THE TWENTY-EIGHT: every app no drill had touched, walked in one night

All 28 walked on scratch guest 9202 against the private drill catalog. 26 deployed, 6 proven,
5 inconclusive, 14 with no upstream edge, 1 failed honestly (outline 1.9.1->1.10.1, HELD with the
right sentence), 2 undeployable - one (plant-it) by design, refused by the lifecycle gate, proven
live for the first time. Each app also got the half the update night skipped: a restore from its own
copy with the seed read back again - 21 restored, 2 correctly REFUSED per 07 6.2.

R-630 RAISED TO P1 by measurement: a stack with NO probe container does not skip verifying - it
waits out the full health timeout and HOLDS, stopping an app whose three containers read healthy.
The controller's own words: "not healthy within 5m0s (last: no probe container)".

R-633 opened: a remove sent during a restore reports success and leaves a container restarting with
a live public route. The product already refuses that clash for update and for restore, naming the
blocker; remove has no such guard.

R-634 opened: an app can be running, healthy and serving while recorded as deployed=false, and is
then unremovable. Reproducible alone on sparkyfitness; concurrency-linked on two others.

R-631 and R-632 CLOSED. Register 321 -> 323. Seven interventions, six of them my own harness -
named, with what each cost. No product code. The live catalog's image: lines are byte-identical to
the start of the night.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/runbooks/nightly-rotation.md

@@ -15,11 +15,11 @@ customer, hub off, tunnel off, `https://192.168.0.114` with the same Host names
 
