n8n: within-major step, both venues proven (R-462, Part F)

{'n8n': 'n8nio/n8n:2.41.2'} -> {'n8n': 'n8nio/n8n:2.42.1'}
The ONLY image move in this commit. Written by upgrade-test.py --write-ladder (gates rc=0):
- bench LXC 9401 (harness v4): the seed read back before and after; 10-minute memory watch: n8n anon 23.0 % | migration: [2Kn8n  | Migrations in progress, please do NOT stop the process.;
  0 kills, 0 restarts; the abort starts and serves the data;
- box 9202 (controller 0.283.1, the product's guarded Update, drill catalog): done in 122.1 s, the seed
  read back through the app's own front door.
Evidence: felhom.eu/documentation/audits/pg-last-six-2026-09-30/F/ and .../box/n8n/

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/n8n/.felhom.yml

@@ -10,7 +10,7 @@ subdomain: "auto"
 slug: "n8n"
 # catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
 # changes an image: line must set this to the same day (see CLAUDE.md).
-catalog_since: "2026-09-25"
+catalog_since: "2026-09-30"
 
 # --- Resource hints (displayed on deploy screen) ---
 resources:
@@ -121,3 +121,4 @@ update_ladder:
   - {"from": {"n8n": "n8nio/n8n:2.31.3"}, "to": {"n8n": "n8nio/n8n:2.40.5"}, "digest": {"n8n": "sha256:9f693fd5565539efd5e75ad168526c8041a6af516d9e50bc4d9cb1c9c5031523"}, "verdict": "proven", "tested_at": "2026-09-21T18:55:28.852396+00:00", "harness_version": 1, "evidence": "felhom.eu/documentation/audits/update-night-2026-09-21/apps/n8n/verdict.json", "memory_peak_pct": null, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "backfilled": "2026-09-23", "note": "backfilled from catalog commit 4132e35; box walk only (harness v1, no memory watch); digest = what the registry served on 2026-09-23, not a measurement of the tested image"}
   - {"from": {"n8n": "n8nio/n8n:2.40.5"}, "to": {"n8n": "n8nio/n8n:2.41.1"}, "digest": {"n8n": "sha256:52f147bba97908fe58e616738f2f0485696ac7b5670a1baf169ccf1ff3173de7"}, "verdict": "proven", "tested_at": "2026-09-23T19:49:44Z", "harness_version": 3, "evidence": "felhom.eu/documentation/audits/night-2026-09-23/apps/n8n/bench/evidence/MV-n8n/verdict.json", "box_evidence": "felhom.eu/documentation/audits/night-2026-09-23/apps/n8n/verdict.json", "memory_peak_pct": 22.7, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 46.8}
   - {"from": {"n8n": "n8nio/n8n:2.41.1"}, "to": {"n8n": "n8nio/n8n:2.41.2"}, "digest": {"n8n": "sha256:1419c3c665b02531dd43d815ef62f573aa9b1307962162a08a349dc8a452e8bf"}, "verdict": "proven", "tested_at": "2026-09-24T21:45:14Z", "harness_version": 3, "evidence": "felhom.eu/documentation/audits/night-2026-09-25/E/apps/n8n/bench", "box_evidence": "felhom.eu/documentation/audits/night-2026-09-25/E/apps/n8n/box", "memory_peak_pct": 22.4, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 55.9}
+  - {"from": {"n8n": "n8nio/n8n:2.41.2"}, "to": {"n8n": "n8nio/n8n:2.42.1"}, "digest": {"n8n": "sha256:e7634e62f766044dc770460db8defdcd84034eb6d767dd6a1101d49fe98f814f"}, "verdict": "proven", "tested_at": "2026-09-30T12:05:01Z", "harness_version": 4, "evidence": "felhom.eu/documentation/audits/pg-last-six-2026-09-30/F/apps/n8n/bench/evidence/MV-n8n/verdict.json", "box_evidence": "felhom.eu/documentation/audits/pg-last-six-2026-09-30/box/n8n/box-verdict-n8n.json", "memory_peak_pct": 23.0, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 45.3}

templates/n8n/docker-compose.yml

@@ -9,7 +9,7 @@
 
 services:
   n8n:
-    image: n8nio/n8n:2.41.2
+    image: n8nio/n8n:2.42.1
     container_name: n8n
     restart: unless-stopped
     environment:

