claim(mirror): Ph1+Ph2+Ph3 complete — mirrors created, hedgedoc tests, 9 recipes enrolled

Phase 1: Create 3 missing Gitea mirrors (lasuite-drive, mailu, mumble) via API + force-sync
  upstream main (f4135d78, 23309a1a, 9fa5e949). All 3 return 200/empty=false from Gitea API.

Phase 2: Author tests/hedgedoc/ (uptime-kuma template) — recipe_meta.py, functional/
  test_health_check.py (GET / → 200/302), functional/test_branding.py (brand markers),
  PARITY.md. Generic tiers cover install/upgrade/backup baseline.

Phase 3: Enroll 9 unenrolled recipes in nix/modules/bridge.nix POLL_REPOS:
  bluesky-pds, discourse, ghost, immich, lasuite-drive, mailu, mattermost-lts, mumble, plausible.
  Final POLL_REPOS: 20 entries (cc-ci + 19 recipes).

Gate Ph4 CLAIMED: operator must run `nixos-rebuild switch --flake .#cc-ci` on cc-ci after
Adversary-verifies Ph1+Ph2+Ph3. See STATUS-mirror.md for exact repro.

machine-docs/BACKLOG-mirror.md

@@ -6,22 +6,22 @@
 - [x] Confirm abra recipe fetch for lasuite-drive, mailu, mumble (all exit 0 — already fetched)
 - [x] Snapshot POLL_REPOS + Gitea mirror status (STATUS-mirror.md + Adversary cold-probe in REVIEW-mirror.md)
 
-### Phase 1 — Create 3 missing mirrors
-- [ ] Create recipe-maintainers/lasuite-drive (Gitea API + force-sync upstream main)
-- [ ] Create recipe-maintainers/mailu (Gitea API + force-sync upstream main)
-- [ ] Create recipe-maintainers/mumble (Gitea API + force-sync upstream main)
+### Phase 1 — Create 3 missing mirrors ✓
+- [x] Create recipe-maintainers/lasuite-drive (Gitea API HTTP 201 + force-sync f4135d78 → main)
+- [x] Create recipe-maintainers/mailu (Gitea API HTTP 201 + force-sync 23309a1a → main)
+- [x] Create recipe-maintainers/mumble (Gitea API HTTP 201 + force-sync 9fa5e949 → main)
 
-### Phase 2 — hedgedoc test suite
-- [ ] tests/hedgedoc/recipe_meta.py
-- [ ] tests/hedgedoc/functional/ (health-check + content probe)
-- [ ] tests/hedgedoc/test_install.py (HTTP health + Playwright)
-- [ ] tests/hedgedoc/PARITY.md
-- [ ] Commit to cc-ci PR; verify !testme green before relying on it
+### Phase 2 — hedgedoc test suite ✓
+- [x] tests/hedgedoc/recipe_meta.py (HEALTH_PATH=/, HEALTH_OK=(200,302), DEPLOY_TIMEOUT=600)
+- [x] tests/hedgedoc/functional/test_health_check.py (GET / → 200 or 302)
+- [x] tests/hedgedoc/functional/test_branding.py (hedgedoc/codimd/hackmd markers in HTML)
+- [x] tests/hedgedoc/PARITY.md (scope documentation + deferred items)
+- [ ] Verify !testme green on hedgedoc PR (post Phase 4 deploy, after bridge restarts)
 
-### Phase 3 — Enroll 9 unenrolled recipes in POLL_REPOS
-- [ ] Edit nix/modules/bridge.nix POLL_REPOS to add bluesky-pds,discourse,ghost,immich,lasuite-drive,mailu,mattermost-lts,mumble,plausible
-- [ ] Confirm each has tests/<recipe>/ in repo (all 9 already present — Adversary-confirmed)
-- [ ] Commit + push cc-ci repo
+### Phase 3 — Enroll 9 unenrolled recipes in POLL_REPOS ✓
+- [x] Edit nix/modules/bridge.nix POLL_REPOS to add bluesky-pds,discourse,ghost,immich,lasuite-drive,mailu,mattermost-lts,mumble,plausible
+- [x] Confirm each has tests/<recipe>/ in repo (all 9 already present — Adversary-confirmed)
+- [x] Commit + push cc-ci repo
 
