review: M4 PASS + M5 PASS (own cold 3-stage run green, clean teardown); A2/A3 remain open

REVIEW.md

@@ -136,3 +136,36 @@ M4 is CLAIMED. Code review done; runtime checks so far:
 - **Deferred to next idle tick (a Builder harness run is active now; sequential-only):** my own
   cold install run (green install + Playwright + clean teardown verification) and the §6 kill-mid-run
   probe to test A3 empirically. Verdict (PASS/FAIL) follows that.
+
+## M4 — Harness + install stage: PASS @2026-05-27T01:05Z
+
+Verified by my **own** cold harness run (`RECIPE=custom-html REF=advcold… cc-ci-run
+runner/run_recipe_ci.py`, app `cust-cfeb6a`, isolated from a Builder run that happened to run
+concurrently as `cust-3c1970` — no collision, distinct domains/volumes/secrets):
+- **Install stage green:** `test_install.py` → 2 passed (27s): `test_http_reachable` (HTTPS 200 via
+  gateway) + `test_playwright_page` (real Chromium loads the live app, status 200, served HTML).
+- **Guaranteed teardown:** after the run, `cust-cfeb6a` left **0** services / volumes / secrets /
+  containers / `.env` — fully clean. Infra (traefik/drone/bridge/backups) untouched.
+- A1 closed (no-ACME enforced). **Open robustness findings A2 (dead `-pr` janitor) + A3 (unverified
+  best-effort teardown)** concern the *crash* path (finalizer-skipped), not this happy-path run;
+  they don't block M4's literal acceptance but must be resolved before DONE (D2 teardown guarantee).
+  Kill-mid-run probe to substantiate A2/A3 deferred until the host is idle.
+
+Verdict: **M4 PASS.**
+
+## M5 — Upgrade + backup/restore stages: PASS @2026-05-27T01:05Z
+
+Same cold run, stages 2 and 3 — both genuine end-to-end (no mocks; assertions reviewed in source
+and not softened):
+- **Upgrade green:** `test_upgrade.py` → 1 passed (41s). Deploys the **previous published version**
+  (`previous_version` = `recipe_versions[-2]`), writes a marker into the volume-backed html dir,
+  upgrades to latest (`abra upgrade`), then asserts HTTP 200 **and** the marker survives — a real
+  version change with data persistence across the volume (`cust-…_content`), not a no-op.
+- **Backup/restore green:** `test_backup.py` → 1 passed (37s). Writes `original`, `abra backup`,
+  mutates to `mutated` (asserted), `abra restore`, then asserts the served content is back to
+  `original` ("restore did not return the pre-mutation state"). Real backup→mutate→restore cycle
+  via backup-bot-two.
+- Teardown clean (same `cust-cfeb6a` 0-remnant check above covers all three stages — same domain
+  reused per stage).
+
+Verdict: **M5 PASS.**