-- W9: notices that are not about the product; an empty fix with a closed range
  ok  W9 a GitHub Actions advisory (the project's CI) is not about the image -> not listed
  ok  W9 an empty fix with a range ending at 2.6.0 -> ADVISORY, fixed after 2.6.0 (not 'no fixed version')
  ok  W9 negative: the same notice at 2.7.0 -> not listed
  ok  W9 control: an open range with no fix still says 'no fixed version named yet'
-- W1-W4: the classes
  ok  W1 traefik v3.7.13 -> ADVISORY, fixed v3.7.14
  ok  W1 negative: traefik v3.7.16 -> CURRENT (the rc is no fix, v2 is another channel)
  ok  W1 Nextcloud 34.0.4 -> no Server advisory (fixed 34.0.1); the Deck app's advisory is not ours
  ok  W1 Nextcloud 34.0.0 -> ADVISORY GHSA-nc01
  ok  W1 an unreadable range is LISTED (unsure), never dropped
  ok  W1 OSV: Go 1.27.2 -> GO-2026-6809 fixed 1.27.3; Go 1.27.3 -> none
  ok  W2 the recorded Cloudflare blog item -> ADVISORY for cloudflared (and only that item)
  ok  W2 the VULN- marker in 2026.10.4 -> ADVISORY fixed 2026.10.4; 2026.10.2's plain bump is not one
  ok  W2 the same blog item 71 days later -> nothing (30-day window)
  ok  W2 positive control at the pin it hit: cloudflared 2026.9.3 on 2026-10-26 -> ADVISORY
  ok  W3 filebrowser 1.5.6-stable -> BEHIND 1.5.7-stable (the beta is no channel, its CVE no fix)
  ok  W3 redis 7-alpine -> FLOATING
  ok  W3 postgres gap -> GAP (BEHIND still computed: no newer 16-…)
  ok  W3 an abandoned template -> GAP, nothing looked up (no route needed)
  ok  W4 a source that fails -> NOT CHECKED, with the reason
  ok  W4 the table prints the NOT CHECKED line
-- W5-W7: memory and mails
  ok  W5 a new advisory mails that night
  ok  W5 the mail carries our version, the fixed version, the lane
  ok  W5 the same advisory the next night mails NOTHING
  ok  W5 still open 7 days later -> one reminder
  ok  W5 and not again the next night
  ok  W5 a vendor notice mails once and never repeats
  ok  W5 a pin checked clean forgets its closed advisory
  ok  W5 box programs first in the subject
-- W6: a source down
  ok  W6 one night down -> no mail
  ok  W6 two nights -> one mail naming the source
  ok  W6 a third night -> no second mail
  ok  W6 back up -> the streak resets (one more night down -> no mail)
-- W7: weekly and seed
  ok  W7 Monday -> the weekly summary
  ok  W7 not twice the same Monday
  ok  W7 a Tuesday whose last weekly is 8 days old -> the weekly (a missed Monday)
  ok  W7 a seed mails nothing, records the advisory, and says what it would have mailed
  ok  W7 a pin the seed could not read is PENDING
  ok  W7 its first real read is recorded SILENTLY; a pin added later still mails
-- W13: one image in the catalog AND on DooPlex (R-1333)
  XX  W13 a new notice on both pins is mailed for BOTH (the catalog's 5.4.1 and DooPlex's 5.4.0) nd a notice that affects a version we ship.

Box programs first (none tonight).

rommapp/romm — CVE-2026-111497
  What:        s
  Our version: 5.4.0  (t; t)
  Fixed in:    1.0.1
  Severity:    high
  Source:      GitHub advisory
  Link:        l
  Next:        the homelab session updates this DooPlex workload (Felhom changes nothing on DooPlex; the list: documentation/security-watch/dooplex-workloads.txt)

A notice is mailed once, and again every 7 days while it stays open. Night of 2026-10-26.
  XX  W13 the memory keeps one entry per group ['rommapp/romm|CVE-2026-111497']
  XX  W13 the old shared key is copied to the DooPlex key: no mail again ([], {'rommapp/romm|CVE-2026-111497': {'first': '2026-10-27', 'last_mailed': '2026-10-27', 'program': 'rommapp/romm 5.4.0 (x)', 'summary': 's'}})
  XX  W13 a shared key whose catalog pin is gone moves to the DooPlex key (no stale twin, no mail) (['rommapp/romm|CVE-2026-111497'], [])
  ok  W13 DooPlex's pin checked clean forgets only DooPlex's entry
-- W8: the inventory and its gate
  ok  W8 a gap with no reason is a problem
  ok  W8 two sources parse
  ok  W8 an unknown kind is a problem
  ok  W8 a decoy pin whose line is only a comment REFUSES (rc 1, names demo/b)
-- W10: the runtime inside an image
  ok  W10 Node 24.18.1 -> ADVISORY from runtime, CVE-2026-111497, fixed 24.22.1
  ok  W10 negative control: Node 24.22.1 -> no advisory
  ok  W10 Python Brotli 1.2.0 -> ADVISORY, fixed 1.2.1
  ok  W10 negative control: Brotli 1.2.1 -> no advisory
  ok  W10 Node 20 (no fixed release on its line) -> ADVISORY naming the end of life
  ok  W10 a layer read error -> NOT CHECKED with source runtime
  ok  W10 a registry with no route -> a note, not a failure
RUNTIME-READ ex/node-old:1.0.0 0 s ok
  ok  W10 the result is cached by digest: one full read for two nights
RUNTIME-READ ex/broken:1.0.0 0 s NOT CHECKED: layer sha256:1234 unreadable: ReadError
  ok  W10 an UNCHECKED result is not cached (tomorrow tries again)
  ok  W10 main() hands the reader to run() (off only with --no-runtime)
  ok  W10 the reader counts what it read and from the cache (the log's RUNTIME line)
-- W11: ghcr.io tags are paged
  ok  W11 both pages are read (1.1.0 is on page 2)
-- W12: the DooPlex group
  ok  W12 the list file is read, group dooplex, the catalog's sources reused
  ok  W12 an image the catalog does not ship is a stated gap (runtime + registry only)
  ok  W12 a DooPlex advisory names the homelab session and not the lane
  ok  W12 a DooPlex image in a private registry -> NOT CHECKED with the reason
  ok  W12 the weekly mail has its own DooPlex block

FAIL: W13 a new notice on both pins is mailed for BOTH (the catalog's 5.4.1 and DooPlex's 5.4.0) nd a notice that affects a version we ship.

Box programs first (none tonight).

rommapp/romm — CVE-2026-111497
  What:        s
  Our version: 5.4.0  (t; t)
  Fixed in:    1.0.1
  Severity:    high
  Source:      GitHub advisory
  Link:        l
  Next:        the homelab session updates this DooPlex workload (Felhom changes nothing on DooPlex; the list: documentation/security-watch/dooplex-workloads.txt)

A notice is mailed once, and again every 7 days while it stays open. Night of 2026-10-26.
FAIL: W13 the memory keeps one entry per group ['rommapp/romm|CVE-2026-111497']
FAIL: W13 the old shared key is copied to the DooPlex key: no mail again ([], {'rommapp/romm|CVE-2026-111497': {'first': '2026-10-27', 'last_mailed': '2026-10-27', 'program': 'rommapp/romm 5.4.0 (x)', 'summary': 's'}})
FAIL: W13 a shared key whose catalog pin is gone moves to the DooPlex key (no stale twin, no mail) (['rommapp/romm|CVE-2026-111497'], [])
