The whole-mesh dry-run found umami's runtime crash-looping "admin password is not set": its `admin` own-secret is mounted at /run/secrets/admin, but the client read the bare env UMAMI_ADMIN_PASSWORD, which nothing sets. Same shape as the six tool-runtime credential fixes — read the mounted file first (MESH_UMAMI_ADMIN_PASSWORD_FILE), falling back to the env. (photos and mailu remain deeper conversion jobs — a stub app image and a full Mailu config env — not credential-wiring, tracked separately.) Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF