docs: record weekly upgrade report

.claude/skills/recipe-upgrade/testme-on-pr.sh

@@ -18,7 +18,7 @@ RECIPE="${1:?usage: testme-on-pr.sh <recipe> <pr-index>}"
 PRIDX="${2:?usage: testme-on-pr.sh <recipe> <pr-index>}"
 TESTENV="${TESTENV:-/srv/cc-ci/.testenv}"
 set -a; . "$TESTENV"; set +a
-: "${GITEA_USERNAME:?}"; : "${GITEA_PASSWORD:?}"; : "${GITEA_URL:?}"
+: "${GITEA_USERNAME:?}"; : "${GITEA_PASSWORD:?}"; : "${GITEA_URL:=git.autonomic.zone}"
 NS="${GITEA_NAMESPACE:-recipe-maintainers}"
 API="https://${GITEA_URL}/api/v1"; AUTH=(-u "${GITEA_USERNAME}:${GITEA_PASSWORD}")
 POST="${POST:-1}"; MAX_WAIT="${MAX_WAIT:-480}"; INTERVAL="${INTERVAL:-30}"

cc-ci-plan/JOURNAL.md

@@ -929,3 +929,67 @@ progressing (surveying the 9 remaining recipes). Watching it through to completi
   and a fresh small session is running, the gate should see progress and stand down.
 - Lesson: when a weekly run dies mid-flight on a giant context, do NOT resume the original session —
   start fresh and scope to the remaining recipes. The /upgrade-all skill is idempotent so this is safe.
+
+## Session 2026-08-31 17:17 UTC — restricted acme-dns renewal staged
+
+**What happened:** Implemented and deployed the cc-ci restricted ACME DNS-01 design in cc-ci PRs
+#24–#27 (all merged). The initial `sqlite3` backend setting was detected during staging bootstrap
+and corrected to acme-dns 2.x `sqlite` before any account registration succeeded.
+
+**Live state:**
+- `acme-dns` is authoritative for `acme.commoninternet.net` on `91.98.47.73`, with public UDP/TCP
+  53 verified directly; it serves the apex NS and `ns-acme.commoninternet.net A 91.98.47.73`.
+- Its HTTP update API is bound solely to `127.0.0.1:8080`; registration is disabled (local POST
+  returns 403). The one restricted Lego account is stored mode `0600` under `/var/lib/acme/`, outside
+  Git and the Nix store. No Gandi credentials were used or stored.
+- Nix ACME is in Let's Encrypt staging mode for `ci.commoninternet.net` and its wildcard; its renewal
+  timer is enabled. Traefik handoff remains production-gated so staging cannot replace the live cert.
+- Every server deployment used `nixos-rebuild test`, reachability/service verification, then
+  `nixos-rebuild switch` on `#cc-ci-hetzner`.
+
+**Manual Gandi handoff (only blocker):** Add the parent-zone A+NS delegation and permanent CNAME:
+`ns-acme.commoninternet.net. A 91.98.47.73`,
+`acme.commoninternet.net. NS ns-acme.commoninternet.net.`, and
+`_acme-challenge.ci.commoninternet.net. CNAME
+9d3f0428-eb97-4b14-bb07-da2f0f6c2073.acme.commoninternet.net.` Once propagated, resume with a
+staging issuance, then production cutover/handoff verification. Do not obtain or add a Gandi token.
+
+## Session 2026-08-31 19:05 UTC — ACME production issuance complete
+
+**Completed:** The operator added the narrow Gandi delegation and permanent CNAME. Staging then
+validated both `ci.commoninternet.net` and `*.ci.commoninternet.net`; production issuance validated
+the same SAN pair and produced a Let's Encrypt certificate valid through 2026-11-29. cc-ci PRs #28–#30
+were merged to promote production, make Traefik roll certificate-secret changes even when recipe
+upgrades are held, and remove the retired SOPS wildcard-file injection.
+
+**Live cc-ci state:**
+- `/var/lib/acme/ci.commoninternet.net` is the sole source of the production cert/key; the runtime
+  pair matches it, is root-only for the key, and Traefik now references matching versioned Swarm
+  secrets. Reboot-safe `nixos-rebuild switch` completed at cc-ci `7147d77` after the required test
+  activations and health checks.
+- acme-dns remains authoritative only for the delegated subzone, its update API is localhost-only,
+  registration is disabled, and the restricted-account JSON is mode `0600`. The Nix ACME renewal
+  timer is active. No Gandi credential was added.
+
+**External blocker, not cc-ci-owned:** Direct TLS to `91.98.47.73:443` now presents the new valid
+certificate. The operator-managed public gateway at `143.244.213.108` currently accepts TCP then
+closes TLS before presenting a certificate, so its passthrough to cc-ci needs repair/verification.
+The cc-ci plan explicitly marks the gateway as operator infrastructure; do not change the DNS
+delegation or add a Gandi token to work around it.
+
+## Session 2026-08-31 20:45 UTC — weekly DeepSeek Flash run and report complete
+
+**Completed:** Started the weekly upgrader explicitly on `opencode/deepseek-v4-flash`; its parent
+and every recipe subagent were confirmed with that persisted model. All nine eligible recipe PRs
+completed `!testme` successfully. The public report was then restarted before publication when the
+first handoff was found to use the old GLM model; the replacement report session was confirmed
+`opencode/deepseek-v4-flash` and published successfully at
+`https://report.ci.commoninternet.net/week-2026-08-31.html` (HTTP 200).
+
+**Follow-up fixes:** Orchestrator PR #17 (`1b75d98`) made `testme-on-pr.sh` apply the documented
+public Gitea-host default. cc-ci PR #31 (`769fd29`) adds that public hostname to `.env.public`.
+Both commits were scanned clean and contain no coauthor trailers. No recipe PR was merged.
+
+**Security note:** A subagent briefly enabled shell tracing while debugging the verifier, exposing
+runtime credentials in its private agent trace. No values were committed or put in this journal,
+but rotate the affected `/srv/cc-ci/.testenv` credentials as a precaution.

