bookstack: 26.05.5 -> 26.09.1 (within the line), both venues proven (R-462, Part F)

The ONLY image move in this commit. Written by upgrade-test.py --write-ladder:
- bench LXC 9401 (harness v4, the bench's own BookStack fixture): FROM settled, the seeded admin
  read back, migrations ran, read back after, 10-minute memory watch peak 43.7 % (anon), 0 kills,
  0 restarts; the abort (old image back) starts and serves the data;
- box 9202 (controller 0.283.1, the product's guarded Update, drill catalog): done in 64.6 s, the
  seeded admin read back through the app's own CLI.
The superseded step keeps its definition at steps/fdb7afbec5ea4dbc.{yml,felhom.yml} (09 §6.4 part 5).
The database half only, as before (R-460). MariaDB 12.3 does not move.
Evidence: felhom.eu/documentation/audits/pg-last-six-2026-09-30/F/ and .../box/bookstack/

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/bookstack/.felhom.yml

@@ -10,7 +10,7 @@ subdomain: "wiki"
 slug: "bookstack"
 # catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
 # changes an image: line must set this to the same day (see CLAUDE.md).
-catalog_since: "2026-09-22"
+catalog_since: "2026-09-30"
 
 # --- Resource hints (displayed on deploy screen) ---
 resources:
@@ -133,3 +133,4 @@ i18n:
 # gated by scripts/check-test-record.py. An image: move without a proven entry here is refused.
 update_ladder:
   - {"from": {"bookstack": "lscr.io/linuxserver/bookstack:26.05.2", "bookstack-db": "mariadb:12.3"}, "to": {"bookstack": "lscr.io/linuxserver/bookstack:26.05.5", "bookstack-db": "mariadb:12.3"}, "digest": {"bookstack": "sha256:189c796273469115cf810e53f450e15b93184018e4728cd65fcaef8aa93584bc", "bookstack-db": "sha256:805c8e104bd563d5bfa24fadd3f31cd419ea859cb5277f32b5dbf2db714f9ed1"}, "verdict": "proven", "tested_at": "2026-09-21T18:25:39.453490+00:00", "harness_version": 1, "evidence": "felhom.eu/documentation/audits/update-night-2026-09-21/apps/bookstack/verdict.json", "memory_peak_pct": null, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "backfilled": "2026-09-23", "note": "backfilled from catalog commit ac4828f; box walk only (harness v1, no memory watch); digest = what the registry served on 2026-09-23, not a measurement of the tested image"}
+  - {"from": {"bookstack": "lscr.io/linuxserver/bookstack:26.05.5", "bookstack-db": "mariadb:12.3"}, "to": {"bookstack": "lscr.io/linuxserver/bookstack:26.09.1", "bookstack-db": "mariadb:12.3"}, "digest": {"bookstack": "sha256:99cd1f5707c1911afad213adec5c9739763b76f843d1477142231834ecdcb6f7", "bookstack-db": "sha256:805c8e104bd563d5bfa24fadd3f31cd419ea859cb5277f32b5dbf2db714f9ed1"}, "verdict": "proven", "tested_at": "2026-09-30T11:09:02Z", "harness_version": 4, "evidence": "felhom.eu/documentation/audits/pg-last-six-2026-09-30/F/apps/bookstack/bench/evidence/MV-bookstack/verdict.json", "box_evidence": "felhom.eu/documentation/audits/pg-last-six-2026-09-30/box/bookstack/box-verdict-bookstack.json", "memory_peak_pct": 43.7, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 58.3}

templates/bookstack/docker-compose.yml

@@ -10,7 +10,7 @@
 
 services:
   bookstack:
-    image: lscr.io/linuxserver/bookstack:26.05.5
+    image: lscr.io/linuxserver/bookstack:26.09.1
     container_name: bookstack
     restart: unless-stopped
     depends_on:

