09 §3 decision 43 (claper -> PG 17, CC unattended); CONTEXT

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -14,6 +14,12 @@
 > language, one screen, no identifiers in the prose. Same subjects, different readers; merging them
 > would make one of the two audiences stop reading. `STATUS.md` is also a **view of `OPEN-ITEMS.md`**
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
+
+> **2026-09-28 — decided by CC unattended (operator may reverse): `09` §3 decision 43 — claper → PostgreSQL 17** (its
+> upstream runs 15; decision 42's rule). Also that day: golden 0.276.0 baked + vouched with agent 0.137.0; controller
+> v0.277.0 (kept data loads from the off-site copy, R-691 (2)); floor 0.277.0; R-702 (claper default admin, P1) and
+> R-703 (calcom OOM at 768 MB) filed.
+
 ## 2026-09-27 evening — a restore and a drive move keep the app's records (controller v0.276.0)
 
 - **Controller v0.276.0** (floor 0.276.0, MinAgent 0.131.0): R-697 closed (the restore's write carries the life records; `earlier_conversion_copies`); R-700 filed + fixed (a drive move dropped the pin → the next start took the catalog's newest version) — live proof open, no Tier-0 guest has two drives. R-691 (2) deliberately not built (no off-site target on a box CC may touch). Rule added to `07` §6.6. Evidence `audits/records-carried-2026-09-27/`.

documentation/architecture/09-update-architecture.md

@@ -477,6 +477,14 @@ R-636's louder repeated alarm.
     two WHEN the upstream runs the newer major — paperless's does (18, Django ~5.2.5, psycopg 3); tandoor's does not,
     and 17 is the newest major its Django documents, with no mount change. Read 2026-09-27 from each upstream's
     compose and requirements (`audits/version-travel-2026-09-26/B/`). Reversible: the catalog pins the major.
+43. **claper → PostgreSQL 17; calcom not moved** — *decided by CC unattended 2026-09-28 — operator may reverse.*
+    *One sentence:* which major does claper's conversion target? **Options:** (a) 17 — no mount change; (b) 18 —
+    the mount moves to `/var/lib/postgresql`. **Costs:** (a) a later second conversion if claper's upstream moves to
+    18; (b) claper would run a major its own upstream compose (`postgres:15`, v2.5.0) has not run. **Why (a):**
+    decision 42's rule — the newer major only when the app's own upstream runs it; claper's does not. Proven on both
+    venues (bench: 32 tables equal, peaks 75.8 %/78.3 %; box 9202: converted through the guarded Update in 7.2 s),
+    catalog `4a249b9`, `audits/pg-calcom-claper-2026-09-28/`. **calcom** is not moved: its FROM version does not
+    start at the catalog's memory limit (R-703), so no conversion can be proven. Reversible: the catalog pins the major.
 
 ---