README + REUSE: the PostgreSQL conversion (v0.273.0)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -577,7 +577,7 @@ job, and answers **202**. The page polls `GET /api/stacks/{name}`.
 | field | meaning |
 |---|---|
 | `updating` | a guarded update is in progress |
-| `update_phase` / `update_phase_label` | `checking`, `backing-up`, `safety-dump`, `pinning`, `pulling`, `copying` (v0.263.0), `starting`, `verifying`, `done`, `undoing` / `undone` (v0.263.0), `failed` — and the Hungarian label for each |
+| `update_phase` / `update_phase_label` | `checking`, `backing-up`, `safety-dump`, `pinning`, `pulling`, `copying` (v0.263.0), `converting` (v0.273.0, a PostgreSQL major step only), `starting`, `verifying`, `done`, `undoing` / `undone` (v0.263.0), `failed` — and the Hungarian label for each |
 | `update_error` | the customer sentence when the update did not complete |
 | `hold_reason` | the hold's sentence while the app is held (failed update OR failed restore) |
 
@@ -650,6 +650,24 @@ the old version back; a power cut while undoing resumes the undo. Reasoning and
 `felhom.eu/documentation/architecture/09-update-architecture.md` §6.1a,
 `felhom.eu/documentation/audits/undo-bakeoff-2026-09-23/`.
 
+**PostgreSQL majors are converted by the box (v0.273.0, `09` §3 decisions 35–38, §6.4 part 10).** Only on a
+step whose ladder entry carries the harness's mark `engine_conversion {service, engine: postgres, from, to}`.
+After the undo copy, a new phase `converting` („Adatbázis átalakítása" / "Converting the database"): the OLD
+database container alone → the check (per database owner/encoding/collation, every role, every extension, every
+table's row count) → `pg_dumpall` into `<stackdir>/pre-update-convert/`, refused without its completion line → the
+old engine stops → **the DB volume is emptied only after the copy's finished-marker is validated again** (and
+inside the emptying helper) → the NEW engine alone on the empty volume (`up -d --no-deps <svc>`) → the
+entrypoint's empty databases dropped, `CREATE ROLE` skipped for roles that exist → the load with `ON_ERROR_STOP`
+→ the check again, plus `$PGDATA/PG_VERSION` = the mark's `to`. Any failure, and a controller restart during
+`converting`, runs the existing undo. The space check (the dump's bound = the DB volume's size × 1.25, plus the
+2 GB floor, beside the stack dir) and the mark check refuse before anything moves: „A(z) %s adatbázisának
+átalakításához %s szabad hely kell, de csak %s van. Nem változott semmi." / „Ez a lépés a(z) %s adatbázisának fő
+verzióját váltaná, de nincs róla próba. Nem változott semmi." — a PostgreSQL major move WITHOUT the mark is
+refused by the preflight and by the job. After success the old datadir's copy is kept (`app.yaml`
+`conversion_copy`) until a backup is proven after the conversion; the hourly `conversion-copy-release` job then
+removes it, logged by name. PostgreSQL 18 mounts its volume at `/var/lib/postgresql` — the step's definition
+carries that. Code: `internal/stacks/pgconvert.go`. Proof: `felhom.eu/documentation/audits/night-2026-09-26/`.
+
 **Held apps say so (v0.265.0, R-625).** While a hold stands, the update badge reads „Megállítva —
 visszaállítás szükséges" / "Stopped — restore needed" (`tag-error`, title = the hold sentence's first
 sentence, in the reader's language) and no Update button is rendered; the API still answers 409 `held`. A