@@ -79,16 +79,16 @@ end to end, verified order-independent (see
 
 | Layer | Technology | Role |
 |---|---|---|
-| Services | Python 3.12, FastAPI, SQLAlchemy + Alembic, Poetry | Five domain services + GraphQL gateway; migrations via init-containers |
+| Services | Python 3.14 on UBI 10 (`ubi10/python-314-minimal`), FastAPI, SQLAlchemy + Alembic, Poetry | Five domain services + GraphQL gateway; migrations via init-containers |
 | Protocols | REST (OpenAPI), gRPC (Protobuf/buf), GraphQL (SDL), Kafka (Avro) | The deliberate protocol mix: cross-product APIs, hot paths, read surface, async spine |
 | Packaging | Helm (umbrella chart + per-service subcharts), Docker Engine | One chart tree for the whole system; images built on the host and loaded into the minikube node |
-| Substrate | Kubernetes v1.32 on minikube (Docker driver, containerd + runc) | The whole system on one 24 GB profile |
-| Database | CloudNativePG operator, PostgreSQL | One shared cluster, schema-per-service ownership |
-| Events | Strimzi operator, Apache Kafka | The asynchronous spine (`order-placed` topic) |
-| Contracts | Apicurio Registry | OpenAPI + Protobuf + GraphQL SDL (discovery) and Avro (runtime, Confluent-compatible API) |
-| Catalog | OpenMetadata (+ OpenSearch) | Service inventory, ownership, cross-product lineage |
-| Mesh | Istio | mTLS, traffic splitting for the v1→v2 contract canary |
-| Autoscaling | KEDA (core + HTTP add-on) | Consumer-lag scaling for event consumers, request-based scale-to-zero for the gateway |
+| Substrate | Kubernetes v1.36.5 on minikube 1.39 (Docker driver, containerd + runc) | The whole system on one 24 GB profile |
+| Database | CloudNativePG 1.30 operator, PostgreSQL 18 | One shared cluster, schema-per-service ownership |
+| Events | Strimzi 1.2 operator, Apache Kafka 4.3 (KRaft) | The asynchronous spine (`order-placed` topic) |
+| Contracts | Apicurio Registry 3.3 | OpenAPI + Protobuf + GraphQL SDL (discovery) and Avro (runtime, Confluent-compatible API) |
+| Catalog | OpenMetadata 2.0 (+ OpenSearch 3.4) | Service inventory, ownership, cross-product lineage |
+| Mesh | Istio 1.31 | mTLS, traffic splitting for the v1→v2 contract canary |
+| Autoscaling | KEDA 2.21 (core + HTTP add-on 0.16) | Consumer-lag scaling for event consumers, request-based scale-to-zero for the gateway |
 | Observability | Prometheus, Tempo, Grafana, Kiali, OpenTelemetry | Metrics, cross-product traces, dashboards, live mesh topology |
 | Site | Jekyll / GitHub Pages | The ten-page reading set with paired SVG + Excalidraw diagrams |
 
@@ -131,7 +131,9 @@ cd examples/lgtm-datamesh
 ```
 
 The verified configuration is Fedora 44 with Docker Engine, 64 GB RAM
-(24 GB for the minikube profile), and minikube ≥ 1.36.
+(24 GB for the minikube profile), and minikube ≥ 1.39.0, which runs the pinned
+Kubernetes v1.36.5. Exact component versions are pinned in the setup scripts
+and charts (see DRA-020 in `_plans/decisions.md`).
 
 An optional OpenShift Local (CRC) appendix uses podman. <!-- forbidden-ok -->
 
 
@@ -188,7 +188,7 @@ job extends to giving every domain a *trusted base* to layer on.
 ![A trusted base for every data product — the supply chain the platform gives each domain]({{ '/assets/diagrams/17-trusted-supply-chain.svg' | relative_url }})
 
 The deck pairs this reference with OpenShift's specific supply chain:
-Red Hat Universal Base Image (UBI) — `ubi9/python-311` is the base for
+Red Hat Universal Base Image (UBI) — `ubi10/python-314-minimal` is the base for
 every Python service in the reference. UBI is freely redistributable
 and enterprise-maintained, which means a domain team gets a base image
 they can use without licensing constraints and that's patched on a
 
@@ -337,7 +337,7 @@ images with no further wiring. Pushing auto-creates an ImageStream per image in
 namespace, which is how the internal registry tracks what it's holding.
