security watch sees runtimes (R-1327) and DooPlex (R-1328); HTTP2Shell rows R-1329–R-1332; R-1326 closed

- scripts/image_runtime.py: Node / Python Brotli / brotlicffi / apk / dpkg read from an image's registry config and
  layers (no pull; HEAD for the nightly digest; zstd via the zstd program where present; quay.io, index.docker.io).
- security_watch.py: a „runtime" source (security_watch_runtimes.json), cached by digest in state.json (154 images,
  filled on DooPlex tonight); ghcr.io tag lists are paged; the DooPlex group (own block, homelab next-step).
- dooplex_inventory.py + documentation/security-watch/dooplex-workloads.txt (89 images, homelab-manifests 5aeec8d).
- Tests W10–W12 (58 checks) + test_image_runtime.py (13), each red-proved.
- audits/http2shell-2026-10-27: the Home Assistant lane walk (proven), HOMELAB-LIST.md (19 to update), the run log.
- 08 §11 design line; 09 §3 decision 276 (HA monthly = same main version; decided by CC unattended).

documentation/architecture/08-alarm-ladder.md

@@ -684,3 +684,16 @@ The memory is `documentation/security-watch/state.json`, committed by the job it
 that it did. A job that does not finish mails „[felhom CI] security watch FAILED". The mail starts the security-fix lane
 (capability map B23).
 
+**[DESIGN — R-1327/R-1328, built 2026-10-27 night, commit only] A fourth source, „runtime", and a third group,
+„DooPlex".** HTTP2Shell (CVE-2026-111497) sat in the Node.js and Python Brotli INSIDE app images, where no app notice
+mentions it. The watch now reads each pin's image (`scripts/image_runtime.py`: the registry config, then only where
+needed the layers — Alpine/Debian package databases, Node's `node_version.h`, Python `.dist-info` — never a pull) and
+matches it against `scripts/security_watch_runtimes.json`; a hit is an ADVISORY with source „runtime", a read that
+fails is NOT CHECKED. Results are cached by the tag's digest in `state.json` (`runtime_cache`) and the nightly lookup is
+a HEAD request (Docker Hub does not count it against the anonymous pull limit — the first run's GETs hit HTTP 429).
+**Decided by CC unattended 2026-10-27 — operator may reverse:** the CI runner has no zstd (Python 3.13 has none), so
+images with zstd layers (Home Assistant) are read on DooPlex by a filling run (`--no-mail`, the stored Docker Hub login
+through `sec run`) and committed into the cache; CI reads them from there and lists a new unread zstd image as NOT
+CHECKED — instead of a new dependency in CI. The DooPlex group (`documentation/security-watch/dooplex-workloads.txt`,
+from homelab-manifests) is read the same way and mailed in its own block; Felhom changes nothing on DooPlex.
+

documentation/architecture/09-update-architecture.md

@@ -1145,6 +1145,14 @@ its length, and both fixes cost something the household would notice — operato
      overwrite its records with no login; no box runs it; an installed copy is not touched. *Operator, 2026-10-27 21:33
      (CC's pick).*
 
+276. **A Home Assistant monthly release (2026.9 → 2026.10) is the SAME main version for the ladder, so a security fix
+     may ride the lane.** *Decided by CC unattended 2026-10-27 — operator may reverse.* Options: A) the lane — the one
+     comparator (`stacks.CompareImageRefs`, Q3) parses „2026" as the major, a notice id exists (CVE-2026-111497, Python
+     Brotli 1.2.0 → 1.2.1 inside the image); cost: a monthly HA release carries feature changes into the night lane;
+     B) a normal step — cost: a second rule beside the comparator for one app's version shape (Q3 warns that is how a
+     major gets automated by accident). Why A: the brief („a normal step if it counts as a main version in our ladder
+     rules, else the lane") and the one-comparator rule; the box walk + soak is the guard either way.
+
 ### 2026-10-27 (attended release block) — the line-test hold is fixed the same day; R-1218's live proof is waived
 
 269. **The line-test hold waits until the held app has really slowed down — fixed in the controller the same day.**