More apps update themselves at night (30+2 -> 35+3); the same-name security-fix gap measured (R-740, decision for the operator)

- Twelve steps published on both venues (catalog): first ladders for calibre-web, gitea, wger,
  crafty-controller, uptime-kuma, zipline (two steps); within-major emby, ghost, home-assistant,
  outline, rallly. immich's step v3.0.3 -> v3.2.2 re-proven at 768M (Part D).
- Part C: the night leg skips a digest-only change AND the catalog never records a same-tag re-test,
  so a same-name upstream fix reaches no box. Row R-740; the decision in STATUS; `09` decision 30
  carries a dated note (the decision itself unchanged).
- Rows: 369 -> 377. Opened R-735..R-742; closed R-735, R-738, R-742; narrowed R-462, R-624, R-446,
  R-440, R-734, R-732. The currency audit gains §1b (and corrects its 31+1 to 30+2).

Evidence: documentation/audits/more-night-apps-2026-09-30/. Report: REPORT-more-night-apps-2026-09-30.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -16,6 +16,20 @@
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
 
 
+> **2026-09-30 (evening) — more night-updatable apps; the same-name fix gap measured (R-740, operator decision).**
+> Catalog: first ladders for calibre-web, gitea (its installer form, R-624), wger, crafty-controller, uptime-kuma, zipline
+> (4.6.1 → 4.7.0 → 4.8.0 — 4.8.0 refuses a database that skipped 4.7.x, R-742; the box UNDID the direct jump by itself);
+> within-major steps emby, ghost, home-assistant, outline, rallly. Night (a) 30 + 2 → 34 + 3 (calibre-web conditional:
+> its library `metadata.db` changes). wger ran no migrations on update → login 500 behind a `done` Update; fixed in the
+> template (`DJANGO_PERFORM_MIGRATIONS=True`, R-738 closed). immich's step 0b82… re-proven at 768M and rewritten by the
+> new `upgrade-test.py --restep` (Part D). Harness: 5 fixtures, HTTPS backends on the bench, per-file names behind
+> `files_may_change`, bench `password:N:special` (R-735 closed). **Part C (R-740):** the night leg skips a digest-only
+> change (`unattended.go:433–435`), AND the catalog never records a same-tag re-test (writer refuses "nothing moves"), so a
+> same-name upstream fix reaches no box; a unit walk shows the leg WOULD take a same-tag re-test entry with no controller
+> change. `09` decision 30 carries a dated note. New rows R-736 (images never deleted → disk fills), R-737 (wger app-login
+> 500, no JWT key), R-739 (bench cannot run wanderer), R-741 (after_install's default-login window, measured 1–18 s).
+> Evidence: `documentation/audits/more-night-apps-2026-09-30/`. Report: `REPORT-more-night-apps-2026-09-30.md`.
+
 > **2026-09-30 (late afternoon) — immich's first start (R-732 CLOSED).** Cause measured: the first-start geodata import
 > runs up to 9 concurrent 5000-row INSERTs; the database needs ~400 MB anon + ~170 MB touched shared_buffers (the image's
 > fixed 512MB) — over a 512M limit without swap (bench: 61–104 kills), survivable only by swapping (9202). An update that