[marcusrbrown]

This updates the Umami Postgres 15 → 18 plan so it's ready to run. Only the plan doc changes; no code or compose changes yet.

Changes

• Volume layout. The Postgres 18 image moves PGDATA to /var/lib/postgresql/18/docker and declares VOLUME /var/lib/postgresql. The new volume therefore mounts at /var/lib/postgresql. A mount left at /data would bring up an empty cluster that still passes its health checks. Gates now check the PGDATA value, the mount, and that each table's row count and content checksum match the source before umami starts.
• Staging. Staging runs on the workstation as linux/amd64 with throwaway secrets. The droplet has about 245 MB free and no swap, so it can't run a second stack.
• Dumps. Each dump streams over SSH into age -r <recipient> on the workstation. Plaintext never reaches either disk, and nothing is installed on the droplet. The cutover dump is decrypt-tested before PG15 stops.
• Freeze. The retention timer is disabled first. Every waiting or queued umami deploy run, including router runs, is cancelled rather than held, because deploy.ts re-uploads main's PG15 compose on every deploy.
• Rollback. Before Caddy starts, a rollback to the untouched PG15 volume loses no data. Once Caddy starts, rolling back drops writes made on PG18, so it needs an explicit decision.
• Retention. Retention re-arms through the existing ENABLE gate after a supervised check, apply and post-check on PG18, with a new PG18 evidence record.

The runbook (Unit 2) and the compose/Renovate pin change (Unit 3) come in later PRs.

[fro-bot]

Verdict: PASS

Reviewed the diff against the current Umami compose, deploy implementation, retention procedures, and integration tests. The plan covers the PG18 volume layout, fresh quiesced recovery point, restore integrity gates, deploy freeze, retention re-enablement, and rollback's data-loss boundary.

Blocking issues

None

Non-blocking concerns

None

Missing tests

None. This documentation-only change requires no automated test execution; staging and PG18 integration evidence remain explicit prerequisites for the migration.

Risk assessment (LOW) + rationale

This PR changes only the migration plan and cannot directly alter production or the deploy pipeline. Execution remains gated on a reviewed runbook, staging evidence, and operator approval.

---

Run Summary

Field	Value
Event	pull_request
Repository	marcusrbrown/infra
Run ID	40057614634
Cache	hit
Session	ses_e9415f44bffe0ZCH73fEQg1KbT