diff --git a/docs/execution/approved-issue-plans-ledger.md b/docs/execution/approved-issue-plans-ledger.md
index c5ea69026..c6655281c 100644
--- a/docs/execution/approved-issue-plans-ledger.md
+++ b/docs/execution/approved-issue-plans-ledger.md
@@ -39,7 +39,7 @@ state changes are outside scope.
 | 04 AI provider compatibility | #2732, #2766, #2723, #2708 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | serialize edits to AI service | zero drift; historical #2708 Responses path and #2766 structured Test path absent; remaining tuples differ | focused API 96 and full API suites/typecheck/boundaries passed in audit | — | select wire/state/import/base-path unit only after exact current tuple fails | provider/model/base URL/path/version/action/error tuple and allowed endpoint unavailable |
 | 05 AI provider migrations | #3152 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | coordinate DB/startup with 03 | zero drift; table schema, migration, startup ordering, Docker copy path coherent; `42P01` historical cause unresolved | audit API/server/DB tests, typechecks, boundaries passed; no real PostgreSQL migration fixture | — | choose config/packaging/startup/migration repair only after disposable reproduction | affected image layout/digest, working directory, DB schema/search path/journal, fresh+upgrade DB fixture |
 | 06 image storage delivery | #2684, #2778 | blocked | audit `task_855fbee0a803` | `codex-audit-backend-01-06` | `7a98f6662` → no source change | coordinate 12/15/25 renderer/image fixtures | #2684 ACL cause fixed by merged #3432 (`35cecf9`); #2778 Browserless path obsolete; current topology unproved | #3432 hosted checks successful; audit storage/upload/PDF tests, typechecks, boundaries passed | #3432 merged before run | deployment retest plus shared real-encoding/backend/render fixture before repair | deployed digest; disposable S3/Garage/SeaweedFS/MinIO/proxy and browser/server raster matrix unavailable |
-| 07 AIO deployment | #2722 | reviewing | implementation `task_aee702e37eae`; review `task_b29de2cd974c` / `ctx_46d7f32205a1` | `codex/issue-2722-postgres-docs` | `7a98f6662` → `e37b73566` | none | two docs committed locally; separate PostgreSQL/no-AIO policy plus topology/Unraid/reused-DB/upgrade gaps addressed | implementer reports Compose config, Markdown lint, focused source/diff/scope gates green; independent rerun active | — | resolve independent findings, fresh verify, publish unmerged PR without closing keyword | no AIO implementation permitted; optional Unraid host smoke unavailable |
+| 07 AIO deployment | #2722 | implementing | review fix `task_8ea6cfc76ef4` / `ctx_0184e1101bca` | `codex/issue-2722-postgres-docs` | `7a98f6662` → `e37b73566` + pending | none | independent review found app-update recipe pulled all services while `postgres:latest` can cross major versions; finding verified | initial checks green; reviewer independently reran Compose/Markdown/link/diff gates | — | restrict update recipe to app service, re-review, fresh verify, publish unmerged PR without closing keyword | no AIO implementation; optional Unraid host smoke unavailable |
 | 08 root public resume | #2669 | plan amendment required before implementation | audit `task_9f27829ca50f` | planned `codex/issue-2669-root-resume` | `7a98f6662` → — | none | current password redirect rejects `/`; public view is slug-hook-bound; SSR canonical cannot import server env; expanded auth/canonical contract identified | audit focused API/web suites, typechecks, boundaries passed | — | amend ownership for identity-vs-return auth flow and server-derived canonical root, then dispatch coherent feature | engineering scope correction; feature remains narrower than arbitrary domain/TLS registry |
 | 09 external version backup | #2705 | reviewing | implementation `task_e450ea143bfa`; review `task_129b49e32bc7` / `ctx_68b13c76cc72` | `codex/issue-2705-git-backup-docs` | `7a98f6662` → `d4ef67113` | none | two docs committed locally with export-shape distinctions, plain local Git workflow, privacy/image limits, import-as-new recovery | implementer reports API/import/schema/web tests, synthetic Git round trip, Markdown/diff/scope gates green; DB integration/E2E skipped; independent rerun active | — | resolve independent findings, fresh verify, publish unmerged PR | no automatic sync, remote, or whole-account restore |
 | 10 legacy link routing | #2836 | pending implementation after brief correction | audit `task_9f27829ca50f` | planned `codex/issue-2836-retired-slug-notices` | `7a98f6662` → — | none | prospective same-username slug-attempt notice remains coherent; exact DB/API/UI/E2E owner set verified | audit focused API/web suites, DB/API/web typechecks, boundaries passed | — | correct final E2E target to `public-sharing.spec.ts`, then implement migration/API/owner UI atomically | historical cause absent; no redirects/emails/recovery; prospective partial coverage only |
@@ -82,7 +82,8 @@ state changes are outside scope.
