# STATUS — what works, what's broken, what's next

**Updated 2026-09-29 afternoon. Both demo boxes run controller 0.281.0 and host agent 0.137.0. Hub 0.125.0. New installs get golden 0.276.0 with agent 0.137.0.**

**Decisions today.** Yours: after an app's first admin exists, strangers can no longer sign up. Mine (you may reverse it): most apps have no switch the box can flip to close sign-up. So the box blocks just the app's sign-up address after the setup. The household can open it for 15 minutes from the app page, so a family member can join.

**What I did, and it worked.**
- **The gate is on 32 of the 34 apps where the first visitor would become the admin.** On a new install a stranger gets only the gate page. You, signed in to the dashboard, go straight to the setup. I tested every one on the scratch box.
- **9 apps open the gate by themselves** when their setup is done. The rest open with the "Done" button.
- **The "Done" button now asks the app first.** If the app says "not done", the button refuses. I tested it on zipline before its setup.
- **Strangers can no longer sign up after the setup.** 11 apps let anyone make an account; the box now blocks that. 11 more refuse strangers by themselves. The 15-minute window works and closes again by itself.
- **claper's password step is safe** for passwords with unusual characters. I tested one with a quote mark in it.
- **Apps already installed were not closed.** I checked this first, and again on both demo boxes after the update.

**What is not done.**
- **wanderer is not closed.** Its web part calls its own database through the public address, and a gate would block that call. So a stranger can still create its admin and sign up. It needs a small design change.
- **seerr, outline and rallly** are closed to strangers. I could not test the opening, because it needs a media server or e-mail.
- **3 apps have a "setup done" signal the box cannot read yet** (ghost, home-assistant, gramps-web). They use the button for now.

**Rows.** 3 opened, 3 closed, plus 1 for you. The list went from 350 to 353 rows.

**What needs you.**
1. **wanderer:** (A) keep it in the catalog until I fix it; its page now says plainly that anyone who finds the address can make an account (I recommend A; the fix is small). (B) Hide it from new installs until fixed. If you do nothing: A.
2. **Apps installed before today on the demo boxes** (adventurelog, opengist) still allow open sign-up. (A) Add a one-time "close sign-up now" button for installed apps. (B) Leave them; only the demo boxes have such installs. If you do nothing: B.
3. **D4, the image copies, the Peti leftovers:** unchanged. If you do nothing, nothing changes.