templates/bookstack/steps/fdb7afbec5ea4dbc.felhom.yml

@@ -0,0 +1,129 @@
+# =============================================================================
+# .felhom.yml - App metadata for felhom-controller
+# =============================================================================
+
+# --- Display info (shown on dashboard) ---
+display_name: "BookStack"
+description: "Egyszerű, könyv-szerű wiki és dokumentáció platform"
+category: "productivity"
+subdomain: "wiki"
+slug: "bookstack"
+# catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
+# changes an image: line must set this to the same day (see CLAUDE.md).
+catalog_since: "2026-09-22"
+
+# --- Resource hints (displayed on deploy screen) ---
+resources:
+  mem_request: "150M"
+  mem_limit: "512M"
+  pi_compatible: true
+  needs_hdd: false
+
+# --- Deploy fields (first deployment only) ---
+deploy_fields:
+  - env_var: DOMAIN
+    label: "Domain"
+    type: domain
+    description: "A szerver domain neve"
+    locked_after_deploy: true
+
+  - env_var: SUBDOMAIN
+    label: "Aldomain"
+    type: subdomain
+    default: "wiki"
+    required: true
+    locked_after_deploy: true
+    description: "Az alkalmazás aldomainje"
+
+  - env_var: APP_KEY
+    label: "Alkalmazás kulcs"
+    type: secret
+    generate: "base64key:32"
+    locked_after_deploy: true
+
+  - env_var: DB_PASSWORD
+    label: "Adatbázis jelszó"
+    type: secret
+    generate: "password:24"
+    locked_after_deploy: true
+
+  # `09` §3 decision 45: BookStack starts with admin@admin.com / password. The box replaces that password with
+  # this generated one right after the install (after_install below); the app page shows it as the first password.
+  - env_var: ADMIN_PASSWORD
+    label: "Admin jelszó (admin@admin.com)"
+    type: password
+    generate: "password:24"
+    description: "Az első bejelentkezéshez: admin@admin.com és ez a jelszó. Utána a profilodban módosítható."
+    locked_after_deploy: true
+
+# --- App info (info page content) ---
+app_info:
+  tagline: "Egyszerű wiki platform - polcok, könyvek, fejezetek és oldalak"
+  default_creds: "admin@admin.com / password"
+  docs_url: "https://www.bookstackapp.com/docs/"
+
+  use_cases:
+    - 'Családi tudásbázis - receptek, kézikönyvek, szabályok'
+    - 'Projekt dokumentáció strukturált formában'
+    - 'Könyv > Fejezet > Oldal hierarchia az áttekinthetőségért'
+    - 'Teljes szöveges keresés és címkék'
+    - 'WYSIWYG és Markdown szerkesztő'
+
+  first_steps:
+    - 'Nyisd meg a wiki.DOMAIN címet a böngészőben'
+    - 'Jelentkezz be: admin@admin.com és a Beállítások oldalon látható első jelszó'
+    - 'Változtasd meg az admin email címét a sajátodra'
+    - 'Hozd létre az első polcot és könyvet'
+    - 'Kezdj el írni!'
+
+
+# --- After a fresh install (controller >= 0.279.0, decision 45) ---
+# BookStack's OWN artisan command updates the initial admin in place. Measured on 9202 2026-09-28: afterwards
+# admin@admin.com / password no longer logs in, the generated password does.
+after_install:
+  service: bookstack
+  env: [ADMIN_PASSWORD]
+  command: ["php", "/app/www/artisan", "bookstack:create-admin", "--email=admin@admin.com", "--name=Admin", "--password=${ADMIN_PASSWORD}", "--initial"]
+  success: "The default admin user has been updated"
+
+# --- Controller-side health probe ---
+healthcheck:
+  checks:
+    - type: http
+      port: 80
+
+# --- English copy (localisation slice 5, R-560) --------------------------------------------
+# The Hungarian above is UNCHANGED. A box on English reads this block field by field; a missing
+# field shows the Hungarian one; a controller older than 0.257.0 ignores the block entirely.
+i18n:
+  en:
+    description: 'A simple, book-shaped wiki and documentation platform'
+    app_info:
+      tagline: 'A simple wiki platform - shelves, books, chapters and pages'
+      default_creds: 'admin@admin.com / password'
+      use_cases:
+        - 'A family knowledge base - recipes, manuals, house rules'
+        - 'Project documentation with a structure you can follow'
+        - 'Book > Chapter > Page, so a large set stays readable'
+        - 'Full text search and tags'
+        - 'A visual editor and a Markdown editor'
+      first_steps:
+        - 'Open wiki.DOMAIN in your browser'
+        - 'Sign in: admin@admin.com and the first password shown on the settings page'
+        - 'Change the admin e-mail address to your own'
+        - 'Create your first shelf and book'
+        - 'Start writing'
+    deploy_fields:
+      - env_var: DOMAIN
+        label: 'Domain'
+        description: 'The server domain name'
+      - env_var: SUBDOMAIN
+        label: 'Subdomain'
+        description: 'The subdomain this app answers on'
+      - env_var: DB_PASSWORD
+        label: 'Database password'
+      - env_var: APP_KEY
+        label: 'Application key'
+      - env_var: ADMIN_PASSWORD
+        label: 'Admin password (admin@admin.com)'
+        description: 'For the first sign-in: admin@admin.com and this password. Change it in your profile afterwards.'

