More apps update themselves at night (30+2 -> 35+3); the same-name security-fix gap measured (R-740, decision for the operator)

- Twelve steps published on both venues (catalog): first ladders for calibre-web, gitea, wger,
  crafty-controller, uptime-kuma, zipline (two steps); within-major emby, ghost, home-assistant,
  outline, rallly. immich's step v3.0.3 -> v3.2.2 re-proven at 768M (Part D).
- Part C: the night leg skips a digest-only change AND the catalog never records a same-tag re-test,
  so a same-name upstream fix reaches no box. Row R-740; the decision in STATUS; `09` decision 30
  carries a dated note (the decision itself unchanged).
- Rows: 369 -> 377. Opened R-735..R-742; closed R-735, R-738, R-742; narrowed R-462, R-624, R-446,
  R-440, R-734, R-732. The currency audit gains §1b (and corrects its 31+1 to 30+2).

Evidence: documentation/audits/more-night-apps-2026-09-30/. Report: REPORT-more-night-apps-2026-09-30.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT-more-night-apps-2026-09-30.md

@@ -0,0 +1,56 @@
+# REPORT — more apps that update themselves (2026-09-30, evening, by day)
+
+Evidence: `documentation/audits/more-night-apps-2026-09-30/` (README there has the per-app table). Architecture read:
+`architecture/09-update-architecture.md` §3 decisions 6, 13, 14, 17, 22, 30, §6.4 parts 4–7, §6.5.
+
+## The Part table
+
+| Part | done / not done / changed | why |
+|---|---|---|
+| **A1 calibre-web** | **done** — v4.0.6 → v4.0.8, first ladder `53a4a1d` | front door = the Upload button (HTTP form), read back through OPDS + the served EPUB. The ingest folder was NOT used (it would be a file planted in a mount). `files_may_change`: the library DB `metadata.db` (+`-shm`, `-wal`) in the books folder; the book file did not change |
+| **A2 gitea** | **done** — 1.27.0 → 1.27.3, first ladder `d7ba60c` | the installer-form POST (no CSRF on that form), through the setup gate on the box. 28.0.0 not touched |
+| **B1 emby, ghost, home-assistant** | **done** — `3e4aa77`, `9a78e3b`, `15f4d59` | each had a newer tag inside its line (re-checked) |
+| **B2 uptime-kuma, wger, crafty-controller** | **done** — `35dd5cf`, `4ad32aa` (+ fix `7a4ff48`), `e1f0179` | new fixtures; wger needed a template fix first (R-738) |
+| **B2 wanderer** | **not done** | the bench cannot run it at all: its web server calls the DB at a public https name (R-739). The meilisearch question is NOT measured |
+| **B3 time left** | **done** — outline `b0b2514`, rallly `8d3a35a`, zipline 4.6.1 → 4.7.0 `a9700e2` → 4.8.0 `fb87030` | zipline 4.8.0 refuses a database that skipped 4.7.x (R-742); the box undid the direct jump itself |
+| **C the same-name fix gap** | **done** — row R-740, STATUS decision, `09` decision 30 dated note | measured from source, a unit walk, the registry and demo-hp; **nothing built** |
+| **D immich's older step** | **done (changed)** — re-proven at 768M, step files rewritten `48440ce` | the brief's route needed a writer mode that did not exist → `upgrade-test.py --restep` `63a96b0`, with tests |
+
+**Night-updatable apps (the audit's method (a)): 30 + 2 conditional at the start → 35 + 3 conditional** (38 carry a proven step; 15 have no ladder).
+
+## Claims in the brief that turned out wrong
+
+1. **"Night-updatable: 31 (+ nextcloud conditional)"** — at the session's start it was **30 + 2 conditional**: the
+   afternoon's immich step carries `files_may_change` (R-734), so immich counts as conditional.
+2. **"Register 366 rows"** — **369**: the afternoon session added R-732..R-734 after STATUS said 366.
+3. **"calibre-web and gitea have no ladder"** — true.
+4. **"gitea's fixture fails at the installer"** — true (`MustInstalled`); the installer form works headless.
+5. **"The leg never presses a digest-only change"** — true (`unattended.go:433–435`). But the larger fact is that the
+   catalog never records a same-tag re-test at all, so the Update button does not deliver it either (R-740).
+6. **"Decision 30's text says the leg would"** — true: „until someone (or the automatic leg) presses Update".
+7. **"immich's 0b82… step pins 512M"** — true. **"The writer rewrites the step file"** — it could not (it writes a
+   step file only once, when a step is superseded); `--restep` was added.
+8. **"No real box runs immich v3.0.3"** — true and stronger: no box reporting to the hub runs immich at all
+   (hub `/apps`, positive control bookstack = 2 deployments).
+9. **"wger: behind inside the major"** and **"crafty/uptime-kuma/wanderer need a new fixture"** — true; wanderer
+   cannot be run on the bench at all.
+
+## Rows
+
+Before **369**, after **377**. Opened: R-735 (bench password shape — closed), R-736 (old images never deleted),
+R-737 (wger app-login 500), R-738 (wger migrations — closed), R-739 (bench cannot run wanderer), R-740 (same-name fix —
+decision), R-741 (after_install default-login window), R-742 (zipline needs 4.7.x first — closed). Narrowed: R-462, R-624, R-446,
+R-440, R-734, R-732 (note). Closed: R-735, R-738, R-742.
+
+## Teardown
+
+Three layers:
+- **Machine.** Scratch guest 9202: every app this session installed removed through the product (calibre-web twice,
+  gitea, emby, ghost, home-assistant, wger ×3, crafty-controller, uptime-kuma, outline, rallly, zipline ×3); their images
+  and older drill leftovers removed **by name** (53 GB freed at 17:43 when the disk refused an install — R-736); pointed
+  back at the live catalog and its `update:` override removed (`box/T6`, `repo_url` read back); the same six containers
+  run as at the start. Bench LXC 9401: evidence copied off after every run, its images removed by name once (disk full),
+  then destroyed with its template (`bench/B9`). Drill catalog: force-reset to live `main` `fb87030` (operator-allowed),
+  image lines identical (`box/T7`).
+- **Host.** demo-hp: `pct list` shows 9201 and 9202 only, as at the start.
+- **Hub.** Read only (`/hosts`, `/apps`); nothing provisioned.