DRILL new household on golden 0.282.0: 0 interventions; ready for a first real tester on a new record

Audit doc, STATUS one sentence, capability-map first-hour row (walk re-proven, day-one
off-site sentence narrowed: R-720/R-726/R-727), teardown in four layers, R-600 measured again.
Secret scan over all audits: 0 hits, positive control 1.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -1,22 +1,23 @@
 # STATUS — what works, what's broken, what's next
 
-**Updated 2026-09-29 evening. Both demo boxes run controller 0.282.0 and host agent 0.137.0. Hub 0.125.0. New installs get golden 0.276.0 with agent 0.137.0.**
+**Ready for a first real tester: YES, on a new customer record — a fresh box went from the download to restored apps with no help at all; fix the volunteer guide first, and decide whether their apps go off-site by themselves (today they do not).**
 
-**Decisions today** (yours, recorded): wanderer stays, with its warning, until it is closed. Apps installed before the sign-up rule get a "close sign-up now" button.
+**Updated 2026-09-30 morning. Both demo boxes run controller 0.282.0 and host agent 0.137.0. Hub 0.125.0. New installs get golden 0.282.0 with agent 0.137.0 (baked and vouched last night).**
 
 **What I did, and it worked.**
-- **Sign-up now has two locks.** 9 apps have their own "no sign-up" setting. The box switches it on after your first account exists. The address block stays as the second lock.
-- **The block resists address tricks now.** I tried 113 tricks on 11 apps (capital letters, extra slashes and similar). None got in. Two tricks worked before I fixed them.
-- **"Close sign-up now" works.** I pressed it on the HP box's adventurelog and opengist, and on the N100's opengist. Strangers can no longer sign up there. adventurelog restarted once for about 30 seconds.
-- **wanderer is closed too.** It cannot have the gate. You make your account, then press "close sign-up now".
-- **ghost, home-assistant and gramps-web now open their gate by themselves** after the setup, like 9 other apps.
-- **A new catalog check** stops a wrong "setup done" check from reaching the catalog.
+- **A fresh box, walked like a volunteer, needed no help.** Download, install on the Hungarian keyboard, the e-mailed link, the dashboard through the internet, the recovery code, three apps, a family member, backup, restore, delete, a power cut, typos, a phone. Last walk needed one intervention; this one needed none.
+- **The new safety parts held on a fresh box.** Strangers saw only the gate page. The gate opened by itself after the household's setup. Sign-up stayed closed. The random first password worked, and the old default password was refused.
 
-**What is not done.**
-- **opengist and wishlist** keep their own "no sign-up" setting inside their database. The box cannot reach it yet, so they have the address block only. It held against every trick.
-- **The "close sign-up now" card does not say the app restarts.** Small text fix, written down.
+**What broke.**
+- **No off-site copy on night one.** Every app starts with its off-site copy switched off, and nothing tells the household. On top of that, tester-1's old off-site store belonged to an earlier box, so the box skipped it all night. The household's data stayed safe on the box.
+- **The night's restore test tried an old box's backup** and failed on its key. The page shows a bare ✗ and names the wrong place.
+- **A Stop pressed during a backup was undone by that backup.**
+- **The volunteer guide is out of date in five places.** For example, it still gives BookStack's old default password, which is now refused.
 
-**Rows.** 3 closed, 2 opened. The list went from 353 to 355 rows.
+**Rows.** 9 opened, 1 closed. The list went from 350 to 359 rows.
 
 **What needs you.**
-1. **D4, the image copies, the Peti leftovers:** unchanged. If you do nothing, nothing changes.
+1. **Decide: should apps go off-site by themselves?** Option A: yes, every app is switched on when the customer has off-site (my pick — that is what the guide already promises). Option B: no, the guide tells the household to switch each app on. If you do nothing, a new household's apps have no off-site copy.
+2. **Approve the guide fix** (five lines, I write them). If you do nothing, a volunteer tries BookStack's old password and fails.
+3. **Three whole-machine backups of deleted drill boxes are still in tester-1's space on ep0** (two from 16 September, one from last night). I only looked; I did not touch them. The old ones make the restore test fail. If you do nothing, every new tester-1 box repeats that failure. Say "remove them" and I will do it with before/after checks.
+4. **D4, the image copies, the Peti leftovers:** unchanged. If you do nothing, nothing changes.