kimai: apache-2.57.0 -> 2.67.0 (within major 2), both venues proven (R-462, Part F)

The ONLY image move in this commit. Upstream stopped the `apache-` tag prefix after 2.57.0;
MEASURED 2026-09-30 on Docker Hub: `2.67.0`, `2`, `stable` and `apache` all resolve to ONE digest
(sha256:3084f1e5…), while `fpm`/`latest` are another — so the plain tag IS the Apache variant.
Written by upgrade-test.py --write-ladder:
- bench LXC 9401 (harness v4, box fixture Kimai via boxport): the seeded user read back before
  and after, Doctrine migrations ran (to Version20260804090000), 10-minute memory watch: kimai
  anon 6.0 % (cgroup 91.7 % = file cache, decision 22), kimai-db anon 45.0 %, 0 kills, 0 restarts;
  the abort starts and serves the data;
- box 9202 (controller 0.283.1, the product's guarded Update, drill catalog): done in 82.1 s, the
  seeded user read back through the app's own CLI.
The superseded step keeps its definition at steps/def18c0c25cf49f7.{yml,felhom.yml}.
Evidence: felhom.eu/documentation/audits/pg-last-six-2026-09-30/F/ and .../box/kimai/

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

templates/kimai/.felhom.yml

@@ -10,7 +10,7 @@ subdomain: "time"
 slug: "kimai"
 # catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
 # changes an image: line must set this to the same day (see CLAUDE.md).
-catalog_since: "2026-09-23"
+catalog_since: "2026-09-30"
 
 # --- Resource hints (displayed on deploy screen) ---
 resources:
@@ -119,3 +119,4 @@ i18n:
 # gated by scripts/check-test-record.py. An image: move without a proven entry here is refused.
 update_ladder:
   - {"from": {"kimai": "kimai/kimai2:apache-2.57.0", "kimai-db": "mariadb:11.6"}, "to": {"kimai": "kimai/kimai2:apache-2.57.0", "kimai-db": "mariadb:11.8"}, "digest": {"kimai": "sha256:efa66c5eadf948b94d8031e9436feae491d90b2ceaa3d5e45e4d7c1a59dd8c38", "kimai-db": "sha256:79d59758afc91b89b120b0a8904d637f5a3b3e1c4900f29b740d6d46c72fef68"}, "verdict": "proven", "tested_at": "2026-09-23T19:58:59Z", "harness_version": 3, "evidence": "felhom.eu/documentation/audits/night-2026-09-23/apps/kimai/bench/evidence/MV-kimai/verdict.json", "box_evidence": "felhom.eu/documentation/audits/night-2026-09-23/apps/kimai/verdict.json", "memory_peak_pct": 37.9, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 100.0}
+  - {"from": {"kimai": "kimai/kimai2:apache-2.57.0", "kimai-db": "mariadb:11.8"}, "to": {"kimai": "kimai/kimai2:2.67.0", "kimai-db": "mariadb:11.8"}, "digest": {"kimai": "sha256:3084f1e5ecdc10afafc193911039a06cdabda4473f3a48d62edbe460e3c154ee", "kimai-db": "sha256:79d59758afc91b89b120b0a8904d637f5a3b3e1c4900f29b740d6d46c72fef68"}, "verdict": "proven", "tested_at": "2026-09-30T11:25:04Z", "harness_version": 4, "evidence": "felhom.eu/documentation/audits/pg-last-six-2026-09-30/F/apps/kimai/bench/evidence/MV-kimai/verdict.json", "box_evidence": "felhom.eu/documentation/audits/pg-last-six-2026-09-30/box/kimai/box-verdict-kimai.json", "memory_peak_pct": 45.0, "marks": {"files_may_change": false, "needs_person": null, "memory_tight": false}, "memory_basis": "anon", "memory_cgroup_peak_pct": 91.7}

templates/kimai/docker-compose.yml

@@ -11,7 +11,7 @@
 
 services:
   kimai:
-    image: kimai/kimai2:apache-2.57.0
+    image: kimai/kimai2:2.67.0
     container_name: kimai
     restart: unless-stopped
     depends_on:

