Why: the U4 branch is 89 commits behind main, which now carries the shared document renderer, two-trees project work, the SQLite instance guard and exec env layers (PR #209 merged asc76d8bd); it conflicted in storage migrations, host capabilities and the extension surface. The user authorized syncing U4 after the renderer line on 2026-10-18. Evidence: content is the agent-exec transport 3b64eb5 (cursor worker, unit backend-iam-u4-onto-main-c76d8bd-r1, run on a checkout whose tree equals main, receipt /tmp/cleanup-20261018/render/u4-backend-onto-run.json, SELF). Host check: main migrations 1-48 unchanged (migrate.go has no deleted lines versus main), U4 migrations moved from 35-36 to 49-50 with identical SQL, surface.txt is the sorted union, deps stay at main's pins. Impact: databases that ran unmerged U4 builds with the old numbering must be recreated. SurfaceVersion becomes 2.25.0-experimental. Main's admin password account creation now requires the system.users.create action like the other U4 account writes. Refs: Backend mainc76d8bd, PR #209 Co-authored-by: Cursor <cursoragent@cursor.com>