home-assistant: 2026.9.3 -> 2026.9.4, within-major step, both venues proven (R-462)

Bench 9401 (harness v4, swap 0): the onboarding owner seeded and logged in before and after,
10-min memory watch 0 kills (anon peak 32.0 %); the abort starts and serves. Box 9202: the guarded
Update done in 113.8 s through the setup gate, the owner logs in. The old head was a backfilled
harness-v1 entry; this step carries the memory watch. Written by upgrade-test.py --write-ladder.

Evidence: felhom.eu/documentation/audits/more-night-apps-2026-09-30/

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/home-assistant/.felhom.yml

@@ -10,7 +10,7 @@ subdomain: "ha"
 slug: "home-assistant"
 # catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
 # changes an image: line must set this to the same day (see CLAUDE.md).
-catalog_since: "2026-09-22"
+catalog_since: "2026-09-30"
 
 # --- Resource hints (displayed on deploy screen) ---
 resources:
@@ -110,3 +110,4 @@ i18n:
 # gated by scripts/check-test-record.py. An image: move without a proven entry here is refused.
 update_ladder:
   - {"from": {"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.7.2"}, "to": {"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.9.3"}, "digest": {"home-assistant": "sha256:d8922685169707fd91e8b9729902d975f06157d005e422874d201e0261dda196"}, "verdict": "proven", "tested_at": "2026-09-21T19:10:14.843396+00:00", "harness_version": 1, "evidence": "felhom.eu/documentation/audits/update-night-2026-09-21/apps/home-assistant/verdict.json", "memory_peak_pct": null, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "backfilled": "2026-09-23", "note": "backfilled from catalog commit 4405f12; box walk only (harness v1, no memory watch); digest = what the registry served on 2026-09-23, not a measurement of the tested image"}
+  - {"from": {"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.9.3"}, "to": {"home-assistant": "ghcr.io/home-assistant/home-assistant:2026.9.4"}, "digest": {"home-assistant": "sha256:3e6710a7ab2a61311d9d899b719f6c3657791c63e8f4942cec4ebc42401d6b76"}, "verdict": "proven", "tested_at": "2026-09-30T15:56:29Z", "harness_version": 4, "evidence": "felhom.eu/documentation/audits/more-night-apps-2026-09-30/bench/apps/home-assistant/bench/evidence/MV-home-assistant/verdict.json", "box_evidence": "felhom.eu/documentation/audits/more-night-apps-2026-09-30/box/home-assistant/step.txt", "memory_peak_pct": 32.0, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 47.4}

templates/home-assistant/docker-compose.yml

@@ -8,7 +8,7 @@
 
 services:
   home-assistant:
-    image: ghcr.io/home-assistant/home-assistant:2026.9.3
+    image: ghcr.io/home-assistant/home-assistant:2026.9.4
     container_name: home-assistant
     restart: unless-stopped
     entrypoint: ["/bin/sh", "-c"]

