Security app updates 2026-10-27: 14 security-fix steps + 2 normal steps live (catalog 06e603e, 7b0071e, 65a6b11); controller v0.346.1 (traefik, file manager, cloudflared) floor set; R-1304 and R-1306 CLOSED, R-1305 NARROWED; R-1313, R-1315–R-1325 filed (big steps left, three observations); 09 decision 255 and B23: the batch use of the lane; evidence

documentation/architecture/00-capability-map.md

@@ -124,7 +124,7 @@
 | <a id="b20"></a>[B20](capability-map-detail/B.md#b20) | App crashes → customer notified (one event per transition, no flapping spam) | controller v0.120, hub v0.48 | **IMPLEMENTED** | crash→customer mail never live-confirmed | `audits/CAMPAIGN-3-2026-07-11.md` (2026-07-11) |
 | <a id="b21"></a>[B21](capability-map-detail/B.md#b21) | Post-deploy optional config (API keys etc.) with restart | controller, catalog `.felhom.yml` | **IMPLEMENTED** | config-save + restart in no campaign | `tests/CAMPAIGN-2-2026-07-07.md` (2026-07-07) |
 | <a id="b22"></a>[B22](capability-map-detail/B.md#b22) | Backup classification: 13 bind-bearing apps carry mandatory/optional/excluded classes | catalog, controller v0.132–133 | **PROVEN-LIVE** | — | `audits/SPIKE-backup-classification-2026-07-14.md` (2026-07-14); `audits/CAMPAIGN-6D-2026-07-15.md` (2026-07-15) |
-| <a id="b23"></a>[B23](capability-map-detail/B.md#b23) | An urgent security fix reaches the boxes at night — a `security_fix` ladder step (box walk required, bench optional, a CVE/GHSA notice), taken by the night update (`09` §3 decision 255, D39 = B) | catalog `3898593`, controller v0.341.0 | **PROVEN-LIVE** | scratch 9202 (drill catalog), Plex 1.43.4 → 1.43.5; an app with no box fixture is checked by health, version and a soak only (`seed: none`) | `audits/security-lane-2026-10-23/` (2026-10-23) |
+| <a id="b23"></a>[B23](capability-map-detail/B.md#b23) | An urgent security fix reaches the boxes at night — a `security_fix` ladder step (box walk required, bench optional, a CVE/GHSA notice), taken by the night update (`09` §3 decision 255, D39 = B) | catalog `3898593`, controller v0.341.0 | **PROVEN-LIVE** | scratch 9202 (drill catalog), Plex 1.43.4 → 1.43.5; an app with no box fixture is checked by health, version and a soak only (`seed: none`) | `audits/security-lane-2026-10-23/` (2026-10-23); batch use: `audits/security-app-updates-2026-10-27/` (2026-10-27, 14 steps live) |
 
 ## C. Protection & recovery (the product promise)
 

documentation/architecture/09-update-architecture.md

@@ -1098,6 +1098,19 @@ its length, and both fixes cost something the household would notice — operato
      night leg logged `plex: skipped — not_proven` and a hand press took the step; on 0.341.0-rc.1 the night leg logged
      `plex: security fix CVE-2026-96652,CVE-2026-96654,CVE-2026-96655,CVE-2026-96656 taken` and ended `done` in 30.1 s
      after the update's second-drive copy and undo copy. Released as controller 0.341.0, global floor 11:24 UTC.
+     **Batch use, 2026-10-27 (the lane's first live use, `audits/security-app-updates-2026-10-27/`):** the security
+     watch (R-1303) flagged 38 pins; a hand triage put 15 apps in the lane. One negative control first (TO
+     `busybox:1.36.1` → `failed`, undone), then walks on 9202 three at a time, each written to the drill, then **a STOP
+     per batch of about five** before the live catalog: batch 1 `06e603e` (rallly, romm, code-server, outline, vikunja),
+     batch 2 `7b0071e` (n8n, privatebin, docmost, grafana), batch 3 `65a6b11` (homebox, mealie, audiobookshelf,
+     bentopdf, uptime-kuma) — 14 steps, 12 with the seed read back after the update, 2 `seed: none` (code-server: no
+     script route; bentopdf: no data). Two notices with no CVE/GHSA id (wishlist's critical account takeover,
+     bookstack's two leaks) could not use the lane and went as NORMAL steps (bench 9401 + box) in the same batches.
+     **What the batch use taught:** (a) a walk can be `inconclusive` because the FIXTURE is stale, not the step — four
+     were (Rallly 4.15's code-only sign-in, Jellyfin 10.11's wizard, Homebox 0.26's entities API, Mealie's generated
+     admin password); each was fixed and the walk run again; (b) three walks at a time on 9202 (25 GiB) kept every soak
+     clean; (c) a one-step-per-app lane stops below a fix that needs a NEW main version — those stay big steps with a
+     row each (R-1311, R-1313–R-1322).
 
 ### 2026-10-26 (night brief) — D55: demo-hp's one clean-up window gets a cap of 260
 

documentation/architecture/capability-map-detail/B.md

@@ -409,4 +409,10 @@ a hand press took the step; on 0.341.0-rc.1 the night leg logged `plex: security
 **Gap:** an app with no box fixture (Plex today, R-1238) is checked only by health, version and the soak — no data is
 read back. `files_may_change` is a bench measurement and reads `false` when no bench ran (decision 255 item 7).
 
+**Batch use (2026-10-27, `audits/security-app-updates-2026-10-27/`):** 14 security-fix steps in three batches, each
+pushed live after the operator's yes at a batch STOP (catalog `06e603e`, `7b0071e`, `65a6b11`); 12 read the seed back
+after the update, 2 are `seed: none`. demo-hp's 9201 read `06e603e` at once and holds RomM's step for its night leg
+(`live-readback-batch1-9201.txt`). Notices with no CVE/GHSA id go as normal steps in the same batches (wishlist,
+bookstack). Four stale fixtures were found and fixed by the walks' `inconclusive` C1 (`09` decision 255, batch note).
+
 ---