Night 2026-10-27/28: Immich and Home Assistant lane walks proven (drill), Wanderer hidden in the drill, R-1322/R-1313 updated; STATUS (D61 RomM, the morning list), CONTEXT with the unattended decisions

STATUS.md

@@ -2,7 +2,7 @@
 
 **Ready for Tester 2? Yes — tell the friend go (hand-over list: `documentation/pilot/TESTER2-handover.md`).**
 
-**Updated 2026-10-27 (evening).** On your yes: 14 apps got a tested security step, and Wishlist, Bookstack and Jellyfin a normal step; boxes take them tonight. Every box runs controller 0.346.1 with the new Traefik, file manager and cloudflared. Ten apps need a bigger step, a row each (R-1311, R-1313, R-1315–R-1322); no household runs them.
+**Updated 2026-10-28 (night).** CC cannot delete from its secret store any more (D60). The watch now reads the Node and Brotli inside every image: 20 catalog apps carry HTTP2Shell; Home Assistant and Immich have tested steps waiting for your yes. The hub has 3 minutes to start.
 
 ## What works
 - **The Plex attack (10-17 → 10-23) did not reach Felhom's secrets** (R-1241).
@@ -32,6 +32,7 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
 
 | # | Row | Question | Pick (why) | The other option costs | If you do nothing | Blocked |
 |---|---|---|---|---|---|---|
+| D61 | R-1330 | RomM: keep it offered while its newest release still has the bad Node inside? Node does not run in RomM, and the setup gate is in front. | **Keep it** (no fixed release exists; the watch flags it nightly) | hide it: it leaves the catalog until RomM ships a fix | it stays offered | — |
 | D38 | R-1235 | Put the newest golden (637 MB) into the nightly release copy on ep0 too? | **Yes** (a new install after a DooPlex loss needs it; it fits under the 3 GB cap) | leave it out: after a loss, no new install until a golden is rebuilt and vouched | the same | — |
 | D37 | R-1236 | Raise Gitea's memory limit from 1 GiB to 2 GiB? It was killed for memory 4 times in 17 days, once during today's release. | **Yes** (DooPlex has the RAM; a DooPlex change, so yours) | keep 1 GiB: a restart in release hours fails box updates and CI for a minute | the same | — |
 | D9 | R-1062 | Split the N100's USB drive in two, for multi-drive tests? | **No — keep one drive** (the lived-in box keeps its nightly whole-box backup) | Split: the box loses its local whole-box backup, or you buy a second drive first | it stays one drive; multi-drive tests stay on Tester 1 | — |
@@ -48,7 +49,7 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
 6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. (since 10-14)
 7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). (since 10-12)
 
-**2026-10-27.** Done today: agent 0.167.0 vouched, the D55 token revoked, `Tester4-b5dbbd` deleted. New: a nightly security watch mails you (R-1303).
+**2026-10-28 morning.** 1. Yes for the catalog push: Home Assistant and Immich (tested steps), Wanderer hidden (R-1313). If not: both keep the bad code; Wanderer stays offered. 2. Give the homelab session `audits/http2shell-2026-10-27/HOMELAB-LIST.md` (19 images, R-1328). 3. A removed store name back: `git revert` in your terminal (cc-secrets REPORT).
 **2026-10-23 do list.**
 1. Print the break-glass sheet (`documentation/runbooks/break-glass-sheet.md`, the part from „The sheet”, one A4), fill it by hand, keep it outside the home (D32; R-923, R-924). If not: after a DooPlex loss no off-site copy opens.
 2. On the hub's Hosts page: Discard appliance 49. If not: a dead entry alarms.