felhom.eu/REPORT-new-apps-2026-10-01.md

REPORT — wger hidden; the first new apps through the checklist (2026-10-01, night)

Architecture read: 09-update-architecture.md §3 (13, 22, 42, 45–50, 57, 61) and §6.5; 01-topology-and-trust.md (the HTTP-only tunnel; §5 the setup gate); 07-backup-architecture.md (classes). Evidence: documentation/audits/new-apps-2026-10-01/ (README, FIT.md, A/ B/ S/ G/ bench/ box/ undo/ shots/ wip/ tools/).

The Part table

part	result	changed from the brief, and why
0 — wger hidden	done — catalog 55b8c8a; on 9202 after a sync wger is not on the app list (control: mealie is, plant-it is not)	none
A — fit table	done — FIT.md, nine apps; verdicts in STATUS	three research passes in parallel, facts kept with their sources
B — build in order	Radicale, Karakeep, Dawarich published; Grimmory tested and held (R-775); Grimoire, MeTube, Pinchflat stopped on the fit verdict	no app was "not reached": every app in the order got its verdict before 23:00

The fit table (one line each — the full table is FIT.md)

Radicale build · Karakeep build with a note · Dawarich build with a note · Grimmory build with a note · Grimoire stop (upstream: public exposure unsupported; no 1.x image) · MeTube stop (no login by design) · Pinchflat stop (paused upstream; no tag for its last release) · Invidious stop recommended (companion-only playback, YouTube blocks the household's IP) · moonlight-web stop (UDP / gaming PC).

Claims in the brief that turned out wrong

1. Grimmory / BookLore — "the original was abandoned" is half right: the developer deleted it 2026-03-23, it came back ~04-30 in maintenance mode pointing at BookOrbit; grimmory-tools/grimmory is the right fork (an organisation, 24 releases in 2026).
2. Invidious — the "signature helper" is gone; invidious-companion replaces it and the po_token generator.
3. moonlight-web — two unrelated projects; both have a WebSocket fallback (the brief implied UDP only).
4. Karakeep's AI default — off unless a key is set (as the brief hoped); not in the brief: its phone app sends crash reports to its makers.
5. Grimoire is not a lighter Karakeep we can publish — its makers rule out internet exposure.
6. SparkyFitness and Calibre-Web Automated — confirmed already in the catalog.
7. Radicale — the brief offered tomsquest/docker-radicale or upstream: upstream's own ghcr.io/kozea/radicale chosen (same cadence, multi-arch, the project's own).

Per published app

app	commit	record	bench (swap 0)	9202	memory peaks (anon)	ladder
Radicale	195129c	60/60 done or n/a	proven	step done 14 s; undo on a forced failure; remove + restore read back	26 MiB / 128M	3.8.0 → 3.8.1
Karakeep	882ac14	60/60	proven (768M: 79 %; 1024M: 51 %)	step done 95 s; restore read back; 10-page burst at 1536M	web 832 / 1536M, chrome 218 / 768, meili 84 / 512	0.33.1 → 0.33.2
Dawarich	72247a3	60/60	proven	step done 158 s; restore read back + own password signs in	app 460–505 / 1024, sidekiq 270–314 / 1024, db 148 / 512	1.15.2 → 1.15.3

Grimmory — bench proven (v3.4.1 → v3.5.0, app 522 / 1024M, db 109 / 384M); on 9202 the update step done in 78 s, the gate opened by its own probe (data false → true), OPDS through traefik right 200 / wrong 401, and a stranger's 5 wrong sign-ins locked every visitor out (429) for 15 min (Caffeine expireAfterWrite(15 min), keys by address and by name, hard-coded) — while the OPDS feed kept working. Held: R-775 (operator: A publish with a page sentence / B wait for R-753).

Rows

Opened R-765 (Radicale restore — closed the same session), R-766 (assets reach boxes only with a hub release), R-767 MeTube, R-768 Grimoire, R-769 Pinchflat, R-770 Invidious, R-771 moonlight-web, R-772 a probe that cannot run records healthy, R-773 sign-up block lost after remove + restore, R-774 Karakeep/Dawarich mail ON + Karakeep's phone-app crash reports, R-775 Grimmory lock-out. Notes on R-762/R-763 (wger hidden). Register 399 → 410.

Teardown

• Machine (9202): every app installed tonight removed through the product (Radicale, Karakeep, Dawarich with data; Grimmory keeping drive data because of R-756's 409, then its harness-made test folders deleted by name, two empty folders removed only after checking they were empty); no container or volume of tonight's apps left; temp files removed; back on the LIVE catalog (B/B9-restore-live.txt: clone = live 72247a3, standing apps healthy).
• Host (demo-hp): bench LXC 9401 destroyed (pct destroy --purge); the drill repo reset to live main.
• Hub: untouched (9202 is unenrolled; no asset reseed — R-766).
• Secrets: the 9202 dashboard password and the generated app passwords lived in a 0600 scratch directory, never printed; the evidence was scanned for their values (none); the scratch directory is shredded at the end.