 - [x] bentopdf — 2026-09-13 (night 2, scratch guest 9202): install, front door 200, no data route (browser-side toolbox — recorded, not faked), backup now + Tier 2, remove-keep → Tier-2 restore back, same-version Update (backed up first: the restore's deploy time is newer than the copies, R-478 by design), remove-all clean. No new rows. `audits/nightly-2026-09-13b-bentopdf/`.
 - [x] bookstack — 2026-09-21 (update night, scratch guest 9202): install, seeded through `php artisan` with its own negative control, backup, real upstream Update 26.05.2->26.05.5 (45.1 s), read back, removed. DATABASE HALF ONLY (R-460). `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] calibre-web
+- [x] calibre-web — 2026-09-22 (the 28, scratch guest 9202): install, front door 302, NO non-browser data route (no fixture: no non-browser seed route was written for this app), „Mentés most", no upstream edge tonight, restore failed, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
 - [x] docmost — 2026-09-21 (update night, scratch guest 9202): install, seeded a workspace+user through its own API, read back, backup, real upstream Update 0.95.0->0.96.0 (103.6 s) with its own migration line quoted, read back, removed with data. `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] kimai
+- [x] kimai — 2026-09-22 (the 28, scratch guest 9202): install, front door 302, NO non-browser data route (recorded, not faked), „Mentés most", no upstream edge tonight, restore ok, read back after the restore, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
 - [ ] opengist — NOT A FULL WALK; attempted 2026-09-21 (update night, scratch guest 9202): install, seeded an account through its own sign-up form, read back, backup, real upstream Update 1.13->1.15 — the UPDATE SUCCEEDED (14.4 s, all four observables agree) but the readback ran before /login was serving, so the edge is **inconclusive**, not proven. `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] paperless-ngx
+- [x] paperless-ngx — 2026-09-22 (the 28, scratch guest 9202): install, front door 302, NO non-browser data route (no fixture: no non-browser seed route was written for this app), „Mentés most", no upstream edge tonight, restore refused-with-a-sentence, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
 - [x] privatebin — 2026-09-21 (update night, scratch guest 9202): install, seeded a paste through its own JSON API, read back, „Mentés most", real upstream Update 2.0.5->2.0.6 (15.4 s), read back again, removed with data. `audits/DRILL-update-night-2026-09-21.md`.
 - [x] romm — 2026-09-21 (update night, scratch guest 9202): install, seeded through its own CSRF-protected user API, backup, real upstream Update 5.0.0->5.3.0 (60.6 s), logged in again, removed. DATABASE HALF ONLY. `audits/DRILL-update-night-2026-09-21.md`.
 ## The rest of the catalog
@@ -27,44 +27,45 @@ customer, hub off, tunnel off, `https://192.168.0.114` with the same Host names
 - [x] actualbudget — 2026-09-13: no non-browser front door (the client talks a sync protocol, no REST); deploy / update / remove were exercised the same day for R-475 (`audits/rulings-r472-r475-2026-09-13/`). Recorded, not faked.
 - [x] adventurelog — 2026-09-13: full walk (install, sign-up + trip data through the API, backup now + Tier 2, remove-with-data-kept → second-drive restore REFUSED (R-486) → own-copy restore byte-identical, same-version guarded Update, remove-with-backups left 484 MB behind (R-474)). Photo upload needs a browser (R-483). Rows: R-482..R-487. `audits/nightly-2026-09-13-adventurelog/`.
 - [x] audiobookshelf — 2026-09-21 (update night, scratch guest 9202): install with its drive path, seeded a root account through /init, read back, backup, real upstream Update 2.35.1->2.36.1 (23.6 s), read back, removed. DATABASE HALF ONLY. `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] calcom
-- [ ] claper
-- [ ] code-server
-- [ ] crafty-controller
-- [ ] emby
-- [ ] ghost
+- [x] calcom — 2026-09-22 (the 28, scratch guest 9202): install, front door 502, NO non-browser data route (no fixture: no non-browser seed route was written for this app), „Mentés most", no upstream edge tonight, restore failed, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] claper — 2026-09-22 (the 28, scratch guest 9202): install, front door 200, NO non-browser data route (no fixture: no non-browser seed route was written for this app), „Mentés most", no upstream edge tonight, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] code-server — 2026-09-22 (the 28, scratch guest 9202): install, front door 502, NO non-browser data route (fixture ran and found no non-browser seed route: its front door is a browser IDE behind one password; it exposes no data API, and writing a file with docker exec would not be the front door (R-156)), „Mentés most", real upstream Update 4.129.0->4.138.0 (done), own migration line quoted, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] crafty-controller — 2026-09-22 (the 28, scratch guest 9202): install, front door 302, NO non-browser data route (no fixture: no non-browser seed route was written for this app), „Mentés most", real upstream Update 4.10.7->4.11.0 (done), own migration line quoted, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] emby — 2026-09-22 (the 28, scratch guest 9202): install, front door 302, seeded through its own /Startup/User wizard, then /Users/Public and read back, „Mentés most", real upstream Update 4.10.0.20->4.11.0.1 (done), own migration line quoted, read back after the update, restore ok, read back after the restore, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] ghost — 2026-09-22 (the 28, scratch guest 9202): install, front door 200, seeded through its own /ghost/api/admin/authentication/setup/ and read back, „Mentés most", real upstream Update 6.53.0-alpine->6.64.0-alpine (done), own migration line quoted, read back after the update, restore ok, read back after the restore, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
