The last six PostgreSQL apps decided; the gate's wait seen live by day; catalog currency; stale rows

- R-463 CLOSED: rallly, outline, sparkyfitness -> PostgreSQL 18 (catalog 25ffd89 / aeb0cd6 / 1666572),
  each proven on the bench and on 9202 through the guarded Update with one undo case; zipline,
  adventurelog, immich stay on 16 by 09 decision 42's rule (upstream runs 16 / 16 / 14).
- Part F: bookstack, kimai, audiobookshelf, n8n, navidrome, grafana, komga moved on both venues;
  immich not (R-732: its first start OOM-killed its database on the bench).
- R-687 item 4 PROVEN LIVE on demo-hp: two deferrals while the leg stepped two apps, the whole-guest
  backup on the first poll after, success; config + window put back and read back.
- Catalog currency audit (Part D): 25/53 behind inside a major, 19 across; night-updatable 28 -> 31 (+1).
- R-446 and R-440 narrowed (measured on demo-hp); R-624 corrected (outline, rallly, zipline have routes);
  R-548 note (demo-hp's local tier refused for space since 09-27).
- New rows: R-730 (the ISO 1.29.0 build commit cannot be proven -> no tag; installer-v* is the script's
  line), R-731 (tag-shape switches), R-732. Register 361 -> 364.
- 09 §3: the 2026-09-30 operator notes (by day; Tester-2 pre-checks done; decision 52 not needed, not
  recorded); §6.4 dated currency note. STATUS, CONTEXT, REPORT-pg-last-six-2026-09-30.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -569,6 +569,24 @@ R-636's louder repeated alarm.
     Same day, operator: the first real tester gets a NEW customer record (`Tester-2`, domain `sajatfelhom.hu`), not
     `tester-1`; and CC rewrites the volunteer guide as measured (R-722).
 
+### 2026-09-30 (day) — operator notes, recorded before the work
+
+- **The day brief runs by day.** Every backup and automatic-update test is started by hand — the night chain's debug
+  action (`POST /api/debug/backup/night-chain`), or demo-hp's backup window moved for one test and put back. Nothing waits
+  for a real night.
+- **Tester-2's pre-checks** (the tunnel route in Cloudflare, the two connect mails) were done by the operator (handoff
+  2026-09-30 §4).
+- **A decision 52 was offered by the reviewer and NOT taken** — *may a PostgreSQL conversion proof seed through the
+  database when an app has no headless front-door seed?* It was to be recorded only if used. It was not needed: all three
+  apps it was written for have a front-door seed after all (outline's self-hosted `installation.create`, rallly's own
+  sign-up with the e-mail code read from its own table in place of a mailbox, sparkyfitness's better-auth). The number 52
+  stays free.
+
+**Outcome (same day):** decision 42's rule applied to the last six PostgreSQL apps from each upstream's compose — rallly,
+outline and sparkyfitness (from 15) move to **18** (each upstream runs 18), each proven on both venues with one undo case
+on 9202 (catalog `25ffd89`, `aeb0cd6`, `1666572`); **zipline, adventurelog and immich stay on 16** (their upstreams run 16,
+16 and 14). All eleven PostgreSQL apps are now decided (R-463 closed). `audits/pg-last-six-2026-09-30/`.
+
 ---
 
 ## 3b. ANSWERED 2026-09-23 — the seven questions Slices 6 and 7 needed
@@ -1345,6 +1363,15 @@ what the part can do to a household's data if it is wrong, not how likely that i
 | **10** | **SHIPPED FOR DOCMOST — controller v0.273.0 + catalog `6a4a5f0` (harness v4, the gate's proof clause), proven live on 9202 2026-09-25** (`audits/night-2026-09-26/D/`): one press converted docmost 16 → 18 in **9.9 s** of engine work (**42 s** end to end), the check equal (2 databases, 48 tables, 71 rows), `PG_VERSION` 18, the seed read back; the load failing (an extension 18 lacks) → **undone in 43.6 s**; the app unhealthy on 18 → **undone in 148 s** (90 s drill health timeout); the controller SIGKILLed one second after the volume was emptied → the restart **undid it in 40 s**; each ending on 16 with the seed read back. The old datadir's copy is kept until a backup is proven after the conversion. Decisions 35, 37, 38. Every other PostgreSQL app stays refused by the gate until its own two-venue proof. *(Before:)* **PostgreSQL majors converted by the box.** A guarded-update step: `pg_dumpall` from the old engine, a NEW datadir (the old one kept aside, never deleted, until the check passes), load, check; then each of the eleven apps proven on the bench before its catalog move. | 16, R-463 | **2 + 3** | 1 (the same load discipline), 4 | **HIGH** — it rebuilds the datadir; bounded by keeping the old datadir aside |
 | **11** | **Fleet view** — per compose service: installed ref, catalog ref, badge state in the report; the hub lists boxes behind. | 18, R-451 | 2 | — | none — **deferred by the ruling** until the fleet grows |
 
+**Dated note 2026-09-30 — how current the catalog is** (`audits/catalog-currency-2026-09-30.md`, measured from the
+registries, the 2026-09-21 method). **25 of 53 apps were behind upstream inside a major and 19 across one** (37 behind in
+some way) that morning. **The night rule, read from the leg's code** (`legCandidate`): an app can update itself at night
+when the catalog's ladder holds a `proven` step from the box's pin, not marked `needs_person` (and, for a
+`files_may_change` step, only with a fresh whole copy). **28 apps + nextcloud (conditional) in the morning; 31 + nextcloud
+after the day's moves** (rallly, outline, sparkyfitness got their first steps; bookstack and kimai new heads); 21 have no
+ladder at all and are never updated at night. Part 10 is now decided for all eleven PostgreSQL apps (8 moved, 3 stay);
+part 7's gate wait (decision 20) was seen live on demo-hp the same day (R-687 item 4).
+
 **Recommended order: 1 → 2 + 3 → 4 → 5 → 6 → 7 → 8 → 9 → 10**, part 11 when the fleet grows. **Total
 for 1–10: ≈ 22 evenings.** The automatic caller (7) is deliberately late: it is the only part that
 acts with nobody watching, and every part before it is what makes that safe. Parts 8 and 9 are small