Record operator ruling 2026-10-01 evening: decision 63 — extend the box's own gate (A), order R-753 → spike → build on go

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -16,6 +16,11 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
 
+> **Ruling 2026-10-01 (evening, operator) — `09` §3 decision 63, recorded before the work.** Login problems are solved by
+> EXTENDING THE BOX'S OWN GATE (option A), not by an identity app on every box (option B, Authentik/Authelia — a possible
+> later step behind the same traefik `forwardAuth` hook). Order: the box tells visitors apart (R-753) → a SPIKE of a
+> permanent gate with family accounts (Grimmory, MeTube; measured, not built) → a build only after the operator's go.
+
 > **2026-10-01 (night) — the first new apps through the checklist.** Published with complete records and first ladder
 > steps: Radicale (catalog `195129c`; login file written once — R-765), Karakeep (`882ac14`; web 1536M on measurements),
 > Dawarich (`72247a3`; seeded login replaced behind the install hold; SECRET_KEY_BASE data_key). Grimmory tested on both

documentation/architecture/09-update-architecture.md

@@ -678,6 +678,15 @@ header a client can send. Each measured on 9202 (`audits/lockouts-2026-10-01/B/`
 calibre-web-automated is NOT decided here: its only long lock (40 tries a day per name, `cps/web.py:2218`) has no knob for
 its length, and both fixes cost something the household would notice — operator decision in STATUS.
 
+### 2026-10-01 (evening) — an operator ruling (recorded before the work)
+
+63. **Login problems are solved by extending the box's OWN gate (option A), not by an identity app on every box (option
+    B: Authentik/Authelia)** — *operator ruling 2026-10-01 evening.* B stays a possible later step: the gate's traefik
+    `forwardAuth` hook could later point to one. **Order:** first the box tells visitors apart (R-753) — built; then a
+    SPIKE of a permanent gate with family accounts (Grimmory, MeTube) — measured, not built; a build only after the
+    operator's go. **Why:** one gate the box already runs and the controller already answers, against a new service with
+    its own database, upgrades and failure modes on every box. Design record: `01-topology-and-trust.md` §5.
+
 ### 2026-09-30 (day) — operator notes, recorded before the work
 
 - **The day brief runs by day.** Every backup and automatic-update test is started by hand — the night chain's debug