felhom.eu/STATUS.md

STATUS — what works, what's broken, what's next

Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).

Updated 2026-10-01 (night). Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.

Tester-2 — read only, from the hub. The customer record exists. Tester-2's box has not registered yet.

Tonight: the first new apps through the checklist

• wger is hidden from new installs until its two problems are fixed. No box has wger.
• Three new apps are in the catalog, each fully tested: Radicale (calendar and contacts), Karakeep (bookmarks), Dawarich (location history). Each passed all 60 checks, with a tested update and a tested restore.
• Their logos and screenshots reach the boxes only with the next hub release. Until then the cards have no picture.
• Grimmory (e-book library) is ready but NOT published. A stranger who guesses wrong 5 times locks everyone out of its login for 15 minutes. You decide (below).
• Not built, on the fit check: Grimoire (its makers say: never put it on the internet), MeTube (it has no login at all), Pinchflat (its makers stopped working on it).
• Fit check only, as you asked: Invidious and moonlight-web. My advice: build neither (below).

The fit table, one line each

• Radicale — build. Done.
• Karakeep — build with a note (it visits every page you save; AI is off unless you give it a key). Done.
• Dawarich — build with a note (a known login at first, replaced at install; map pictures come from its makers' server). Done.
• Grimmory — build with a note. Built, waiting for your word.
• Grimoire — stop. Its makers say it must not be on the internet, and there is no ready image.
• MeTube — stop for now. No login at all: anyone who finds it downloads through your home connection.
• Pinchflat — stop. No new version since September 2025.
• Invidious — stop (my advice). It breaks when YouTube changes, and YouTube can block the household's home address.
• moonlight-web — stop. It needs a gaming PC and network paths our tunnel does not carry.

Earlier today

• The new-app checklist is built (60 checks; a new app cannot reach the catalog without its filled-in copy). The test on wger found its 4 known problems and 3 more (no styling or photos, strangers can sign up, no e-mail).
• Your afternoon decisions are built: calibre-web's secret login name; the registry clean-up rule (it deleted nothing).

What broke tonight, and what I did

• Radicale's first version lost your login after a restore. Found in testing, fixed before it went out.
• After "remove the app, keep backups" and a restore, one of the two sign-up locks is gone (the app's own lock still holds). Written down for the box.
• The box's health check writes "healthy" when it could not check at all. The app's state still showed the problem. Written down.
• Karakeep needed more memory than first planned. It now has room for saving many heavy pages at once.

Rows. Tonight: 11 opened, one of them already closed (the Radicale restore problem). The list went from 399 to 410 rows.

What needs you

1. Grimmory: publish it now, or wait?
   • A — publish now with a sentence on its page: "if someone guesses your password wrong 5 times, the login waits 15 minutes." E-reader apps keep working during the wait (measured).
   • B — wait until the box can tell visitors apart (the bigger build you have not decided yet). Nobody gets Grimmory until then.
   • I would choose A: the lock is short, it is the web page only, and e-readers are not touched. It is like mealie's lock, which you kept.
2. Invidious and moonlight-web: build or not? I advise no for both. If you do nothing, neither is built.
3. MeTube and Pinchflat (video downloaders): stopped for other reasons (no login; makers stopped). The YouTube sentence („Csak saját használatra…") waits until one of them is built.
4. Older, nothing urgent: should apps see each visitor's real address; is the design document or the build right about where the tunnel runs.

Standing steps

• Monthly security re-test: last run 2026-10-01, next due ~2026-11-01. (You start it with the standing brief.)
• Weekly: the golden bake (around 8 October).
• Registry clean-up: only when the registry disk fills; "show me" mode first, then a person decides.