Big steps close-out: Wanderer, Termix, Homepage, Seerr live (bench + box + undo); R-1335/R-1311/R-1320/R-1317 closed, R-1338 opened, R-1334 VERIFY (0 refused in two dry runs, no login); 09 decision 279 + [DESIGN] path rule; STATUS, CONTEXT, evidence

documentation/architecture/09-update-architecture.md

@@ -1153,6 +1153,26 @@ its length, and both fixes cost something the household would notice — operato
      major gets automated by accident). Why A: the brief („a normal step if it counts as a main version in our ladder
      rules, else the lane") and the one-comparator rule; the box walk + soak is the guard either way.
 
+### 2026-10-28 (afternoon, attended) — the four big steps; D59 ends; Wanderer's inbound federation stays off
+
+279. **D59 ends: Wanderer is offered again** after its big step v0.20.0 → v0.21.2 went live (catalog `1825247`), and
+     **its inbound federation stays OFF** — the template sets no `POCKETBASE_PROXY_SECRET`, so v0.21 rejects every
+     inbound ActivityPub delivery (fail closed, upstream's docs). Options: off (a family instance takes nothing from
+     strangers' servers; the route GHSA-fprh abused stays shut) or on (a generated shared secret; other servers deliver
+     follows, comments, updates). *Operator, 2026-10-28, at the Wanderer STOP; CC's pick both times.*
+
+**[DESIGN] A pin move needs its step — also when no box runs the app (2026-10-28, stated here because the brief asked
+for „the rule for a pin change when no box runs the old version" and this document did not say it).** The rule lives in
+the catalog: `app-catalog-felhom.eu/CLAUDE.md` („An `image:` move needs its TEST RECORD") and its gates —
+`check-test-record.py` (the newest ladder entry IS the compose) and `check-test-record-move.py` (a moved ref must add a
+proven entry). There is no exception for an app no box runs: the writer (`upgrade-test.py --write-ladder`) refuses
+unless the bench AND the box walk say `proven`, so every big step is a normal ladder step. A big step's UNDO is proven
+on 9202 as well (the 2026-10-27 Jellyfin method, generalised in `audits/dockerhub-bigsteps-2026-10-28/undo_proof2.py`):
+TO with failing checks must end `undone` and the seed must read back on FROM. **The broken probe must fail on any app:**
+a single-page app answers 200 on every path, so a „no such path" probe passed and Termix's update ended `done`; the
+tool now probes port 1. `test-record-move` also refuses a `memory_tight` step whose range does not raise the limit —
+Wanderer's Meilisearch went 256 → 384 MB and was measured again (it sizes itself to its limit: 88.8 %).
+
 ### 2026-10-28 (day, attended) — RomM kept; the runtime cache fills itself in CI
 
 277. **D61 = keep RomM offered** (R-1330) while no RomM release carries Node ≥ 24.22.1; the first one that does is taken