 0.286.1 and host agent 0.138.0. Hub 0.126.0. New
-installs get golden 0.286.1 with agent 0.138.0.**
+**Updated 2026-10-02. Both demo boxes run controller 0.287.0 and host agent 0.138.0. Hub 0.126.0. New installs get
+golden 0.287.0 with agent 0.138.0.**
 
 **Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.
 
-## Tonight: the box tells visitors apart
+## Today: the family gate is built
 
-- **Before:** through the internet every visitor looked like the same address. A stranger's 5 wrong passwords locked the
-  whole family out of the box's own dashboard for a minute, and out of some apps.
-- **Now:** the box sees each visitor's real address, and a stranger cannot fake it. Measured on demo-hp through the real
-  internet path: a stranger's wrong passwords locked only that stranger.
-- **Apps:** 19 apps would have believed a faked address. They are protected, in the same update. BookStack now locks
-  only the stranger, measured. Home Assistant no longer treats every internet visitor as "at home".
-- **Not measured:** a second outside address on the real internet path. The test machine abroad was refused by
-  Cloudflare before it reached the box. A 2-minute test from your phone would close it.
+- **What it is:** a door in front of chosen apps. Only the family gets in. Each family member has their own name and
+  password. You add, reset and remove them on the dashboard: Settings → Security → **Család** card.
+- **Grimmory (e-books) is published behind it.** Strangers cannot reach its login any more, so they cannot lock you out.
+  E-readers (Kobo, KOReader, OPDS apps) still work with Grimmory's own login.
+- **MeTube (video downloads) is published behind it.** It has no login of its own, so the gate is its only door. The page
+  says: download only what you have the right to.
+- **Measured on the scratch box and on demo-hp:** a stranger reached nothing; a stranger's wrong guesses locked only that
+  stranger; a removed family member was out at the next click; backup, remove and restore kept the gate.
+- **Phone test: skipped** — you were not here. A 2-minute test from your phone off wifi would prove the real-internet
+  family sign-in by a person, not by me.
 
-## The permanent family gate: tested, NOT built
+## Licences: all 58 apps read
 
-- A gate with a login for each family member, in front of Grimmory and MeTube, passed every test on the scratch box.
-- **Strangers:** they reached nothing, and their wrong guesses locked only themselves.
-- **Family:** members stayed signed in for 30 days, logout worked, and the family login does not open the dashboard.
-- **E-readers:** Kobo, KOReader and OPDS readers kept working with Grimmory's own login.
-- **Cost:** under 1 ms per page. If the box's controller is down, the gated apps refuse — they never open.
+Most are open source. These need your word (nothing was hidden or changed):
 
-## Also tonight
+| App | The licence says | Choose: keep / hide / ask | I would |
+|---|---|---|---|
+| **Tandoor** | You may not sell a service whose value comes mostly from it (paid hosting and support named). | | ask the authors; keep meanwhile |
+| **Emby** | Personal, non-commercial use only. Jellyfin does the same job. | | hide for new installs |
+| **SparkyFitness** | Commercial use needs the author's written permission. (Decided: keep, ask.) | — | send the e-mail draft |
+| n8n | Own or personal use is fine; giving it to others only free of charge. | | keep |
+| Plex | Your household is the licensee with its own Plex account. | | keep |
+| recipe-importer | Our own app — it has no licence file. | | pick one |
 
-- **SparkyFitness passed most of the checklist.** One problem: its **licence forbids commercial use** without the
-  author's written permission (below).
-- **Two box fixes:**
-  - The health check now says "not checked" instead of "healthy" when it could not look.
-  - A removed and restored app keeps its sign-up lock.
-- **A new golden.** Fresh installs get today's version.
+Four apps carry paid "enterprise" parts that stay switched off (Cal.com, Docmost, Outline, search in Wanderer), and seven
+apps use Redis 7.4 as a private cache. Both are fine as they run; I watch them.
 
-**Rows.** 4 closed, 12 opened. The list went from 410 to 422 rows.
+**SparkyFitness e-mail:** drafted, NOT sent. The author has no public e-mail; the draft suggests their Discord.
+If no written permission arrives before the first paying customer, SparkyFitness gets hidden from new installs.
+
+## Also today
+
+- **A new golden (0.287.0).** Baked early, because a box from the old golden would have shown the two apps without the
+  gate until its first update. The catalog check now refuses that case.
+- **A bug in one catalog check, fixed:** the check "does the app keep its data where we back it up" never actually
+  talked to any app. Fixed and proven; all apps must be checked again (my next work).
+- **Rows.** 3 closed, 14 opened (most are your licence choices). The list went from 422 to 436 rows.
 
 ## What needs you
 
-1. **The permanent family gate: build it or not?**
-   - **Go:** 2 work sessions — the box first, then Grimmory and MeTube published behind it.
-   - **No-go:** Grimmory stays unpublished, and MeTube is not built.
-   - **If you say nothing:** nothing is built, and the next sessions do other work.
-   - I would choose **go**. It also answers Grimmory and MeTube.
-2. **SparkyFitness's licence** says "non-commercial use only".
-   - **A:** hide it from new installs and ask the author for permission.
-   - **B:** keep it offered while asking.
-   - I would choose **A**.
-   - **If you say nothing:** it stays offered.
-3. **Grimmory:** publish behind the family gate (if go), or as it is now. Its lock is per visitor since tonight; read in
-   its code, not yet measured.
-4. **One phone test (2 minutes):** sign in to demo-hp's dashboard from your phone off wifi, while I lock out my own
-   address. If you skip it, the second-address proof stays the simulated one.
-5. Still open from before: Invidious and moonlight-web — I advise no to both. MeTube and Pinchflat are stopped.
+1. **The licence table above:** keep, hide or ask, per row. **If you say nothing:** everything stays offered.
+2. **Send the SparkyFitness request** (the draft is ready). **If you do nothing:** it gets hidden before the first paying
+   customer.
+3. **Removing an app "with data" keeps its files** (Grimmory's books, MeTube's videos) in the household folder, and
+   the dialog does not say so. **Choose:** keep them and say so on the dialog (I would), or delete the app's own folder
+   too. **If you say nothing:** files stay, the dialog stays silent.
+4. **Demo box apps:** I installed Grimmory and MeTube on demo-hp for the test and removed them after. Want them kept
+   there for showing? **If you say nothing:** they stay removed.
+5. **One phone test (2 minutes), only if you want it:** say so, and I put MeTube back on demo-hp and give you a family
+   login; you open `video.enkisfelhom.hu` on your phone off wifi. **If you say nothing:** the proof stays my real-internet
+   test from here.
+6. Still open: Invidious and moonlight-web — I advise no to both. Pinchflat stays stopped (upstream paused).
 
 ## Standing steps
 
 - **Monthly security re-test: last run 2026-10-01, next due ~2026-11-01.** (You start it with the standing brief.)
-- **Weekly:** the golden bake (around 8 October; tonight's bake was 0.286.1).
+- **Weekly:** the golden bake (next around 9 October; today's bake was 0.287.0).
+- **SparkyFitness:** written permission from the author before the first paying customer, or `lifecycle: hidden`.
 - **Registry clean-up:** only when the registry disk fills; "show me" mode first, then a person decides.