diff --git a/REUSE.md b/REUSE.md
index 565c5c2..97fabc4 100644
--- a/REUSE.md
+++ b/REUSE.md
@@ -24,6 +24,7 @@ None — this repo is templates/config, not code. See §2/§5.
 | Memory convention | `templates/paperless-ngx/docker-compose.yml` (~L71) + `.felhom.yml resources:` | EVERY service has `deploy.resources.limits.memory` (compose is the enforcement). NO `reservations` anywhere. `.felhom.yml mem_limit` = SUM of all containers' limits (see paperless header comment: 768+256+128=1152M); `mem_request` = expected steady-state usage, display-only. |
 | Compose file skeleton | `templates/paperless-ngx/docker-compose.yml` (header) | Header comment (app, domain, DB type, RAM math, Pi), `restart: unless-stopped`, `TZ=Europe/Budapest`, explicit `container_name`, `traefik-public` external network + `<app>-internal` for DBs, Traefik labels with ``Host(`${SUBDOMAIN}.${DOMAIN}`)``, named volumes for DB/config (NVMe), `${HDD_PATH}/appdata/<app>/...` for bulk data, `${USERDATA_PATH}/...` for customer-browsable content. |
 | App-email (SMTP shim) opt-in | `templates/vaultwarden/.felhom.yml` (`smtp_mapping:`) + README.md §smtp_mapping | `smtp_mapping` maps shim host/port/security/from to the app's own env names; compose MUST reference the mapped `${VAR:-}` keys with empty defaults. STARTTLS if the app can accept self-signed certs, else `security_value: "NONE"` plaintext (or the :2526 plaintext listener for STARTTLS-insistent clients — see calcom/nextcloud). |
+| Probe-container naming | `templates/vaultwarden/docker-compose.yml` (`container_name: vaultwarden`) + `templates/sparkyfitness/` | The controller-side `healthcheck.checks[]` probe dials the container whose **name equals the stack (directory) name exactly**; fallback = the FIRST running prefix-match, which in a multi-container stack can be the DB (verified: `felhom-controller/internal/stacks/healthprobe.go` `findProbeContainer`). So the Traefik-exposed service's `container_name` must be exactly the stack name; sidecars `<app>-db`, `<app>-redis`, …. |
 
 ## 3. Dangerous lookalikes — do NOT copy
 
diff --git a/templates/sparkyfitness/.felhom.yml b/templates/sparkyfitness/.felhom.yml
index 9b58d64..202e102 100644
--- a/templates/sparkyfitness/.felhom.yml
+++ b/templates/sparkyfitness/.felhom.yml
@@ -10,6 +10,7 @@ slug: "sparkyfitness"
 
 resources:
   mem_request: "400M"
+  # Sum of compose limits: db 512M + server 1024M + frontend 256M = 1792M
   mem_limit: "1792M"
   pi_compatible: false
   needs_hdd: false
diff --git a/templates/sparkyfitness/docker-compose.yml b/templates/sparkyfitness/docker-compose.yml
index 1ab38e3..2f484cd 100644
--- a/templates/sparkyfitness/docker-compose.yml
+++ b/templates/sparkyfitness/docker-compose.yml
@@ -76,7 +76,8 @@ services:
         limits:
           memory: 1024M
     healthcheck:
-      # VERIFY-BEFORE-FINALIZE (see 1.3): node-exec probe, no wget/curl dependency.
+      # Node-exec probe (image-inspected 2026-07-03: node v24.17.0 at /usr/local/bin/node; wget/curl
+      # also present, but the node HTTP GET checks the real /api/health status, not just reachability).
       test: ["CMD", "node", "-e", "require('http').get('http://127.0.0.1:3010/api/health',r=>process.exit(r.statusCode<400?0:1)).on('error',()=>process.exit(1))"]
       interval: 30s
       timeout: 10s
@@ -85,7 +86,10 @@ services:
 
   sparkyfitness-frontend:
     image: codewithcj/sparkyfitness:v0.17.2
-    container_name: sparkyfitness-frontend
+    # container_name = the stack name EXACTLY: the controller-side health probe dials the container
+    # named like the stack (fallback = FIRST prefix match, which here could be the DB) — see the
+    # felhom-app-catalog skill / REUSE.md probe-naming row.
+    container_name: sparkyfitness
     restart: unless-stopped
     depends_on:
       sparkyfitness-server:
@@ -113,7 +117,8 @@ services:
         limits:
           memory: 256M
     healthcheck:
-      # VERIFY-BEFORE-FINALIZE (see 1.3): confirm wget exists in this image; else curl; else omit.
+      # BusyBox-wget family (image-inspected 2026-07-03: /usr/bin/wget present in this Alpine/nginx
+      # image; curl too — wget kept as the catalog's most common family).
       test: ["CMD", "wget", "--spider", "-q", "http://127.0.0.1:80/"]
       interval: 30s
       timeout: 10s