REPORT: v0.273.0 + v0.274.0

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

REPORT.md

@@ -1,9 +1,31 @@
-# REPORT — controller v0.272.0 (2026-09-25)
+# REPORT — controller v0.273.0 + v0.274.0 (2026-09-25)
 
-`44ae4de`, image `gitea.dooplex.hu/admin/felhom-controller:0.272.0`, floor 0.272.0 (MinAgent 0.131.0), both demo
-boxes arrived in ~25 s. **R-685 page half:** the backup page's tier row says, in both languages, when the agent
-skipped a whole-box backup because it cannot fit, with the agent's numbers. **R-671:** a restore that lifts an update
-hold removes that hold's undo copies. **R-670:** probe-only `.felhom.yml` copies load without the backup-block check.
-**R-677:** a re-tested floating tag's badge age counts from its test. Red-proofs: five; live on 9202: R-670, R-671,
-R-677 proven; R-685's line render-tested only (no box short of space; 9202 has no agent). Also: the unprompted-work
-rule no longer names Peti's box (retired). Record: `felhom.eu/documentation/audits/RETIRE-peti-2026-09-25.md` Part B.
+Two releases in one session, as the brief allowed: **v0.273.0** (`5a731b4`) — the PostgreSQL major conversion
+(`09` §3 decisions 35, 37, 38; §6.4 part 10) + R-687's two small items; **v0.274.0** (`64cbefe`) — kept data (decision
+36) + R-690 + R-692. Floor 0.273.0 then 0.274.0, MinAgent 0.131.0 declared both times, read back from the hub; both
+demo boxes arrived healthy within ~25 s each time. CI: `5a731b4` job 1002 success.
+
+**The conversion** (`internal/stacks/pgconvert.go`): only on a ladder step marked `engine_conversion`; a PostgreSQL
+major move without the mark is refused by the preflight and the job. Phase `converting` after the undo copy: old
+engine alone → check (owners, encodings, roles, extensions, per-table row counts) → `pg_dumpall` with its completion
+line → the volume emptied only after the copy's marker is validated again → new engine alone → entrypoint databases
+dropped, existing roles' `CREATE ROLE` skipped → load with `ON_ERROR_STOP` → check equal + `PG_VERSION`. Any failure,
+and a restart during `converting`, runs the existing undo. The old datadir's copy stays until a backup is proven
+after the conversion (hourly `conversion-copy-release`). **Live on 9202** (`0.273.0-rc1`, drill catalog): docmost
+16 → 18 done in 42 s (9.9 s of engine work, 48 tables / 71 rows equal); the load failing (`adminpack`, gone in 17+) →
+undone in 43.6 s; the app unhealthy on 18 → undone in 148 s; SIGKILL one second after the volume was emptied → the
+restart undid it in 40 s; each ending on 16 with the seed read back. Found live and fixed: the recovery line said
+UNDOING for a restart during `converting`. **Red-proofs:** 9 (conversion) + 2 (R-687) + 1 (R-692) here; the Part E
+build carries 10 more (`felhom.eu/documentation/audits/night-2026-09-26/E/redproofs/`).
+
+**Kept data** (`internal/stacks/kept.go`, `internal/web/kept_handlers.go`, `internal/api/kept_install.go`): built by a
+parallel helper session in its own worktree, reviewed and proven here. The install over a non-empty drive folder answers
+409 `kept_data_choice` until „use my kept data" / „start fresh" is chosen; the „Megőrzött adatok" / "Kept data" page
+lists, loads, deletes (typed); a read-only file-browser source; `<drive>/kept` protected and never backed up; the
+drive-full warning names kept folders. **R-692 found live** (the list named leftovers „Filebrowser") and fixed before
+the release. **Live on 9202** (endpoint level, both languages): the whole E5 walk passed — see
+`felhom.eu/documentation/audits/night-2026-09-26/E/E5-*`.
+
+**Not done:** R-691 (a 0770 folder is not readable in the view; "use" does not look off-site); R-694 (what the page
+shows after a load regenerates a withheld login secret) — measure first. Full session record:
+`felhom.eu/documentation/audits/DRILL-night-2026-09-26.md`.