Gitea 28.2.0 live (R-1315 closed; D57 -> decision 280: imports only from GitHub/Codeberg/GitLab); R-1338: the Meilisearch cap helps on the bench, not on 9202 — measured, not pushed; STATUS, CONTEXT, evidence

documentation/architecture/09-update-architecture.md

@@ -1153,6 +1153,15 @@ its length, and both fixes cost something the household would notice — operato
      major gets automated by accident). Why A: the brief („a normal step if it counts as a main version in our ladder
      rules, else the lane") and the one-comparator rule; the box walk + soak is the guard either way.
 
+### 2026-10-28 (evening, attended) — D57 judged again in Gitea's big step: imports from three hosts only
+
+280. **Gitea's repository import is limited to github.com, codeberg.org and gitlab.com** (`[migrations] EGRESS_MODE=strict`,
+     `ALLOWED_HOST_LIST`, Gitea 28's own egress rules) — this replaces D57's „keep import on, unrestricted" (decision 273).
+     Measured on 9202 with 28.2.0: the default (`lax`) already refuses home-network and Docker addresses (422); the
+     allow-list also refuses every other public host (gitea.com 422) and lets GitHub import (201). Options: the allow-list
+     (cost: an import from a self-hosted forge or Bitbucket is refused) or 28's default (cost: the box fetches any public
+     address a family member names). *Operator, 2026-10-28, at the Gitea STOP; CC's pick.*
+
 ### 2026-10-28 (afternoon, attended) — the four big steps; D59 ends; Wanderer's inbound federation stays off
 
 279. **D59 ends: Wanderer is offered again** after its big step v0.20.0 → v0.21.2 went live (catalog `1825247`), and