felhom.eu/REPORT-signup-lock-2026-09-29.md

REPORT — 2026-09-29 evening: sign-up locked twice; "close sign-up now"; wanderer closable; three more probes

Architecture read first: 09 §3 decisions 45–49, 01-topology-and-trust.md §5, audits/gate-rollout-2026-09-29/, rows R-714, R-715, R-716. Controller v0.282.0 (one release), floor 0.282.0, both demo boxes on it. Catalog 6446197. Evidence: documentation/audits/signup-lock-2026-09-29/ (A own switch, B tricks, C demo boxes, D wanderer, E probes, redproofs).

The Parts

Part	Step	State	Note
—	decisions 48, 49 recorded first	done	09 §3
A1	own switch per app (spike)	done	9 of 11 have an env switch (below); opengist, wishlist only in their database (R-717)
A1	"can be set only after the first admin"	measured	6 of 9 refuse the household's own first account while on; 3 (calcom, gitea, gramps-web) do not
A2	after_setup: (controller)	done	env merged + one compose up -d when the gate opens; command form with after_install's argv rules; an old compose reported, not faked; retries every 30 min at most
A2	live	done	all 9 apps: record ok, running container carries the switch, a stranger straight at the app refused
A3	the window with an own switch	done — lift and restore	homebox: the window turned the switch off (one restart), a family member joined; after 15 min both locks back, a stranger refused through the web and straight at the app
B	trick table	done, changed	termix's router ignores case: /users/CREATE got past the old prefix block (its own switch refused it). All blocks now PathRegexp((?i)…), slash-tolerant. Final: 113 tries on 11 apps, 0 got in, 106 refused by the block, 7 were vikunja's plain HTML page (its API blocked)
B	login / reset / sharing	done	household sign-in on 7 apps; password reset and share routes reach the apps, not the block
C	"close sign-up now" (controller)	done	lock record opened_by: close-signup, block, own switch; offered once; never a gate
C3	demo boxes	done, changed	pressed on demo-hp adventurelog + opengist, demo-felhom opengist. "Before" proven WITHOUT making an account (the app answered an invalid sign-up with its own validation) — the apps' admin passwords are the operator's, so a test account could not be deleted through their admin pages. After: refused; login pages answer. adventurelog's backend restarted once (~30 s) for its own switch, same images (R-718: the card does not say so)
D	wanderer	done, changed	no gate: one DB URL for server and browser (measured), and no first-admin screen for a stranger (PocketBase's installer needs the log link). Closed by "close sign-up now": two holes found and closed (collection id _pb_users_auth_, collection name in capitals); proven on 9202
E1	probe reads lists / a done status	done	RP29, RP30
E2	ghost, home-assistant, gramps-web	done	before/after measured on fresh installs; each gate opened by itself within seconds of the setup; a press before the setup refused on all three
E3	catalog gate probe-measured	done	5 decoys seen failing; it caught immich/n8n/audiobookshelf (their note sat one block too high)

Part A / B — one row per app

app	own switch	blocks the household's first account?	own switch live after the gate	tricks (8 shapes per route)
adventurelog	DISABLE_REGISTRATION	yes	on; is_disabled: true	0 in
calcom	NEXT_PUBLIC_DISABLE_SIGNUP	no	on; "Signup is disabled"	0 in
gitea	GITEA__service__DISABLE_REGISTRATION	no	on; "Registration is disabled"	0 in
gramps-web	GRAMPSWEB_REGISTRATION_DISABLED	no	on; 405 "Registration is disabled"	0 in
homebox	HBOX_OPTIONS_ALLOW_REGISTRATION	yes	on; "user registration disabled"	0 in
papra	AUTH_IS_REGISTRATION_ENABLED	yes	on	0 in
sparkyfitness	SPARKY_FITNESS_DISABLE_SIGNUP	yes	on	0 in
termix	ALLOW_REGISTRATION	yes	on — and it caught the case hole	0 in
vikunja	VIKUNJA_SERVICE_ENABLEREGISTRATION	yes	on	0 in
opengist	none reachable (DB)	—	block only	0 in
wishlist	none reachable (DB)	—	block only	0 in
wanderer	PUBLIC_DISABLE_SIGNUP (web only)	—	on after the press	0 in after the fix (2 holes before)

Claims in the brief that turned out wrong (or right), named

• The three env names given from memory — right: gitea GITEA__service__DISABLE_REGISTRATION (through its env-to-ini), homebox HBOX_OPTIONS_ALLOW_REGISTRATION, papra AUTH_IS_REGISTRATION_ENABLED — each measured working.
• "A native setting can be set only after the first admin exists" — true for 6 of 9, wrong for 3 (calcom, gitea, gramps-web make their first admin by another route).
• "The address block can be passed by case or encoding tricks" — right for case, wrong for encoding: termix (router ignores case) and PocketBase (collection name in any case, and by id) got past the old blocks; percent-encoding, double slashes, trailing slashes and query strings never did (traefik decodes and cleans before matching).
• "wanderer separates its internal and public database URL" — wrong: one PUBLIC_POCKETBASE_URL for both.
• "gramps-web answers 405 only after its setup" — right: 200 with an owner token before, 405 after.

Also found

• The scratch box's Docker disk was full of old images (1 GB free) — the install check refused correctly; 44 unused images removed by name (no prune).
• test_gate_decoys.py had stopped running any case after docmost moved to PostgreSQL 18 (a typed "16"); fixed to read it.
• My own slip: I restarted the scratch box's controller while a removal job was running; one removal was cut off (502). Re-run; nothing left behind.

Rows

Closed: R-714, R-715, R-716. Opened: R-717 (opengist/wishlist own switch in their DB), R-718 (the close card should say the app restarts). Register 353 → 355 rows.

Teardown

Machines: 9202 — every test app removed through the product; no gate or block file left; back on the live catalog; the drill catalog reset. Demo boxes — the floor, and the three "close sign-up now" presses (ruled). Host: nothing. Hub: floor 0.282.0. ep0: untouched.