Persistence re-sweep of all 58 (R-801 closed: CLEAN 40 / UNDETERMINED 18 / BROKEN 0), R-788 + R-803 (papra) closed, R-804..R-807 opened; STATUS "Before the first paying customer"; REPORT-persistence-sweep-2026-10-02; register 442

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,69 +2,52 @@
 
 **Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
 
-**Updated 2026-10-02. Both demo boxes run controller 0.287.0 and host agent 0.138.0. Hub 0.126.0. New installs get
-golden 0.287.0 with agent 0.138.0.**
+**Updated 2026-10-02 (afternoon). Both demo boxes run controller 0.288.0 and host agent 0.138.0. Hub 0.126.0. New
+installs get golden 0.288.0 with agent 0.138.0.**
 
 **Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.
 
-## Today: the family gate is built
+## Today (afternoon): every app checked again
 
-- **What it is:** a door in front of chosen apps. Only the family gets in. Each family member has their own name and
-  password. You add, reset and remove them on the dashboard: Settings → Security → **Család** card.
-- **Grimmory (e-books) is published behind it.** Strangers cannot reach its login any more, so they cannot lock you out.
-  E-readers (Kobo, KOReader, OPDS apps) still work with Grimmory's own login.
-- **MeTube (video downloads) is published behind it.** It has no login of its own, so the gate is its only door. The page
-  says: download only what you have the right to.
-- **Measured on the scratch box and on demo-hp:** a stranger reached nothing; a stranger's wrong guesses locked only that
-  stranger; a removed family member was out at the next click; backup, remove and restore kept the gate.
-- **Phone test: skipped** — you were not here. A 2-minute test from your phone off wifi would prove the real-internet
-  family sign-in by a person, not by me.
+- **No data-loss fault.** I checked all 58 apps with the fixed check. It made each app really save something, then
+  looked where the data landed. **No app saves data where the backup does not copy it.**
+- **40 apps: proven correct. 18 apps: not proven either way.** In those 18 the check could not fill every folder (for
+  example an upload folder stays empty because my test saves no upload). Nothing was found outside a backed-up folder.
+  I list them and work on them later.
+- **papra was broken for new installs, now fixed.** It needs more memory than its limit, so a fresh install crashed in a
+  loop. I measured it and raised the limit. No box runs papra.
+- **plant-it's program image is gone from Docker Hub.** It is already hidden from new installs. No box runs it.
 
-## Licences: all 58 apps read
+## Removing an app now tells the truth (your choice A)
 
-Most are open source. These need your word (nothing was hidden or changed):
+- When the household removes an app, its own files (books, videos) **stay**. The dialog and the result now say so, and
+  name the folder. Proven on the scratch box: the video was still there after the remove.
 
-| App | The licence says | Choose: keep / hide / ask | I would |
-|---|---|---|---|
-| **Tandoor** | You may not sell a service whose value comes mostly from it (paid hosting and support named). | | ask the authors; keep meanwhile |
-| **Emby** | Personal, non-commercial use only. Jellyfin does the same job. | | hide for new installs |
-| **SparkyFitness** | Commercial use needs the author's written permission. (Decided: keep, ask.) | — | send the e-mail draft |
-| n8n | Own or personal use is fine; giving it to others only free of charge. | | keep |
-| Plex | Your household is the licensee with its own Plex account. | | keep |
-| recipe-importer | Our own app — it has no licence file. | | pick one |
+## Before the first paying customer
 
-Four apps carry paid "enterprise" parts that stay switched off (Cal.com, Docmost, Outline, search in Wanderer), and seven
-apps use Redis 7.4 as a private cache. Both are fine as they run; I watch them.
+Everything here must be done before the first customer who pays:
 
-**SparkyFitness e-mail:** drafted, NOT sent. The author has no public e-mail; the draft suggests their Discord.
-If no written permission arrives before the first paying customer, SparkyFitness gets hidden from new installs.
+1. **SparkyFitness:** written permission from the author (the e-mail draft is ready). If none → hidden from new installs.
+2. **Tandoor:** written permission from the authors. If none → hidden from new installs.
+3. **A lawyer reviews the licence list** (Tandoor, SparkyFitness, Emby, n8n, Plex, the paid "enterprise" parts, Redis).
+4. **Agent updates:** I may sign agent updates only until the first paying customer; after that you sign them.
+
+Your licence decisions are recorded: Emby, Plex and n8n stay. recipe-importer needs nothing unless we share it.
 
 ## Also today
 
-- **A new golden (0.287.0).** Baked early, because a box from the old golden would have shown the two apps without the
-  gate until its first update. The catalog check now refuses that case.
-- **A bug in one catalog check, fixed:** the check "does the app keep its data where we back it up" never actually
-  talked to any app. Fixed and proven; all apps must be checked again (my next work).
-- **Rows.** 3 closed, 14 opened (most are your licence choices). The list went from 422 to 436 rows.
+- **New version 0.288.0 and a new golden (0.288.0).**
+- **Rows.** 7 closed, 6 opened. The list went from 436 to 442 rows.
 
 ## What needs you
 
-1. **The licence table above:** keep, hide or ask, per row. **If you say nothing:** everything stays offered.
-2. **Send the SparkyFitness request** (the draft is ready). **If you do nothing:** it gets hidden before the first paying
-   customer.
-3. **Removing an app "with data" keeps its files** (Grimmory's books, MeTube's videos) in the household folder, and
-   the dialog does not say so. **Choose:** keep them and say so on the dialog (I would), or delete the app's own folder
-   too. **If you say nothing:** files stay, the dialog stays silent.
-4. **Demo box apps:** I installed Grimmory and MeTube on demo-hp for the test and removed them after. Want them kept
-   there for showing? **If you say nothing:** they stay removed.
-5. **One phone test (2 minutes), only if you want it:** say so, and I put MeTube back on demo-hp and give you a family
-   login; you open `video.enkisfelhom.hu` on your phone off wifi. **If you say nothing:** the proof stays my real-internet
-   test from here.
-6. Still open: Invidious and moonlight-web — I advise no to both. Pinchflat stays stopped (upstream paused).
+1. **plant-it:** keep the hidden template as it is, or remove it entirely (its image no longer exists). **If you say
+   nothing:** it stays hidden; nothing runs it.
+2. **Send the SparkyFitness request, and ask the Tandoor authors** (the "Before the first paying customer" list).
+3. **Phone test (2 minutes), only if you want it:** say so, and I put MeTube back on demo-hp with a family login.
 
 ## Standing steps
 
 - **Monthly security re-test: last run 2026-10-01, next due ~2026-11-01.** (You start it with the standing brief.)
-- **Weekly:** the golden bake (next around 9 October; today's bake was 0.287.0).
-- **SparkyFitness:** written permission from the author before the first paying customer, or `lifecycle: hidden`.
+- **Weekly:** the golden bake (next around 9 October; today's bake was 0.288.0).
 - **Registry clean-up:** only when the registry disk fills; "show me" mode first, then a person decides.