Big steps close-out: Wanderer, Termix, Homepage, Seerr live (bench + box + undo); R-1335/R-1311/R-1320/R-1317 closed, R-1338 opened, R-1334 VERIFY (0 refused in two dry runs, no login); 09 decision 279 + [DESIGN] path rule; STATUS, CONTEXT, evidence

STATUS.md

@@ -2,7 +2,7 @@
 
 **Ready for Tester 2? Yes — tell the friend go (hand-over list: `documentation/pilot/TESTER2-handover.md`).**
 
-**Updated 2026-10-28 (day).** On your yes, tested security steps are live for 10 apps (Home Assistant, Immich, AdventureLog, Ghost, MeTube, Zipline, Karakeep, Tandoor, Papra, Dawarich); Wanderer is hidden. The nightly watch now reads the runtime inside every image in CI by itself. Tonight demo-hp takes the Home Assistant and AdventureLog steps; no box runs the other eight apps.
+**Updated 2026-10-28 (evening).** On your yes, the four big updates are live with their undo tested: Wanderer v0.21.2 (offered again, D59 ended; federation from other servers stays off), Termix 26.10.5 (D58 ended), Homepage v2.7.0 and Seerr v3.5.1. Docker Hub no longer refuses the security watch in test runs, with no login; tonight's run is the check.
 
 ## What works
 - **The Plex attack (10-17 → 10-23) did not reach Felhom's secrets** (R-1241).
@@ -23,7 +23,7 @@
 - DooPlex: something sets the shared checkout to „bare" (R-935).
 
 ## What we work on
-- Apps still waiting for the HTTP2Shell fix: 10 — Homepage, Termix, Wanderer and Seerr need a big step; ActualBudget, cal.com, Calibre-Web, Paperless, RomM and SparkyFitness have no fixed release yet.
+- Apps still waiting for the HTTP2Shell fix: 6 — ActualBudget, cal.com, Calibre-Web, Paperless, RomM and SparkyFitness have no fixed release yet.
 - Dated checks, run by CC. 2026-10-30: D35, website and installer to Cloudflare, starts (R-1228, ruled yes).
 
 ## Waiting on you — decide