Rulings 2026-10-01 built: report, STATUS (standing monthly line), decision 57 (mealie lockout, decided by CC unattended), R-747 narrowed, evidence

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -621,6 +621,21 @@ R-636's louder repeated alarm.
     **Why:** about 50 old controller versions sat on each demo box (R-745); a release is ~400 MB unpacked and several ship
     a day. Registry tags are never deleted by this.
 
+### 2026-10-01 — decided by CC unattended, operator may reverse
+
+57. **mealie's account lock lasts 1 hour (in practice 1–2 h), not 24** — *decided by CC unattended 2026-10-01 (R-747) —
+    operator may reverse.* **Question:** how long may a stranger's five wrong passwords lock the household out of mealie?
+    **Options:** (a) keep mealie's default 24 h — the strongest guard against guessing, and a stranger who knows the public
+    login (`admin` / `changeme@example.com`) locks the household out for a day; (b) `SECURITY_USER_LOCKOUT_TIME=1` — the
+    unit's minimum; mealie's hourly job lifts it, so 1–2 h; still 5 tries per lock against guessing; (c) no lock (a huge
+    attempt limit) — strangers cannot lock anyone out, and nothing slows guessing but the hash; (d) rename the login to
+    something unguessable after install — the guard stays and strangers cannot aim it, but it changes what the household
+    types and what the app page shows. **Why (b):** the brief prefers a short lockout over none; a household would not
+    notice the weaker guard (5 tries per 1–2 h against a generated 30-character first password); (d) changes a promise on
+    the page and stays open as an option. **Measured on 9202:** 5 wrong → the right password 423 for 120 min, then 200; a
+    wrong one 401 after. **Limit, stated:** the lock is per account and the name is public, so a stranger can renew it
+    every hour. Catalog `a4597cd`.
+
 ### 2026-09-30 (day) — operator notes, recorded before the work
 
 - **The day brief runs by day.** Every backup and automatic-update test is started by hand — the night chain's debug