 
 **One real snag worth planning for.** The CRC VM's outbound networking does not
-necessarily reach Docker Hub — a direct `podman pull docker.io/library/postgres:16-alpine`
+necessarily reach Docker Hub — a direct `podman pull docker.io/library/postgres:18.6-alpine`
 run *inside* the cluster's image-pull path can fail with something like `dial tcp
 registry-1.docker.io:443: i/o timeout`, which shows up as `postgres-0`/`kafka-0` stuck in
 `ImagePullBackOff` after `helm install`. The *host* running `podman`/`oc`, by contrast,
@@ -349,15 +349,15 @@ directly:
 ./openshift/build-and-push.sh -r "$REG" -n datamesh --mirror-infra
 ```
 
-which pulls `docker.io/library/postgres:16-alpine` and `docker.io/apache/kafka:3.8.0` on
-the host, retags them into `$REG/datamesh/postgres:16-alpine` and
-`$REG/datamesh/kafka:3.8.0`, and pushes — exactly the refs `values.yaml`'s
+which pulls `docker.io/library/postgres:18.6-alpine` and `docker.io/apache/kafka:4.3.1` on
+the host, retags them into `$REG/datamesh/postgres:18.6-alpine` and
+`$REG/datamesh/kafka:4.3.1`, and pushes — exactly the refs `values.yaml`'s
 `postgres.image`/`kafka.image` default to. On a cluster whose CRC VM *does* have Docker
 Hub egress, skip `--mirror-infra` and uncomment the commented upstream `docker.io/...`
 lines in `values.yaml` instead; both forms are left in the file, one active.
 
 Apicurio needs no such mirror: its image lives on `quay.io`
-(`quay.io/apicurio/apicurio-registry:3.2.4`), which CRC's networking reaches directly, so
+(`quay.io/apicurio/apicurio-registry:3.3.3`), which CRC's networking reaches directly, so
 `apicurio.yaml`'s Deployment references it unmirrored.
 
 ![Building and pushing: the host bridges the CRC VM's Docker Hub egress gap; Apicurio pulls from quay.io directly]({% raw %}{{ '/assets/diagrams/19-crc-image-delivery.svg' | relative_url }}{% endraw %})
@@ -774,6 +774,16 @@ endpoint. The full capture is committed at
   limitation.
 - OpenMetadata's server component remains unverified live, blocked on an external
   registry quota rather than anything this build controls.
+- The verification above ran on the appendix's earlier image pins
+  (`postgres:16-alpine`, `kafka:3.8.0`, Apicurio 3.2.4, otel-lgtm 0.8.1, Prefect
+  `3-latest`, OpenMetadata 1.12.8). On 2026-10-09 the pins moved to the newest
+  stable tags (`postgres:18.6-alpine`, `kafka:4.3.1`, Apicurio 3.3.3, otel-lgtm
+  0.36.0, Prefect 3.8.8-python3.14, OpenMetadata 2.0.5 with OpenSearch 3.4.0;
+  DRA-020); they have
+  not been run on CRC yet. Postgres 18 cannot open a 16 data directory, so an
+  existing install needs a fresh PVC. The operator CSVs (Service Mesh 3, Custom
+  Metrics Autoscaler) and the OSSM3 Istio version can't be resolved without a
+  cluster; they are re-checked at the next CRC run.
 - **OpenShift GitOps** (the `Application` at `openshift/gitops/application.yaml`) and
   **OpenShift Pipelines** (Tekton) remain authored, not applied — no operators for
   either were installed for either verification pass.
 
@@ -857,3 +857,101 @@ status table of what is published and reachable.
 - Membership in the `docker` group is root-equivalent on the host.
 - CI gate scan 5 in `scripts/forbidden-syntax.sh` enforces the podman scope.
 - Live verification (2026-10-08/09): passed on Docker Engine 29.8.0 provided by Docker Desktop with the docker driver and containerd 2.2.1; see `_plans/reconciliation.md`. `ensure_node_forwarding` did not fire (the node's `FORWARD` policy was already `ACCEPT`). The live run also surfaced three fixes now in the scripts: bootstrap's service list ordering, endpoint checks accepting `LoadBalancer` Services, and `build-image.sh` waiting for its rollouts and for replaced pods to terminate. gRPC clients set `GRPC_DNS_RESOLVER=native`. A native (non-VM) Docker Engine run is still to do.
