CHANGELOG + REPORT: same-tag re-tests (decision 52), wger's key, wanderer on the bench

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,17 @@
+## Same-tag security fixes as tested steps (decision 52); wger's app login; wanderer on the bench (2026-09-30, late)
+
+- **Re-tests (`09` §3 decision 52, R-740)** `6a3ead9`: a ladder entry whose `from` equals its `to`, carrying `digest_from`
+  and `box_evidence`; `ladder.check_entry`, `check-test-record.py` rule 2b and `check-test-record-move.py` (which now judges
+  re-tests too — they change `.felhom.yml` only) refuse no new digest, a digest the registry stopped serving, a missing box
+  proof and a `digest_from` that is not the previous digest; 8 decoys (red with the rules off). `upgrade-test.py --retest`;
+  the ONE monthly command `scripts/retest-floating.py` (`--dry-run`, `--engines-only`, `--push`) with `retest_box.py` and the
+  box client `box_walk.py` moved into the catalog. Proven end to end on 9202 (docmost, redis). Today: nothing to re-test on
+  the engine lines; `nextcloud:34.0.4-apache` and linuxserver `sonarr:4.0.20` were rebuilt under their tags (R-743).
+- **wger** `45d8482` (R-737): its app login's JWT pair made once by wger's own command, kept on its data volume.
+- **Bench-only overrides** (R-739): `BENCH_ENV_OVERRIDES` lets the bench run wanderer (recorded in every verdict). Measured:
+  meilisearch v1.54 refuses v1.36's data unless `MEILI_UPGRADE_DB=true`; wanderer's step is not done.
+- `test_gate_decoys.py` read kimai's tag and date from the clone (it had been red on main since kimai moved).
+
 ## Twelve more steps, six first ladders, and the fixtures behind them (2026-09-30, evening, R-462)
 
 Each step: bench 9401 (harness v4, swap 0, 10-min memory watch) + box 9202 (drill catalog, the product's guarded

REPORT.md

@@ -1,13 +1,9 @@
-# REPORT — 2026-09-30 (evening): twelve more steps, six first ladders
+# REPORT — 2026-09-30 (late): same-tag security fixes become tested steps (decision 52)
 
-Evidence: `felhom.eu/documentation/audits/more-night-apps-2026-09-30/`. Operator report: `felhom.eu/REPORT-more-night-apps-2026-09-30.md`.
+Evidence: `felhom.eu/documentation/audits/night-rulings-2026-09-30/`. Operator report: `felhom.eu/REPORT-night-rulings-2026-09-30.md`.
 
-- **First ladders:** calibre-web `53a4a1d` (`files_may_change`: its library DB), gitea `d7ba60c`, wger `4ad32aa`,
-  crafty-controller `e1f0179`, uptime-kuma `35dd5cf`, zipline `a9700e2` + `fb87030` (4.6.1 → 4.7.0 → 4.8.0; the direct
-  jump fails and the box undid it). **Within-major:** emby `3e4aa77`, ghost `9a78e3b`, home-assistant `15f4d59`, outline
-  `b0b2514`, rallly `8d3a35a`. Each: bench 9401 (swap 0, 10-min watch, 0 kills) + box 9202 through the guarded Update.
-- **Fixes:** wger runs its migrations at start `7a4ff48` (R-738 — its update left the login 500 behind a `done`);
-  immich's step `0b82…` re-proven at 768M and rewritten by the new `--restep` `48440ce`/`63a96b0` (R-732).
-- **Harness** `5b1972b`, `63a96b0`, `84de9a9`: five fixtures, gitea's installer, HTTPS backends, named files behind
-  `files_may_change`, the bench's `password:N:special` (R-735), zipline's readback, the stale gate-count test.
-- **Night-updatable:** 30 + 2 conditional → **35 + 3 conditional**; 15 apps have no ladder. Not done: wanderer (R-739).
+- `6a3ead9`: the re-test entry, its gates and decoys, `upgrade-test.py --retest`, `scripts/retest-floating.py` (the monthly
+  command), `retest_box.py`, `box_walk.py`, `BENCH_ENV_OVERRIDES`. Proven end to end on 9202. Run today: nothing on the
+  engine lines; two exact tags rebuilt upstream (R-743).
+- `45d8482`: wger's JWT key pair (R-737).
+- Runbook: `felhom.eu/documentation/runbooks/monthly-floating-retest.md`.