docs: 09 decisions 35-38 + part 10 as built; R-689 filed, R-469 narrowed; night-2026-09-26 evidence (A, B, C, D, F)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/architecture/09-update-architecture.md

@@ -402,6 +402,46 @@ R-636's louder repeated alarm.
     behaviour shipped in v0.271.0 is now the rule. **Why:** one night's delay for an app is cheap, and a resume
     would be one more mechanism acting with nobody watching.
 
+### 2026-09-25 (evening) — two operator rulings
+
+35. **Part 10 is built now, one app first** (operator ruling 2026-09-25 evening, D1 option A). The box
+    converts a PostgreSQL major as a step of the guarded update. **docmost is the first app.** Each other app
+    needs its own proof on both venues (the test bench and a scratch box through the real guarded Update)
+    before the catalog may move it. The engine-major gate stays for every app without that proof. **Why:**
+    decision 16 said "each of the eleven apps is proven before the catalog may move it"; one app first makes
+    the first proof small enough to read. As built: §6.4 part 10.
+36. **A reinstall over kept data offers a choice** (operator ruling 2026-09-25 evening, D2 option A): "use
+    my kept data" (the database from a backup, with the kept files) or "start fresh" (the kept files move to
+    a dated folder; nothing is deleted). **And, from the operator's follow-up question: kept data must never
+    be a dead end.** The household can see it (read only), load it into a later install, and delete it.
+    Support is for the rare case, not the normal one. **Not ruled (D3, in `STATUS.md`):** whether the box
+    ever deletes kept data by itself. Until it is ruled, **nothing deletes kept data automatically** — only a
+    household's explicit Delete. Where it lives and who deletes it: `07-backup-architecture.md` §"Kept data".
+
+### 2026-09-25 (evening) — two decisions taken by CC unattended, building part 10
+
+37. **docmost converts PostgreSQL 16 → 18, not 16 → 17** — *decided by CC unattended 2026-09-25 — operator may
+    reverse.* *One sentence:* which major does the first conversion target? **Options:** (a) 17 — no mount
+    change; (b) 18 — the data volume's mount moves to `/var/lib/postgresql` in the same step. **Costs:** (a) every
+    box converts again later, and docmost's own upstream compose already ships `postgres:18` at
+    `/var/lib/postgresql`; (b) the step changes the mount point — measured: `postgres:18` REFUSES (exit 1) even an
+    EMPTY volume at `/var/lib/postgresql/data` — so the step's definition carries the mount, and the undo must put
+    the old mount back with the old bytes, which it does (it restores the old definition and every volume).
+    **Why (b):** one conversion is better than two when the app's upstream runs the newer major. Reversible: the
+    catalog could pin 17 instead before any customer box moves. `audits/night-2026-09-26/A/README.md` A1.
+38. **The box loads from a `pg_dumpall` of the OLD engine, with no error tolerated** — *decided by CC unattended
+    2026-09-25 — operator may reverse.* *One sentence:* what does the conversion load into the new engine?
+    **Options:** (a) the existing safety dump (`pg_dump` per database, `--no-owner --no-privileges`); (b) a
+    `pg_dumpall` taken from the old engine at conversion time, loaded with `ON_ERROR_STOP`. **Costs:** (a) is free,
+    and silently drops any role, grant or database setting beyond the bootstrap ones (for docmost both routes gave
+    identical databases — it has one role and one database; the other ten are not measured); (b) one more dump
+    (0.6 s for docmost) and a load that must step around exactly two objects the new engine's entrypoint makes (the
+    bootstrap role and database — measured: loaded raw, exactly two `already exists` errors). **Why (b):** decision
+    16 says "save everything"; the two collisions are removed precisely (the entrypoint's databases dropped only
+    when they hold no table; `CREATE ROLE <x>;` skipped only for a role that exists — its `ALTER ROLE … PASSWORD`
+    still runs), so ANY other error stops the load and the undo runs. Proven live: an extension 18 lacks
+    (`adminpack`) stopped the load and the box undid it. `audits/night-2026-09-26/A/README.md` A2.
+
 ---
 
