review(2): Q4.2 mumble PASS — COLD first-hand full-lifecycle GREEN (my clone @1ba5613); 5 tiers, deploy-count=1, tcp ready-probe 2x, real upgrade crossover, P3 config round-trips non-vacuous (max_users=42 + welcome marker), P4 sqlite ci_marker survives, clean teardown; no veto. Minor: leftover mumb-smoke volume (housekeeping)

machine-docs/REVIEW-2.md

@@ -1339,3 +1339,49 @@ returned by construction.
    health-only).
 4. Upgrade tier: real version crossover (0.1.0/0.2.0/1.0.0), CHAOS_BASE_DEPLOY base deploy is the
    prior pinned version (not LATEST), host-ports overlay provided to versions predating it.
+
+## Q4.2 mumble — PASS @2026-05-29T~19:33Z (COLD, first-hand, my clone /root/adv-verify @1ba5613)
+Re-ran the FULL harness myself: `RECIPE=mumble PR=0 cc-ci-run runner/run_recipe_ci.py` from my own
+clone reset to origin/main `1ba5613`. Log `/root/adv-mumble-cold.log` (read end-to-end, 190 lines,
+not truncated). **All 5 tiers GREEN, deploy-count=1, clean teardown.**
+
+**Evidence (cold, first-hand):**
+- RUN SUMMARY: `deploy-count = 1 (expect 1)`; install/upgrade/backup/restore/custom = **all pass**.
+- Enrollment markers matched claim: `CHAOS_BASE_DEPLOY → chaos base deploy of pinned version`;
+  `mumble install_steps: provided compose.host-ports.yml to recipe checkout`; 2 images present.
+- **`ready-probe OK (tcp 3x): 127.0.0.1:64738` appears TWICE** (L8 post-install, L43 post-upgrade) —
+  the new TCP voice-server probe gates past the host-mode 64738 rebind churn (the 409 the Builder
+  fixed in `ec76072`). Verified it fires on both deploys.
+- **Real upgrade crossover (HC1):** `head_ref=9fa5e949 chaos-version=9fa5e949 version=
+  0.2.0+v1.6.870-0→1.0.0+v1.6.870-0`. head_ref==chaos-version; prev→PR-head, not a no-op.
+- Pre-op seeds executed: `pre_upgrade`, `pre_backup`, `pre_restore` (ops.py).
+- **P2 parity (3, all green):** `test_tcp_health::test_mumble_listening_on_64738`,
+  `test_protocol_handshake::test_handshake_completes_with_channel_presence` (16.27s — real TLS
+  handshake w/ retry, NOT a stub), `test_web_client::test_web_client_serves_mumble_web_ui`.
+- **P3 specific (2, version-independent config round-trips — the non-vacuity linchpin, both green in
+  MY cold run):** `test_server_config_limits::test_configured_max_users_surfaces_in_serverconfig`
+  (ServerConfig.max_users == 42, a NON-default; murmur default is 100 → can't pass vacuously) +
+  `test_welcome_text_roundtrip::test_configured_welcome_text_surfaces_in_serversync` (unique marker
+  `cc-ci-mumble-welcome-7f3a9c` surfaced in ServerSync welcome_text). Both prove deploy-time config
+  (EXTRA_ENV WELCOME_TEXT/USERS → MUMBLE_CONFIG_*) propagated into the running murmur server and is
+  delivered over the real protocol. Decoded from server wire bytes (audited `_mumble_proto.py`
+  earlier), not returned by construction.
+- **P4 backup data-integrity (real):** `test_backup_captures_state` + `test_restore_returns_state`
+  PASSED — the sqlite `ci_marker` row (in `/data/mumble-server.sqlite`, the file backupbot dumps) is
+  asserted at backup, dropped in pre_restore, and returns as `original` after restore. Recipe-aware,
+  not health-only.
+- **P6 N/A** accepted: mumble's core UX is the native voice-protocol client (covered by the handshake
+  test); the web UI is asserted via test_web_client. Reasonable; no browser flow owed.
+- **Teardown:** post-run `docker stack ls | grep mumb` → empty; no `mumb-<hash>` volume from my run.
+
+**Verdict: Q4.2 mumble PASS.** First non-HTTP-native (TCP/voice) recipe fully enrolled with genuine,
+non-vacuous coverage across P1/P2/P3/P4/P7; P5 N/A (no deps), P6 N/A (justified). Advances P1
+coverage. No VETO.
+
+**Minor housekeeping (NOT a Q4.2 defect, no veto):** a leftover volume
+`mumb-smoke_ci_commoninternet_net_mumble_data` remains on cc-ci — from the Builder's earlier manual
+*smoke* deploy (app name `mumb-smoke`), not from any harness run (harness apps get random hashes and
+mine cleaned up). Builder may `docker volume rm` it at convenience.
+
+**Isolation note:** verdict formed from the plan + code (pre-claim audit `191fa77`) + STATUS claim
+verification info + my own cold re-run. JOURNAL-2 not consulted before this verdict.