Lockouts (R-752): decisions 58-60 (decided by CC unattended), the one address behind the tunnel (R-753), the registry answered (R-750); STATUS, report, evidence

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,54 +2,50 @@
 
 **Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
 
-**Updated 2026-10-01. Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.**
+**Updated 2026-10-01 (afternoon). Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.**
 
 **Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.
 
-## A decision I took myself (you may reverse it)
+## Decisions I took myself (you may reverse them)
 
-- **mealie: a stranger can now lock the household out for 1 to 2 hours, not a whole day.** mealie locks the account after
-  five wrong passwords, and its login name is public. I set the lock to mealie's shortest time (1 hour; its hourly
-  clean-up makes it up to 2). Tested on the scratch box: locked for 2 hours, then the right password worked. The guard
-  against password guessing stays. **What it does not fix:** a stranger can lock it again every hour. The other way would
-  be a secret login name, but that changes what the household types — so I did not do it.
+- **wger: a stranger now locks only the name they try, for 5 minutes.** Before, ten wrong tries locked out every
+  household member for 30 minutes. Tested: the other member could still log in; the targeted one was back in after
+  7.5 minutes. Short on purpose: in wger, every try during a lock restarts it, also the household's own.
+- **BookStack and Grafana: no change.** Their locks are already short: 1 minute and 5 minutes, measured.
+- **mealie stays on the 1-hour lock**, as you said.
 
-## Your three decisions of today — built
+## What I measured
 
-- **The monthly security re-test covers every tested app (your 2A).** First full run today: **nextcloud and sonarr** had
-  a new build under the same name. Both passed on the test bench and on the scratch box, and are now in the catalog. Boxes
-  take them at night. It took about 17 minutes per app.
-- **You start the monthly run (your 1A).** Give the standing brief `MONTHLY-security-retest.md` to CC once a month. The
-  runbook now says so.
-- **A box keeps only two controller versions (your 3A).** The new controller 0.285.0 deletes the older ones. The HP demo
-  box went from 84 versions to 2 (Docker images 15.2 → 11.7 GB). The N100 went from 76 to 2 (6.1 → 1.1 GB). All apps kept
-  running. I checked first: if an update fails, the box goes back to the version it was running, and that one is always kept.
+- **Behind the tunnel, every visitor looks like the same address** to an app. So an app that locks "by address" locks
+  out everyone at once (that was wger). Apps cannot see who is who. I did not change this box-wide: the easy way would
+  let a stranger fake an address. Written down.
+- **Old controller versions in the registry:** no automatic rule removed them. Someone ran a clean-up script by hand
+  on 22–23 August, when the registry disk was full. Nothing runs it on a schedule.
+- **An installed app takes a new setting** at its next restart, update or night backup — not by itself.
 
-## What else I did, and it worked
+## What else I found
 
-- **A crash fixed.** The image clean-up after an app update could crash the controller if the app was removed right
-  after. The test suite found it. Fixed in 0.285.0.
-- **Two test-tool fixes:** the digest check now refuses an image build that is gone, and the outline test works with
-  outline's newest version.
-- **New controller 0.285.0** is on both demo boxes, and **a new golden 0.285.0** is baked and vouched. The golden check is
-  green.
+- wger runs a development web server, not a production one. Written down.
+- The design document says the tunnel runs on the host. It runs inside the box. One of the two is wrong. Written down.
 
-## What broke, and what I did
-
-- **The monthly re-test could not start on a fresh test bench.** It checked for its own files before it copied them. Fixed.
-- **Four more apps can be locked by strangers like mealie:** calibre-web (up to a day), wger (30 minutes, and everyone at
-  once), Grafana (5 minutes), BookStack (1 minute). I read this in their code; not tested on a box yet. Written down.
-- **Very old controller versions are gone from our own registry** (everything before mid-August). Nothing needs them
-  today. I do not know what removed them. Written down.
-
-**Rows.** Today: 6 closed, 1 narrowed, 4 opened. The list went from 383 to 387 rows.
+**Rows.** Today (afternoon): 0 closed, 2 narrowed or answered, 3 opened. The list went from 387 to 390 rows.
 
 ## What needs you
 
-1. **Nothing urgent.** If you want the household to be safe from the hourly re-lock in mealie, say so: then I give it a
-   secret login name, and the app page shows it. If you do nothing, a stranger who keeps trying can keep mealie locked.
-2. **Do you know what removed the old controller versions from the registry?** If you do nothing, I look at the Gitea
-   settings next time (read only).
+1. **calibre-web: a stranger can lock the household out for a day** (40 wrong tries in 14 minutes). There is no setting
+   for a shorter lock. Two ways:
+   - **A — a secret login name** (recommended): the box makes one at install and shows it on the app page next to
+     the password. Strangers cannot aim at it. Cost: the household types a strange name.
+   - **B — switch the login limit off:** no lock at all. Cost: no limit on password guessing in the login form.
+   If you do nothing: a stranger who knows the name `admin` can keep the household out for a day.
+2. **The registry clean-up script:** today it keeps only the newest 7 versions, about one day of controller releases,
+   and it does not protect the versions in use. Two ways:
+   - **A — a written rule** (recommended): keep the newest 20 releases, plus every version a golden, the floor or the
+     vouched agent names. Change the script to match.
+   - **B — keep it as it is:** run by hand when the disk fills.
+   If you do nothing: the next manual run can delete a version a box or a backup still needs.
+3. **Smaller:** should apps see each visitor's real address (a bigger build), or do we keep fixing per app? And which is
+   right for the tunnel: the design document (on the host) or the build (inside the box)? Nothing breaks if you wait.
 
 ## Standing steps