REPORT — 2026-10-28 (day, attended at the STOPs): HTTP2Shell steps live, the runtime cache fills itself, the 20 apps

Architecture read: 09-update-architecture.md §3 (decisions 255, 275–278) and §6.4 (the security-fix lane); 08-alarm-ladder.md §11 (the watch).

In plain words

Last night's three steps are live: yes — Home Assistant 2026.10.4 and Wanderer hidden (b5b78f6), Immich v3.3.5 (0158b50). demo-hp (9201) read the new commit and listed Home Assistant's step as due.
The runtime cache fills itself in CI: yes — no DooPlex change. With two entries taken out of the cache, a CI run read Home Assistant 2026.10.4 (zstd) in 87 s and RomM 5.4.1 (gzip) in 25 s, and took audiobookshelf from the cache. The whole job took 3 min 34 s.
Of the 20 apps: 10 are live as tested security steps. 4 need a big step. 6 have no fixed release yet.
The operator: give the homelab session its list (unchanged since the morning). Nothing else is waiting on you.

D61 = keep RomM offered (operator, starting the brief) — 09 §3 decision 277.
zstd in CI through a hash-pinned zstandard wheel, not zstd in the runner image (the brief's „say which and why") — decision 278. The runner image would be a homelab change, a rebuild and a k3s rollout on DooPlex, which the brief forbids. A wrong or missing wheel gives NOT CHECKED, never a pass.

Live as steps (10), each box walk proven on 9202, its data read back after the update:
- Home Assistant (b5b78f6), Immich (0158b50)
- Ghost, MeTube, Zipline (abf3db3)
- Karakeep, Tandoor (71e3fdf)
- Papra, Dawarich (651a991)
- AdventureLog (0829994)
A big step (4): Homepage, Termix, Wanderer, Seerr — each on its big-step row.
No fix (6): ActualBudget, cal.com, Calibre-Web, Paperless, RomM, SparkyFitness — each on its row, with its exposure.
No bench test ran: none of these apps has a bench fixture.
AdventureLog failed twice before it passed:
- After an update its backend needs about 2 min 45 s to start. With a 30 s start time, Docker marked it unhealthy for about a minute.
- A record every 10 seconds shows this. With 300 s the services go from „starting" straight to „healthy".
- The step carries that change. Run 2 was inconclusive: 9202's copy of the drill was old.

Catalog (CI gates):

felhom.eu:

Commit	What	CI
`a3247d9f`	zstd in CI	gates 2449, watch dry run 2450 — both green
`73c91eac`	the zstd decoder named in words	pushed with `ac95ca4f`
`29e9cd36`	the watch remembers a notice per group	pushed with `ac95ca4f`
`47e1ef06`, `e3811728`	table, decisions, register	pushed with `ac95ca4f`
`ac95ca4f`	STATUS	gates 2453 green
this commit	final docs	in the final check below

Drill: the walk commits were reverted, so every lane app is back at FROM (1207966, 528bc06, 5c51ddc).

The Papra test helper sends an Origin header.
- Papra 26.x refuses a sign-up without one (MISSING_OR_NULL_ORIGIN).
- Proven live: the sign-up was refused (403) before the fix and works (200) after.
The box-walk drill mover moves two services that share one image.
- Dawarich's app and its worker use the same image. The walk stopped with „FROM ref not found".
- Test: test_box_walk_drill_move.py. Proven live on Dawarich.
The walk loads the drill into the box before it installs the old version.
- My revert of the drill never reached 9202. The walk's own check stopped the run as inconclusive.
The nightly watch remembers a notice per group (dooplex:<image>|<id>).
- Before, the catalog's RomM and DooPlex's RomM shared one memory entry. A new notice on both reached only one of them.
- Old entries are copied once, so the change sends no repeat mails. Test W13: 4 of 5 checks failed before the fix.
The RUNTIME log line names the zstd decoder in words, not as a Python module object.
Two code comments no longer say the cache is filled on DooPlex.

Calibre-Web does load Brotli. This morning's table said it does not.
- The morning check used the process list. Inside the container, the app's memory map could not be read.
- Read from the guest instead (/proc/<pid>/maps): the app maps Python Brotli 1.2.0, Pillow's libbrotlidec 1.2.0 and Debian's 1.1.0. It now has its own row (R-1337).
The file manager does not load Brotli on any of the three boxes. Measured: ldd and the maps of every process.

R-1333 was a draft only. Its fix landed in the session (the watch's memory per group), so it was never filed.

Observation	Result
Docker Hub's tag API answers 429; 19 DooPlex images NOT CHECKED in night 2446	FILED: R-1334
ghcr.io answered one blob with 429 during the dry run, while this session read images from the same address	NOT-A-FINDING: caused by this session's own parallel reads; R-1334 carries the rate-limit work
The security review flagged „version rollback" in the drill revert commits	NOT-A-FINDING: the drill is the test copy and must stand at FROM before a walk; the live catalog keeps the new versions
The evidence scan matched `Drill-1a37bb84e421`	NOT-A-FINDING: a seeded Ghost site title, not a secret
The evidence scan matched `"password": mpw` in `immich_repair.py`	NOT-A-FINDING: a variable name in code, not a value
A `git pull --autostash` in the shared felhom.eu clone emptied Dawarich's `walk.txt` while the walk was writing it	NOT-A-FINDING (fixed in the session): the log was rebuilt from the verdict's `log` field, and walk output now goes to the scratchpad
AdventureLog run 1's files were overwritten by run 2 (same folder)	NOT-A-FINDING: run 3 reproduced the failure on its own and is kept
A `pkill -f` matched its own shell (exit 144)	NOT-A-FINDING: the known trap; nothing had started; re-run in two commands

Machine: 9202 is back on the LIVE catalog (repoint-9202-live.txt, cache HEAD 0829994). Every walk app was removed through the product and verified gone: no container, no app.yaml, no volume.
Host: nothing was provisioned. The bench (9401) was not started.
Hub: no change.