For the Migration plan, decision D1. Fossil 2.27 [99675884a9] built from source with a 78-line patch (rcvlogin.patch, in the attached tar) adding the page /rcvlogin and the setting rcvlogin, off by default.

• With the setting on, a user holding only Read (o2) learns, for a check-in pushed from a clone and for a post made through /forume1, the user each was received from and that user's capabilities; never the address.
• With it off, Fossil sends the reader to its login page.
• Fossil's reply form, given fpid, reply, content and preview without a csrf token, shows the text with Fossil's own Submit and token and stores nothing.

The tar holds the patch, both trial scripts, their output and a README. Nothing was installed anywhere; the trial ran on a scratch repository on 127.0.0.1.