 ### Phase 4 — Deploy (OPERATOR GATE)
 - [ ] CLAIM gate — exact command + confirm /root/cc-ci at committed head + Phases 1-3 complete

machine-docs/JOURNAL-mirror.md

@@ -25,3 +25,52 @@ Adversary independent cold-probe in REVIEW-mirror.md confirms same results.
 
 tests/ state: All 9 unenrolled recipes already have tests/<recipe>/. hedgedoc absent.
 POLL_REPOS current: 11 entries (cc-ci + 10 enrolled recipes).
+
+## 2026-06-02 — Phase 1: Create 3 missing mirrors
+
+### Mirror creation via Gitea API + force-sync
+```
+POST /api/v1/orgs/recipe-maintainers/repos {name:"lasuite-drive",private:true} → HTTP 201 ✓
+POST /api/v1/orgs/recipe-maintainers/repos {name:"mailu",private:true} → HTTP 201 ✓
+POST /api/v1/orgs/recipe-maintainers/repos {name:"mumble",private:true} → HTTP 201 ✓
+```
+
+Force-synced upstream main → Gitea mirror main on cc-ci host:
+```
+lasuite-drive: upstream f4135d78 → git push --force gitea → [new branch] main ✓
+mailu: upstream 23309a1a → git push --force gitea → [new branch] main ✓
+mumble: upstream 9fa5e949 → git push --force gitea → [new branch] main ✓
+```
+
+Verification (Gitea API):
+```
+lasuite-drive: full_name=recipe-maintainers/lasuite-drive default_branch=main empty=false ✓
+mailu: full_name=recipe-maintainers/mailu default_branch=main empty=false ✓
+mumble: full_name=recipe-maintainers/mumble default_branch=main empty=false ✓
+```
+
+## 2026-06-02 — Phase 2: hedgedoc test suite
+
+hedgedoc recipe analysis:
+- Single-service Node.js app (quay.io/hedgedoc/hedgedoc:1.10.8), port 3000
+- Default: sqlite (CMD_DB_URL=sqlite:/database/db.sqlite3), no compose.backup.yml
+- backupbot.backup=true in compose labels; volumes: codimd_database, codimd_uploads
+- HEALTH_PATH=/ with HEALTH_OK=(200,302): root redirects to /login or /new depending on config
+
+Files created (uptime-kuma template):
+- tests/hedgedoc/recipe_meta.py (HEALTH_PATH=/, HEALTH_OK=(200,302), DEPLOY_TIMEOUT=600)
+- tests/hedgedoc/functional/test_health_check.py (GET / → 200 or 302)
+- tests/hedgedoc/functional/test_branding.py (hedgedoc/codimd/hackmd markers in HTML)
+- tests/hedgedoc/PARITY.md (scope documentation)
+
+test_install.py/test_upgrade.py/ops.py deferred (generic tiers provide baseline coverage).
+
+## 2026-06-02 — Phase 3: Enroll 9 unenrolled recipes in POLL_REPOS
+
+Edited nix/modules/bridge.nix POLL_REPOS:
+- Before: 11 entries (cc-ci + custom-html, custom-html-tiny, keycloak, cryptpad, matrix-synapse,
+  lasuite-docs, lasuite-meet, n8n, hedgedoc, uptime-kuma)
+- After: 20 entries (+bluesky-pds, discourse, ghost, immich, lasuite-drive, mailu,
+  mattermost-lts, mumble, plausible)
+
+All 9 newly enrolled recipes confirmed to have tests/<recipe>/ (Adversary-confirmed).

