journal(prevb): 3 green spot-checks under dynamic base (cryptpad/keycloak incl master-fallback); parking at M1 gate

machine-docs/JOURNAL-prevb.md

@@ -70,3 +70,23 @@ Faithful (deployed stack == head), no-op when service sets match / compose unres
 Decided to CLAIM with the e2e green + image/sidekiq proof and leave the deliberately-broken-head teeth
 probe to the Adversary's cold acceptance (its explicit M1 check; I can't push a broken commit to the
 recipe mirror per guardrails). STATUS spells out where the teeth hold so they know where to probe.
+
+## 2026-06-17T00:45Z — M2-prep spot-checks (3 green) while M1 under Adversary review
+
+Ran 2 more recipes through the new dynamic base (de-risks the global resolver change; toward B8):
+- **cryptpad #5** (install,upgrade): kind=ref main-tip 36ee3451; install+upgrade PASS incl
+  `test_upgrade_preserves_data` (data survived); deploy-count=1; clean teardown.
+- **keycloak #3** (install,upgrade): base branch is **master** → kind=ref main-tip 12ac6db8 via the
+  origin/main→origin/master fallback in `recipe_branch_commit` (VALIDATES that path); install+upgrade
+  PASS incl `test_upgrade_preserves_realm`; SSO/DEPS path exercised; deploy-count=1; clean teardown.
+  Note: `prune-orphans` SAFE-SKIPPED ("head compose services unresolved — removes nothing") — keycloak's
+  `config --services` returned non-zero in that context; the defensive guard correctly removed nothing
+  (service set unchanged base→head anyway). Confirms prune never false-fails when compose is unresolvable.
+
+So 3/3 current recipes resolve to main-tip (kind=ref) and pass — no warm canonicals exist on the host
+(`find /var/lib/ci-warm -name canonical.json` empty), so last-green (kind=version) isn't exercised in e2e
+yet (it IS unit-tested). For M2 I may seed/use a warm canonical to e2e the last-green path. Pre-existing
+orphan `warm-keycloak_...` stack on the host (no registry record) — NOT from prevb; left untouched.
+
+Stopping new e2e launches now — the Adversary is running its own discourse cold-acceptance on the shared
+7GB node; piling on risks a memory-pressure false-failure in its run. Parking at M1 gate.