cc-ci-plan/upstream/mattermost-lts.md

@@ -94,6 +94,16 @@
     was on 11.10.0 (operator chose innovation line that week); operator should now decide the
     `-lts` line. postgres 15-alpine still HELD (DB-major out of scope).
 
+- **2026-08-31 re-check** (endoflife.date/api/mattermost.json 2026-08-31; Docker Hub tag list;
+    GitHub release `v11.7.10`): **11.7 ESR line UNCHANGED** — latest patch still **11.7.10**
+    (released 2026-08-26, "various bug fixes"), EOL 2027-05-15. PR #2 already carries 11.7.9 →
+    11.7.10; the wildcard cert is RENEWED (valid to 2026-11-29), so this run just RE-VERIFIES PR #2
+    via `!testme` (the 2026-08-28 run's `!testme` was infra-blocked). 11.8.5 / 11.9.1 / 11.10.1
+    remain innovation (EOL 2026-09-15 / 10-15 / 11-15), NOT ESR — do NOT target; 10.11 ESR ended
+    2026-08-15 (upstream main still pins 10.11.22 = EXPIRED ESR → the 10→11 ESR move PR #2 carries
+    remains required; Mattermost docs: ESR→ESR is "fully supported and tested"). postgres 15-alpine
+    still HELD (DB-major out of scope, operator dump/pg_upgrade).
+
 ## NVD CPE fallback
 This project publishes nothing machine-readable we can reach — no GitHub advisory feed,
 no release-attributable changelog — so its CVE count was `?` (nothing measured). NVD is

cc-ci-plan/upstream/n8n.md

@@ -111,3 +111,29 @@
   taken). Rolling upgrade safe (sqlite, TypeORM auto-migrate on boot). Operator flag: the two 2.37.0
   API behavior changes (JSON content-type on decorator body routes; binary-data endpoint adapt) only
   affect HTTP API callers. Recommended release: `-y` (feature minor).
+  NOTE: PR #7's `!testme` on this date was BLOCKED — `*.ci.commoninternet.net` wildcard cert expired
+  (bridge: `CERTIFICATE_VERIFY_FAILED certificate has expired`). UNVERIFIED; operator renewed the cert
+  (now valid to 2026-11-29). The 2.37.3 work must be re-verified by a fresh `!testme`.
+- 2.34.5 (2026-08-12, patch): 1 core fix (apply TLS options per hop through a proxy).
+- 2.34.6 (2026-08-14, patch): 3 fixes (core `continueErrorOutput` `details` field; Google Ads sunset
+  v21→v25 API migration; MS Teams Restore `Group.ReadWrite.All` OAuth2 scope — matches the 2.35.3
+  in-progress backports).
+- 2.35.4/2.35.5/2.35.6/2.35.7 (2026-08-19..21, patches): API schema for decorator routes in /discover;
+  Google Ads v25 view metric rename; task-runners not restarted when only slow; expression engine
+  init on expression commands; test-webhook isolate release after teardown; env normalization before
+  schema parsing; end-user credential resolution; trigger closeFunction isolate; AI Assistant token
+  limit raise. All patch bugfixes, no breaking changes.
+- 2.36.8 (2026-08-28, patch): 1 core fix (domain-restricted credential usable in its own node) —
+  cross-backport of the 2.37.4 fix into the stable line.
+- 2.36.9 (2026-08-31, patch; **now the Stable/Latest badge** — `stable` tag): 1 core fix (apply proxy
+  environment variables consistently across packages and processes, cross-backport of 2.37.1/2.37.3).
+- 2.37.4 (2026-08-28, Pre-release): 1 core fix (allow a domain-restricted credential to work in its
+  own node).
+- 2.37.5 (2026-08-31): **withdrawn** — no plain `2.37.5` tag on Docker Hub (only partial
+  `2.37.5-amd64/-arm64/-pc` artifact tags, no manifest). Skip entirely, like 2.37.2/2.36.1.
+- 2.37.6 (2026-08-31, Pre-release; **newest 2.37.x tag**): 1 core fix (thread execution id through
+  dynamic-credential storage).
+- 2026-08-31 run: PR #7 extended 2.34.4 → **2.37.6** (newest tag abra lists = 2.37.6/2.37.4/2.37.3/…;
+  2.37.5 withdrawn). 2.36.9 holds the Stable/Latest badge; 2.37.x remains Pre-release on GitHub
+  (consistent precedent). Re-verified 2.37.3→2.37.6 (pure core bugfixes), no breaking changes beyond
+  the already-flagged 2.37.0 API behavior pair. Rolling upgrade safe. Recommended release: `-y`.