diff --git a/documentation/audits/CAMPAIGN-7-catalog-sweep-2026-07-19.md b/documentation/audits/CAMPAIGN-7-catalog-sweep-2026-07-19.md
index 1f5046b..4d9a5d8 100644
--- a/documentation/audits/CAMPAIGN-7-catalog-sweep-2026-07-19.md
+++ b/documentation/audits/CAMPAIGN-7-catalog-sweep-2026-07-19.md
@@ -296,6 +296,32 @@ calibre-web **ok**, immich page-only (deliberate, §3). For the other 40 apps lo
 | **wanderer** | FAIL — image | `ghcr.io/flomp/wanderer` does not resolve — **neither 0.20.0 nor the shipped 0.16.0** | **pre-existing**; meilisearch sidecar bumped v1.12 → v1.49. Needs upstream research |
 | **plex** | not attempted | `PLEX_CLAIM` is a required field with no default — a real claim token from plex.tv is needed | not automatable; genuinely owner-supplied. Not a defect |
 
+### 6.3 MAJOR breaking notes (for the future update-path story — see R-40)
+
+Fresh deploys do not migrate, so none of these bit during the sweep. They matter for the moment an
+EXISTING customer presses update.
+
+| app | major | one-line breaking note | source |
+|---|---|---|---|
+| bookstack | 25.02 → 26.05 | `storage/fonts` must be writable for PDF export; revision-viewing became a separate permission | upstream releases |
+| immich | v2 → v3 | drops pgvecto.rs, requires VectorChord (our pin was already VectorChord); most other breaks are API-only | v3.0.0 notes |
+| nextcloud | 31 → 34 | **"You cannot skip major releases"** — sequential upgrade required. The sharpest case for R-40 | admin manual |
+| n8n | 1 → 2 | MySQL/MariaDB support removed; several nodes removed; `ExecuteCommand`/`LocalFileTrigger` disabled by default; env access blocked in code expressions | 2.0.0 notes |
+| grafana | 11 → 13 | Angular plugin support **removed** in 12 (deprecated in 11); `editors_can_admin` gone; v2 dashboard schema is one-way | whatsnew v12 |
+| vikunja | 0.24 → 2.3 | CORS on by default and `service.publicurl` becomes **required to start**; OpenID provider config array→map; SQLite paths now relative to `service.rootpath`; API `/tasks/all`→`/tasks` | 1.0.0 changelog |
+| privatebin | 1 → 2 | min PHP 7.3→7.4; `page` template removed; legacy model class names must become `Filesystem`/`Database`; v1/ZeroBin paste format support dropped (DB column drops needed) | 2.0.0 notes |
+| radarr | 5 → 6 | no breaking config/DB changes documented; docker users must update the image (no in-container update) | 6.3.0 notes |
+| romm | 4 → 5 | no breaking config/DB/folder changes documented (UI overhaul release) | 5.0.0 notes |
+| outline | 0.82 → 1.9 | **found empirically:** 1.x defaults to SSL for Postgres — needs `PGSSLMODE=disable` against a sidecar DB | live deploy |
+| tandoor | 1 → 2 | **found empirically:** app port moved 8080 → 80 and `ALLOWED_HOSTS` became mandatory (Django 400s everything without it) | live deploy |
+| zipline | (4.0 → 4.6) | **found empirically:** v4 renamed `CORE_DATABASE_URL` → `DATABASE_URL` and `/api/health` → `/api/healthcheck` | live deploy |
+| homebox | (v0.16 → 0.26) | **found empirically:** upstream dropped the `v` tag prefix; `HBOX_AUTH_API_KEY_PEPPER` now required | live deploy |
+| wger | (2.3 → 2.6) | **found empirically:** full `DJANGO_DB_*` set required even for sqlite; app listens on :8000 | live deploy |
+| calcom · claper · gramps-web · onlyoffice | v4→v6 · 1→2 · v24→v25 · 8→9 | deployed clean; upstream one-liner **not retrieved** within the wall-clock — flagged MAJOR without a fabricated note | — |
+
+The empirically-found rows are the more valuable half: they are what actually happens on a real
+deploy, not what a changelog remembered to mention.
+
 ---
 
 ## 7. Findings, ranked
@@ -393,9 +419,10 @@ terminal state.
 
 - **DB/cache sidecar majors** (postgres 16→18, redis 7→8, mariadb→12, postgis 16→17) —
   deliberately not bumped, rationale in §4. **ROADMAP decision item.**
-- **MAJOR breaking notes** were retrieved from upstream for bookstack, immich, nextcloud, n8n and
-  grafana. For the remaining MAJOR rows the note was **not retrieved** within the wall-clock; they
-  are flagged MAJOR without an upstream one-liner rather than given a fabricated one.
+- **MAJOR breaking notes** are in §6.3. Retrieved from upstream for bookstack, immich, nextcloud,
+  n8n, grafana, vikunja, privatebin, radarr and romm; found EMPIRICALLY (better) for outline,
+  tandoor, zipline, homebox and wger. Four (calcom, claper, gramps-web, onlyoffice) deployed clean
+  but have **no upstream one-liner** — recorded as not-retrieved rather than fabricated.
 - **immich redis → valkey** (upstream migrated in v3; redis:7-alpine works fine on v3) — recorded,
   not done: an image swap is structural, not a pin bump.
 - **glance config seeding**, **gokapi v2 config migration**, **plant-it / wanderer upstream