templates/bookstack/steps/fdb7afbec5ea4dbc.yml

@@ -0,0 +1,90 @@
+# BookStack - Egyszerű, könyv-szerű wiki és dokumentáció platform
+# Domain: ${SUBDOMAIN}.${DOMAIN}
+# Database: mariadb
+# RAM: ~150M (mem_limit: 512M) | Pi-compatible: Yes
+#
+# Environment variables:
+#   DOMAIN          - Your domain (e.g., demo-felhom.eu)
+#   DB_PASSWORD     - Adatbázis jelszó (auto-generated)
+#   APP_KEY         - Laravel application key (auto-generated)
+
+services:
+  bookstack:
+    image: lscr.io/linuxserver/bookstack:26.05.5
+    container_name: bookstack
+    restart: unless-stopped
+    depends_on:
+      bookstack-db:
+        condition: service_healthy
+    environment:
+      - TZ=Europe/Budapest
+      - PUID=1000
+      - PGID=1000
+      - DB_HOST=bookstack-db
+      - DB_PORT=3306
+      - DB_USERNAME=bookstack
+      - DB_PASSWORD=${DB_PASSWORD}
+      - DB_DATABASE=bookstack
+      - APP_KEY=${APP_KEY}
+      - APP_URL=https://${SUBDOMAIN}.${DOMAIN}
+    volumes:
+      - bookstack_config:/config
+    networks:
+      - traefik-public
+      - bookstack-internal
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:80"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.bookstack.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
+      - "traefik.http.routers.bookstack.entrypoints=websecure"
+      - "traefik.http.routers.bookstack.tls=true"
+      - "traefik.http.routers.bookstack.tls.certresolver=letsencrypt"
+      - "traefik.http.services.bookstack.loadbalancer.server.port=80"
+
+  bookstack-db:
+    image: mariadb:12.3
+    container_name: bookstack-db
+    restart: unless-stopped
+    environment:
+      - MYSQL_ROOT_PASSWORD=${DB_PASSWORD}
+      - MYSQL_DATABASE=bookstack
+      - MYSQL_USER=bookstack
+      - MYSQL_PASSWORD=${DB_PASSWORD}
+      - TZ=Europe/Budapest
+      # MARIADB_AUTO_UPGRADE: on a MAJOR engine move the engine converts its own datadir (~7 s on a
+      # small DB, backs its system tables up first). Operator ruling 2026-09-13 on
+      # felhom.eu/documentation/audits/SPIKE-r459-mariadb-upgrade-2026-09-06.md. Inert until a
+      # major moves — and none may, until Slice 4 (R-448) ships: see CLAUDE.md, engine-major rule.
+      - MARIADB_AUTO_UPGRADE=1
+    volumes:
+      - bookstack_db_data:/var/lib/mysql
+    networks:
+      - bookstack-internal
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+volumes:
+  bookstack_config:
+  bookstack_db_data:
+
+networks:
+  traefik-public:
+    external: true
+  bookstack-internal: