# REPORT — healthcheck sweep: `localhost` → `127.0.0.1` across all 48 templates (2026-07-06)

**Class:** implementation (mechanical sweep; push = deploy). **Baseline:** `main` @ `d86e256` → (this commit).
Part C of the pilot-blockers bundle (A = agent v0.73.0 F2, B = controller v0.102.0 async restore).
Provenance: RERUN vaultwarden healthcheck observation, escalated to a class.

## The class
48/53 templates used `localhost` in their docker healthcheck `test:` line. BusyBox `wget` (and the
node `http.get`, python `urllib`/`socket.create_connection`, and `curl` one-shot forms) resolve
`localhost`→IPv6 `::1` with NO cross-address-family fallback, so an app that binds IPv4-only reads
docker-`unhealthy` while fully serving (vaultwarden, re-run 2026-07-06).

## The change
Mechanical `localhost`→`127.0.0.1`, scoped strictly to the healthcheck `test:` lines of the 48 affected
`templates/*/docker-compose.yml` (all four check-binary forms incl. mealie's python socket tuple). Diff
review confirmed: **no** app env/config/label line changed; `.felhom.yml` files were already clean (zero
occurrences). New REUSE.md convention row.

## Live acceptance
Catalog synced to guest 9201 (`POST /api/sync` 200); vaultwarden template + container now
`http://127.0.0.1:80/alive`. **vaultwarden recreated → docker-`healthy`** (the observation's subject flips).
bookstack got the same 127.0.0.1 sweep but stays `unhealthy` from an **app-level HTTP 500** on its health
path (pre-existing, unrelated to localhost — documented).

## Not changed
Only healthcheck `test:` lines. No env, config, labels, ports, or `.felhom.yml`.