More apps update themselves at night (30+2 -> 35+3); the same-name security-fix gap measured (R-740, decision for the operator)

- Twelve steps published on both venues (catalog): first ladders for calibre-web, gitea, wger,
  crafty-controller, uptime-kuma, zipline (two steps); within-major emby, ghost, home-assistant,
  outline, rallly. immich's step v3.0.3 -> v3.2.2 re-proven at 768M (Part D).
- Part C: the night leg skips a digest-only change AND the catalog never records a same-tag re-test,
  so a same-name upstream fix reaches no box. Row R-740; the decision in STATUS; `09` decision 30
  carries a dated note (the decision itself unchanged).
- Rows: 369 -> 377. Opened R-735..R-742; closed R-735, R-738, R-742; narrowed R-462, R-624, R-446,
  R-440, R-734, R-732. The currency audit gains §1b (and corrects its 31+1 to 30+2).

Evidence: documentation/audits/more-night-apps-2026-09-30/. Report: REPORT-more-night-apps-2026-09-30.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,27 +2,65 @@
 
 **Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
 
-**Updated 2026-09-30 (late afternoon). Both demo boxes run controller 0.283.1 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.283.1 with agent 0.138.0. No new release today.**
+**Updated 2026-09-30 (evening). Both demo boxes run controller 0.283.1 and host agent 0.138.0. Hub 0.126.0. New installs get golden 0.283.1 with agent 0.138.0. No controller, agent or hub release today.**
 
-**Tester-2 — read only, from the hub.**
-- The customer record exists and its settings are ready.
-- **Tester-2's box has not registered yet.** So there are no apps and no update switch to read.
-- When Tester-2 installs an app, the box updates it at night by itself, like the demo boxes.
+**Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet, so there are no apps to read.
 
-**Decisions today:** none taken by me. The "seed test data through the database" choice was **not needed**, so it is not recorded.
+## One decision for you
 
-**What I did, and it worked.**
-- **The last six database apps are decided.** Three moved to the newer database version (rallly, outline, sparkyfitness). Each was tested on the test bench and on the scratch box, and each one's automatic undo was tested too. Three stay where they are (zipline, adventurelog, immich), because their makers use the same or an older version. **All eleven database apps are now done.**
-- **More apps can update themselves at night:** 31 apps (plus nextcloud when a full copy exists), up from 28 this morning. Seven more apps got a newer version today, each tested on the bench and on the scratch box: bookstack, kimai, audiobookshelf, n8n, navidrome, grafana, komga.
-- **immich is fixed and updated (afternoon).** On its first start, immich loads a big list of places into its database, 9 parts at once. That needs about 575 MB. Its database had only 512 MB. A box without swap space killed it again and again; the scratch box survived only because it has swap. Now the database gets 768 MB. Tested with swap off: a fresh install on the bench (two times) and on the scratch box, 0 kills. The held immich update is published with it, because that update loads the list again. **Cost: each immich box reserves 256 MB more** (immich already reserves about 4 GB).
-- **The full-system backup now waits for app updates — seen live.** On the HP demo box it waited twice while two apps updated, then started, and it worked. The box's settings are back as before.
-- **The HP demo box had no full-system backup since 29 Sept** (its disk was just too full to fit one). Today's test made a fresh one. The problem is the old known one: the box's system disk is small.
-- **How current the catalog is:** 25 of 53 apps are a little behind their makers, 19 are a big version behind. The plan for which apps to test next is written.
-- **Old register rows fixed.** The "up to date" badge is honest now for every app with a test record.
+**Question: should a box also take, at night, a security fix that the app's maker ships under the same name?**
+Database images like `postgres:18-alpine` or `redis:7-alpine` get fixes without a new name. Seven of the eight such names
+we use on Docker Hub got a new push in the last 30 days.
 
