Part F — more apps that update themselves (2026-09-30, afternoon)

Rule: within-major edges for apps that already had fixtures on both venues, at most 8, the normal method (bench LXC 9401 → box 9202 through the guarded Update → upgrade-test.py --write-ladder → one catalog commit per app, the only image move in it). Candidates from the currency audit's ranking (../../catalog-currency-2026-09-30.md §6).

app	step	bench (harness v4, 10-min watch)	box 9202	memory, anon peak	catalog
bookstack	26.05.5 → 26.09.1	proven, migrations ran, abort starts and serves	done 64.6 s, read back	bookstack 4.8 %; db 43.7 %	`54ca055`
kimai	apache-2.57.0 → 2.67.0	proven, Doctrine migrations ran	done 82.1 s, read back	kimai 6.0 % (cgroup 91.7 % = file cache); db 45.0 %	`d75d1fd`
audiobookshelf	2.36.1 → 2.37.1	proven	done 24.6 s, read back	10.5 %	`7425ebd`
n8n	2.41.2 → 2.42.1	proven, its migrations ran	done 122.1 s, read back	23.0 %	`9f075a4`
navidrome	0.64.1 → 0.64.2	proven	done 14.4 s, read back	6.9 %	`6d91495`
grafana	13.2.2 → 13.2.3	proven	done 23.6 s, read back (second walk — see below)	47.1 % (cgroup 100 % = file cache)	`2acfbf1`
komga	1.27.1 → 1.28.0	proven	done 44.2 s, read back	64.5 %	`403a8f5`
immich	server + ML v3.2.2 → v3.2.4 (the database does not move)	first run inconclusive (FROM never settled in 420 s — the first-start geodata import with two other runs on 6 cores, R-676); retried alone: see `benchq-q10.txt`	done 112.0 s, album read back	—	see the report

No step is memory_tight; no limit moved. kimai's tag: upstream dropped the apache- prefix after 2.57.0; measured on Docker Hub (kimai-tag-variant.txt): 2.67.0, 2, stable and apache are ONE digest, fpm/latest another — the plain tag is the Apache image.

Instrument faults found and fixed (the product was not at fault), stated:

grafana's first box walk read back 401: the fixture authenticates with the admin password the deploy generated, kept in the process's memory; the step ran in a second process, which tried the default. Fixed in tools/boxmove.py (the generated secrets are kept beside the seed, in the 0600 scratch file) and boxstep.py/undocase.py (read them back). grafana was removed, reinstalled at 13.2.2 from the drill catalog (a revert commit there), seeded, stepped: read back. First attempt kept: ../box/grafana/*attempt1*.
n8n's first box seed answered 404 (Cannot POST /rest/owner/setup): the app was still starting; a second try 25 s later seeded. The fixture's ready-wait (/healthz through the gate answers 401) is weak — noted, not changed.
A typo started the n8n bench run with a different repository (docker.n8n.io/n8nio/n8n); it was killed by PID 21 s in, its project taken down, its evidence renamed *-wrongref-*, and the run restarted with the template's own repository (benchq-q8.txt).
immich's box install first stopped at the kept-data question (decision 36): the scratch drive held an older test's immich folder. Answered "start fresh" through the product (kept_data: fresh — the old folder moved aside, nothing deleted).

Part B for these apps: bookstack and kimai are on demo-hp and were stepped by the chain press of Part C (../C/). None of the others is installed on either demo box.