 - [ ] gitea — NOT A FULL WALK; attempted 2026-09-21 (update night, scratch guest 9202): attempted 2026-09-21 and **inconclusive**: a fresh Gitea sits in its web-installer state so `gitea admin user create` refuses. Needs an installer-form fixture (R-624). `audits/DRILL-update-night-2026-09-21.md`.
 - [ ] glance — NOT A FULL WALK; attempted 2026-09-21 (update night, scratch guest 9202): used 2026-09-21 as the UNATTENDED HOLD subject on drill images (R-618's method), not as a catalog walk — deliberately not ticked. `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] gokapi
+- [ ] gokapi — NOT A FULL WALK; attempted 2026-09-22 (the 28, scratch guest 9202): install, front door 200, NO non-browser data route (no fixture: no non-browser seed route was written for this app), „Mentés most", no upstream edge tonight, restore ok, removed **with a leftover container**. `audits/DRILL-the-28-2026-09-22.md`.
 - [x] grafana — 2026-09-21 (update night, scratch guest 9202): install, seeded a folder through its own API as the deploy-generated admin, read back, backup, real upstream Update 13.1.0->13.2.2 (26.7 s), read back, removed with data. `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] gramps-web
+- [x] gramps-web — 2026-09-22 (the 28, scratch guest 9202): install, front door 200, NO non-browser data route (recorded, not faked), „Mentés most", no upstream edge tonight, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
 - [x] home-assistant — 2026-09-21 (update night, scratch guest 9202): install, seeded the owner through its own onboarding API, logged in through its own login flow, backup, real upstream Update 2026.7.2->2026.9.3 (103.6 s), read back, removed with data. `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] homebox
-- [ ] homepage
-- [ ] immich
-- [ ] jellyfin
-- [ ] komga
+- [x] homebox — 2026-09-22 (the 28, scratch guest 9202): install, front door 200, NO non-browser data route (fixture ran and found no non-browser seed route: POST /api/v1/locations -> 404 404 page not found
+), „Mentés most", no upstream edge tonight, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] homepage — 2026-09-22 (the 28, scratch guest 9202): install, front door 200, NO non-browser data route (no fixture: no non-browser seed route was written for this app), „Mentés most", no upstream edge tonight, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] immich — 2026-09-22 (the 28, scratch guest 9202): install, front door 200, seeded through its own /api/auth/admin-sign-up, then an album and read back, „Mentés most", real upstream Update v3.0.3->v3.2.2 (done), read back after the update, restore refused-with-a-sentence, read back after the restore, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] jellyfin — 2026-09-22 (the 28, scratch guest 9202): install, front door 302, NO non-browser data route (fixture ran and found no non-browser seed route: POST /Startup/User -> 503 Jellyfin Server is loading. Please try again shortly.), „Mentés most", no upstream edge tonight, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] komga — 2026-09-22 (the 28, scratch guest 9202): install, front door 200, NO non-browser data route (recorded, not faked), „Mentés most", real upstream Update 1.25.0->1.27.1 (done), own migration line quoted, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
 - [x] mealie — 2026-09-21 (update night, scratch guest 9202): install, seeded a recipe through its own API as the first-run admin, read back, backup, real upstream Update v3.20.1->v3.27.0 (18.5 s), read back, removed with data. `audits/DRILL-update-night-2026-09-21.md`.
 - [x] n8n — 2026-09-21 (update night, scratch guest 9202): install, seeded the owner through its own setup API, read back, backup, real upstream Update 2.31.3->2.40.5 (117.9 s), read back, removed with data. `audits/DRILL-update-night-2026-09-21.md`.
 - [x] navidrome — 2026-09-21 (update night, scratch guest 9202): install with its drive path, seeded the first admin through its own API, read back, backup, real upstream Update 0.63.2->0.64.0 (11.3 s), read back, removed. **The removal left a container behind that a later reboot resurrected — R-626**. `audits/DRILL-update-night-2026-09-21.md`.
 - [x] nextcloud — 2026-09-21 (update night, scratch guest 9202): install, seeded a user through `occ`, read back, backup, **MariaDB engine major 11.6->12.3 through the real Update button** (217.4 s) with all four SPIKE-r459 observables, read back, removed. `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] onlyoffice
-- [ ] outline
+- [x] onlyoffice — 2026-09-22 (the 28, scratch guest 9202): install, front door 302, NO non-browser data route (fixture ran and found no non-browser seed route: a stateless document server: it holds no household data of its own, so there is nothing to seed), „Mentés most", no upstream edge tonight, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] outline — 2026-09-22 (the 28, scratch guest 9202): install, front door 404, NO non-browser data route (fixture ran and found no non-browser seed route: sign-in requires an external identity provider (OIDC/Slack/Google); no local sign-up route exists), „Mentés most", real upstream Update 1.9.1->1.10.1 (failed), restore failed, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
