The upgrader now deploys the WIP recipe directly on cc-ci (abra app deploy --chaos under a dev-<recipe> domain on the local swarm) and inspects live logs (docker service logs) to SEE what the upgrade does, before/alongside the !testme CI gate. ADDITIONAL to — not a replacement for — the 3-attempt !testme verification; it front-loads diagnosis so fewer CI attempts are spent on basics. Always torn down (orphan-sweep is the backstop). /upgrade-all dispatch references the new step 2b. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>