STATUS 2026-10-28 (day): the steps live, the waiting apps in one line; D61 ruled and moved to history

STATUS.md

@@ -2,7 +2,7 @@
 
 **Ready for Tester 2? Yes — tell the friend go (hand-over list: `documentation/pilot/TESTER2-handover.md`).**
 
-**Updated 2026-10-28 (night).** CC cannot delete from its secret store any more (D60). The watch now reads the Node and Brotli inside every image: 20 catalog apps carry HTTP2Shell; Home Assistant and Immich have tested steps waiting for your yes. The hub has 3 minutes to start.
+**Updated 2026-10-28 (day).** On your yes, tested security steps are live for Home Assistant, Immich, Ghost, MeTube, Zipline, Karakeep and Tandoor; Wanderer is hidden. The nightly watch now reads the runtime inside every image in CI by itself. Tonight demo-hp's Home Assistant takes its step; no box runs the other six apps.
 
 ## What works
 - **The Plex attack (10-17 → 10-23) did not reach Felhom's secrets** (R-1241).
@@ -23,7 +23,7 @@
 - DooPlex: something sets the shared checkout to „bare" (R-935).
 
 ## What we work on
-- Released 2026-10-27: held apps reach you; safer kept data, ceremony and app import; reinstalled boxes back up off-site at once; the line test works while seeding; Go 1.27.3. Open: R-1285 (needs a BYO box on an old agent), R-1312 (what the hub's off-site switch does on the box). Evening: the one-time off-site clean-up window has a button (customer page → Backup & DR; you tested it); `sec rm` deleted 46 dead test-box names from CC's store.
+- Apps still waiting for the HTTP2Shell fix: 10 — Homepage, Termix, Wanderer and Seerr need a big step; ActualBudget, cal.com, Calibre-Web, Paperless, RomM and SparkyFitness have no fixed release yet (AdventureLog, Papra and Dawarich are in test).
 - Dated checks, run by CC. 2026-10-30: D35, website and installer to Cloudflare, starts (R-1228, ruled yes).
 
 ## Waiting on you — decide
@@ -32,7 +32,6 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
 
 | # | Row | Question | Pick (why) | The other option costs | If you do nothing | Blocked |
 |---|---|---|---|---|---|---|
-| D61 | R-1330 | RomM: keep it offered while its newest release still has the bad Node inside? Node does not run in RomM, and the setup gate is in front. | **Keep it** (no fixed release exists; the watch flags it nightly) | hide it: it leaves the catalog until RomM ships a fix | it stays offered | — |
 | D38 | R-1235 | Put the newest golden (637 MB) into the nightly release copy on ep0 too? | **Yes** (a new install after a DooPlex loss needs it; it fits under the 3 GB cap) | leave it out: after a loss, no new install until a golden is rebuilt and vouched | the same | — |
 | D37 | R-1236 | Raise Gitea's memory limit from 1 GiB to 2 GiB? It was killed for memory 4 times in 17 days, once during today's release. | **Yes** (DooPlex has the RAM; a DooPlex change, so yours) | keep 1 GiB: a restart in release hours fails box updates and CI for a minute | the same | — |
 | D9 | R-1062 | Split the N100's USB drive in two, for multi-drive tests? | **No — keep one drive** (the lived-in box keeps its nightly whole-box backup) | Split: the box loses its local whole-box backup, or you buy a second drive first | it stays one drive; multi-drive tests stay on Tester 1 | — |
@@ -49,7 +48,7 @@ Newest first. CC's pick is in the „Pick" column. Each row also has its full te
 6. BIOS: on the N100, read „After Power Loss"; on the HP, set „Bypass F1 Prompt on Configuration Changes" to Enable. (since 10-14)
 7. Pin the first Facebook post (R-917), and look at the new cover in the Facebook phone app (R-919). (since 10-12)
 
