journal: upgrader session 2026-09-28 (7 green PRs; subagent model bump deepseek-v4.1-flash; quay minio 401 watch)

cc-ci-plan/JOURNAL.md

@@ -1311,3 +1311,16 @@ harness → `results.json` + PR card `✅ passed` linking `ci.autonomic.zone/run
 - NOTE: no tailscale on this host (`tailscale: command not found`) — the AGENTS.md "ssh cc-ci"
   alias + 100.90.116.4 peer notes are stale post-rebuild; public-IP SSH is the access path.
   Recovery scripts in scripts/recovery/ still reference old server id 134485294 — worth updating.
+
+---
+## 2026-09-28 — upgrader session (weekly /upgrade-all)
+
+Weekly run 2026-09-28 complete: 19 considered · 7 GREEN PRs · 1 externally-CI-blocked (lasuite-docs, quay minio 401) · 0 failed · 11 skipped. Summary (PR list): `<logs>/upgrades/upgrade-all-2026-09-28.md` — repo ignores .cc-ci-logs, so the PR list lives in the file + the weekly report.
+
+**Operational config change (no PR):** subagent `general` model `deepseek-v4-flash` was killed upstream ("Model access is disabled", zen endpoint; glm-5.2 also dead) — pointed to `deepseek-v4.1-flash` in `/srv/cc-ci-orch/cc-ci/opencode.json`, `/srv/cc-ci-orch/opencode.json` (uncommitted) + live `/etc/cc-ci/opencode.json`. Prior committed setting still in the cc-ci repo's main. Operator: confirm + PR the bump (config change precedent #37/#42).
+
+**minio watch:** docker.io removal (2026-09-18) → now quay.io/minio/minio 401s since ~09-24; lasuite-docs CI-blocked on it; lasuite-drive passed (image cached).
+
+**abandoned worktree note:** `/srv/cc-ci-orch/cc-ci-conc/` (worktree of cc-ci, untracked in orch repo) has a stale worktree at 2f6787f; no writes this week; recorded so the next sweep notices.
+
+Key logs: .cc-ci-logs/upgrades/*-2026-09-28.md (8 per-recipe + summary).

cc-ci-plan/upstream/n8n.md

@@ -239,3 +239,18 @@
   safe (sqlite, TypeORM auto-migrate). Operator flags unchanged (API-caller-level deprecations,
   encryption-key rework informational, N8N_DB_PING_TIMEOUT warn-only, recipe doesn't set it).
   2.40.3 exists (see above) — flagged, not taken. Recommended release: `-y`.
+- 2.40.4 (2026-09-21, Pre-release): core fix (tear down workflow triggers when publication meets a
+  node type the instance cannot load) + perf (stop loading project members when listing
+  credentials).
+- 2.40.5 (2026-09-21, Pre-release): core fix (limit declarative routing during base URL ownership
+  checks). Docker Hub `2.40.5` manifest verified active multi-arch (amd64+arm64, digest
+  sha256:9f693fd5..., 2026-09-21) — not a withdrawn 2.37.5-style partial tag. NOTE: 2.40.x
+  `POST /rest/login` now takes `emailOrLdapLoginId` instead of `email` (request-shape change; the
+  cc-ci login-state test only GETs /rest/login so unaffected).
+- 2026-09-21 run: the flagged catch-up. PR #8 (branch `upgrade-ef0dd56`, at 2.40.2, !testme GREEN
+  2026-09-18) extended **2.40.2 → 2.40.5** on the same upstream main tip `0b436ec` (n8n NOT
+  merged upstream today, unlike discourse/keycloak/matrix-synapse). 2.40.2→2.40.5 is bugfix-only
+  (encryption-key raw-repair, trigger teardown, declarative-routing limit); no breaking
+  compose/env changes; no new migrations beyond the 15 already verified at 2.40.2. Stable badge
+  now on the 2.39.x line (2.39.9/2.39.10 released 2026-09-21); 2.40.x pre-release per precedent.
+  Recommended release: `-y`.