A couple of tidbits ...

<Overwriting old files vs. replacing the old folders: a few files are no longer included in the new version.>

I was specifically and exactly instructed in previous discussions to overwrite the files and not to worry about orphans.

< Is it risky to have people on the site, possibly posting content? If yes, what to do?>

It's gotta be risky. We'll shut down during upgrade, just haven't figured out how yet, especially how to determine that all users are done and gone. Good question/s.

• htaccess order should not matter
• doesn't matter if old files are there or not
• upgrading while the site is being used could cause problems for those users (they might get white pages or the blog post they just submitted might be lost). This is especially true as you are copying the new code over the old code.
  
• execution time depends on so many factors - best to test it out first on a test site if timing is important to you.
  
• 1.7.0 redoes the user directories and 1.7.2 renames the profile photos. I always backup both the db and the data directory before an upgrade.
  
• the new user directory is based on the signup date of the user. I'm sure someone will write a plugin to make it easier to check out a particular user's directory.

I've finally done the upgrade from Elgg 1.6.2 to the (just released) Elgg 1.7.3, so I've now the answers to my own questions...

First advice: testing, testing, testing!

I wanted to upgrade since Elgg 1.7.0 was released already. But some non core plugins were just not ready for Elgg 1.7+ yet. It really took until this week until the last problematic plugin finally worked. So my advice: set up a local test installation and test everything thoroughly. As the combinations of plugins are basically unlimited you will never be able to tell for sure if everything will still work after the upgrade, especially if you are using some of the less popular plugins.

The local test installation also had the advantage that I could put together all files I wanted to replace, both core Elgg and also a few non-core plugins. I've zipped the whole bundle and uploaded this zip file as preparation for the upgrade. I've included already the new .htaccess file and also my settings.php file.

Okay, you sure everything works? Test the upgrade on a test installation. And just to be sure backup everything from your site nonetheless!

• The order of running upgrade.php and replacing .htaccess is not important. I replaced .htaccess before running upgrade.php.
• I removed the old Elgg core installation completely (but kept the non-core plugins in the mod directory). It seemed the cleaner way, i.e. no deprecated files remaining. Additionally, there was no period of transition during the file copying. My site was just not accessible for a few minutes - the whole upgrade took just about 15 mins as I just had to unzip the new files.
  
• I've timed the upgrade to be done when most likely site traffic is low. Fortunately, no trouble caused by traffic during the upgrade.
• upgrade.php runtime was much, much shorter than expected, i.e. less than a minute including the restructuring of user's data directory (900 users, ~2 GB data).
• Everything went smoothly, so I can't give any advice about problems during the upgrade.lol