mealie: lockout 1 hour instead of 24 (R-747, 09 decision 57 — decided by CC unattended, operator may reverse)

mealie locks the ACCOUNT after 5 wrong logins and its login names (admin, changeme@example.com) are public, so a
stranger could lock the household out for a day. Measured on 9202 with SECURITY_USER_LOCKOUT_TIME=1: the right
password answered 423 for 120 min (the hourly job lifts it after the hour), then 200; a wrong one still 401.
Evidence: felhom.eu/documentation/audits/rulings-2026-10-01/C/. CHANGELOG also records today's re-test run and fixes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,19 @@
+## The first full monthly re-test (decision 55); the digest resolver, the outline fixture, the re-test's start (2026-10-01)
+
+- **The monthly re-test now covers every app with a proven ladder** (`09` §3 decisions 54, 55; R-743). First full run:
+  **nextcloud** `34.0.4-apache` `3b59dfb` and linuxserver **sonarr** `4.0.20` `1a37032` re-tested at the registry's new
+  digests on both venues (bench 9401 swap 0 with the 10-minute watch; 9202 through the guarded Update) and written as
+  re-test entries. ~17 min per app. Evidence `felhom.eu/documentation/audits/retest-2026-10/`.
+- **`retest-floating.py` could not start on a fresh bench** `9e53205` (R-749): it asked for `/opt/upg/upgrade-test.py`
+  before the step that copies it there. It now asks for docker + python3, and for the file after the sync.
+- **`image_digest.resolve` honours a `@digest`** `804884a` (R-746): it asks the registry for that manifest; a digest
+  the registry no longer serves is refused (it answered the tag's current digest). `scripts/test_image_digest.py`.
+- **mealie: a stranger's wrong passwords lock the household out for 1-2 hours, not a day** (R-747; `09` §3 decision 57,
+  decided by CC unattended — operator may reverse): `SECURITY_USER_LOCKOUT_TIME=1`. mealie locks the ACCOUNT after 5
+  wrong logins and its login names are public. Measured on 9202: 5 wrong → 423 for the right password too; open again
+  after 120 min (the hourly job); a wrong password still refused after. Other apps with the same shape: R-752.
+- **outline's fixture reads Outline 1.10's `__Host-csrfToken`** `9fc7052` (R-744): proven on 9202 at 1.10.1.
+
 ## Same-tag security fixes as tested steps (decision 52); wger's app login; wanderer on the bench (2026-09-30, late)
 
 - **Re-tests (`09` §3 decision 52, R-740)** `6a3ead9`: a ladder entry whose `from` equals its `to`, carrying `digest_from`

templates/mealie/docker-compose.yml

@@ -20,6 +20,11 @@ services:
     restart: unless-stopped
     environment:
       - ALLOW_SIGNUP=false
+      # R-747 (decided by CC unattended 2026-10-01, `09` §3 decision 57 — operator may reverse): mealie locks the ACCOUNT
+      # after 5 wrong logins for SECURITY_USER_LOCKOUT_TIME hours (default 24), and its login names (admin,
+      # changeme@example.com) are public — a stranger could lock the household out for a day. 1 hour (the unit's
+      # minimum) keeps the guard; mealie's hourly job lifts it, so a lock lasts 1-2 h (measured on 9202: 120 min).
+      - SECURITY_USER_LOCKOUT_TIME=1
       - PUID=1000
       - PGID=1000
       - TZ=Europe/Budapest