templates/n8n/steps/b11b8c2e9771ba0f.felhom.yml

@@ -0,0 +1,115 @@
+# =============================================================================
+# .felhom.yml - App metadata for felhom-controller
+# =============================================================================
+
+# --- Display info (shown on dashboard) ---
+display_name: "n8n"
+description: "Workflow automatizálás vizuális szerkesztővel"
+category: "productivity"
+subdomain: "auto"
+slug: "n8n"
+# catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
+# changes an image: line must set this to the same day (see CLAUDE.md).
+catalog_since: "2026-09-25"
+
+# --- Resource hints (displayed on deploy screen) ---
+resources:
+  mem_request: "512M"
+  mem_limit: "1536M"
+  pi_compatible: false
+  needs_hdd: false
+
+# --- Deploy fields (first deployment only) ---
+deploy_fields:
+  - env_var: DOMAIN
+    label: "Domain"
+    type: domain
+    description: "A szerver domain neve"
+    locked_after_deploy: true
+
+  - env_var: SUBDOMAIN
+    label: "Aldomain"
+    type: subdomain
+    default: "auto"
+    required: true
+    locked_after_deploy: true
+    description: "Az alkalmazás aldomainje"
+
+  - env_var: N8N_ENCRYPTION_KEY
+    label: "Titkosítási kulcs"
+    type: secret
+    generate: "hex:16"
+    locked_after_deploy: true
+
+
+# --- The setup gate (controller >= 0.280.0, `09` §3 decision 46) ---
+# The first visitor would create the admin. So a fresh install is closed to everyone but the household (a browser
+# signed in to the dashboard) until the first setup is done; n8n's own settings say so (measured on 9202 2026-09-29:
+# showSetupOnFirstLoad true -> false once the owner exists).
+setup_gate: true
+# measured on 9202 2026-09-29: showSetupOnFirstLoad true -> false after the owner setup (audits/login-gate-2026-09-29/C).
+setup_done_probe:
+  url: http://n8n:5678/rest/settings
+  field: data.userManagement.showSetupOnFirstLoad
+  done: "false"
+
+# --- App info (info page content) ---
+app_info:
+  tagline: "Vizuális workflow automatizálás - Zapier/IFTTT alternatíva"
+  docs_url: "https://docs.n8n.io/"
+
+  use_cases:
+    - 'Alkalmazások összekapcsolása vizuális workflow szerkesztővel'
+    - 'Automatizálás: email, Telegram, webhook, fájl feldolgozás'
+    - '400+ integráció (Google, Slack, Notion, GitHub, stb.)'
+    - 'Időzített feladatok (cron) és webhook triggerek'
+    - 'AI munkafolyamatok LLM integrációval'
+
+  first_steps:
+    - 'Nyisd meg az auto.DOMAIN címet a böngészőben'
+    - 'Hozd létre az admin fiókot'
+    - 'Próbálj ki egy sablon workflow-t a Template galériából'
+    - 'Hozd létre az első saját munkafolyamatot'
+
+  prerequisites:
+    - 'x86 processzor szükséges'
+
+# --- Controller-side health probe ---
+healthcheck:
+  checks:
+    - type: api
+      port: 5678
+      path: "/healthz"
+      expect:
+        status: 200
+
+# --- English copy (localisation slice 5, R-560) --------------------------------------------
+# The Hungarian above is UNCHANGED. A box on English reads this block field by field; a missing
+# field shows the Hungarian one; a controller older than 0.257.0 ignores the block entirely.
+i18n:
+  en:
+    description: 'Workflow automation with a visual editor'
+    app_info:
+      tagline: 'Visual workflow automation - a Zapier/IFTTT alternative'
+      use_cases:
+        - 'Wire apps together in a visual workflow editor'
+        - 'Automate e-mail, Telegram, webhooks and file handling'
+        - '400+ integrations (Google, Slack, Notion, GitHub and more)'
+        - 'Scheduled jobs (cron) and webhook triggers'
+        - 'AI workflows with an LLM in them'
+      first_steps:
+        - 'Open auto.DOMAIN in your browser'
+        - 'Create the admin account'
+        - 'Try a ready-made workflow from the Template gallery'
+        - 'Build your first workflow of your own'
+      prerequisites:
+        - 'An x86 processor is needed'
+    deploy_fields:
+      - env_var: DOMAIN
+        label: 'Domain'
+        description: 'The server domain name'
+      - env_var: SUBDOMAIN
+        label: 'Subdomain'
+        description: 'The subdomain this app answers on'
+      - env_var: N8N_ENCRYPTION_KEY
+        label: 'Encryption key'

templates/n8n/steps/b11b8c2e9771ba0f.yml

@@ -0,0 +1,48 @@
+# n8n - Workflow automatizálás vizuális szerkesztővel
+# Domain: ${SUBDOMAIN}.${DOMAIN}
+# Database: None (file-based)
+# RAM: ~150M (mem_limit: 512M) | Pi-compatible: No
+#
+# Environment variables:
+#   DOMAIN          - Your domain (e.g., demo-felhom.eu)
+#   N8N_ENCRYPTION_KEY- Titkosítási kulcs (auto-generated)
+
+services:
+  n8n:
+    image: n8nio/n8n:2.41.2
+    container_name: n8n
+    restart: unless-stopped
+    environment:
+      - TZ=Europe/Budapest
+      - N8N_HOST=${SUBDOMAIN}.${DOMAIN}
+      - N8N_PROTOCOL=https
+      - WEBHOOK_URL=https://${SUBDOMAIN}.${DOMAIN}/
+      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
+    volumes:
+      - n8n_data:/home/node/.n8n
+    networks:
+      - traefik-public
+    deploy:
+      resources:
+        limits:
+          memory: 1536M
+    healthcheck:
+      test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:5678/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.n8n.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
+      - "traefik.http.routers.n8n.entrypoints=websecure"
+      - "traefik.http.routers.n8n.tls=true"
+      - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
+      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
+
+volumes:
+  n8n_data:
+
+networks:
+  traefik-public:
+    external: true