- Weblog desktops were unauthenticated and publicly reachable (entry vector)
- Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified
- Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth)
- GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined
- Removed /home/sam:ro mount from GIMP (was exposing secrets to the container)
- Service-controller restarted (was dead, which is why toggles did nothing)
- Incident record + captured payload in docs/incident-2026-11-11*