 ## 3b. ANSWERED 2026-09-23 — the seven questions Slices 6 and 7 needed
@@ -1175,7 +1215,7 @@ what the part can do to a household's data if it is wrong, not how likely that i
 | **7** | **SHIPPED — controller v0.271.0 (`9cf13a3`), proven on 9202 over four simulated nights 2026-09-24/25 and watched through the demo boxes' first real automatic night (`audits/DRILL-night-2026-09-25.md`).** Decisions 31–33 taken unattended. Gaps a scratch box cannot close: R-687; no resume after a restart: R-686. *(Before:)* **SPIKED 2026-09-24 (night, Part C) — the measured build brief is §6.4.2 below.** **The update leg in the chain + the automatic caller + the switch.** A leg that starts when the off-site leg has ENDED (on every exit path, skips included), one app at a time, one step per press, `app_update.unattended` default ON (decision 12), `stacks.update_window` removed, reads `UpdateRefusal.Reason`, remembers a failed step so it never re-presses it, and the full-system backup's gate waits for it until W+5h (decision 20). | 11, 12, 14, 15, 20 | **3** | 1, 2, 5 | medium — the only part that acts with nobody watching; everything above is what makes it safe |
 | **8** | **SHIPPED — controller v0.265.0 + hub v0.121.0, proven live on 9202 2026-09-23** (`audits/cleanup-2026-09-23/`; a kernel `oom_kill` counter, not the sticky flag — `08` §6.2). **R-636** — the same OOM key re-firing escalates instead of staying one `warning` for six hours. | R-636 | **1** | — | none |
 | **9** | **SHIPPED — controller v0.265.0, proven live on 9202 2026-09-23** (badge „Megállítva — visszaállítás szükséges" / "Stopped — restore needed", no Update button, 409 `held` unchanged). **R-625** — a held app stops offering an Update it will refuse. With the undo, holds become rarer; the lie on the page does not go away by itself. | R-625 | **0.5** | 1 | none |
-| **10** | **PostgreSQL majors converted by the box.** A guarded-update step: `pg_dumpall` from the old engine, a NEW datadir (the old one kept aside, never deleted, until the check passes), load, check; then each of the eleven apps proven on the bench before its catalog move. | 16, R-463 | **2 + 3** | 1 (the same load discipline), 4 | **HIGH** — it rebuilds the datadir; bounded by keeping the old datadir aside |
+| **10** | **SHIPPED FOR DOCMOST — controller v0.273.0 + catalog `6a4a5f0` (harness v4, the gate's proof clause), proven live on 9202 2026-09-25** (`audits/night-2026-09-26/D/`): one press converted docmost 16 → 18 in **9.9 s** of engine work (**42 s** end to end), the check equal (2 databases, 48 tables, 71 rows), `PG_VERSION` 18, the seed read back; the load failing (an extension 18 lacks) → **undone in 43.6 s**; the app unhealthy on 18 → **undone in 148 s** (90 s drill health timeout); the controller SIGKILLed one second after the volume was emptied → the restart **undid it in 40 s**; each ending on 16 with the seed read back. The old datadir's copy is kept until a backup is proven after the conversion. Decisions 35, 37, 38. Every other PostgreSQL app stays refused by the gate until its own two-venue proof. *(Before:)* **PostgreSQL majors converted by the box.** A guarded-update step: `pg_dumpall` from the old engine, a NEW datadir (the old one kept aside, never deleted, until the check passes), load, check; then each of the eleven apps proven on the bench before its catalog move. | 16, R-463 | **2 + 3** | 1 (the same load discipline), 4 | **HIGH** — it rebuilds the datadir; bounded by keeping the old datadir aside |
 | **11** | **Fleet view** — per compose service: installed ref, catalog ref, badge state in the report; the hub lists boxes behind. | 18, R-451 | 2 | — | none — **deferred by the ruling** until the fleet grows |
 
 **Recommended order: 1 → 2 + 3 → 4 → 5 → 6 → 7 → 8 → 9 → 10**, part 11 when the fleet grows. **Total