templates/kimai/steps/def18c0c25cf49f7.felhom.yml

@@ -0,0 +1,115 @@
+# =============================================================================
+# .felhom.yml - App metadata for felhom-controller
+# =============================================================================
+
+# --- Display info (shown on dashboard) ---
+display_name: "Kimai"
+description: "Időkövetés és projektmenedzsment"
+category: "productivity"
+subdomain: "time"
+slug: "kimai"
+# catalog_since: the date THIS repo last changed this app's pinned images. Any commit that
+# changes an image: line must set this to the same day (see CLAUDE.md).
+catalog_since: "2026-09-23"
+
+# --- Resource hints (displayed on deploy screen) ---
+resources:
+  mem_request: "100M"
+  mem_limit: "384M"
+  pi_compatible: true
+  needs_hdd: false
+
+# --- Deploy fields (first deployment only) ---
+deploy_fields:
+  - env_var: DOMAIN
+    label: "Domain"
+    type: domain
+    description: "A szerver domain neve"
+    locked_after_deploy: true
+
+  - env_var: SUBDOMAIN
+    label: "Aldomain"
+    type: subdomain
+    default: "time"
+    required: true
+    locked_after_deploy: true
+    description: "Az alkalmazás aldomainje"
+
+  - env_var: DB_PASSWORD
+    label: "Adatbázis jelszó"
+    type: secret
+    generate: "password:24"
+    locked_after_deploy: true
+
+  - env_var: ADMIN_EMAIL
+    label: "Admin email"
+    type: text
+    default: "admin@example.com"
+
+  - env_var: ADMIN_PASSWORD
+    label: "Admin jelszó"
+    type: password
+    generate: "password:16"
+    description: "Első bejelentkezéshez. Utána a webes felületen módosítható."
+    locked_after_deploy: false
+
+# --- App info (info page content) ---
+app_info:
+  tagline: "Időkövetés - projektek, ügyfelek és munkaidő nyilvántartás"
+  default_creds: "(telepítéskor megadott admin email és jelszó)"
+  docs_url: "https://www.kimai.org/documentation/"
+
+  use_cases:
+    - 'Munkaidő nyilvántartás projektekre és ügyfelekre bontva'
+    - 'Stopper-szerű időmérés egy kattintással'
+    - 'Riportok és exportálás (PDF, CSV, Excel)'
+    - 'Költségek és számlázás nyilvántartás'
+    - 'Több felhasználó csapat szintű jogosultságokkal'
+
+  first_steps:
+    - 'Nyisd meg a time.DOMAIN címet a böngészőben'
+    - 'Jelentkezz be a telepítéskor megadott admin adatokkal'
+    - 'Hozd létre az első ügyfelet és projektet'
+    - 'Indítsd el az időmérést'
+
+
+# --- Controller-side health probe ---
+healthcheck:
+  checks:
+    - type: http
+      port: 8001
+
+# --- English copy (localisation slice 5, R-560) --------------------------------------------
+# The Hungarian above is UNCHANGED. A box on English reads this block field by field; a missing
+# field shows the Hungarian one; a controller older than 0.257.0 ignores the block entirely.
+i18n:
+  en:
+    description: 'Time tracking and project management'
+    app_info:
+      tagline: 'Time tracking - projects, clients and hours worked'
+      default_creds: '(the admin e-mail and password you set at install time)'
+      use_cases:
+        - 'Record hours worked, split by project and client'
+        - 'A stopwatch you start with one click'
+        - 'Reports and export (PDF, CSV, Excel)'
+        - 'Keep track of costs and invoicing'
+        - 'Several people, with team-level permissions'
+      first_steps:
+        - 'Open time.DOMAIN in your browser'
+        - 'Sign in with the admin details you set at install time'
+        - 'Create your first client and project'
+        - 'Start the timer'
+    deploy_fields:
+      - env_var: DOMAIN
+        label: 'Domain'
+        description: 'The server domain name'
+      - env_var: SUBDOMAIN
+        label: 'Subdomain'
+        description: 'The subdomain this app answers on'
+      - env_var: DB_PASSWORD
+        label: 'Database password'
+      - env_var: ADMIN_EMAIL
+        label: 'Admin e-mail'
+      - env_var: ADMIN_PASSWORD
+        label: 'Admin password'
+        description: 'For the first sign-in. You can change it in the app afterwards.'

templates/kimai/steps/def18c0c25cf49f7.yml

@@ -0,0 +1,85 @@
+# Kimai - Időkövetés és projektmenedzsment
+# Domain: ${SUBDOMAIN}.${DOMAIN}
+# Database: mariadb
+# RAM: ~100M (mem_limit: 384M) | Pi-compatible: Yes
+#
+# Environment variables:
+#   DOMAIN          - Your domain (e.g., demo-felhom.eu)
+#   DB_PASSWORD     - Adatbázis jelszó (auto-generated)
+#   ADMIN_EMAIL     - Admin email
+#   ADMIN_PASSWORD  - Admin jelszó (auto-generated)
+
+services:
+  kimai:
+    image: kimai/kimai2:apache-2.57.0
+    container_name: kimai
+    restart: unless-stopped
+    depends_on:
+      kimai-db:
+        condition: service_healthy
+    environment:
+      - TZ=Europe/Budapest
+      - DATABASE_URL=mysql://kimai:${DB_PASSWORD}@kimai-db:3306/kimai?charset=utf8mb4&serverVersion=11.6.2-MariaDB
+      - ADMINMAIL=${ADMIN_EMAIL:-admin@example.com}
+      - ADMINPASS=${ADMIN_PASSWORD}
+    volumes:
+      - kimai_var:/opt/kimai/var
+    networks:
+      - traefik-public
+      - kimai-internal
+    deploy:
+      resources:
+        limits:
+          memory: 384M
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:8001"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.kimai.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
+      - "traefik.http.routers.kimai.entrypoints=websecure"
+      - "traefik.http.routers.kimai.tls=true"
+      - "traefik.http.routers.kimai.tls.certresolver=letsencrypt"
+      - "traefik.http.services.kimai.loadbalancer.server.port=8001"
+
+  kimai-db:
+    image: mariadb:11.8
+    container_name: kimai-db
+    restart: unless-stopped
+    environment:
+      - MYSQL_ROOT_PASSWORD=${DB_PASSWORD}
+      - MYSQL_DATABASE=kimai
+      - MYSQL_USER=kimai
+      - MYSQL_PASSWORD=${DB_PASSWORD}
+      - TZ=Europe/Budapest
+      # MARIADB_AUTO_UPGRADE: on a MAJOR engine move the engine converts its own datadir (~7 s on a
+      # small DB, backs its system tables up first). Operator ruling 2026-09-13 on
+      # felhom.eu/documentation/audits/SPIKE-r459-mariadb-upgrade-2026-09-06.md. Inert until a
+      # major moves — and none may, until Slice 4 (R-448) ships: see CLAUDE.md, engine-major rule.
+      - MARIADB_AUTO_UPGRADE=1
+    volumes:
+      - kimai_db_data:/var/lib/mysql
+    networks:
+      - kimai-internal
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+volumes:
+  kimai_db_data:
+  kimai_var:
+
+networks:
+  traefik-public:
+    external: true
+  kimai-internal: