New apps 2026-10-10: Grocy and LubeLogger on the website; Monica stopped

The catalogue side is app-catalog-felhom.eu b7f0f7c. Here: the evidence, the
website, the register and the operator's view.

Website
- Two cards in the Otthon & Eletmod / Home & Lifestyle section of BOTH apps
  pages, with assets: grocy-logo.svg is grocy's own icon with its single fill
  made white like the other logos, lubelogger-logo.png is the app's own icon
  with its dark background dropped and the mark made white (the rule
  SparkyFitness's PNG follows), and six screenshots of each app's own UI with a
  household's own data, taken headless on the bench from the published template.
- The app count moved 56 -> 58 in 15 places per language set, both languages,
  and the open-source tile 49 -> 51. Checked by asking the same patterns for the
  new number afterwards. marketing/facebook/COPY.md still says 56 and is NOT
  changed: the post it carries is already scheduled.

Evidence
- documentation/audits/new-apps-2026-10-10/ — FIT.md (checklist group 0 for all
  three, with the Hungarian-UI column), the bench and box transcripts, the
  memory samples, the screenshots and the gate runs.

Register: 137 -> 139 rows, 2 opened, 0 closed.
- R-926 after a remove-keeping-backups and restore, nobody has checked what the
  app page shows for an after_install app's generated password. Measured here:
  LubeLogger is safe (its login is derived from the environment at every start,
  the new password signs in, the data is back); grocy's install password still
  signs in from the restored database but the deployed environment no longer
  carries ADMIN_PASSWORD at all. Seven apps are in the class.
- R-927 Monica, stopped at checklist 0.2 with the measurements, waiting on the
  operator.

Gate scripts: the same console trap in nineteen of them and in repo_gates.py
itself, where it ABORTED THE WHOLE RUNNER at the first gate — printing a
non-ASCII character on this workstation's cp1250 console raised
UnicodeEncodeError before the gate had decided anything, and reuse_refs_check.py
died while printing a NOTE. All now reconfigure their own streams. Red-proof
that the remaining script-test failures are not mine: test_due_checks_gate.py
fails the same 5 of 42 with the change reverted.

STATUS.md

@@ -3,8 +3,32 @@
 **Ready for the first real tester (Tester-2): yes. Tester 2 (a laptop) is off; nothing was sent to it.**
 
 **Updated 2026-10-10: hub 0.145.0; demo-hp, demo-felhom and Tester 1 run agent 0.154.0 and controller
-0.305.0. The open-items list is at 137. Reports: `REPORT-release-2026-10-10.md`, `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
+0.305.0. The open-items list is at 139. Reports: `REPORT-new-apps-2026-10-10.md`, `REPORT-release-2026-10-10.md`, `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
 
+## Saturday 2026-10-10 (afternoon): two new apps in the catalogue, and one that was stopped
+
+- **Grocy and LubeLogger are in the catalogue.** Grocy runs the household — what food is in the house, what
+  runs out, the shopping list, the chores — and LubeLogger keeps the family car's services, repairs, fuel and
+  costs. Both went through the whole 61-check list on the test machines; nothing was taken on trust.
+- **Monica is NOT in, and that is the one thing I need you to decide.** It has had no release of any kind for
+  seventeen months and no finished release for two and a half years; the branch its own README calls "the
+  stable version" has not moved since May 2024; and the two commits that ended a 13-month silence add a notice
+  saying the authors' own hosted service and all its data will be deleted at the end of December 2026, before a
+  rewrite. Keeping it out costs us nothing we have today — no app covers a family address book either way, and
+  Radicale already carries contacts to a phone. **If you do nothing, it stays out.**
+- **Two real faults were found and fixed before either app was offered to anyone:**
+  1. LubeLogger **ships with no login at all**. On a default install a stranger who found the address could read
+     the family's car records *and add to them*. I measured exactly that, and our install now turns the app's own
+     login on from a generated password before the app answers its first request.
+  2. Grocy **could not be updated**. Moving it from the previous version to the current one left every page
+     showing an error, because the app keeps a settings file written at the first install and never updates it.
+     Our install now rewrites that file at every start. The update works on both test machines after the fix,
+     and the product's own "undo" was watched putting the old version back, with the data intact, before it.
+- **The app count on the website moved from 56 to 58**, in both languages, everywhere it is stated.
+- **One thing I could not finish and did not pretend to:** after a household removes an app keeping its backups
+  and restores it, the password the app's page shows is no longer backed by anything the box stored. The data
+  and the household's own login are fine — I checked both — but nobody has looked at what that page then
+  displays. It is written down as an open item.
 ## Saturday 2026-10-10: released — the security hole is closed, and the kernel button shows
 
 - **Hub 0.145.0 is live** (you were present). One box's key could change another household's mail settings. Now it