 - [x] papra — 2026-09-21 (update night, scratch guest 9202): install, seeded an account through its own sign-up API, signed in again, backup, real upstream Update 26.6.1->26.6.2 (60.5 s), removed with data. `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] plant-it
-- [ ] plex
-- [ ] radarr
-- [ ] rallly
-- [ ] recipe-importer
-- [ ] seerr
-- [ ] sonarr
-- [ ] sparkyfitness
-- [ ] tandoor — NOT A FULL WALK; attempted 2026-09-21 (update night, scratch guest 9202): install, seeded a superuser through its own Django CLI, read back, backup, real upstream Update 2.6.13->2.6.15 — **the update SUCCEEDED and the app served 200 on the new version, then the box stopped it because the template probes the wrong port (R-618, P1)**. Restored in 32.4 s. **failed**, and the failure is ours. `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] termix
+- [ ] plant-it — NOT A FULL WALK; attempted 2026-09-22 (the 28, scratch guest 9202): **could not be deployed** — deploy never reached `deployed` with a pin. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] plex — 2026-09-22 (the 28, scratch guest 9202): install, front door 401, NO non-browser data route (fixture ran and found no non-browser seed route: the first-run claim needs a token minted at plex.tv by a real Plex account; no account exists for this venue), „Mentés most", real upstream Update 1.41.4.9463-630c9f557->1.43.4.10903-e5521bd8c (done), restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] radarr — 2026-09-22 (the 28, scratch guest 9202): install, front door 200, seeded through its own /api/v3/tag with the app's own ApiKey and read back, „Mentés most", real upstream Update 6.3.0->6.4.4 (done), own migration line quoted, read back after the update, restore ok, read back after the restore, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] rallly — 2026-09-22 (the 28, scratch guest 9202): install, front door 200, NO non-browser data route (fixture ran and found no non-browser seed route: sign-in is an e-mail magic link; this venue has no mailbox the harness can read), „Mentés most", real upstream Update 4.11.1->4.15.2 (done), own migration line quoted, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] recipe-importer — 2026-09-22 (the 28, scratch guest 9202): install, front door 302, NO non-browser data route (no fixture: no non-browser seed route was written for this app), „Mentés most", no upstream edge tonight, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] seerr — 2026-09-22 (the 28, scratch guest 9202): install, front door 307, NO non-browser data route (no fixture: no non-browser seed route was written for this app), „Mentés most", no upstream edge tonight, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] sonarr — 2026-09-22 (the 28, scratch guest 9202): install, front door 200, seeded through its own /api/v3/tag with the app's own ApiKey and read back, „Mentés most", real upstream Update 4.0.19->4.0.20 (done), own migration line quoted, read back after the update, restore ok, read back after the restore, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
+- [ ] sparkyfitness — NOT A FULL WALK; attempted 2026-09-22 (the 28, scratch guest 9202): **could not be deployed** — deploy never reached `deployed` with a pin. `audits/DRILL-the-28-2026-09-22.md`.
+- [x] tandoor — 2026-09-21 (update night) and RE-WALKED 2026-09-22 after the probe fix (scratch guest 9202): install, seeded a superuser through its own Django CLI, read back, backup, real upstream Update 2.6.13->2.6.15 — on 2026-09-21 the update SUCCEEDED and the box then STOPPED the working app because the template probed the wrong port (R-618, P1, CLOSED 2026-09-22). With the port corrected the identical edge ends **`done` at +41.1 s**, seed read back, both containers running with zero restarts. **proven.** `audits/PROBE-FIX-2026-09-22.md`.
+- [ ] termix — NOT A FULL WALK; attempted 2026-09-22 (the 28, scratch guest 9202): install, front door 200, seeded through its own /users/create sign-up, then /users/me and read back, „Mentés most", real upstream Update 2.5.0->2.8.0 (done), own migration line quoted, read back after the update, restore ok, read back after the restore, removed **with a leftover container**. `audits/DRILL-the-28-2026-09-22.md`.
 - [ ] uptime-kuma
 - [ ] vaultwarden — NOT A FULL WALK; attempted 2026-09-21 (update night, scratch guest 9202): attempted 2026-09-21 and **inconclusive BY DESIGN**: the catalog closes self-registration on purpose (R-512), so no headless account route exists (R-624). `audits/DRILL-update-night-2026-09-21.md`.
 - [x] vikunja — 2026-09-21 (update night, scratch guest 9202): install, registered a user and created a project through its own API, read back, backup, real upstream Update 2.3.0->2.6.0 (24.6 s), read back, removed with data. `audits/DRILL-update-night-2026-09-21.md`.
-- [ ] wanderer
+- [x] wanderer — 2026-09-22 (the 28, scratch guest 9202): install, front door 404, NO non-browser data route (no fixture: no non-browser seed route was written for this app), „Mentés most", no upstream edge tonight, restore ok, removed clean. `audits/DRILL-the-28-2026-09-22.md`.
 - [ ] wger — NOT A FULL WALK; attempted 2026-09-21 (update night, scratch guest 9202): deployed 2026-09-21 ONLY to measure its health probe: it listens on 8000 and the template probes 80, so the box reads it unhealthy while it serves (R-618). Removed. NOT a catalog walk. `audits/DRILL-update-night-2026-09-21.md`.
 - [ ] wishlist
 - [ ] zipline — NOT A FULL WALK; attempted 2026-09-21 (update night, scratch guest 9202): attempted 2026-09-21 and **inconclusive**: registration disabled by the template; and its probe path is wrong (R-618), so an update would have been held by the probe (R-624). `audits/DRILL-update-night-2026-09-21.md`.