stacks: the box converts a PostgreSQL major as a guarded-update step (09 6.4 part 10, decisions 35/37/38)

A step whose ladder entry carries engine_conversion {service, engine, from, to}
converts the database: the old engine alone, the check (owners, roles,
extensions, per-table row counts), pg_dumpall validated by its completion line,
the volume emptied only after the undo copy's marker is validated again, the new
engine alone, the load with ON_ERROR_STOP, the check again + PG_VERSION. Any
failure goes to the existing undo; a restart during converting is undone.
A PostgreSQL major move without the mark is refused before anything moves.
The old datadir's copy is kept until a backup is proven after the conversion.
17 tests, 9 red-proofs (audits/night-2026-09-26/B/).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/scripts/docker_run_volume_path_gate.py

@@ -45,6 +45,13 @@ ALLOWLIST = [
      "the undo's finished-marker check (v0.263.0): a named copy volume, read-only, daemon-side"),
     ("internal/stacks/undo.go", '"-v", copyVol+":/from:ro", "-v", vol+":/to"',
      "the undo's restore (v0.263.0): named copy volume -> the app's named volume, daemon-side"),
+    ("internal/stacks/pgconvert.go", '"psql", "-h", "127.0.0.1", "-U", user, "-d", db, "-v"',
+     "psql's own -v flag (ON_ERROR_STOP) in the conversion's check queries — not a docker mount (v0.273.0)"),
+    ("internal/stacks/pgconvert.go", '"-v", copyVol+":/from:ro", "-v", vol+":/to"',
+     "the conversion's Empty (v0.273.0): two NAMED volumes (the kept copy read-only, the database volume) "
+     "into a throwaway alpine — daemon-side, no host path; the undo Restore's exact shape"),
+    ("internal/stacks/pgconvert.go", '"-d", "postgres", "-v", "ON_ERROR_STOP=1"',
+     "psql's own -v flag (ON_ERROR_STOP) in the conversion's load — not a docker mount (v0.273.0)"),
     ("internal/web/handlers.go", '"compose", "down", "-v"',
      "docker compose's own --volumes flag (DR reset wipes the stack's volumes) — not a mount"),
 ]