Session close: REPORT-visitors-2026-10-01, STATUS (go/no-go: the family gate; SparkyFitness licence), CONTEXT, capability map rows, R-783..R-787 (register 422)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,67 +2,61 @@
 
 **Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
 
-**Updated 2026-10-01 (night). Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.**
+**Updated 2026-10-01 (late night). Both demo boxes run controller 0.286.1 and host agent 0.138.0. Hub 0.126.0. New
+installs get golden 0.286.1 with agent 0.138.0.**
 
 **Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.
 
-## Tonight: the first new apps through the checklist
+## Tonight: the box tells visitors apart
 
-- **wger is hidden** from new installs until its two problems are fixed. No box has wger.
-- **Three new apps are in the catalog, each fully tested:** Radicale (calendar and contacts), Karakeep (bookmarks),
-  Dawarich (location history). Each passed all 60 checks, with a tested update and a tested restore.
-- **Their logos and screenshots reach the boxes only with the next hub release.** Until then the cards have no picture.
-- **Grimmory (e-book library) is ready but NOT published.** A stranger who guesses wrong 5 times locks everyone out of
-  its login for 15 minutes. You decide (below).
-- **Not built, on the fit check:** Grimoire (its makers say: never put it on the internet), MeTube (it has no login at
-  all), Pinchflat (its makers stopped working on it).
-- **Fit check only, as you asked:** Invidious and moonlight-web. My advice: build neither (below).
+- **Before:** through the internet every visitor looked like the same address. A stranger's 5 wrong passwords locked the
+  whole family out of the box's own dashboard for a minute, and out of some apps.
+- **Now:** the box sees each visitor's real address, and a stranger cannot fake it. Measured on demo-hp through the real
+  internet path: a stranger's wrong passwords locked only that stranger.
+- **Apps:** 19 apps would have believed a faked address. They are protected, in the same update. BookStack now locks
+  only the stranger, measured. Home Assistant no longer treats every internet visitor as "at home".
+- **Not measured:** a second outside address on the real internet path. The test machine abroad was refused by
+  Cloudflare before it reached the box. A 2-minute test from your phone would close it.
 
-## The fit table, one line each
+## The permanent family gate: tested, NOT built
 
-- **Radicale** — build. Done.
-- **Karakeep** — build with a note (it visits every page you save; AI is off unless you give it a key). Done.
-- **Dawarich** — build with a note (a known login at first, replaced at install; map pictures come from its makers' server). Done.
-- **Grimmory** — build with a note. Built, waiting for your word.
-- **Grimoire** — stop. Its makers say it must not be on the internet, and there is no ready image.
-- **MeTube** — stop for now. No login at all: anyone who finds it downloads through your home connection.
-- **Pinchflat** — stop. No new version since September 2025.
-- **Invidious** — stop (my advice). It breaks when YouTube changes, and YouTube can block the household's home address.
-- **moonlight-web** — stop. It needs a gaming PC and network paths our tunnel does not carry.
+- A gate with a login for each family member, in front of Grimmory and MeTube, passed every test on the scratch box.
+- **Strangers:** they reached nothing, and their wrong guesses locked only themselves.
+- **Family:** members stayed signed in for 30 days, logout worked, and the family login does not open the dashboard.
+- **E-readers:** Kobo, KOReader and OPDS readers kept working with Grimmory's own login.
+- **Cost:** under 1 ms per page. If the box's controller is down, the gated apps refuse — they never open.
 
-## Earlier today
+## Also tonight
 
-- **The new-app checklist is built** (60 checks; a new app cannot reach the catalog without its filled-in copy). The test
-  on wger found its 4 known problems and 3 more (no styling or photos, strangers can sign up, no e-mail).
-- Your afternoon decisions are built: calibre-web's secret login name; the registry clean-up rule (it deleted nothing).
+- **SparkyFitness passed most of the checklist.** One problem: its **licence forbids commercial use** without the
+  author's written permission (below).
+- **Two box fixes:**
+  - The health check now says "not checked" instead of "healthy" when it could not look.
+  - A removed and restored app keeps its sign-up lock.
+- **A new golden.** Fresh installs get today's version.
 
-## What broke tonight, and what I did
-
-- **Radicale's first version lost your login after a restore.** Found in testing, fixed before it went out.
-- **After "remove the app, keep backups" and a restore, one of the two sign-up locks is gone** (the app's own lock
-  still holds). Written down for the box.
-- **The box's health check writes "healthy" when it could not check at all.** The app's state still showed the problem.
-  Written down.
-- Karakeep needed more memory than first planned. It now has room for saving many heavy pages at once.
-
-**Rows.** Tonight: 11 opened, one of them already closed (the Radicale restore problem). The list went from 399 to 410 rows.
+**Rows.** 4 closed, 12 opened. The list went from 410 to 422 rows.
 
 ## What needs you
 
-1. **Grimmory: publish it now, or wait?**
-   - **A — publish now** with a sentence on its page: "if someone guesses your password wrong 5 times, the login waits
-     15 minutes." E-reader apps keep working during the wait (measured).
-   - **B — wait** until the box can tell visitors apart (the bigger build you have not decided yet). Nobody gets Grimmory
-     until then.
-   - I would choose **A**: the lock is short, it is the web page only, and e-readers are not touched. It is like mealie's lock, which you kept.
-2. **Invidious and moonlight-web: build or not?** I advise **no** for both. If you do nothing, neither is built.
-3. **MeTube and Pinchflat (video downloaders):** stopped for other reasons (no login; makers stopped). The YouTube
-   sentence („Csak saját használatra…") waits until one of them is built.
-4. Older, nothing urgent: should apps see each visitor's real address; is the design document or the build right about
-   where the tunnel runs.
+1. **The permanent family gate: build it or not?**
+   - **Go:** 2 work sessions — the box first, then Grimmory and MeTube published behind it.
+   - **No-go:** Grimmory stays unpublished, and MeTube is not built.
+   - **If you say nothing:** nothing is built, and the next sessions do other work.
+   - I would choose **go**. It also answers Grimmory and MeTube.
+2. **SparkyFitness's licence** says "non-commercial use only".
+   - **A:** hide it from new installs and ask the author for permission.
+   - **B:** keep it offered while asking.
+   - I would choose **A**.
+   - **If you say nothing:** it stays offered.
+3. **Grimmory:** publish behind the family gate (if go), or as it is now. Its lock is per visitor since tonight; read in
+   its code, not yet measured.
+4. **One phone test (2 minutes):** sign in to demo-hp's dashboard from your phone off wifi, while I lock out my own
+   address. If you skip it, the second-address proof stays the simulated one.
+5. Still open from before: Invidious and moonlight-web — I advise no to both. MeTube and Pinchflat are stopped.
 
 ## Standing steps
 
 - **Monthly security re-test: last run 2026-10-01, next due ~2026-11-01.** (You start it with the standing brief.)
-- **Weekly:** the golden bake (around 8 October).
+- **Weekly:** the golden bake (around 8 October; tonight's bake was 0.286.1).
 - **Registry clean-up:** only when the registry disk fills; "show me" mode first, then a person decides.