# STATUS — what works, what's broken, what's next

**Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**

**Updated 2026-10-01 (night). Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.**

**Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.

## Tonight: the first new apps through the checklist

- **wger is hidden** from new installs until its two problems are fixed. No box has wger.
- **Three new apps are in the catalog, each fully tested:** Radicale (calendar and contacts), Karakeep (bookmarks),
  Dawarich (location history). Each passed all 60 checks, with a tested update and a tested restore.
- **Their logos and screenshots reach the boxes only with the next hub release.** Until then the cards have no picture.
- **Grimmory (e-book library) is ready but NOT published.** A stranger who guesses wrong 5 times locks everyone out of
  its login for 15 minutes. You decide (below).
- **Not built, on the fit check:** Grimoire (its makers say: never put it on the internet), MeTube (it has no login at
  all), Pinchflat (its makers stopped working on it).
- **Fit check only, as you asked:** Invidious and moonlight-web. My advice: build neither (below).

## The fit table, one line each

- **Radicale** — build. Done.
- **Karakeep** — build with a note (it visits every page you save; AI is off unless you give it a key). Done.
- **Dawarich** — build with a note (a known login at first, replaced at install; map pictures come from its makers' server). Done.
- **Grimmory** — build with a note. Built, waiting for your word.
- **Grimoire** — stop. Its makers say it must not be on the internet, and there is no ready image.
- **MeTube** — stop for now. No login at all: anyone who finds it downloads through your home connection.
- **Pinchflat** — stop. No new version since September 2025.
- **Invidious** — stop (my advice). It breaks when YouTube changes, and YouTube can block the household's home address.
- **moonlight-web** — stop. It needs a gaming PC and network paths our tunnel does not carry.

## Earlier today

- **The new-app checklist is built** (60 checks; a new app cannot reach the catalog without its filled-in copy). The test
  on wger found its 4 known problems and 3 more (no styling or photos, strangers can sign up, no e-mail).
- Your afternoon decisions are built: calibre-web's secret login name; the registry clean-up rule (it deleted nothing).

## What broke tonight, and what I did

- **Radicale's first version lost your login after a restore.** Found in testing, fixed before it went out.
- **After "remove the app, keep backups" and a restore, one of the two sign-up locks is gone** (the app's own lock
  still holds). Written down for the box.
- **The box's health check writes "healthy" when it could not check at all.** The app's state still showed the problem.
  Written down.
- Karakeep needed more memory than first planned. It now has room for saving many heavy pages at once.

**Rows.** Tonight: 11 opened, one of them already closed (the Radicale restore problem). The list went from 399 to 410 rows.

## What needs you

1. **Grimmory: publish it now, or wait?**
   - **A — publish now** with a sentence on its page: "if someone guesses your password wrong 5 times, the login waits
     15 minutes." E-reader apps keep working during the wait (measured).
   - **B — wait** until the box can tell visitors apart (the bigger build you have not decided yet). Nobody gets Grimmory
     until then.
   - I would choose **A**: the lock is short, it is the web page only, and e-readers are not touched. It is like mealie's lock, which you kept.
2. **Invidious and moonlight-web: build or not?** I advise **no** for both. If you do nothing, neither is built.
3. **MeTube and Pinchflat (video downloaders):** stopped for other reasons (no login; makers stopped). The YouTube
   sentence („Csak saját használatra…") waits until one of them is built.
4. Older, nothing urgent: should apps see each visitor's real address; is the design document or the build right about
   where the tunnel runs.

## Standing steps

- **Monthly security re-test: last run 2026-10-01, next due ~2026-11-01.** (You start it with the standing brief.)
- **Weekly:** the golden bake (around 8 October).
- **Registry clean-up:** only when the registry disk fills; "show me" mode first, then a person decides.