harness v4 converts a PostgreSQL major; the engine-major gate passes one proven, marked app (09 decision 35)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CLAUDE.md

@@ -105,7 +105,17 @@ deployed `app.yaml` (customer secrets) is never overwritten. Full deploy details
   **What is NOT lifted.** The **eleven PostgreSQL** services stay refused: the image performs no
   `pg_upgrade` and REFUSES to start on an older major's datadir (R-463). A backup is a route back,
   not a conversion — the app simply would not come up. MySQL is refused too, with nothing measured
-  at all. This half is removed when R-463 has a scripted `pg_upgrade` edge proven on all eleven.
+  at all. **ONE APP AT A TIME, since 2026-09-25 (`09` §3 decision 35):** the BOX converts a PostgreSQL
+  major itself (controller v0.273.0 — dump from the old engine, load into the new, check, undo on any
+  failure), but ONLY on a step whose ladder entry carries `engine_conversion {service, engine: postgres,
+  from, to}`. So a PostgreSQL major passes the gate only when the template's ladder entry for that step
+  is `proven`, cites BOTH venues (`evidence` + `box_evidence`) and carries the mark — written by
+  `upgrade-test.py --write-ladder`, which refuses unless the bench converted it (harness v4) AND the box
+  converted it through the product — and only as the ONLY image move in its commit. Every other
+  PostgreSQL app stays refused until it has its own proof. **PostgreSQL 18 moves the data mount** to
+  `/var/lib/postgresql` (18 refuses even an empty volume at `/var/lib/postgresql/data`); the writer and
+  the harness move that line with the image (`pg_mounts_for`). The postgis family is judged too (it was
+  not before 2026-09-25).
   **The new clause — one edge, one migration (R-450).** A MariaDB major must be the ONLY image move
   in its template in that commit. bookstack's `0b73e5e` moved the application 25.02.2 → 26.05.2 **and**
   MariaDB 11.6 → 12.3 in one commit: two migrations behind one edge, and an unreadable failure when it