recon(prevb): M1 cold acceptance in flight — base=main-tip ref confirmed; concurrent keycloak run isolated

machine-docs/REVIEW-prevb.md

@@ -49,8 +49,26 @@ STILL REQUIRED for the formal M1 PASS (needs the Builder's e2e claim + my cold a
   (an EXPECTED_NA for a non-upgrade rung must not suppress the base) is preserved via `.get("upgrade")` but no
   longer has a dedicated test. Low risk; consider re-adding one line of coverage.
 
+## M1 cold acceptance — IN FLIGHT (2026-06-17T00:42Z)
+Gate M1 CLAIMED @00:40Z (code commit e1b32ea; claim commit bb79e91 = machine-docs only). Cold-verifying from a
+FRESH clone on cc-ci (`/root/cc-ci-adv-prevb` @ bb79e91), not the Builder's tree.
+Done so far (cold):
+- prevb unit surface: **64 passed** (`test_upgrade_base`+`test_previous`+`test_meta`) via nix pytest.
+- statics: `compose.ccci.yml` env-only (`order: stop-first`); discourse `recipe_meta.py` has NO `UPGRADE_BASE_VERSION` assignment.
+- `prune_orphan_services` reviewed: removes only services NOT in the head compose → cannot mask the prevb bug
+  (if overlay leaked sidekiq into the head compose it'd be in `defined` → not pruned → test RED). Teeth preserved.
+- e2e launched (`RECIPE=discourse SRC=recipe-maintainers/discourse REF=ae5a8180… PR=4 STAGES=install,upgrade`),
+  run `manual-1344943`. Early log CONFIRMS `upgrade base: kind=ref ref=f87c612d71b4 (target-branch (main) tip)`
+  → base = main-tip chaos deploy (matches claim). Base deploy (main-tip, has the known sidekiq depends_on bug)
+  in progress; observed a non-fatal `lint rung: fail R011` on the base — watching whether it blocks.
+- CONCURRENCY observed: a Builder keycloak spot-check (PR#3) runs simultaneously in `/root/prevb-deploy`. My
+  discourse run's janitor saw the keycloak lock and LEFT IT (`live concurrent run, leaving it`) — per-run
+  ABRA_DIR isolation holding. Watching for memory-pressure false-failures on the shared 7GB node.
+STILL TO CONFIRM: head ran official `discourse/discourse:3.5.3` (not bitnamilegacy) + sidekiq gone + upgrade GREEN
++ clean teardown; then a deliberately-broken-head BREAK-IT probe → upgrade RED.
+
 ## Verdicts
-(none yet — awaiting M1 CLAIM with e2e evidence)
+(none yet — M1 cold acceptance in flight)
 
 ## Open VETOes
 (none)