upstream(discourse): 2026.1→2026.7 ESR jump notes

cc-ci-plan/upstream/discourse.md

@@ -23,4 +23,27 @@
   no manual dump/restore needed (the old "Welcome to hell" procedure is superseded for this image).
 - Redis 8.0 GA supports upgrade from 7.x data files. Discourse uses Redis only as a cache/queue (Sidekiq)
   with no persistence modules. Redis 8.0 integrates RediSearch/RedisJSON/etc. as built-ins; discourse
-  does not use those modules so this is transparent.
+  does not use those modules so this is transparent. Redis 8.10-alpine is a safe sidecar bump from 8.8.
+- **2026.1 ESR → 2026.7 ESR jump (2026-07-28 release; 2026.7.1 = July 31 security intermediate):**
+  the big ~6-month ESR jump. Behavior changes that arrive on their own (all surfaced via the new
+  Upcoming Changes opt-out system, so NOT hard breaks for the recipe boot): Discourse Reactions
+  enabled by default (opt out via `discourse_reactions_enabled`); Uncategorized being removed (opt-out
+  for now); `rich_editor` site setting gone (rich editor unconditional, per-user `composition_mode`
+  remains); simpler email subject lines (beta). Web server: **Discourse replaced Unicorn with Pitchfork
+  (default in 2026.2, Unicorn removed entirely in 2026.4)** — internal, healthcheck `curl /srv/status`
+  still works. Theme/plugin deprecations: `.hbs` deprecated (2026.7 is last ESR with support, drop in
+  2026.8.0-latest → 2027.1 first ESR without it; codemod available); `.js.es6` deprecated (rename to
+  `.js`); legacy widget shims removed (`discourse.breadcrumbs.*`, `add-flag-property`,
+  `add-header-panel`, `bootbox`). New features: Upcoming Changes config page, Nested replies
+  (experimental), one-time email code login (alpha), new admin category management, bulk actions
+  (tag/pin/suspend), livestreams in Discourse Events. Postgres: discourse-health-check flags anything
+  below pg15; recipe is on pg18 so fine — do NOT bump the pg major in the weekly cron (operator
+  decision). For a fresh CI deploy (no custom themes/plugins/data) the jump converges cleanly; the
+  breaking-change surface is operator-facing for existing sites with custom themes. No Ruby version
+  concern (Ruby ships in the image). Release notes: https://releases.discourse.org/changelog/v2026.7.1/
+  and https://releases.discourse.org/changelog/v2026.7.0/ ; community jump guide:
+  https://meta.discourse.org/t/jumping-from-2026-1-esr-to-2026-7-what-i-found/408779 .
+- **Recommended release bump for the ESR jump:** `-x` major (it's a 6-month ESR jump with web-server
+  swap, default-on behavior changes, and theme deprecations — signal operators to review). The recipe
+  version label is NOT bumped in the upgrade PR; the operator runs `abra recipe release discourse -x`
+  after the upstream PR merges.