diff --git a/CHANGELOG.md b/CHANGELOG.md
index 68a086f..6acc4e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,39 @@
+## Fifteen proven versions move to the catalog (2026-09-22, R-462)
+
+Every one was walked on scratch guest 9202 **through the product's own guarded Update**, seeded and
+read back through the app's own front door, during the update night of 2026-09-21. One commit per
+app; each app's `catalog_since` moves to 2026-09-22 (R-452).
+
+| app | move |
+|---|---|
+| actualbudget | `26.7.0` -> `26.9.0` |
+| audiobookshelf | `2.35.1` -> `2.36.1` |
+| bookstack | `26.05.2` -> `26.05.5` |
+| docmost | `0.95.0` -> `0.96.0` |
+| grafana | `13.1.0` -> `13.2.2` |
+| home-assistant | `2026.7.2` -> `2026.9.3` |
+| mealie | `v3.20.1` -> `v3.27.0` |
+| n8n | `2.31.3` -> `2.40.5` |
+| navidrome | `0.63.2` -> `0.64.0` |
+| papra | `26.6.1-rootless` -> `26.6.2-rootless` |
+| privatebin | `2.0.5` -> `2.0.6` |
+| romm | `5.0.0` -> `5.3.0` |
+| tandoor | `2.6.13` -> `2.6.15` |
+| vikunja | `2.3.0` -> `2.6.0` |
+| **nextcloud (ENGINE)** | `mariadb:11.6` -> `mariadb:12.3` |
+
+**tandoor is here because its edge was re-walked TODAY and passed.** On 2026-09-21 the same edge
+ended `failed` at +361.9 s with the app stopped — by the wrong health probe, not by the version.
+With the probe corrected the identical edge ends **`done` at +41.1 s**, seed read back, both
+containers running with zero restarts.
+
+**nextcloud is the one ENGINE move and it is deliberate**: proven end to end in 217.4 s,
+`MARIADB_AUTO_UPGRADE=1` already in the template, and `check-engine-major.py` run against that exact
+commit ALLOWS it by name under R-469 rather than being assumed to.
+
+Nothing was forced. Every gate was run before each commit, `check-image-resolvable.py` confirms all
+18 unique pins still exist upstream, and no move was dropped.
+
 ## A gate that refuses a probe the app does not answer (2026-09-22, R-618)
 
 `scripts/check-probe-matches-compose.py`, wired into `catalog_gates.py` as a **`--fast`** gate, so