# STATUS — what works, what's broken, what's next

**Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**

**Updated 2026-10-01 (late night). Both demo boxes run controller 0.286.1 and host agent 0.138.0. Hub 0.126.0. New
installs get golden 0.286.1 with agent 0.138.0.**

**Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.

## Tonight: the box tells visitors apart

- **Before:** through the internet every visitor looked like the same address. A stranger's 5 wrong passwords locked the
  whole family out of the box's own dashboard for a minute, and out of some apps.
- **Now:** the box sees each visitor's real address, and a stranger cannot fake it. Measured on demo-hp through the real
  internet path: a stranger's wrong passwords locked only that stranger.
- **Apps:** 19 apps would have believed a faked address. They are protected, in the same update. BookStack now locks
  only the stranger, measured. Home Assistant no longer treats every internet visitor as "at home".
- **Not measured:** a second outside address on the real internet path. The test machine abroad was refused by
  Cloudflare before it reached the box. A 2-minute test from your phone would close it.

## The permanent family gate: tested, NOT built

- A gate with a login for each family member, in front of Grimmory and MeTube, passed every test on the scratch box.
- **Strangers:** they reached nothing, and their wrong guesses locked only themselves.
- **Family:** members stayed signed in for 30 days, logout worked, and the family login does not open the dashboard.
- **E-readers:** Kobo, KOReader and OPDS readers kept working with Grimmory's own login.
- **Cost:** under 1 ms per page. If the box's controller is down, the gated apps refuse — they never open.

## Also tonight

- **SparkyFitness passed most of the checklist.** One problem: its **licence forbids commercial use** without the
  author's written permission (below).
- **Two box fixes:**
  - The health check now says "not checked" instead of "healthy" when it could not look.
  - A removed and restored app keeps its sign-up lock.
- **A new golden.** Fresh installs get today's version.

**Rows.** 4 closed, 12 opened. The list went from 410 to 422 rows.

## What needs you

1. **The permanent family gate: build it or not?**
   - **Go:** 2 work sessions — the box first, then Grimmory and MeTube published behind it.
   - **No-go:** Grimmory stays unpublished, and MeTube is not built.
   - **If you say nothing:** nothing is built, and the next sessions do other work.
   - I would choose **go**. It also answers Grimmory and MeTube.
2. **SparkyFitness's licence** says "non-commercial use only".
   - **A:** hide it from new installs and ask the author for permission.
   - **B:** keep it offered while asking.
   - I would choose **A**.
   - **If you say nothing:** it stays offered.
3. **Grimmory:** publish behind the family gate (if go), or as it is now. Its lock is per visitor since tonight; read in
   its code, not yet measured.
4. **One phone test (2 minutes):** sign in to demo-hp's dashboard from your phone off wifi, while I lock out my own
   address. If you skip it, the second-address proof stays the simulated one.
5. Still open from before: Invidious and moonlight-web — I advise no to both. MeTube and Pinchflat are stopped.

## Standing steps

- **Monthly security re-test: last run 2026-10-01, next due ~2026-11-01.** (You start it with the standing brief.)
- **Weekly:** the golden bake (around 8 October; tonight's bake was 0.286.1).
- **Registry clean-up:** only when the registry disk fills; "show me" mode first, then a person decides.