Decision 47 recorded (R-711 option A: open sign-up closed after the first admin)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/01-topology-and-trust.md

@@ -134,7 +134,9 @@ controller first (`forwardAuth`), and only a browser holding a gate cookie for t
 is minted after a valid dashboard session vouched for the browser (a 60-second, one-use token bound to the host, on
 the dashboard's own `/__gate/start`). The controller is in an app's request path ONLY while its gate is closed; once
 open, the gate's traefik router is removed and the app is reached exactly as without it. The gate decides who creates
-the first admin; it does not decide who may sign up afterwards (R-711).
+the first admin. **Who may sign up afterwards** is `09` §3 decision 47 (operator ruling 2026-09-29): once the first admin
+exists, open sign-up is closed; only the admin adds people, from the app's own user page. An app that cannot close it
+says so on its page.
 
 ---
 

documentation/architecture/09-update-architecture.md

@@ -511,6 +511,11 @@ R-636's louder repeated alarm.
     request; a gated app answers 500 while the controller is down (closed, not open); a phone app cannot reach a gated
     app; an app with no probe waits for the household's press, and the press trusts the household. Not covered by the
     gate: open sign-up after the setup (R-711). Design record: `01-topology-and-trust.md` §5.
+47. **Open sign-up is closed once an app's first admin exists** — *operator ruling 2026-09-29 (R-711, option A).* After
+    the household's first admin exists, a stranger can no longer make an account; only the admin adds people, from the
+    app's own user page, and the app page says how. Where an app cannot close sign-up, it stays in the catalog and its
+    page says plainly that anyone who finds the address can make an account; STATUS asks the operator about it.
+    Mechanism and per-app proof: *(filled in by the 2026-09-29 afternoon session)*.
     Same day, operator: CC changes the admin passwords of demo-hp's installed bookstack and calibre-web and stores them
     in the operator's credentials file (not in any repo).