admin a4597cd005 mealie: lockout 1 hour instead of 24 (R-747, 09 decision 57 — decided by CC unattended, operator may reverse) ...

mealie locks the ACCOUNT after 5 wrong logins and its login names (admin, changeme@example.com) are public, so a
stranger could lock the household out for a day. Measured on 9202 with SECURITY_USER_LOCKOUT_TIME=1: the right
password answered 423 for 120 min (the hourly job lifts it after the hour), then 200; a wrong one still 401.
Evidence: felhom.eu/documentation/audits/rulings-2026-10-01/C/. CHANGELOG also records today's re-test run and fixes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

2026-10-01 10:18:17 +02:00

..

actualbudget

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

adventurelog

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

audiobookshelf

audiobookshelf: within-major step, both venues proven (R-462, Part F)

2026-09-30 14:11:57 +02:00

bentopdf

English copy — BATCH 1 of 3: 17 apps, 319 strings (R-560 slice 5)

2026-09-20 16:29:37 +02:00

bookstack

bookstack: 26.05.5 -> 26.09.1 (within the line), both venues proven (R-462, Part F)

2026-09-30 13:14:12 +02:00

calcom

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

calibre-web

calibre-web: v4.0.6 -> v4.0.8, its first ladder step, both venues proven (R-462)

2026-09-30 18:15:49 +02:00

claper

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

code-server

English copy — BATCH 2 of 3: 17 apps, 317 strings (R-560 slice 5)

2026-09-20 16:32:18 +02:00

crafty-controller

crafty-controller: 4.10.7 -> 4.11.0, its first ladder step, both venues proven (R-462)

2026-09-30 18:41:02 +02:00

docmost

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

emby

emby: 4.11.0.3 -> 4.11.0.4, within-major step, both venues proven (R-462)

2026-09-30 17:45:40 +02:00

ghost

ghost: 6.65.0-alpine -> 6.67.0-alpine, within-major step, both venues proven (R-462)

2026-09-30 17:46:01 +02:00

gitea

gitea: 1.27.0 -> 1.27.3, its first ladder step, both venues proven (R-462, R-624)

2026-09-30 17:16:56 +02:00

glance

REVERT both drill bumps: all four app pins back to their pre-drill images

2026-09-21 14:54:58 +02:00

gokapi

English copy — BATCH 2 of 3: 17 apps, 317 strings (R-560 slice 5)

2026-09-20 16:32:18 +02:00

grafana

grafana: within-major step, both venues proven (R-462, Part F)

2026-09-30 14:26:47 +02:00

gramps-web

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

home-assistant

home-assistant: 2026.9.3 -> 2026.9.4, within-major step, both venues proven (R-462)

2026-09-30 18:05:31 +02:00

homebox

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

homepage

English copy — BATCH 1 of 3: 17 apps, 319 strings (R-560 slice 5)

2026-09-20 16:29:37 +02:00

immich

immich: step v3.0.3 -> v3.2.2 (0b8272068aab36bf) re-proven at 768M; its definition rewritten by the writer (R-732)

2026-09-30 19:34:08 +02:00

jellyfin

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

kimai

kimai: apache-2.57.0 -> 2.67.0 (within major 2), both venues proven (R-462, Part F)

2026-09-30 13:27:45 +02:00

komga

komga: within-major step, both venues proven (R-462, Part F)

2026-09-30 14:30:27 +02:00

mealie

mealie: lockout 1 hour instead of 24 (R-747, 09 decision 57 — decided by CC unattended, operator may reverse)

2026-10-01 10:18:17 +02:00

n8n

n8n: within-major step, both venues proven (R-462, Part F)

2026-09-30 14:12:00 +02:00

navidrome

navidrome: within-major step, both venues proven (R-462, Part F)

2026-09-30 14:26:43 +02:00

nextcloud

nextcloud: re-test of the same tag at a new digest (decision 52, R-740)

2026-10-01 07:37:51 +02:00

onlyoffice

English copy — BATCH 3 of 3: the last 16 apps. THE CATALOG IS TRANSLATED.

2026-09-20 16:34:47 +02:00

opengist

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

outline

outline: 1.9.1 -> 1.10.1, within-major step, both venues proven (R-462)

2026-09-30 19:14:09 +02:00

paperless-ngx

paperless-ngx: PostgreSQL 16 -> 18, converted by the box (09 decision 42)

2026-09-27 12:08:57 +02:00

papra

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

plant-it

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

plex

English copy — BATCH 2 of 3: 17 apps, 317 strings (R-560 slice 5)

2026-09-20 16:32:18 +02:00

privatebin

test record: an image move must carry its proof (09 decision 13, part 4)

2026-09-23 20:52:32 +02:00

radarr

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

rallly

rallly: 4.11.1 -> 4.15.3, within-major step, both venues proven (R-462)

2026-09-30 19:18:24 +02:00

recipe-importer

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

romm

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

seerr

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

sonarr

sonarr: re-test of the same tag at a new digest (decision 52, R-740)

2026-10-01 07:53:44 +02:00

sparkyfitness

sparkyfitness: PostgreSQL 15 -> 18, converted by the box (R-463)

2026-09-30 12:58:34 +02:00

tandoor

Setup gate on 28 more apps; signup_block on 11 (decision 47); claper R-713 base64; FIRST-ADMIN current

2026-09-29 11:08:56 +02:00

termix

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

uptime-kuma

uptime-kuma: 2.4.0 -> 2.5.5, its first ladder step, both venues proven (R-462)

2026-09-30 18:51:17 +02:00

vaultwarden

English copy — BATCH 3 of 3: the last 16 apps. THE CATALOG IS TRANSLATED.

2026-09-20 16:34:47 +02:00

vikunja

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

wanderer

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

wger

wger: its app login API gets its JWT key pair (R-737)

2026-09-30 22:27:13 +02:00

wishlist

Sign-up locked twice (after_setup + case-insensitive blocks); wanderer closable (decision 48); ghost/HA/gramps probes; probe-measured gate; decoy fixture fix

2026-09-29 17:00:18 +02:00

zipline

zipline: 4.7.0 -> 4.8.0, its second ladder step, both venues proven (R-462, R-742)

2026-09-30 20:22:53 +02:00