harness v4 converts a PostgreSQL major; the engine-major gate passes one proven, marked app (09 decision 35)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,18 @@
+## The harness converts a PostgreSQL major; the gate lets ONE proven app through (2026-09-25 evening, Part C)
+
+`09` §3 decision 35 (docmost first). **No template moved in this commit.**
+- `upgrade-test.py` harness **v4**: a step that moves a PostgreSQL major is CONVERTED on the bench the box's way
+  (old engine alone → check → `pg_dumpall` with its completion line → volume emptied → new engine alone → the
+  entrypoint's empty databases dropped, existing roles' `CREATE ROLE` skipped → load with `ON_ERROR_STOP` → check
+  again + `PG_VERSION`). `render` points a PostgreSQL 18+ data volume at `/var/lib/postgresql` (18 refuses even an
+  empty volume at `/var/lib/postgresql/data`). The engine probe reads `$PGDATA/PG_VERSION`.
+- `--write-ladder` writes `engine_conversion {service, engine, from, to}` only when the bench converted it AND the
+  box converted it through the product; it moves the data mount line with the image.
+- `check-engine-major.py`: a PostgreSQL major passes only with its template's proven, two-venue, marked ladder entry
+  for that step, as the only image move in its commit. The postgis family is judged now (it was not). Decoys: one
+  genuine, three look-alikes (no mark, one venue, the mark in a comment), one bundled, postgis — red-proofed.
+- `ladder.py` validates the mark; `test_pg_conversion.py` covers the harness pieces that run without Docker.
+
 ## Rules: Peti's box retired (2026-09-25)
 
 The unprompted-work rule's fence names DooPlex and ep0 only (operator ruling: Peti's box retired). No template changed.