Update arc resumed: the state measured, R-524/R-520/R-589/R-469 closed, seven questions put to the operator

Phase 0 — measured, never estimated:
- both demo boxes: 10 apps, 0 behind, 0 unknown
- 46 of 58 exact catalog pins are behind upstream; 39 within a major, 7 across
- 6 of 7 measurable floating pins have been repushed since the catalog set them
  (R-446 is no longer theoretical)
- the "23 of 66 floating pins" figure repeated in four places was STALE; recounted
  to 10, with the definition written down beside it

Three claims in the brief corrected, named first:
- R-589 was NOT open — it shipped in v0.258.0; only the row was stale
- the chaos-night canary is NOT a defect — both gates refused to certify by design
- the hub half of the report confirmed, with the nuance that the raw payload is
  stored whole, so Slice 7 is cheaper than the row implies

Closed: R-524 (controller v0.260.0, proven live in both languages), R-520 (power cut
during a REAL version change — the pin goes back, the app runs, the page says so),
R-589, R-469 (MariaDB half). Filed: R-605, R-606. R-462's stale scope corrected.

09 gains §3 decision 10 (decided by CC unattended — operator may reverse), §3b with
the seven questions in the decision shape, §6.2/6.3 the two open slices, and §6.4 an
update night costed from R-462's real numbers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -1,6 +1,78 @@
 # STATUS — what works, what's broken, what's next
 
-**Updated 2026-09-21 — the one screen that stopped an English speaker is fixed, the floor is raised, and both boxes have it.**
+**Updated 2026-09-21 (afternoon) — the update feature: a box can no longer be offered an older version as an "update", and I measured how far behind everything actually is.**
+
+**A decision I took on my own — you can reverse it.** When we move an app back to an older version in
+our catalog, a machine that already took the newer one used to show **"Update available"** — and the
+button behind it would have put the **older** version back, on top of data the newer one may already
+have changed. We cannot undo that. So from today such a machine says **"Up to date"**, and the button
+**refuses**, with a sentence saying the version is newer than ours and that going back needs you. It
+only refuses when it is certain; in every unclear case it behaves exactly as before.
+
+**What I measured, and the numbers are not comfortable.**
+
+- **Your two demo machines are perfectly up to date** — all ten apps, both machines, nothing behind.
+- **But our catalog is far behind the world.** Of the app versions we pin, **46 of 58 have a newer
+  version out there**. **Seven are a big jump** — Nextcloud, Paperless, Claper, Gokapi, Homepage and
+  SparkyFitness — and all seven have sat still since **18 July, 65 days**.
+- **"Up to date" is not always true, and now I know by how much.** Some of our pins name a *line*
+  rather than an exact version. **Six of the seven I could check have quietly changed underneath us.**
+  On the HP machine, four apps say "up to date" over a database engine that has moved. The label is
+  answering a narrower question than the one a household hears.
+- **One app's image is gone from the internet.** Plant-it. It was already marked abandoned, so this is
+  the expected ending, not a fault. A machine already running it keeps running it; it can never be
+  installed again.
+
+**A rule I lifted, and half of one I kept.** Since 13 September our catalog has refused to move a
+database engine to a new major version, because the Update button took no backup. **It takes one
+now**, so I lifted that ban **for MariaDB** — and only when the engine moves **on its own**, never in
+the same change as the app itself, because two changes behind one step give an unreadable failure.
+**I did not lift it for PostgreSQL.** That engine does not convert your data by itself and simply
+refuses to start on the old data — eleven apps would go down at once. A backup is a way back, not a
+conversion.
+
+**I proved it on a real machine, not only in tests.** On the spare machine I installed a throwaway
+app, moved our catalog forward, updated it, **cut the power mid-update**, and then moved the catalog
+back. Three results:
+- **The power cut is handled honestly.** The machine came back, put the app's version back where it
+  was, ran it, and told the household in plain words that the update was interrupted and the old
+  version is running. Nothing was left half-done.
+- **The new refusal works.** With the machine running the newer version, the page said "Up to date"
+  and the Update button was refused, in Hungarian and in English.
+- **Nothing moves when it refuses.** I pressed it three times; the app was untouched every time.
+
+**One new fault found while doing it, and I did not paper over it.** On an English page, the sentence
+explaining *why* an update stopped is still **Hungarian** — sitting directly under an English label.
+Every sentence the update feature shows in that situation has the same problem, including one that
+tells a household **whether their files will come back**. I wrote it down as work to do; I did not fix
+it today, because one released version per day is the rule and today's was already out.
+
+**Two things in the brief I was given were wrong, and I want you to know I checked rather than
+assumed.** It said the version label was still Hungarian on English pages — it has been fixed since
+yesterday and only our note was out of date. And a number describing our catalog, repeated in four
+places, had not matched reality for some time. Both corrected.
+
+**Rows.** Four closed, three now waiting on you, one corrected, two opened. 299 in total.
+
+**Needs you — two things.**
+
+1. **Seven questions about updating by itself.** The machine still cannot update an app on its own,
+   and 39 of the versions we are behind on are small, safe steps that nobody will press a button for
+   39 times. I have written each question down with two or three choices, what each costs, and which
+   one I would pick. They are in the design notes.
+   **If you do nothing:** nothing breaks, and nothing updates itself either — the gap to the world
+   keeps widening, quietly.
+2. **The fleet version.** Today's fix is on the two demo machines only. Raising the fleet version
+   would carry it to the rest — including the tester's real machine — and that is your switch, not
+   mine.
+   **If you do nothing:** the other machines keep offering a downgrade as an update. That is a label
+   and a button, not your data at risk, so waiting is cheap.
+
+
+## Previous note
+
+
+**Updated 2026-09-21 (morning) — the one screen that stopped an English speaker is fixed, the floor is raised, and both boxes have it.**
 
 > **Ready for an English-speaking tester: yes — nothing known now stands in their way.**
 > Ready for a Hungarian volunteer: yes, unchanged.