# REPORT — more apps that update themselves (2026-09-30, evening, by day)

Evidence: `documentation/audits/more-night-apps-2026-09-30/` (README there has the per-app table). Architecture read:
`architecture/09-update-architecture.md` §3 decisions 6, 13, 14, 17, 22, 30, §6.4 parts 4–7, §6.5.

## The Part table

| Part | done / not done / changed | why |
|---|---|---|
| **A1 calibre-web** | **done** — v4.0.6 → v4.0.8, first ladder `53a4a1d` | front door = the Upload button (HTTP form), read back through OPDS + the served EPUB. The ingest folder was NOT used (it would be a file planted in a mount). `files_may_change`: the library DB `metadata.db` (+`-shm`, `-wal`) in the books folder; the book file did not change |
| **A2 gitea** | **done** — 1.27.0 → 1.27.3, first ladder `d7ba60c` | the installer-form POST (no CSRF on that form), through the setup gate on the box. 28.0.0 not touched |
| **B1 emby, ghost, home-assistant** | **done** — `3e4aa77`, `9a78e3b`, `15f4d59` | each had a newer tag inside its line (re-checked) |
| **B2 uptime-kuma, wger, crafty-controller** | **done** — `35dd5cf`, `4ad32aa` (+ fix `7a4ff48`), `e1f0179` | new fixtures; wger needed a template fix first (R-738) |
| **B2 wanderer** | **not done** | the bench cannot run it at all: its web server calls the DB at a public https name (R-739). The meilisearch question is NOT measured |
| **B3 time left** | **done** — outline `b0b2514`, rallly `8d3a35a`, zipline 4.6.1 → 4.7.0 `a9700e2` → 4.8.0 `fb87030` | zipline 4.8.0 refuses a database that skipped 4.7.x (R-742); the box undid the direct jump itself |
| **C the same-name fix gap** | **done** — row R-740, STATUS decision, `09` decision 30 dated note | measured from source, a unit walk, the registry and demo-hp; **nothing built** |
| **D immich's older step** | **done (changed)** — re-proven at 768M, step files rewritten `48440ce` | the brief's route needed a writer mode that did not exist → `upgrade-test.py --restep` `63a96b0`, with tests |

**Night-updatable apps (the audit's method (a)): 30 + 2 conditional at the start → 35 + 3 conditional** (38 carry a proven step; 15 have no ladder).

## Claims in the brief that turned out wrong

1. **"Night-updatable: 31 (+ nextcloud conditional)"** — at the session's start it was **30 + 2 conditional**: the
   afternoon's immich step carries `files_may_change` (R-734), so immich counts as conditional.
2. **"Register 366 rows"** — **369**: the afternoon session added R-732..R-734 after STATUS said 366.
3. **"calibre-web and gitea have no ladder"** — true.
4. **"gitea's fixture fails at the installer"** — true (`MustInstalled`); the installer form works headless.
5. **"The leg never presses a digest-only change"** — true (`unattended.go:433–435`). But the larger fact is that the
   catalog never records a same-tag re-test at all, so the Update button does not deliver it either (R-740).
6. **"Decision 30's text says the leg would"** — true: „until someone (or the automatic leg) presses Update".
7. **"immich's 0b82… step pins 512M"** — true. **"The writer rewrites the step file"** — it could not (it writes a
   step file only once, when a step is superseded); `--restep` was added.
8. **"No real box runs immich v3.0.3"** — true and stronger: no box reporting to the hub runs immich at all
   (hub `/apps`, positive control bookstack = 2 deployments).
9. **"wger: behind inside the major"** and **"crafty/uptime-kuma/wanderer need a new fixture"** — true; wanderer
   cannot be run on the bench at all.

## Rows

Before **369**, after **377**. Opened: R-735 (bench password shape — closed), R-736 (old images never deleted),
R-737 (wger app-login 500), R-738 (wger migrations — closed), R-739 (bench cannot run wanderer), R-740 (same-name fix —
decision), R-741 (after_install default-login window), R-742 (zipline needs 4.7.x first — closed). Narrowed: R-462, R-624, R-446,
R-440, R-734, R-732 (note). Closed: R-735, R-738, R-742.

## Teardown

Three layers:
- **Machine.** Scratch guest 9202: every app this session installed removed through the product (calibre-web twice,
  gitea, emby, ghost, home-assistant, wger ×3, crafty-controller, uptime-kuma, outline, rallly, zipline ×3); their images
  and older drill leftovers removed **by name** (53 GB freed at 17:43 when the disk refused an install — R-736); pointed
  back at the live catalog and its `update:` override removed (`box/T6`, `repo_url` read back); the same six containers
  run as at the start. Bench LXC 9401: evidence copied off after every run, its images removed by name once (disk full),
  then destroyed with its template (`bench/B9`). Drill catalog: force-reset to live `main` `fb87030` (operator-allowed),
  image lines identical (`box/T7`).
- **Host.** demo-hp: `pct list` shows 9201 and 9202 only, as at the start.
- **Hub.** Read only (`/hosts`, `/apps`); nothing provisioned.