-**Rows.** Today in total: 3 closed, 3 narrowed, 5 opened. The list went from 361 to 366 rows.
+Today **no box gets these fixes at all** — not at night, and not by the Update button either. The reason: the catalog
+only records a test when the name changes, so the box never learns that a newer, tested image exists. The page says
+"up to date".
 
-**What needs you.**
-1. **Nothing to decide.** The immich memory rise follows your earlier rule for raising a limit. Tell me if you want it undone.
-2. **No golden bake is due.** The golden built today matches the newest controller. The 4 October date matters only if a new controller comes out before then. The weekly bake stays around 7 October. *(Corrected 2026-09-30: the earlier line said a bake was due before 4 October. That was wrong.)*
-3. **D4, the image copies:** unchanged. If you do nothing, nothing changes.
+- **Option A — the night takes a tested fix.** The catalog re-tests the same name at the new image (bench and scratch
+  box, as today), and records it. The box then takes it at night by itself, with its backup and undo. Measured: the box
+  already does this with no change; only the catalog side is new work (about one evening to build). Cost after that:
+  about 20 app re-tests a month, machine time only, run by day.
+- **Option B — keep it manual, say so honestly.** No new work. The fixes arrive only when we move an app to a new name.
+  Database engines rarely change name, so their fixes may wait for months. I would correct the text of the earlier
+  decision, which says the night would take them.
+
+**If nothing is decided:** nothing breaks. Database images stay at the build of the day we tested them.
+**Who is blocked:** nobody today. **My recommendation: A**, database and redis names first — that is where security
+fixes land, and the box side already works.
+
+## What I did, and it worked
+
+- **More apps update themselves at night: 35 now (plus 3 when a full copy exists), up from 30 (+2) at the start of the
+  evening.** New: gitea, wger, crafty-controller, uptime-kuma, zipline. calibre-web counts as "with a full copy", because its
+  update rewrites the book library's own database file.
+- **Twelve updates tested and published**, each on the test bench and on the scratch box: calibre-web, gitea, wger,
+  crafty-controller, uptime-kuma, zipline (their first tested updates; zipline in two steps), and emby, ghost, home-assistant, outline, rallly.
+  Each of these apps is now on its maker's newest version in its line.
+- **calibre-web (books) and gitea now have tests.** calibre-web: a book goes in through its Upload button and is read
+  back. gitea: its first-run form is filled in the way a household does it.
+- **immich's older in-between update is fixed.** It still gave the database 512 MB and it does reload the big list of
+  places. Tested again with 768 MB and no swap: 0 kills. No box runs immich today.
+
+## What broke, and what I did
+
+- **wger: an update would have broken it.** After the update the app looked fine, but nobody could log in. Its database
+  was never upgraded, because the catalog forgot one setting. **Fixed** in the catalog, and tested again: it works. No
+  box runs wger.
+- **zipline: its newest version cannot be reached in one jump.** The scratch box saw it fail and **put the old version
+  back by itself in 20 seconds** — the undo worked on a real failure. Going through the version in between works; that
+  is now the path.
+- **The scratch box's disk filled with old app images.** Removing an app or updating it never deletes the old image.
+  On a household box this would slowly fill the disk until updates are refused. Written down; not fixed today.
+- **For a few seconds after a fresh install, calibre-web's well-known default login works.** The box changes it right
+  after, but the app is already reachable. Written down; not fixed today.
+- **wanderer cannot run on the test bench**, so it was not tested. Written down.
+
+**Rows.** Tonight: 3 closed (all three found and fixed tonight), 6 narrowed, 8 opened. The list went from 369 to 377 rows. *(The brief said 366; the
+afternoon session had already added three.)*
+
+## What needs you
+
+1. **The decision above** (same-name security fixes). If you do nothing, nothing changes.
+2. **The image clean-up on a box** will need your word on what the box keeps (the running image and the one before it,
+   for the undo). If you do nothing, disks fill slowly; nothing breaks tonight.
+3. **No golden bake is due.** The weekly bake stays around 7 October.