Runtime fixes 2026-10-28: TABLE of the 20 apps (calibre-web loads Brotli — corrected; file manager does not, 3 boxes), lane batches 1+2 evidence; 09 decisions 277 (D61, operator) + 278 and the lane batch; R-1313/R-1322/R-1327 closed; R-1334..R-1337 opened; app rows updated

documentation/architecture/09-update-architecture.md

@@ -1153,6 +1153,32 @@ its length, and both fixes cost something the household would notice — operato
      major gets automated by accident). Why A: the brief („a normal step if it counts as a main version in our ladder
      rules, else the lane") and the one-comparator rule; the box walk + soak is the guard either way.
 
+### 2026-10-28 (day, attended) — RomM kept; the runtime cache fills itself in CI
+
+277. **D61 = keep RomM offered** (R-1330) while no RomM release carries Node ≥ 24.22.1; the first one that does is taken
+     as a lane step (CVE-2026-111497). No Node process runs in RomM (gunicorn, rq and nginx — `ps` on demo-hp 9201) and the
+     setup gate is in front; the watch flags it every night until then. *Operator, 2026-10-28 (starting the day brief),
+     CC's pick.*
+
+278. **The watch reads zstd layers in CI with a hash-pinned `zstandard` wheel, not with `zstd` in the CI runner image.**
+     *CC, 2026-10-28, the brief's choice („say which and why").* Options: A) the wheel (0.25.0, PyPI's sha256 per
+     Python/libc, checked on every open, fetched into the runner's cache) — cost: a download from PyPI when the cache is
+     empty, and a pin to renew when the runner's Python moves; B) `zstd` in `felhom-act-runner` — cost: a homelab-repo
+     change, an image rebuild and a k3s rollout on DooPlex, which the brief forbids, and every CI job depends on that
+     image. Why A: no DooPlex change, and a wrong or missing wheel is NOT CHECKED out loud, never a pass (`08` §11).
+
+**The lane batch of 2026-10-28 (R-1332), how it ran — the method, not a new rule.** Twenty apps carried a bad runtime
+(the watch's first full read). For each pin the registry's tags in the pinned tag's own shape were listed, and the newest
+one in the same main version and the newest overall were READ FROM THE IMAGE (`image_runtime.py`), never from release
+notes (`audits/runtime-fixes-2026-10-28/TABLE.md`). Three states: a fixed release in the same main version → a
+security-fix step; a fix only in a new main version → the app's big-step row carries it; no fixed release → a row with
+the exposure. The main version is the tag's first number, and for a `0.x` app the minor (Homebox 0.26 → 0.27 on
+2026-10-27; Karakeep 0.33 → 0.34 today). Batches of about five, each walked on 9202 (`box_walk.py --security`, soak
+600 s, the seeded data read back), the writer run on the live catalog, `catalog_gates.py --fast`, and a STOP before each
+push. None of the eight apps has a bench fixture, so no bench ran (§6.4, the lane's stated trade). Two tool gaps found
+on the way were fixed in the session: the drill mover moved two services that share one image only half (Dawarich), and
+a drill commit made outside a walk (the revert to FROM) never reached the box's mirror before the install.
+
 ### 2026-10-27 (attended release block) — the line-test hold is fixed the same day; R-1218's live proof is waived
 
 269. **The line-test hold waits until the held app has really slowed down — fixed in the controller the same day.**