claim(mirror): Ph1+Ph2+Ph3 complete — mirrors created, hedgedoc tests, 9 recipes enrolled

Phase 1: Create 3 missing Gitea mirrors (lasuite-drive, mailu, mumble) via API + force-sync
  upstream main (f4135d78, 23309a1a, 9fa5e949). All 3 return 200/empty=false from Gitea API.

Phase 2: Author tests/hedgedoc/ (uptime-kuma template) — recipe_meta.py, functional/
  test_health_check.py (GET / → 200/302), functional/test_branding.py (brand markers),
  PARITY.md. Generic tiers cover install/upgrade/backup baseline.

Phase 3: Enroll 9 unenrolled recipes in nix/modules/bridge.nix POLL_REPOS:
  bluesky-pds, discourse, ghost, immich, lasuite-drive, mailu, mattermost-lts, mumble, plausible.
  Final POLL_REPOS: 20 entries (cc-ci + 19 recipes).

Gate Ph4 CLAIMED: operator must run `nixos-rebuild switch --flake .#cc-ci` on cc-ci after
Adversary-verifies Ph1+Ph2+Ph3. See STATUS-mirror.md for exact repro.

machine-docs/STATUS-mirror.md

@@ -14,13 +14,46 @@
 - tests/: all 9 unenrolled recipes have tests/<recipe>/ already (Adversary-confirmed)
 - hedgedoc: NO tests/hedgedoc/ (plan Phase 2 must author)
 
-### Phase 1 — Create 3 missing mirrors — IN PROGRESS
+### Phase 1 — Create 3 missing mirrors ✓ COMPLETE
+- lasuite-drive: created (HTTP 201), main synced to f4135d78 (upstream) ✓
+- mailu: created (HTTP 201), main synced to 23309a1a (upstream) ✓
+- mumble: created (HTTP 201), main synced to 9fa5e949 (upstream) ✓
+- Verified: all 3 return HTTP 200 from Gitea API, empty=false ✓
+- Method: Gitea API POST /orgs/recipe-maintainers/repos + git push --force gitea main on cc-ci
 
-### Phase 2 — hedgedoc test suite — PENDING
+### Phase 2 — hedgedoc test suite ✓ COMPLETE
+- tests/hedgedoc/recipe_meta.py (HEALTH_PATH=/, HEALTH_OK=(200,302), DEPLOY_TIMEOUT=600) ✓
+- tests/hedgedoc/functional/test_health_check.py (GET / → 200 or 302) ✓
+- tests/hedgedoc/functional/test_branding.py (hedgedoc/codimd/hackmd brand markers in HTML) ✓
+- tests/hedgedoc/PARITY.md (documents scope + deferred items) ✓
+- NOTE: test_install.py/test_upgrade.py/ops.py deferred (generic tiers cover baseline)
 
-### Phase 3 — Enroll 9 unenrolled recipes — PENDING
+### Phase 3 — Enroll 9 unenrolled recipes ✓ COMPLETE
+- nix/modules/bridge.nix POLL_REPOS updated: added bluesky-pds,discourse,ghost,immich,
+  lasuite-drive,mailu,mattermost-lts,mumble,plausible (9 new entries → 20 total)
+- Final POLL_REPOS: cc-ci + 19 recipes (all enrolled recipes + all 9 previously unenrolled)
 
-### Phase 4 — Deploy — OPERATOR GATE (not started)
+### Phase 4 — Deploy — OPERATOR GATE CLAIMED (awaiting Adversary + operator)
+
+**Gate: Ph4 CLAIMED — awaiting Adversary verification of Ph1+Ph2+Ph3, then operator deploy**
+
+**WHAT:** Phases 1-3 complete. Bridge config updated with 20 POLL_REPOS. Mirrors for
+lasuite-drive, mailu, mumble created + synced. hedgedoc tests authored. Adversary must verify
+Ph1 mirrors + Ph3 POLL_REPOS change before operator deploys.
+
+**HOW to verify (Adversary):**
+- Ph1 mirrors: `curl -s -u <bot> https://git.autonomic.zone/api/v1/repos/recipe-maintainers/<r>` for lasuite-drive, mailu, mumble → HTTP 200 + empty=false + default_branch=main
+- Ph2 tests: `ls tests/hedgedoc/` → recipe_meta.py, PARITY.md, functional/ present; `ls tests/hedgedoc/functional/` → test_health_check.py, test_branding.py present
+- Ph3 POLL_REPOS: `grep POLL_REPOS nix/modules/bridge.nix` → contains all 20 repos (cc-ci + 19 recipes including the 9 new ones)
+- Repro: `git clone https://git.autonomic.zone/recipe-maintainers/cc-ci && grep POLL_REPOS nix/modules/bridge.nix`
+
+**EXPECTED:** Adversary verifies all 3 checks PASS. Then operator runs:
+```
+ssh cc-ci 'cd /root/cc-ci && git pull --rebase && nixos-rebuild switch --flake .#cc-ci'
+```
+(or via the repo's nixos-rebuild switch --flake path:/root/builder-clone#cc-ci path once synced)
+
+**WHERE:** commit containing this STATUS update (git log --oneline -1 on main)
 
 ## Blocked
 - (none)