CHANGELOG + REPORT: campaign 7 full catalog sweep (53/53, 45 pass, 13 fixes)

Campaign 7 catalog sweep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 2026-07-19 — CAMPAIGN 7: full catalog sweep (53/53 apps deployed + validated on the demo box)
+
+Every app in the catalog was bumped to its newest stable upstream tag where one existed, then
+**actually deployed** through the controller's real endpoints on the demo box (controller 0.146.0),
+validated (all containers healthy, HTTP through the real Traefik ingress, log scan), and removed
+again through the real delete flow. Full evidence + result matrix:
+`felhom.eu/documentation/audits/CAMPAIGN-7-catalog-sweep-2026-07-19.md`.
+
+**Result: 45 apps pass end-to-end, 4 do not, 1 is not automatable (plex needs a real PLEX_CLAIM).**
+
+**Version bumps** — ~40 templates moved to current upstream, 15 of them across a major
+(bookstack 25.02→26.05, immich v2→v3, calcom v4→v6, nextcloud 31→34, grafana 11→13, n8n 1→2,
+outline 0.82→1.9, vikunja 0.24→2.3, tandoor 1→2, romm 4→5, radarr 5→6, privatebin 1→2,
+onlyoffice 8→9, claper 1→2, gramps-web v24→v25). `uptime-kuma` moved off the floating `:2` tag
+to `2.4.0`. **DB/cache sidecar majors were deliberately NOT bumped** — rationale in the campaign
+doc §4 (a DB major is the application's decision, and `postgres:16-alpine` already tracks 16.x).
+
+**13 template fixes, every one live-re-validated:**
+
+- **7 broken healthchecks.** This is not cosmetic: Traefik will not route to an `unhealthy`
+  container, so a probe that cannot run makes the app return **404 to the customer while it serves
+  200 on its own port**. adventurelog (wget in a distroless image → Node-exec at an absolute path),
+  emby (curl absent, BusyBox only), papra + wishlist (node-only images), homebox (`--spider` sends
+  HEAD, endpoint answers 405 to HEAD / 200 to GET), zipline (v4 renamed `/api/health` →
+  `/api/healthcheck`), tandoor (`start_period` too short for gunicorn).
+- **5 apps that had NEVER been deployable** and were fixed: papra (missing required `AUTH_SECRET`,
+  now a generated `data_key` secret), zipline (v4 `CORE_DATABASE_URL` → `DATABASE_URL`), wishlist
+  (dead Docker Hub image → followed upstream to `ghcr.io/cmintey/wishlist:v0.66.0`), homebox
+  (upstream dropped the `v` tag prefix + new required `HBOX_AUTH_API_KEY_PEPPER`), wger (2.6 needs
+  the full `DJANGO_DB_*` set and listens on :8000, not :80 — the Traefik port was wrong too).
+- **4 memory/OOM corrections proven by a live OOM:** gramps-web 384M→1024M, n8n 512M→1536M
+  (V8 heap), rallly 256M→768M, tandoor 512M→1024M (+ its `mem_limit` sum was already wrong).
+- **gokapi reverted v2.2.4 → v1.9.6**: v2 refuses to run against the seeded ConfigVersion-21
+  config and demands an intermediate v2.0.0 pass, even on a fresh deploy. Shipping it would have
+  broken every new gokapi deploy. Needs a dedicated v2 config-migration task.
+
+**Still failing (recorded, not fixed):** `glance` (needs a seeded `glance.yml`; PROVEN pre-existing —
+the pre-campaign v0.7.4 pin fails identically), `gokapi` (above), `plant-it` and `wanderer`
+(their images do not resolve at all — neither the new tag nor the one the catalog already shipped).
+
 ## 2026-07-14 — backup classification `backup:` blocks for the 13 bind-bearing apps (controller v0.132.0)
 
 Adds the referential-coupling `backup:` classification block to every catalog app that binds