REPORT — two template fixes from the first nightly rotation (2026-09-13)

Overwritten each session.

adventurelog — DEBUG=False (ed2c018, R-482). The image defaults Django to DEBUG=True and served debug pages on the public origin. Proven live after the sync: the same CSRF failure renders the 300-byte production page.
glance — a seeded glance.yml on first boot (50ad286, R-473). Fresh installs crash-looped without a config. Proven live: a throwaway install healthy in 21 s, 0 restarts, front door 200.
adventurelog — the backend's own paths go to the backend (3172258, R-483, re-ranked P2 by the operator). Photos uploaded but rendered broken on demo-hp while they rendered on his k3s: the k3s ingress routes /media, /static, /admin, /accounts to the backend; the catalog routed every path to the frontend, which has no /media. A traefik router on the backend service now carries those prefixes. Proven without a browser on the operator's own instance after the guarded Update recreated its containers: a photo placed through the backend API is listed at https://travel…/media/images/<id>.webp and that URL answers 200 through the public origin; the frontend's non-browser multipart 500 is upstream and recorded. Second cut: the router targets port 80 (the nginx inside the backend image that serves Django's X-Accel media). Confirmed by the operator in a browser at 21:49 — R-483 closed.
catalog-since gate (R-452): scripts/check-catalog-since.py — an image: move must bump that app's catalog_since; five decoys; red-proofed.

No version moved. Gates green on every push (catalog_gates.py --fast, now five gates).

Observations

wger, tandoor, paperless-ngx are Django too and their DEBUG default is unmeasured. NOT-A-FINDING: recorded in R-482's closure; each is measured on its own rotation night, not guessed.
adventurelog's photo upload fails from any non-browser client. FILED: R-483