+
+---
+
+## DRA-020 — Newest stable platform on Kubernetes v1.36.5; UBI 10 + Python 3.14
+
+**Status:** decided 2026-10-09; verified live 2026-10-09 on Docker Engine
+29.8.2 + minikube 1.39.0 (bootstrap, every demo group, walkthrough 5/5,
+stop/start; see `_plans/reconciliation.md`). The CRC appendix is re-checked at
+its next run.
+
+**Context.** User decision on 2026-10-09: every component on its newest stable
+release, checked upstream (GitHub releases excluding pre-releases, the Helm
+repo indexes, `skopeo` for image tags), with exact pins and no floating tags.
+Kubernetes is the newest minor every component supports. Istio 1.29 reaches
+end of life on 2026-10-12. The parent repo `minikube-on-fedora` made the same
+move and verified it live on 2026-10-09 (its CAP-048 to CAP-051); this entry
+ports what applies here.
+
+**Decision.**
+
+| Component | From | To |
+|---|---|---|
+| Kubernetes (`--kubernetes-version`, new pin) | minikube default | v1.36.5 |
+| minikube floor | 1.36 | 1.39.0 |
+| Istio (istioctl + addon) | 1.29.2 | 1.31.1 |
+| Kiali (Istio addon image, now pinned) | addon tag | v2.31.0 |
+| KEDA core chart | 2.19.0 | 2.21.0 |
+| KEDA HTTP add-on | 0.15.0 | 0.16.0 |
+| Strimzi operator | 0.51.0 | 1.2.0 (Kafka 4.3.1 set explicitly) |
+| CloudNativePG chart / operator | 0.23.0 | 0.29.1 / 1.30.1 |
+| PostgreSQL image (CNPG) | operator default | `ghcr.io/cloudnative-pg/postgresql:18.6-standard-trixie` |
+| Apicurio Registry | 3.2.4 | 3.3.3 |
+| Kafka UI (kafbat) | `latest` | v1.5.0 |
+| OpenMetadata chart, server, ingestion | 1.12.8 | 2.0.5 |
+| OpenSearch (OpenMetadata dependency) | chart default | 3.4.0 (held back, see below) |
+| prometheus / grafana / tempo charts | unpinned | 29.36.1 / 13.4.0 / 3.1.0 |
+| Service base image | `ubi9/python-312:latest` | `ubi10/python-314-minimal:10.2-1791464217` |
+| asyncpg | ^0.30.0 | ^0.32.0 (cp314 wheels) |
+| OpenTelemetry distro / OTLP exporter | unpinned | 0.66b1 / 1.45.1 |
+| CRC appendix: postgres, kafka, otel-lgtm, Prefect | `postgres:16-alpine`, `kafka:3.8.0`, `otel-lgtm:0.8.1`, `prefect:3-latest` | `postgres:18.6-alpine`, `kafka:4.3.1`, `otel-lgtm:0.36.0`, `prefect:3.8.8-python3.14` |
+
+- **Kubernetes.** `setup-capstone-profile.sh` passes `--kubernetes-version`
+  (override with `KUBE_VERSION`) and refuses an existing profile whose driver,
+  runtime or Kubernetes version differs; `--replace` recreates it.
+- **Istio.** The capstone `setup-istio.sh` checks that `istioctl` on PATH
+  matches `ISTIO_VERSION` in the repo-root `scripts/setup-istio.sh`, because
+  the binary and `~/.local/share/istio-current` are shared with other repos.
+- **KEDA HTTP.** `interceptor.readinessTimeout=180s` replaces the deprecated
+  `interceptor.replicas.waitTimeout`; since 0.14 a timeout is a 504, not a
+  502. `HTTPScaledObject` stays `http.keda.sh/v1alpha1` (`InterceptorRoute` is
+  its successor and is not adopted); 0.16 reports a standard `Ready` condition.
+- **Strimzi.** 1.x serves only `kafka.strimzi.io/v1`. The kafka subchart moves
+  to v1, drops the `strimzi.io/kraft` and `strimzi.io/node-pools` annotations,
+  and sets `spec.kafka.version` from its own `version` value. The unread
+  umbrella `strimziCluster.version` is removed.
