journal: phase conc DONE — concurrency restructure landed, M1+M2 adversary-verified

cc-ci-plan/JOURNAL.md

@@ -368,3 +368,21 @@ and plausible to green." Final state:
   future session: drone cancel still leaks the python child (kill by hand; maybe trap/pgroup fix in
   the runner step); recipe-mirrors org still private (PR-STATUS column dark — operator flip);
   operator to review/merge the two green recipe PRs.
+
+## Session 2026-06-10 — Orchestrator: concurrency restructure DONE (phase conc)
+
+Operator approved the simplification plan (concurrency-restructure-full-plan.md); ran it through
+the Builder (fable) / Adversary (opus, via new ADV_MODEL launcher support e0c9f23) loops + watchdog.
+Phase conc ## DONE 08:56 UTC, M1+M2 both Adversary-PASS, no open veto. cc-ci main now: per-app-domain
+kernel flock (registry/pidfiles/recipe-flock DELETED), flock-probe janitor, per-run ABRA_DIR
+(servers/ symlinked), PDEATHSIG+setsid+60-min-deadline lifetime chain, single capacity knob,
+tests/concurrency suite (21 real-kernel cases, outside the unit gate), docs/concurrency.md rewritten.
+Live verification earned two real catches: wrapper exit-code poisoning under set -e (e1c4198,
+false-RED, adversary 4-path matrix proved no false-GREEN) and CONC-A1 (domain-keyed deploy-count
+file in shared /tmp raced outside the lock — pre-existing, masked by the old recipe flock; fixed
+per-run + mutation-proven test; VETO lifted after 290/291 both green). Also fixed this session:
+orchestrator identity — watchdog was supervising the stale June-1 session; renamed mine to
+cc-ci-orchestrator-vm, repointed .orchestrator-session-id (old → .bak). Loops survived a
+limit-stall window 07:51–08:03 via watchdog kill/reboot/nudge — resilience layer worked as designed.
+Open for operator: review/merge immich PR#2 + plausible PR#3 (still green, unmerged); stale
+session cc-ci-orchestrator-stale can be killed; recipe-mirrors org still private.