# STATUS — what works, what's broken, what's next

**Updated 2026-09-28 evening. Both demo boxes run controller 0.279.0 and host agent 0.137.0. Hub 0.125.0. New installs get golden 0.276.0 with agent 0.137.0.**

**Decisions today** (yours, recorded): the HP box's restore test uses the big NVMe disk. No app goes live with a login a stranger knows.

**What I did, and it worked.**
- **claper and bookstack now get their own random first password.** The box sets it right after install and shows it on the app page. The old shared password no longer works. Tested on fresh installs; for claper also after a restore.
- **Every app with a known default login now says so** on the install page and the app page: "This app starts with a known, shared password: … Change it right after the install."
- **The HP box's full-system restore test works now, on the NVMe disk.** It needed one Proxmox permission, which you approved. The test passed in 9 minutes; the other disk was not touched.
- **A running app whose backup holds no data now raises an alarm** for us and a sentence on its backup page. Yesterday's nextcloud case was silent.
- **A debug button runs the night's backup chain now**, in the night's order. Tested on the scratch box.
- **Removing an app "with its backups" now also deletes its off-site check copy.**
- **ep0:** the test install's network link was already gone. Nothing to remove.

**What is not done.**
- **37 apps still start with a login a stranger can take.** 3 have a known default (calibre-web, mealie, wger). 34 let the first visitor create the admin. You chose to fix them over several sessions. The list and the route for each are written down.
- **On the HP box, the installed bookstack and calibre-web still accept their default passwords.** I changed nothing there, as the brief said. Their pages now warn.
- **romm's page shows a default login that does not exist.** Filed with the 37.
- **The night watch did not run.** It was optional.

**Rows.** 3 opened, 2 closed. The list went from 342 to 345 rows.

**What needs you.**
1. **The installed bookstack and calibre-web on the HP box:** (A) I change their admin passwords on the box and show them to you (I recommend this; they are on the internet), or (B) leave them. If you do nothing, anyone who knows those defaults can log in to the two demo apps.
2. **D4, the image copies, the Peti leftovers:** unchanged. If you do nothing, nothing changes.