Rulings 2026-10-01 built: report, STATUS (standing monthly line), decision 57 (mealie lockout, decided by CC unattended), R-747 narrowed, evidence

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,54 +2,56 @@
 
 **Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
 
-**Updated 2026-09-30 (late evening). Both demo boxes run controller 0.284.2 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.284.2 with agent 0.138.0.**
+**Updated 2026-10-01. Both demo boxes run controller 0.285.0 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.285.0 with agent 0.138.0.**
 
 **Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.
 
-## Your two decisions of tonight — built
+## A decision I took myself (you may reverse it)
 
-- **Security fixes under the same name (your A).** The catalog can now re-test a database image's new fix and record
-  it as a tested step. A box then takes it at night by itself. Tested from start to end on the scratch box: the night
-  run took the fix, the app kept its data, and the page went back to "up to date". **Today there was nothing to re-test**
-  for the database and redis images.
-- **Old program files on the disk (your A).** A box now keeps each app's current program and the one before it, and
-  deletes the older ones. It never deletes one that another app still uses. On the first start it cleaned up once:
-  **the HP demo box freed 11 GB**, the scratch box 21 GB. All apps kept running.
+- **mealie: a stranger can now lock the household out for 1 to 2 hours, not a whole day.** mealie locks the account after
+  five wrong passwords, and its login name is public. I set the lock to mealie's shortest time (1 hour; its hourly
+  clean-up makes it up to 2). Tested on the scratch box: locked for 2 hours, then the right password worked. The guard
+  against password guessing stays. **What it does not fix:** a stranger can lock it again every hour. The other way would
+  be a secret login name, but that changes what the household types — so I did not do it.
+
+## Your three decisions of today — built
+
+- **The monthly security re-test covers every tested app (your 2A).** First full run today: **nextcloud and sonarr** had
+  a new build under the same name. Both passed on the test bench and on the scratch box, and are now in the catalog. Boxes
+  take them at night. It took about 17 minutes per app.
+- **You start the monthly run (your 1A).** Give the standing brief `MONTHLY-security-retest.md` to CC once a month. The
+  runbook now says so.
+- **A box keeps only two controller versions (your 3A).** The new controller 0.285.0 deletes the older ones. The HP demo
+  box went from 84 versions to 2 (Docker images 15.2 → 11.7 GB). The N100 went from 76 to 2 (6.1 → 1.1 GB). All apps kept
+  running. I checked first: if an update fails, the box goes back to the version it was running, and that one is always kept.
 
 ## What else I did, and it worked
 
-- **The short login risk is closed.** After an install, an app with a known default password is now closed to
-  strangers until the box has changed that password. Tested on two apps: no stranger got in.
-- **wger's phone app can log in** now (its missing key is made at the first start).
-- **New controller 0.284.2** is on both demo boxes, and **a new golden 0.284.2** is baked and vouched. The golden check
-  is green (not just waived).
+- **A crash fixed.** The image clean-up after an app update could crash the controller if the app was removed right
+  after. The test suite found it. Fixed in 0.285.0.
+- **Two test-tool fixes:** the digest check now refuses an image build that is gone, and the outline test works with
+  outline's newest version.
+- **New controller 0.285.0** is on both demo boxes, and **a new golden 0.285.0** is baked and vouched. The golden check is
+  green.
 
 ## What broke, and what I did
 
-- **The clean-up first missed most images.** Two mistakes, both found on the scratch box before any demo box got the
-  release: it did not run on the Remove button, and it could not see images stored without a name. Both fixed and
-  tested. That is why the version is 0.284.2 (0.284.0 and 0.284.1 never went out).
-- **wanderer** can now run on the test bench, but its update is not tested yet: I could not create test data in it.
-  Also found: its search engine needs one extra setting before any update, or it refuses to start.
-- **Two exact versions were rebuilt by their makers under the same name** (nextcloud and sonarr). The monthly re-test
-  finds them. Tonight I only did the database images, as you ruled.
-- **mealie locks the account after five wrong passwords** — also when a stranger types them. Written down.
-- **Old controller versions** still pile up on each box (about 50). Your rule covered apps only. Written down.
+- **The monthly re-test could not start on a fresh test bench.** It checked for its own files before it copied them. Fixed.
+- **Four more apps can be locked by strangers like mealie:** calibre-web (up to a day), wger (30 minutes, and everyone at
+  once), Grafana (5 minutes), BookStack (1 minute). I read this in their code; not tested on a box yet. Written down.
+- **Very old controller versions are gone from our own registry** (everything before mid-August). Nothing needs them
+  today. I do not know what removed them. Written down.
 
-**Rows.** Tonight: 5 closed, 3 narrowed, 6 opened. The list went from 377 to 383 rows (counted with every row, including three whose number has a letter — the old check skipped those).
+**Rows.** Today: 6 closed, 1 narrowed, 4 opened. The list went from 383 to 387 rows.
 
 ## What needs you
 
-1. **Who presses the monthly re-test?** It is one command, but it needs the test bench and the scratch box set up
-   first, so it cannot run by itself (the steps are written down). Options: CC does it in a monthly session, or you
-   start it. If nobody presses it, same-name security fixes wait until the next time we move that app.
-2. **Should the monthly re-test cover every app, or only databases?** Exact versions get rebuilt too (nextcloud,
-   sonarr). If you do nothing, only databases are re-tested.
-3. **Old controller versions:** keep only the current and the previous one? If you do nothing, about 150 MB per release
-   keeps piling up.
-4. **No golden bake is due** — tonight's bake carries the newest controller.
+1. **Nothing urgent.** If you want the household to be safe from the hourly re-lock in mealie, say so: then I give it a
+   secret login name, and the app page shows it. If you do nothing, a stranger who keeps trying can keep mealie locked.
+2. **Do you know what removed the old controller versions from the registry?** If you do nothing, I look at the Gitea
+   settings next time (read only).
 
 ## Standing steps
 
-- **Monthly:** the same-name security re-test (runbook `monthly-floating-retest.md`).
-- **Weekly:** the golden bake (around 7 October).
+- **Monthly security re-test: last run 2026-10-01, next due ~2026-11-01.** (You start it with the standing brief.)
+- **Weekly:** the golden bake (around 8 October).