machine-docs/STATUS-mirror.md

@@ -14,13 +14,46 @@
 - tests/: all 9 unenrolled recipes have tests/<recipe>/ already (Adversary-confirmed)
 - hedgedoc: NO tests/hedgedoc/ (plan Phase 2 must author)
 
-### Phase 1 — Create 3 missing mirrors — IN PROGRESS
+### Phase 1 — Create 3 missing mirrors ✓ COMPLETE
+- lasuite-drive: created (HTTP 201), main synced to f4135d78 (upstream) ✓
+- mailu: created (HTTP 201), main synced to 23309a1a (upstream) ✓
+- mumble: created (HTTP 201), main synced to 9fa5e949 (upstream) ✓
+- Verified: all 3 return HTTP 200 from Gitea API, empty=false ✓
+- Method: Gitea API POST /orgs/recipe-maintainers/repos + git push --force gitea main on cc-ci
 
-### Phase 2 — hedgedoc test suite — PENDING
+### Phase 2 — hedgedoc test suite ✓ COMPLETE
+- tests/hedgedoc/recipe_meta.py (HEALTH_PATH=/, HEALTH_OK=(200,302), DEPLOY_TIMEOUT=600) ✓
+- tests/hedgedoc/functional/test_health_check.py (GET / → 200 or 302) ✓
+- tests/hedgedoc/functional/test_branding.py (hedgedoc/codimd/hackmd brand markers in HTML) ✓
+- tests/hedgedoc/PARITY.md (documents scope + deferred items) ✓
+- NOTE: test_install.py/test_upgrade.py/ops.py deferred (generic tiers cover baseline)
 
-### Phase 3 — Enroll 9 unenrolled recipes — PENDING
+### Phase 3 — Enroll 9 unenrolled recipes ✓ COMPLETE
+- nix/modules/bridge.nix POLL_REPOS updated: added bluesky-pds,discourse,ghost,immich,
+  lasuite-drive,mailu,mattermost-lts,mumble,plausible (9 new entries → 20 total)
+- Final POLL_REPOS: cc-ci + 19 recipes (all enrolled recipes + all 9 previously unenrolled)
 
-### Phase 4 — Deploy — OPERATOR GATE (not started)
+### Phase 4 — Deploy — OPERATOR GATE CLAIMED (awaiting Adversary + operator)
+
+**Gate: Ph4 CLAIMED — awaiting Adversary verification of Ph1+Ph2+Ph3, then operator deploy**
+
+**WHAT:** Phases 1-3 complete. Bridge config updated with 20 POLL_REPOS. Mirrors for
+lasuite-drive, mailu, mumble created + synced. hedgedoc tests authored. Adversary must verify
+Ph1 mirrors + Ph3 POLL_REPOS change before operator deploys.
+
+**HOW to verify (Adversary):**
+- Ph1 mirrors: `curl -s -u <bot> https://git.autonomic.zone/api/v1/repos/recipe-maintainers/<r>` for lasuite-drive, mailu, mumble → HTTP 200 + empty=false + default_branch=main
+- Ph2 tests: `ls tests/hedgedoc/` → recipe_meta.py, PARITY.md, functional/ present; `ls tests/hedgedoc/functional/` → test_health_check.py, test_branding.py present
+- Ph3 POLL_REPOS: `grep POLL_REPOS nix/modules/bridge.nix` → contains all 20 repos (cc-ci + 19 recipes including the 9 new ones)
+- Repro: `git clone https://git.autonomic.zone/recipe-maintainers/cc-ci && grep POLL_REPOS nix/modules/bridge.nix`
+
+**EXPECTED:** Adversary verifies all 3 checks PASS. Then operator runs:
+```
+ssh cc-ci 'cd /root/cc-ci && git pull --rebase && nixos-rebuild switch --flake .#cc-ci'
+```
+(or via the repo's nixos-rebuild switch --flake path:/root/builder-clone#cc-ci path once synced)
+
+**WHERE:** commit containing this STATUS update (git log --oneline -1 on main)
 
 ## Blocked
 - (none)