-**2026-10-28 morning.** 1. Yes for the catalog push: Home Assistant and Immich (tested steps), Wanderer hidden (R-1313). If not: both keep the bad code; Wanderer stays offered. 2. Give the homelab session `audits/http2shell-2026-10-27/HOMELAB-LIST.md` (19 images, R-1328). 3. A removed store name back: `git revert` in your terminal (cc-secrets REPORT).
+**2026-10-28 day.** 1. Give the homelab session `audits/http2shell-2026-10-27/HOMELAB-LIST.md` (19 images, R-1328). If not: DooPlex keeps the bad runtimes.
 **2026-10-23 do list.**
 1. Print the break-glass sheet (`documentation/runbooks/break-glass-sheet.md`, the part from „The sheet”, one A4), fill it by hand, keep it outside the home (D32; R-923, R-924). If not: after a DooPlex loss no off-site copy opens.
 2. On the hub's Hosts page: Discard appliance 49. If not: a dead entry alarms.

documentation/backlog/STATUS-HISTORY.md

@@ -5,6 +5,16 @@ Moved here byte for byte on 2026-10-14 (night session), newest first, so that `S
 
 **Updated 2026-10-13 (night): demo-hp, demo-felhom and Tester 1 run agent 0.155.0; demo-felhom runs controller 0.310.0, the other two 0.309.0 until the floor is raised. The open-items list is at 127. Reports: `REPORT-poweroff.md`, `REPORT-plugmeter.md`, `REPORT-usenet-2026-10-12.md`, `REPORT-newapps-2026-10-12.md`, `REPORT-disk-evening-2026-10-12.md`, `REPORT-answers-2026-10-12.md`, `REPORT-m3-2026-10-11.md`, `REPORT-redesign-2026-10-10.md`, `REPORT-testers-2026-10-10.md`, `REPORT-register-shrink-2026-10-10.md`, `REPORT-new-apps-2026-10-10.md`, `REPORT-release-2026-10-10.md`, `REPORT-break-the-circle-2026-10-09.md`, `REPORT-dooplex-survival-2026-10-09.md`, `REPORT-day4-2026-10-09.md`.**
 
+## Moved from STATUS on 2026-10-28 (day)
+
+**Updated 2026-10-28 (night).** CC cannot delete from its secret store any more (D60). The watch now reads the Node and Brotli inside every image: 20 catalog apps carry HTTP2Shell; Home Assistant and Immich have tested steps waiting for your yes. The hub has 3 minutes to start.
+
+- Released 2026-10-27: held apps reach you; safer kept data, ceremony and app import; reinstalled boxes back up off-site at once; the line test works while seeding; Go 1.27.3. Open: R-1285 (needs a BYO box on an old agent), R-1312 (what the hub's off-site switch does on the box). Evening: the one-time off-site clean-up window has a button (customer page → Backup & DR; you tested it); `sec rm` deleted 46 dead test-box names from CC's store.
+
+| D61 | R-1330 | RomM: keep it offered while its newest release still has the bad Node inside? Node does not run in RomM, and the setup gate is in front. | **Keep it** (no fixed release exists; the watch flags it nightly) | hide it: it leaves the catalog until RomM ships a fix | it stays offered | — |  (RULED 2026-10-28: keep it — the operator's yes started the day brief)
+
+**2026-10-28 morning.** 1. Yes for the catalog push: Home Assistant and Immich (tested steps), Wanderer hidden (R-1313). If not: both keep the bad code; Wanderer stays offered. 2. Give the homelab session `audits/http2shell-2026-10-27/HOMELAB-LIST.md` (19 images, R-1328). 3. A removed store name back: `git revert` in your terminal (cc-secrets REPORT).
+
 ## Moved from STATUS on 2026-10-28 (night)
 
 **2026-10-27.** Done today: agent 0.167.0 vouched, the D55 token revoked, `Tester4-b5dbbd` deleted. New: a nightly security watch mails you (R-1303).