Say sign-in is limited when lockout is left out

CHANGELOG.md

@@ -61,6 +61,10 @@ their emails are not delivered until you add a mail provider, as the Account ema
 Apps compiled earlier keep their `AGENTS.md`. To adopt the new rules, ask your agent to compare its spec bullet with
 this entry and update it.
 
+An Account that leaves out `lockout` now gets Rails' own sign-in limit in the generated `RodauthController`: 10
+attempts per IP address every three minutes. People on one network, such as a classroom, share it; `DEPLOY.md`
+describes the limit and how to key it by email as well. The Skill's Accounts text says so instead of "not limited".
+
 ## 2026-10-12: State Machine events First Draft cannot generate are stubs
 
 **Skills — released in plugin 0.8.15.** Plugin 0.8.14 carried the same text but was never published: its tag was pushed while a GitHub Actions incident had dropped its main CI run, so the publish workflow refused it. Once the First Draft service deploys the matching Compiler, a required,

skills/create-full-stack-app/references/foundation-plan-023.md

@@ -692,8 +692,8 @@ a signed-in session. Without `registration`, nobody can sign themselves up: the
 generated README shows the owner how to create each Account, in development seeds and with `bin/rails runner` against
 the production database, because Render Free has no Shell. With `verification` but no `registration`, verification
 covers email changes only. Without `recovery`, there is no password reset, and the README shows how the owner sets a
-new password. Without `lockout`, failed sign-ins are not limited: nothing throttles `/login`, and `DEPLOY.md` says so
-in its Failed sign-ins section. Keep `recovery` and `lockout` unless the user asks to leave them out.
+new password. Without `lockout`, the generated `RodauthController` carries Rails' own sign-in limit, 10 attempts per IP
+address every three minutes, and `DEPLOY.md` describes it in its Failed sign-ins section. Keep `recovery` and `lockout` unless the user asks to leave them out.
 
 A realized Account derives one Web `/account` destination without requiring an authored profile. With
 `registration`, sign-up shows a control for each required registration input that names a stored Account Field,

skills/create-full-stack-app/references/interview.md

@@ -176,7 +176,8 @@ proposal in the read-back.
       confirmation: leave `verification` out unless the user asks for it, so sign-up signs people in at once and
       they can share the app with friends right away. "No sign-up" is supported: without `registration`, sign-in
       and Policies still generate, and the generated README shows the owner how to create each Account. Keep
-      `recovery` and `lockout`; without `lockout`, failed sign-ins are not limited, and `DEPLOY.md` says so.
+      `recovery` and `lockout`; without `lockout`, sign-in allows 10 attempts per IP address every three minutes, and
+      `DEPLOY.md` describes the limit.
 - [ ] Lists: what each main list shows, starting with the record's name, and its order.
 - [ ] Sample data: the proposed sample records and demo sign-in, and any CSV the user wants imported; import itself
       goes in the implementation notes.
@@ -201,8 +202,8 @@ These steps are outside the Plan and do not block local development. They come a
       it, Change email and sign-up with `registration` need one too, because their links travel by email. Follow
       the Account email section of `DEPLOY.md` to add one before inviting real users.
 - [ ] Accounts without sign-up or lockout: without `registration`, create each Account as the README's Accounts
-      section shows; without `lockout`, limit sign-in attempts as the Failed sign-ins section of `DEPLOY.md` says
-      before inviting real users.
+      section shows; without `lockout`, read the Failed sign-ins section of `DEPLOY.md`, because people on one network,
+      such as a classroom, share the per-IP sign-in limit.
 - [ ] Photos and files (apps with image or attachment Fields): sign up for Cloudinary and set `CLOUDINARY_URL`
       as the [upload setup](foundation-plan-023.md#photos-and-files) describes.
 - [ ] Deploy: before the first deploy, the user creates a separate Render workspace for this app in the Render