CHANGELOG + REPORT: the last six PostgreSQL apps, Part F; zipline's fixture tries /api/setup first (R-624)

zipline 4's first-run route is POST /api/setup (measured on the bench 2026-09-30, v4.6.1: GET ->
{"firstSetup":true}, POST {username,password} -> 200 SUPERADMIN, the login works). The two paths the
fixture tried stay as fallbacks. No image moves in this commit.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,21 @@
+## The last six PostgreSQL apps decided; seven more apps update themselves at night (2026-09-30, day brief)
+
+- **PostgreSQL → 18, converted by the box** (the ONLY image move in each commit, written by `upgrade-test.py
+  --write-ladder` from both venues, one undo case each on 9202): rallly `25ffd89`, outline `aeb0cd6`, sparkyfitness
+  `1666572` (from 15; `PGDATA` left as it was, now a folder inside the moved volume). Each app's own upstream runs 18
+  (`09` decision 42's rule). **Stay on 16, same rule:** zipline (upstream 16), adventurelog (upstream postgis 16-3.5),
+  immich (upstream 14; its only 18 images drop pgvecto.rs). All eleven PostgreSQL apps are now decided.
+- **Fixtures (`e6f3ec2`)** — three front-door seeds that were thought impossible: sparkyfitness (better-auth sign-up +
+  a check-in), rallly (sign-up, its own e-mail code read from its own table in place of a mailbox, a poll), outline
+  (`installation.create`, an API key, a document). outline and rallly leave the NoRoute list. **zipline's fixture now
+  tries `POST /api/setup` first** — its real first-run route (measured on the bench: a SUPERADMIN, the login works).
+- **Within-major steps, both venues** (Part F): bookstack 26.09.1 `54ca055`, kimai 2.67.0 `d75d1fd` (the plain tag's
+  digest equals `apache`'s — upstream dropped the prefix), audiobookshelf 2.37.1 `7425ebd`, n8n 2.42.1 `9f075a4`,
+  navidrome 0.64.2 `6d91495`, grafana 13.2.3 `2acfbf1`, komga 1.28.0 `403a8f5`. None `memory_tight`; no limit moved.
+- **Not moved:** immich v3.2.4 (box proven; bench inconclusive twice — its FIRST start at today's pin could not finish,
+  the database OOM-killed at 512 MiB: `felhom.eu` R-732).
+- Evidence: `felhom.eu/documentation/audits/pg-last-six-2026-09-30/`. CI green for every push (jobs 1106–1109 and on).
+
 ## Sign-up locked twice (the app's own switch + a case-insensitive block); wanderer closable; three more probes; a probe must carry its measurement (2026-09-29 evening, decisions 47–49)
 
 - **The app's own sign-up switch** on adventurelog, calcom, gitea, gramps-web, homebox, papra, sparkyfitness, termix,

REPORT.md

@@ -1,10 +1,12 @@
-# REPORT — 2026-09-29 evening: sign-up locked twice; wanderer closable; three probes; the probe-measured gate (decisions 47–49)
+# REPORT — 2026-09-30 (day): the last six PostgreSQL apps decided; seven more within-major steps
 
-Architecture: `09-update-architecture.md` §3 decisions 47–49, `01-topology-and-trust.md` §5. Controller 0.282.0.
-Evidence: `felhom.eu/documentation/audits/signup-lock-2026-09-29/`. Per-app table: `FIRST-ADMIN.md` (sign-up locks).
+Architecture: `09-update-architecture.md` §3 decisions 35, 37–39, 42–43; §6.4 part 10; §6.5 (the drill catalog, 9202 only).
+Evidence: `felhom.eu/documentation/audits/pg-last-six-2026-09-30/`. Operator report: `felhom.eu/REPORT-pg-last-six-2026-09-30.md`.
 
-- 9 apps: the app's own switch closed by `after_setup` when the gate opens (measured: refuses a stranger straight at the app).
-- All 11 blocks case-insensitive; final trick run 113 tries, 0 got in.
-- wanderer: sign-up closed by "Close sign-up now"; two holes found and closed (collection id, letter case).
-- ghost, home-assistant, gramps-web: probes measured; gates opened by themselves.
-- Gates: new `probe-measured` (5 decoys); decoy suite fixed (docmost fixture) — 97 cases pass.
+- rallly, outline, sparkyfitness → PostgreSQL 18: bench converted (31/42/94 tables equal), box 9202 CONVERTED in 7.1/7.9/9.8 s
+  through the guarded Update, one undo case each (undone, back on the old major, seed read back). Engine gate ALLOWED on push.
+- zipline, adventurelog, immich stay on 16 (their upstreams run 16, 16, 14).
+- Three new front-door fixtures; zipline's fixture fixed to its real first-run route.
+- Part F: bookstack, kimai, audiobookshelf, n8n, navidrome, grafana, komga — each proven on both venues, one commit each.
+- immich v3.2.4 NOT moved: first start at today's pin OOM-killed its database on the bench (R-732).
+- Night-updatable apps: 28 (+ nextcloud) in the morning → 31 (+ nextcloud) after.

scripts/upgrade_fixtures_box.py

@@ -769,7 +769,10 @@ class Zipline:
                 return None
         user = "drill" + secrets.token_hex(3)
         pw = "Drill-" + secrets.token_hex(10)
-        for path in ("/api/auth/register", "/api/auth/setup"):
+        # /api/setup is Zipline 4's first-run route (measured on the bench 2026-09-30, v4.6.1: GET -> {"firstSetup":true},
+        # POST {username,password} -> 200 with a SUPERADMIN, the seeded user logs in). The two others were guesses
+        # (R-624 read this app as "no route" because of them); they stay as fallbacks.
+        for path in ("/api/setup", "/api/auth/register", "/api/auth/setup"):
             rc, code, body = w.app_curl(sub, path, "-H", "Content-Type: application/json",
                                         data=json.dumps({"username": user, "password": pw}),
                                         method="POST")