 | Plan 11 implementation | `task_58d76423d364` / not dispatched | planned `codex/issue-3010-jsearch-docs` | waits on plans 07–11 audit | three-file docs change, source/test validation, commit, independent review |
 | Plan 02 synthetic recovery | `task_bae016c4d1f2` / `ctx_303f5d1f1031` | `codex/issue-3181-recovery-procedure` | implementation complete; worker released | commit `3f53deca8`; pure comparator, safeguards docs, TDD evidence |
 | Plan 02 independent review | `task_46be9a1a4d82` / `ctx_e9f651d38a65` | same Plan 02 worktree | reviewing | findings-first review and independent verification |
-| Plan 07 independent review | `task_b29de2cd974c` / `ctx_46d7f32205a1` | same Plan 07 worktree | reviewing | factual/safety review and independent validation |
+| Plan 07 independent review | `task_b29de2cd974c` / `ctx_46d7f32205a1` | same Plan 07 worktree | complete; changes required | high: all-services pull could cross PostgreSQL major version |
+| Plan 07 review fix | `task_8ea6cfc76ef4` / `ctx_0184e1101bca` | same Plan 07 worktree | implementing | app-only update recipe and separately pinned database upgrade path |
 | Plan 09 independent review | `task_129b49e32bc7` / `ctx_68b13c76cc72` | same Plan 09 worktree | reviewing | format/workflow/privacy review and independent validation |
 
 ## Existing PR and residual accounting
diff --git a/docs/execution/briefs/fix-review-plan-07.md b/docs/execution/briefs/fix-review-plan-07.md
new file mode 100644
index 000000000..424afe5e3
--- /dev/null
+++ b/docs/execution/briefs/fix-review-plan-07.md
@@ -0,0 +1,16 @@
+# Address independent review: plan 07
+
+Read `.orchestration/plan-07-review.md`, approved plan 07 from pinned planning head, current `AGENTS.md`, RTK, and applicable
+documentation/receiving-code-review skills. Verify finding against current diff and runtime files. Finding is provisionally
+accepted: current update recipe pulls all Compose services while `postgres:latest` can cross major versions, contradicting
+separate-upgrade guidance.
+
+Edit only `docs/self-hosting/docker.mdx`. Make normal app update path pull and recreate only `reactive-resume`; do not pull or
+recreate PostgreSQL as part of app update. Direct database updates to separately chosen major-pinned image/provider upgrade
+procedure with backup/restore verification. Preserve existing app migration explanation and two-service topology. Do not add
+unsafe generic PostgreSQL commands, Compose/runtime changes, or new scope.
+
+Rerun focused update/PostgreSQL `rg`, Compose config, two-doc Markdown lint, internal-link inspection, `git diff --check`,
+and name-only scope. Amend or add a normal follow-up commit; do not rewrite reviewer report. Write
+`.orchestration/plan-07-review-fix.md` with exact commit, change, commands/results, skipped gates, and remaining risk. Do not
+push, open PR, merge, mutate issues, or spawn subagents. Final response at most ten lines.