diff --git a/REPORT.md b/REPORT.md
index fd2ad1a..418a0f9 100644
--- a/REPORT.md
+++ b/REPORT.md
@@ -1,9 +1,14 @@
-# REPORT — 2026-09-30 (late): same-tag security fixes become tested steps (decision 52)
+# REPORT — the first full monthly re-test (decision 55); mealie's lockout; two harness fixes (2026-10-01)
 
-Evidence: `felhom.eu/documentation/audits/night-rulings-2026-09-30/`. Operator report: `felhom.eu/REPORT-night-rulings-2026-09-30.md`.
+Full session report: `felhom.eu/REPORT-rulings-2026-10-01.md`.
 
-- `6a3ead9`: the re-test entry, its gates and decoys, `upgrade-test.py --retest`, `scripts/retest-floating.py` (the monthly
-  command), `retest_box.py`, `box_walk.py`, `BENCH_ENV_OVERRIDES`. Proven end to end on 9202. Run today: nothing on the
-  engine lines; two exact tags rebuilt upstream (R-743).
-- `45d8482`: wger's JWT key pair (R-737).
-- Runbook: `felhom.eu/documentation/runbooks/monthly-floating-retest.md`.
+- **Re-test run** (`09` §3 decisions 54, 55): `retest-floating.py --push` over every app with a proven ladder. nextcloud
+  `34.0.4-apache` `3b59dfb` and linuxserver sonarr `4.0.20` `1a37032` — both DONE on both venues (bench 9401 swap 0 with the
+  10-minute watch; 9202 through the guarded Update). ~17 min per app. Evidence `felhom.eu/documentation/audits/retest-2026-10/`.
+- **R-749** `9e53205`: the re-test refused a fresh bench (checked `/opt/upg` before copying it). Fixed; the re-run started.
+- **R-746** `804884a`: `image_digest.resolve` asks for a `@digest` by digest; `scripts/test_image_digest.py`; red: the old
+  resolver fails 3 of 4; live: an invented digest → HTTP 404 (was the tag's digest).
+- **R-744** `9fc7052`: outline's fixture reads `__Host-csrfToken` (Outline 1.10 on HTTPS); proven on 9202 at 1.10.1.
+- **R-747** `a4597cd` (decision 57, decided by CC unattended — operator may reverse): mealie `SECURITY_USER_LOCKOUT_TIME=1`;
+  9202: locked 120 min after 5 wrong logins, then the right password works.
+- Gates: `catalog_gates.py --fast` OK before each push; every push through the pre-push gates (no `--no-verify`).