journal: SEQUENCE-COMPLETE — regall/samever/canon/dash/settings/nixenv all DONE, host healthy

cc-ci-plan/JOURNAL.md

@@ -704,3 +704,34 @@ session cc-ci-orchestrator-stale can be killed; recipe-mirrors org still private
   `.env.sample` length=43 spec in PR #1 was the LFS-secret root cause; fixed harness-side (an operator
   uncomments it when enabling LFS, so NOT a PR defect — no PR comment needed). PR #1 NOT merged (operator's
   call); the suite confirms its LFS feature works end-to-end.
+
+## 2026-06-17 ~18:00 — upgrade-base / canonical / config sequence DONE: regall→samever→canon→dash→settings→nixenv; SEQUENCE-COMPLETE
+- A 6-phase sequence (operator-driven over 2026-06-16/17) all M1+M2 Adversary-verified PASS, no VETO;
+  watchdog wrote SEQUENCE-COMPLETE and stopped the loops. Host verified healthy throughout + after the
+  final runtime-env switch (systemctl --failed empty, services active, endpoints 200, git-lfs 3.6.1, 38G free).
+- **regall** (sonnet): full all-recipe regression after the prevb dynamic-base change — 21/21 GREEN, no
+  prevb-caused regressions (plausible's red was a pre-existing recipe bug, fixed via its PR#3).
+- **samever** (opus): when the last-green canonical == the PR head version, the resolver steps back to the
+  newest published release tag < head instead of a same-version no-op (design A; canonical-history = design
+  B deferred to IDEAS). Proven: step-back base<head, version-bump path + discourse#4 unaffected.
+- **canon** (opus): made the HOLLOW nightly sweep real + proven (it fired green but only custom-html was
+  enrolled and ZERO canonicals had ever promoted). Now: all-21-enrolled (keycloak + 5 others are recorded
+  §2.B exceptions), mirror-sync to upstream, **promote only to tagged releases**, **trigger on a new
+  release tag** (operator refinements), skip-when-no-new-tag, run-twice determinism (15 skip / exceptions
+  run), UPGRADE_BASE_VERSION retired (plausible on dynamic base 3.0.1), AI-free runtime, weekly timer. ~7
+  real defects caught+fixed (false PASS-label, broad promote failure, master-vs-main, cold-dep deadlock,
+  concurrent sweeps, live-keycloak footgun, DEFECT-3 env-parity).
+- **dash** (opus): per-recipe history page now sourced from local /var/lib/cc-ci-runs (432 runs) instead of
+  the latest-100 Drone-builds slice — full history (handles mixed numeric/named ids).
+- **settings** (opus): minimal CI-server /etc/cc-ci/settings.toml + SKIP_CANONICALS_FOR_UPGRADE (default
+  false, false here) + always-on **release-tag-first no-canonical fallback** (newest release tag < head →
+  main-tip only as last resort). Proven live: keycloak(no canon)→release tag, gitea(canon)→last-green,
+  flag-true bypasses canonical to release-tag path.
+- **nixenv** (opus): single-sourced the harness runtime env (ccciPyEnv+ccciRuntimeTools+cc-ci-run in
+  packages.nix) referenced by cc-ci-run, the sweep timer (now execs cc-ci-run), and BOTH host
+  systemPackages — root-cause fix for DEFECT-3 drift; removed the DEFECT-3 PATH patch; cc-ci host gained
+  git-lfs/openssl. Live parity proven on BOTH the real timer fire AND the Drone path (#871): gitea
+  test_lfs_roundtrip green from the shared env, zero missing-tool signatures.
+- Orchestrator notes: wrote samever's ## DONE marker once (Builder was opus-quota-blocked; work was
+  Adversary-cleared); nudged regall's bold-wrapped marker fix; queued every phase + the design refinements
+  live. Queue now drained → hourly wake stops; new work = queue a new phase in agents.toml.