+- **CloudNativePG.** Primary-pod selectors use `cnpg.io/instanceRole=primary`.
+- **OpenMetadata.** The 2.0.5 dependencies chart ships OpenSearch 3.5.0, which
+  rejects the server's UUID-format `X-Request-Id`, so every search-index write
+  (lineage included) fails with HTTP 500. OpenSearch is pinned to 3.4.0, the
+  newest release that works (found live in the parent repo).
+- **Services.** UBI 10 minimal has no compiler, so dependencies need cp314
+  wheels. The OpenTelemetry install runs under a pip constraint of the venv it
+  extends; unconstrained it upgraded protobuf to 7.x, past the `<6` pin the
+  committed gRPC stubs were generated for.
+- **Host ports.** Unchanged. This repo already publishes Prometheus on 9091
+  (Cockpit owns 9090 on Fedora Server and RHEL), so the parent repo's
+  9090 → 19090 move does not apply. The profile name stays `capstone`.
+- **Demos** (live-run fixes from the parent repo): the Kafka demos hold
+  notification-service at one replica with `autoscaling.keda.sh/paused-replicas`
+  (`demos/lib/keda.sh`) and release it on exit; `demo-order.sh` deploys
+  inventory-service before ordering. Already present here: `GRPC_DNS_RESOLVER=native`,
+  the walkthrough's OpenMetadata check in the `capstone` namespace, and an
+  in-stock SKU. The walkthrough's trace act enters through the interceptor, so
+  it needs no gateway hold. There is no Jaeger in this stack.
+- **CRC appendix.** Image pins move to the newest stable tags. Operator
+  Subscriptions (CSVs) and the OSSM3 Istio version are unchanged: they can't be
+  resolved without a cluster and are re-checked at the next CRC run.
+
+**Rejected alternatives.**
+
+- Kiali v2.33.0 (newest upstream): the Istio 1.31.1 addon ships v2.31; the
+  parent repo verified that pairing live.
+- OpenSearch 3.5.0 (chart default): breaks OpenMetadata 2.0.5 writes.
+- Adopting `InterceptorRoute`: `HTTPScaledObject` is still supported, and the
+  simpler shape is enough here.
+- Regenerating the gRPC stubs for protobuf 7: out of scope; the lock pins
+  protobuf 5.x and the constraint keeps it there.
+
+**Consequences.**
+
+- An existing `capstone` profile on another Kubernetes version must be
+  recreated: `./scripts/setup-capstone-profile.sh --replace`, then
+  `./scripts/bootstrap-capstone.sh`.
+- A CRC install on postgres 16 needs a fresh PVC; Postgres 18 can't open a 16
+  data directory.
+- OpenSearch is held one minor back until OpenMetadata or its dependencies
+  chart moves; re-check then.
+- Live verification is pending; `_plans/reconciliation.md` tracks it.
@@ -15,6 +15,8 @@ The historical reconciliation rows from the capstone era are preserved in
 
 | Status | Claim | Where | Verification |
 |---|---|---|---|
+| **verified** | The stack runs end to end on the newest stable platform (DRA-020): Kubernetes v1.36.5 on minikube 1.39.0, Istio 1.31.1, KEDA 2.21.0 + HTTP add-on 0.16.0, Strimzi 1.2.0 with Kafka 4.3.1, CloudNativePG 0.29.1 with Postgres 18.6, Apicurio 3.3.3, OpenMetadata 2.0.5 with OpenSearch 3.4.0, services on UBI 10 + Python 3.14 | `examples/lgtm-datamesh/` (DRA-020) | Offline-grounded 2026-10-09: every chart renders at its pin; the Kafka, KafkaNodePool, KafkaTopic, Cluster, ScaledObject and HTTPScaledObject CRs validate against the Strimzi 1.2.0, CNPG 0.29.1 and KEDA 2.21.0 / HTTP 0.16.0 CRD schemas; all seven service images and a scaffolded service build with `docker build` and import on Python 3.14.8. Verified live 2026-10-09 on Fedora 44 with Docker Engine 29.8.2 (context `default`), minikube 1.39.0, a fresh `capstone` profile: `bootstrap-capstone.sh` (OpenMetadata ingestion and lineage included) → 16 `demos/demo-*.sh` green, `verify-grafana.sh`, `demo-canary.sh up 90 10` → `demo-canary-verify.sh` → `down`, `demo-add-data-product.sh up` → `down`, `restore-baseline.sh` between groups, `walkthrough.sh` 5/5 acts; then `minikube stop` → `cluster-up.sh` with all six images still in the node. Not run: `demo-service.sh` (needs a scaffolded service) and the canary `shift` step. |
