review(2): Q4.2 mumble PRE-CLAIM code audit (NOT a verdict) — P7 non-vacuous at code level; cold-verify checklist staged for when claimed

machine-docs/REVIEW-2.md

@@ -1309,3 +1309,33 @@ grep plau` (none); no `run_recipe_ci` process alive. The runner auto-teardown re
 tier). My consolidated verdict stands unchanged: §4.3 content non-vacuous + shown green once in the
 Builder `instcustom.log`; full lifecycle unproven; no VETO, no gate-FAIL. The single-node is now FREE
 (my plausible cold run done) — Builder unblocked to run the Q4.2 mumble full harness.
+
+### Q4.2 mumble — PRE-CLAIM CODE AUDIT (NOT A VERDICT) @2026-05-29T~19:00Z
+Deploy-free isolation-discipline read of the mumble test code (plan + code only; NOT a PASS — the
+gate is not yet claimed and I owe my OWN cold harness run before any verdict). Done while the Builder
+deploys, so my eventual cold-verify is fast.
+
+**P7 vacuousness check — PASS (code-level).** `_mumble_proto.py` is a genuine hand-rolled Mumble
+control-channel client: real TLS connect to 127.0.0.1:64738, correct protobuf-wire varint
+encode/decode. Asserted values are decoded straight from server wire bytes — `welcome_text` =
+ServerSync field 3, `max_users` = ServerConfig field 6 (both mappings match Mumble.proto). NOT
+returned by construction.
+- `test_protocol_handshake`: TLS-accept + Version + auth-accepted + ≥1 channel (presence) +
+  ServerSync. Real liveness, not health-only.
+- `test_welcome_text_roundtrip` (P3 #1): asserts the unique marker `cc-ci-mumble-welcome-7f3a9c`
+  appears in the server's ServerSync welcome_text → proves deploy-time config propagated. Empty/absent
+  welcome_text → FAILS. Non-vacuous.
+- `test_server_config_limits` (P3 #2): asserts ServerConfig.max_users == 42 (recipe sets a
+  non-default; murmur default is 100). If config didn't propagate the server reports 100 → FAILS.
+  Non-vacuous + distinctive.
+
+**Cold-verify checklist for when CLAIMED** (must re-execute, do not trust):
+1. `RECIPE=mumble PR=0 cc-ci-run runner/run_recipe_ci.py` from my own clone → all 5 tiers + custom;
+   deploy-count semantics correct; clean teardown after.
+2. Confirm `EXTRA_ENV` (WELCOME_TEXT / USERS) actually maps to MUMBLE_CONFIG_WELCOMETEXT /
+   MUMBLE_CONFIG_USERS in the deployed recipe (grep the recipe .env/compose) — the marker propagation
+   is the linchpin of both P3 tests.
+3. P4: sqlite ci_marker seeded → backup → mutate → restore → marker survives (recipe-aware, not
+   health-only).
+4. Upgrade tier: real version crossover (0.1.0/0.2.0/1.0.0), CHAOS_BASE_DEPLOY base deploy is the
+   prior pinned version (not LATEST), host-ports overlay provided to versions predating it.