New apps night: Radicale, Karakeep, Dawarich published; Grimmory held (R-775); fit table; R-765..R-775; STATUS, CONTEXT, report, evidence

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT-new-apps-2026-10-01.md

@@ -0,0 +1,65 @@
+# REPORT — wger hidden; the first new apps through the checklist (2026-10-01, night)
+
+Architecture read: `09-update-architecture.md` §3 (13, 22, 42, 45–50, 57, 61) and §6.5; `01-topology-and-trust.md` (the
+HTTP-only tunnel; §5 the setup gate); `07-backup-architecture.md` (classes). Evidence:
+`documentation/audits/new-apps-2026-10-01/` (README, FIT.md, A/ B/ S/ G/ bench/ box/ undo/ shots/ wip/ tools/).
+
+## The Part table
+
+| part | result | changed from the brief, and why |
+|---|---|---|
+| 0 — wger hidden | **done** — catalog `55b8c8a`; on 9202 after a sync wger is not on the app list (control: mealie is, plant-it is not) | none |
+| A — fit table | **done** — `FIT.md`, nine apps; verdicts in STATUS | three research passes in parallel, facts kept with their sources |
+| B — build in order | **Radicale, Karakeep, Dawarich published; Grimmory tested and held (R-775); Grimoire, MeTube, Pinchflat stopped on the fit verdict** | no app was "not reached": every app in the order got its verdict before 23:00 |
+
+## The fit table (one line each — the full table is FIT.md)
+
+Radicale build · Karakeep build with a note · Dawarich build with a note · Grimmory build with a note · Grimoire **stop**
+(upstream: public exposure unsupported; no 1.x image) · MeTube **stop** (no login by design) · Pinchflat **stop** (paused
+upstream; no tag for its last release) · Invidious **stop recommended** (companion-only playback, YouTube blocks the
+household's IP) · moonlight-web **stop** (UDP / gaming PC).
+
+## Claims in the brief that turned out wrong
+
+1. **Grimmory / BookLore** — "the original was abandoned" is half right: the developer deleted it 2026-03-23, it came back
+   ~04-30 in maintenance mode pointing at BookOrbit; `grimmory-tools/grimmory` is the right fork (an organisation, 24
+   releases in 2026).
+2. **Invidious** — the "signature helper" is gone; `invidious-companion` replaces it and the po_token generator.
+3. **moonlight-web** — two unrelated projects; both have a WebSocket fallback (the brief implied UDP only).
+4. **Karakeep's AI default** — off unless a key is set (as the brief hoped); not in the brief: its phone app sends crash
+   reports to its makers.
+5. **Grimoire** is not a lighter Karakeep we can publish — its makers rule out internet exposure.
+6. **SparkyFitness and Calibre-Web Automated** — confirmed already in the catalog.
+7. **Radicale** — the brief offered `tomsquest/docker-radicale` or upstream: upstream's own `ghcr.io/kozea/radicale`
+   chosen (same cadence, multi-arch, the project's own).
+
+## Per published app
+
+| app | commit | record | bench (swap 0) | 9202 | memory peaks (anon) | ladder |
+|---|---|---|---|---|---|---|
+| Radicale | `195129c` | 60/60 done or n/a | proven | step done 14 s; undo on a forced failure; remove + restore read back | 26 MiB / 128M | 3.8.0 → 3.8.1 |
+| Karakeep | `882ac14` | 60/60 | proven (768M: 79 %; 1024M: 51 %) | step done 95 s; restore read back; 10-page burst at 1536M | web 832 / 1536M, chrome 218 / 768, meili 84 / 512 | 0.33.1 → 0.33.2 |
+| Dawarich | `72247a3` | 60/60 | proven | step done 158 s; restore read back + own password signs in | app 460–505 / 1024, sidekiq 270–314 / 1024, db 148 / 512 | 1.15.2 → 1.15.3 |
+
+**Grimmory** — bench proven (v3.4.1 → v3.5.0, app 522 / 1024M, db 109 / 384M); on 9202 the update step done in 78 s, the
+gate opened by its own probe (`data` false → true), OPDS through traefik right 200 / wrong 401, and a stranger's 5 wrong
+sign-ins locked every visitor out (429) for 15 min (Caffeine `expireAfterWrite(15 min)`, keys by address and by name,
+hard-coded) — while the OPDS feed kept working. Held: R-775 (operator: A publish with a page sentence / B wait for R-753).
+
+## Rows
+
+Opened **R-765** (Radicale restore — closed the same session), **R-766** (assets reach boxes only with a hub release),
+**R-767** MeTube, **R-768** Grimoire, **R-769** Pinchflat, **R-770** Invidious, **R-771** moonlight-web, **R-772** a probe
+that cannot run records healthy, **R-773** sign-up block lost after remove + restore, **R-774** Karakeep/Dawarich mail ON +
+Karakeep's phone-app crash reports, **R-775** Grimmory lock-out. Notes on R-762/R-763 (wger hidden). **Register 399 → 410.**
+
+## Teardown
+
+- **Machine (9202):** every app installed tonight removed through the product (Radicale, Karakeep, Dawarich with data;
+  Grimmory keeping drive data because of R-756's 409, then its harness-made test folders deleted by name, two empty
+  folders removed only after checking they were empty); no container or volume of tonight's apps left; temp files
+  removed; back on the LIVE catalog (`B/B9-restore-live.txt`: clone = live `72247a3`, standing apps healthy).
+- **Host (demo-hp):** bench LXC 9401 destroyed (`pct destroy --purge`); the drill repo reset to live `main`.
+- **Hub:** untouched (9202 is unenrolled; no asset reseed — R-766).
+- Secrets: the 9202 dashboard password and the generated app passwords lived in a 0600 scratch directory, never printed;
+  the evidence was scanned for their values (none); the scratch directory is shredded at the end.