UNCHECKED was the magic word that amavis (my blog) added to emails going through it after the upgrade. Various suggested fixes to amavis in 50-user did nothing and so i delved into clamd the zoos scanner.
It could not share a socket in /var/run, adjusting that config file also did no good so after a afternoon of fun restarting things so i disabled the virus scanner in amavis which does not see a lot of action anyhow.
amavis[*]: (07127-01) (!)ClamAV-clamd av-scanner FAILED: run_av error: Too many retries to talk to /var/run/clamav/clamd.ctl (All attempts (1) failed connecting to /var/run/clamav/clamd.ctl) at (eval 98) line 613.\n
my groups already share clamd, and amavis as members for both so that was not the fault I even removed a yara (my blog) file that the 9.5 version that clamd did not like all of a sudden.
It did work in its own user/group but not anymore since it is a low priority and bad files are banned by the mta as well from email (a duplication) i bet nobody will notice it is gone until it gets fixed. Not my issue it seems but some artefact of AllowSupplementaryGroups not perhaps getting reflected elsewhere.
My printer server config got wiped away (dbus/systemd shenanigans ?) but i managed to get a kind of print server working for monday and that is a tale for another day as hplip might need an upgrade via a compile and that seems to be not important software in the grand scheme of now.
Overall apart from the whole server room rebooting itself early in the morning debian 9.5 seems a bit problematical if you use it as a server rather than ‘basic’ workstation.
I would have installed it at some point anyhow and i would not rather want to have done this on a monday morning.
So not sure if this is something i can fix. More fun that way.