+| **unverified** | The CRC appendix runs on its bumped image pins (`postgres:18.6-alpine`, `kafka:4.3.1`, Apicurio 3.3.3, otel-lgtm 0.36.0, Prefect 3.8.8, OpenMetadata 2.0.5) | `examples/lgtm-datamesh/openshift/` (DRA-020) | `postgres:18.6-alpine` (chart `PGDATA` layout) and Kafka 4.3.1 (chart KRaft env) started under `docker run` 2026-10-09. Operator CSVs and the OSSM3 Istio version were not re-checked (no cluster); both are re-checked at the next CRC run. |
 | **verified** | This repo's `examples/lgtm-datamesh/` tree builds and runs the data-mesh reference end to end, producing the same five-act walkthrough verified in the parent repo as of r28 | `examples/lgtm-datamesh/` | Verified 2026-07-04/05 on a fresh Fedora 44 host (rootless podman, minikube 1.38.1, fresh `capstone` profile): `./scripts/bootstrap-capstone.sh` then `./demos/walkthrough.sh` → 5/5 acts green, twice (once in-order, once in the shuffled suite). Caveats that verification surfaced and this repo fixed: six demo-script bugs (`5403d06`–`e22b318`), plus two host prerequisites the README didn't list — legacy `ip_tables`/`iptable_nat` kernel modules loaded on the host (Fedora is nftables-only; the rootless node can't modprobe), and minikube ≥ 1.36 (1.35's registry addon pins a dead `kube-registry-proxy` digest). |
 | **verified** | Every demo script passes against the bootstrapped stack: all 19 `demos/demo-*.sh`, the `demo-canary.sh` cycle (up 90/10 → shift 50/50 → down), and the `demo-add-data-product.sh` cycle (up → down) | `examples/lgtm-datamesh/demos/` | Verified 2026-07-04/05, same host: two full-suite runs (24 scripted invocations each) green, with fixes landed and re-verified between them. Fix verification exercised the failure paths live (historical: re-attaching a dropped forwarded connection, since replaced by published NodePorts, DRA-017; gateway wake from scale-to-zero, interceptor cold-start 502 retry). |
 | **verified** | The smokes are order-independent when `scripts/restore-baseline.sh` is run between groups (the smokes' pass-cleanup, CAP-008, otherwise couples them) | `examples/lgtm-datamesh/scripts/restore-baseline.sh` | Verified 2026-07-05: full suite re-run in a deliberately shuffled order (gateway-heavy first, `demo-order` immediately after the cleanup-happy group — its prior failure position) with `restore-baseline.sh` between groups → all green. The shuffle also exposed one latent race (`demo-kafka`, fixed in `e22b318`) that two in-order runs had passed on timing. |
 
@@ -154,13 +154,13 @@
    "updated": 1,
    "link": null,
    "locked": false,
-   "text": "library/postgres:16-alpine",
+   "text": "library/postgres:18.6-alpine",
    "fontSize": 11,
    "fontFamily": 1,
    "textAlign": "left",
    "verticalAlign": "top",
    "containerId": null,
-   "originalText": "library/postgres:16-alpine",
+   "originalText": "library/postgres:18.6-alpine",
    "lineHeight": 1.25,
    "baseline": 11
   },
@@ -189,13 +189,13 @@
    "updated": 1,
    "link": null,
    "locked": false,
-   "text": "apache/kafka:3.8.0",
+   "text": "apache/kafka:4.3.1",
    "fontSize": 11,
    "fontFamily": 1,
    "textAlign": "left",
    "verticalAlign": "top",
    "containerId": null,
-   "originalText": "apache/kafka:3.8.0",
+   "originalText": "apache/kafka:4.3.1",
    "lineHeight": 1.25,
    "baseline": 11
   },