docs(dnn): #131 target revision 10.1.2 → 10.3.2 FULL upgrade + 2sxc 15→≥21 (decision #2)

[jsboige]

What

jsboige interactive decision #2 (issue #458, 2026-06-18): "Je suis pour l'upgrade complète, même si c'est plus lourde" → DNN target is now 10.3.2-latest + 2sxc 15→≥21 + template audit. This supersedes the 10.1.2 target I built across #520/#522/#527/#528. #445 Stripe Native is unblocked (OpenStore .NET-8 blocker dissolved — DNN 10 = .NET Framework 4.8).

This PR brings the DNN doc arc in line with the decision.

Net-new decision-spec (+141)

131-target-revision-10.3.2-full-upgrade.md — the source of truth for the new target:

• The 6-phase go-live procedure (docs(dnn): #132 production deployment runbook (9.11.1 → 10.1.2 go-live) #527) + rollback contract + .NET 4.8 runtime finding remain valid; only the target version + 2sxc scope change.
• 2sxc upgrade path: 15.02 → 21.07 LTS on DNN 9.11.1 (2sxc-first), then DNN → 10.3.2. New Phase 1.5 + expanded Phase 3/4 (content migration is now real, vs the 10.1.2 no-op).
• 🔑 Grounded finding (§3): the template audit is LARGELY ALREADY DONE. All 4 Argumentum custom templates already use @inherits Custom.Hybrid.Razor14 (verified against source, not asserted) — the legacy RazorComponent migration chore(dnn): Update DNN platform, extensions, and address security vulnerabilities #131 flagged is complete. APIs in use (App.Query, AsList, CmsContext, Link.To, Edit.TagToolbar) are all in the maintained-in-2sxc-21 list from chore(dnn): Update DNN platform, extensions, and address security vulnerabilities #131 itself. Residual risk = the 25 stock 2sxc apps' v20 infra changes = a staging-test item, not a repo-audit item.

This finding materially de-risks the decision: 10.3.2 is far less scary when the custom-app templates are already Razor14-compatible.

Superseded banners (history-faithful, no rewrite)

Added banners to the 4 target-bearing runbooks pointing to the new spec:

• docs(dnn): #131 CVE correction + target refinement — 9.13.x closes 0 CVEs, pragmatic target 10.1.2 #520 (CVE correction): "recommended target = 10.1.2" superseded; CVE facts stay correct.
• docs(dnn): #131 Step 1 sandbox upgrade runbook (9.11.1.19 -> 10.1.2) #522 (sandbox runbook): target superseded; procedure reusable for 10.3.2 path.
• docs(dnn): #132 production deployment runbook (9.11.1 → 10.1.2 go-live) #527 (deploy runbook): target superseded; §4 "no 2sxc migration" explicitly NO LONGER HOLDS.
• docs(dnn): #131 upgrade sandbox plan v2 — go/no-go matrix + 2 CVE/.NET reversals #511 (plan-v2): existing docs(dnn): #131 errata banner on #511 plan-v2 — CVE table superseded by #520 #528 errata redirected to the new spec; 2sxc-compat matrix §5-6 now central.

Doc-only, non-gated

• ❌ No deploy/upgrade/2sxc execution (GATED jsboige). No DB/RDP. No template edit.
• ❌ No merged-history rewrite (banners, not rewrites).
• 5 files: +168/-5. Base master cae93dc8.

Refs #131 #458 #445 #514 #520 #522 #527 #528.

[clusterManager-Myia]

[NanoClaw]

LGTM. Decision-spec solide pour le target revision 10.1.2→10.3.2. Points forts :

1. Grounded template audit (§3) — les 4 templates Argumentum sont deja en Custom.Hybrid.Razor14, la migration critique est pre-faite. Verifie contre le repo, pas asserte.
2. Superseded banners coherents sur les 4 docs precedentes (#520, #522, #527, #511) — chaque doc garde ses faits valides, seul le target change.
3. Gate boundaries clairs — pas de deploiement, pas de rewrite des runbooks existants, pas de decision #445.
4. Honesty boundary (§3) — distingue correctement templates repo-auditees vs stock-app infra risk (staging-test item).
5. Phase 1.5 (2sxc-first) isole bien le risque 2sxc du risque DNN.

Nit : le doc #132 §4 mention depreciee ("no 2sxc migration for 10.1.2") est correctement flaggee comme NO LONGER HOLDS dans le banner du runbook.

RAS — ready pour merge.