R-1303 built and live-proven (test mail arrived, seed run committed its memory); R-1305–R-1309 filed (file manager, 27 apps, image packages, floating tags, mail-only notices); docs 08 §11, B23, monthly §4a; STATUS

documentation/architecture/08-alarm-ladder.md

@@ -662,3 +662,20 @@ every grace — a test configuration only. Live proof: `audits/d53-held-apps-202
 every household leg `skipped operator_only`).
 
 *[DESIGN] R-1298 (2026-10-26 night, controller main `b156e45`): an install's hold (`unhealthy_stop`, `update_failed`, `putback_pending`) of an app that is NOT installed (no `app.yaml`) is not reported — it would remind weekly about an app that does not exist; a restore hold is always reported (R-379, a person clears it).*
+
+## 11. The security watch — three operator-only signals [DESIGN — built 2026-10-26: felhom.eu `1f62d629`, `6ee23a3b`; R-1303]
+
+The nightly CI job `security-watch` (03:40 UTC, `scripts/security_watch.py`) reads where each shipped program publishes
+its security notices (sources and their limits: `audits/security-watch-2026-10-26/SPIKE.md`) and mails **admin@felhom.eu
+only** — no household, no hub event:
+
+| Signal | When | Once? |
+|---|---|---|
+| **ADVISORY** — „[Felhom security] <programs, box first> — N new advisories" | a notice affects the version we pin | once per (program, notice); a reminder every 7 days while it stays open; a vendor-blog notice never repeats |
+| **BEHIND** — „[Felhom security] weekly: …" | Monday (or the last summary is 8+ days old) | one summary; it also lists GAP, FLOATING and tonight's NOT CHECKED |
+| **NOT CHECKED** — „[Felhom security] the watch could not check …" | the same source failed two nights in a row | once per streak; a good night resets it |
+
+The memory is `documentation/security-watch/state.json`, committed by the job itself; a missing memory re-seeds AND mails
+that it did. A job that does not finish mails „[felhom CI] security watch FAILED". The mail starts the security-fix lane
+(capability map B23).
+

documentation/architecture/capability-map-detail/B.md

@@ -392,6 +392,10 @@ four version observables at TO, a 600 s memory soak), and the only writer turns
 ladder step. Every box on controller >= 0.341.0 takes it at night with the usual guards (backup first, undo on a
 failed health check, held / stopped / needs_person / W+5h respected).
 
+**Trigger (2026-10-26, R-1303):** a mail from the nightly security watch („[Felhom security] …", `08` §11) starts the
+lane: it names the program, our version and the fixed version. An app notice goes this lane; a box program's (traefik,
+cloudflared, the file manager) is a controller release — the cloudflared 2026.10.3 run (R-1300) is the worked example.
+
 **Components:** catalog `3898593` (`ladder.py check_security`, the two test-record gates, `upgrade-test.py --write-ladder
 --security`, `box_walk.py --security`); controller v0.341.0 (`legCandidate`).