New-app checklist: the pilot audit (wger as of 2026-09-29 and now, two 9202 walks), R-758..R-764 opened; STATUS, CONTEXT, report

The operator's request of 2026-10-01 recorded in CONTEXT with the reviewer's defaults (new apps only; the 53 get a
read-only gap page). The pilot: the draft caught R-752 and R-755, missed R-737 and (for a new app) R-738; the
sharpened and new rows then found R-762 (wger serves no static files or photos), R-763 (strangers sign up, guest
accounts), R-764 (no mail). Also R-758 (8 mem_limit under the sum), R-759 (wger's open record rows), R-760
(vikunja healthcheck), R-761 (logo comment). R-755 note. Register 392 -> 399.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,27 +2,32 @@
 
 **Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
 
-**Updated 2026-10-01 (late afternoon). Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.**
+**Updated 2026-10-01 (evening). Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.**
 
 **Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.
 
-## Your two decisions of this afternoon — built
+## Your request of today — the new-app checklist — built
 
-- **calibre-web gets a secret login name (your A).** The box makes the name at install and shows it on the app page,
-  next to the password. Tested on the scratch box: a stranger tried 40 wrong passwords with `admin`, and the household
-  still logged in at once with its own name. The lock against guessing stays.
-  **The HP demo box's calibre-web has a new name too.** It is in your credentials file, under the same key as before.
-- **The registry clean-up script keeps 20 versions and never one in use (your A).** "In use" means: the golden, the
-  floor, the approved agent, the running hub. I ran it only in "show me" mode: today it would delete 70 old controller
-  versions and 8 hub versions. **It deleted nothing.** If it cannot read what is in use, it refuses to run.
+- **The checklist is in the app catalog.** 60 checks in 10 groups. Each check says how to test it and why it exists.
+- **A new app cannot reach the live catalog without its filled-in copy.** A check on every push and in CI refuses it.
+  I tested that check with 16 fake cases, and I broke the check on purpose 5 times to prove the fake cases notice.
+- **The 53 old apps are not re-tested.** One page shows what each already has. For example: 24 of 53 show a measured
+  memory check, 26 of 53 show a tested update.
+- **The test on wger:** the first draft found 2 of this week's 4 wger problems. It missed the phone-app login and the
+  missing update step for a brand-new app. I sharpened those checks. Now all 4 are caught.
 
 ## What broke, and what I did
 
-- **A box makes up a value when a template gains a new generated field.** On the HP demo box it made up a calibre-web
-  login name that the app never had. I fixed that box by giving the app that name. Written down. No other box has calibre-web today.
-- On the scratch box, removing calibre-web "with its data" was refused, although the folder is there. Written down.
+- **The checklist found three more wger problems, on the live catalog.** Nothing fixed today (this task changes no app).
+  - wger loads no styling and shows no uploaded photo. The pages look broken.
+  - A stranger can make a wger account after you set it up. Every anonymous visit adds a "guest" account.
+  - wger cannot send e-mail. A "forgot password" mail never leaves the box.
+- Eight apps show a smaller memory figure than they really use. The apps are not affected; the number on the screen is.
+- Earlier today, built: your two afternoon decisions — calibre-web's secret login name (the HP demo box's new name is in
+  your credentials file), and the registry clean-up rule (it deleted nothing). Found: a box makes up a value when a
+  template gains a new generated field (calibre-web). Written down.
 
-**Rows.** This afternoon: 2 closed, 2 opened. The list went from 390 to 392 rows.
+**Rows.** This evening: 7 opened, 0 closed. The list went from 392 to 399 rows.
 
 ## What needs you