# STATUS — what works, what's broken, what's next

**Updated 2026-09-29 morning. Both demo boxes run controller 0.280.0 and host agent 0.137.0. Hub 0.125.0. New installs get golden 0.276.0 with agent 0.137.0.**

**Decisions today** (yours, recorded): I changed the HP box's two demo passwords. The "gate" was tested first, and built only because the test passed.

**What I did, and it worked.**
- **The HP box's bookstack and calibre-web have new admin passwords.** They are in your credentials file, under names starting `DEMO_HP_`. The old shared passwords no longer work. Their pages no longer warn.
- **The gate test passed.** A new app whose first visitor would become its admin is now closed to strangers until you set it up. A stranger sees a page that says "This app is waiting for its first setup. Sign in to the Felhom dashboard." You, signed in to the dashboard, go straight in. It adds about 2 ms.
- **The gate opens by itself** when the app says it has an admin (immich, n8n, audiobookshelf: within 30 seconds of the setup). For an app that cannot say it, you press "Kész, beállítottam" on the app page (uptime-kuma).
- **After it opens, nothing of it is left.** immich's phone-app login worked unchanged.
- **Every app that started with a known password now gets its own random one**: mealie, wger and calibre-web joined claper and bookstack.
- **Small fixes:** wger's login did not work from any browser (fixed). romm and zipline no longer show a login that does not exist. grafana refuses to start without its password. Installed apps' passwords are no longer inside the settings page's code; the eye button fetches them.
- **New button on the app page:** "Megváltoztattam" / "I changed it", under a known default login.

**What is not done.**
- **30 apps still let the first visitor create the admin.** Each needs the gate switched on and tested. That is the next sessions' work, as you chose.
- **About a dozen apps still allow open sign-up after the setup.** The gate does not change that. Written down.
- **I did not test a restore of a gated app live.** It needs a whole-box backup, which test runs must not do. The code keeps the gate's state through a restore, and a test checks it.

**Costs you should know** (no decision needed): while an app is still closed, its phone app cannot reach it, and it stops answering if the controller is down. "Kész, beállítottam" trusts you: pressed too early, the app opens before you set it up.

**Rows.** 4 opened, 4 closed. The list went from 346 to 350 rows.

**What needs you.**
1. **D4, the image copies, the Peti leftovers:** unchanged. If you do nothing, nothing changes.