templates/home-assistant/steps/52034472eaf393c5.felhom.yml

@@ -0,0 +1,106 @@
+# =============================================================================
+# .felhom.yml - App metadata for felhom-controller
+# =============================================================================
+
+# --- Display info (shown on dashboard) ---
+display_name: "Home Assistant"
+description: "Nyílt forráskódú okos otthon központ"
+category: "home"
+subdomain: "ha"
+slug: "home-assistant"
+# catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
+# changes an image: line must set this to the same day (see CLAUDE.md).
+catalog_since: "2026-09-22"
+
+# --- Resource hints (displayed on deploy screen) ---
+resources:
+  mem_request: "256M"
+  mem_limit: "1024M"
+  pi_compatible: true
+  needs_hdd: false
+
+# --- Deploy fields (first deployment only) ---
+deploy_fields:
+  - env_var: DOMAIN
+    label: "Domain"
+    type: domain
+    description: "A szerver domain neve"
+    locked_after_deploy: true
+
+  - env_var: SUBDOMAIN
+    label: "Aldomain"
+    type: subdomain
+    default: "ha"
+    required: true
+    locked_after_deploy: true
+    description: "Az alkalmazás aldomainje"
+
+# --- The setup gate (controller >= 0.281.0, `09` §3 decisions 46-47) ---
+# The first visitor would create the admin; a fresh install is closed to everyone but the household until the first setup is done.
+setup_gate: true
+# measured on 9202 2026-09-29: before [{"step":"user","done":false},…], after the user step [{"step":"user","done":true},…].
+setup_done_probe:
+  url: http://home-assistant:8123/api/onboarding
+  field: 0.done
+  done: "true"
+
+# --- App info (info page content) ---
+app_info:
+  tagline: "Okos otthon központ - automatizálás és vezérlés egy helyről"
+  docs_url: "https://www.home-assistant.io/docs/"
+
+  use_cases:
+    - 'Okos otthon eszközök központi kezelése (lámpa, termosztát, kamera)'
+    - 'Automatizálások létrehozása (pl. mozgásérzékelőre lámpa be)'
+    - '2000+ integráció (Zigbee, Z-Wave, Tuya, Shelly, stb.)'
+    - 'Dashboard a család számára mobilon és tableten'
+    - 'Energiafogyasztás monitorozás'
+
+  first_steps:
+    - 'Nyisd meg a ha.DOMAIN címet a böngészőben'
+    - 'Hozd létre a tulajdonos fiókot az onboarding során'
+    - 'Fedezd fel az automatikusan felfedezett eszközöket'
+    - 'Telepíts integrációkat az okos otthon eszközeidhez'
+    - 'Hozd létre az első automatizálást'
+
+  prerequisites:
+    - 'Okos otthon eszközök (nem kötelező, de ajánlott a telepítés előtt)'
+    - 'Zigbee/Z-Wave koordinátor USB eszközök átpasszolása nem támogatott Docker módban'
+
+# --- Controller-side health probe ---
+healthcheck:
+  checks:
+    - type: api
+      port: 8123
+      path: "/api/"
+
+# --- English copy (localisation slice 5, R-560) --------------------------------------------
+# The Hungarian above is UNCHANGED. A box on English reads this block field by field; a missing
+# field shows the Hungarian one; a controller older than 0.257.0 ignores the block entirely.
+i18n:
+  en:
+    description: 'An open source smart home hub'
+    app_info:
+      tagline: 'A smart home hub - automation and control from one place'
+      use_cases:
+        - 'Run your smart home devices from one place (lights, thermostat, cameras)'
+        - 'Build automations (a light that comes on with a motion sensor, for example)'
+        - '2000+ integrations (Zigbee, Z-Wave, Tuya, Shelly and more)'
+        - 'A dashboard for the household, on phones and tablets'
+        - 'Watch what your home uses in energy'
+      first_steps:
+        - 'Open ha.DOMAIN in your browser'
+        - 'Create the owner account during onboarding'
+        - 'Look at the devices it has already found on its own'
+        - 'Install integrations for your smart home devices'
+        - 'Build your first automation'
+      prerequisites:
+        - 'Smart home devices (not required, but worth having before you install)'
+        - 'Passing a Zigbee/Z-Wave USB coordinator through is not supported in Docker mode'
+    deploy_fields:
+      - env_var: DOMAIN
+        label: 'Domain'
+        description: 'The server domain name'
+      - env_var: SUBDOMAIN
+        label: 'Subdomain'
+        description: 'The subdomain this app answers on'

templates/home-assistant/steps/52034472eaf393c5.yml

@@ -0,0 +1,61 @@
+# Home Assistant - Nyílt forráskódú okos otthon központ
+# Domain: ${SUBDOMAIN}.${DOMAIN}
+# Database: None (file-based)
+# RAM: ~256M (mem_limit: 1024M) | Pi-compatible: Yes
+#
+# Environment variables:
+#   DOMAIN          - Your domain (e.g., demo-felhom.eu)
+
+services:
+  home-assistant:
+    image: ghcr.io/home-assistant/home-assistant:2026.9.3
+    container_name: home-assistant
+    restart: unless-stopped
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        # Ensure reverse-proxy (Traefik) trusted_proxies config exists.
+        # 172.16.0.0/12 covers all Docker bridge networks.
+        CFG=/config/configuration.yaml
+        if [ -f "$$CFG" ] && ! grep -q 'trusted_proxies' "$$CFG"; then
+          printf '\nhttp:\n  use_x_forwarded_for: true\n  trusted_proxies:\n    - 172.16.0.0/12\n' >> "$$CFG"
+        elif [ ! -f "$$CFG" ]; then
+          cat > "$$CFG" << 'HACFG'
+        default_config:
+        http:
+          use_x_forwarded_for: true
+          trusted_proxies:
+            - 172.16.0.0/12
+        HACFG
+        fi
+        exec /init
+    environment:
+      - TZ=Europe/Budapest
+    volumes:
+      - homeassistant_config:/config
+    networks:
+      - traefik-public
+    deploy:
+      resources:
+        limits:
+          memory: 1024M
+    healthcheck:
+      test: ["CMD", "curl", "-sf", "http://127.0.0.1:8123/manifest.json"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.home-assistant.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
+      - "traefik.http.routers.home-assistant.entrypoints=websecure"
+      - "traefik.http.routers.home-assistant.tls=true"
+      - "traefik.http.routers.home-assistant.tls.certresolver=letsencrypt"
+      - "traefik.http.services.home-assistant.loadbalancer.server.port=8123"
+
+volumes:
+  homeassistant_config:
+
+networks:
+  traefik-public:
+    external: true