status(2): ghost F2-14b PASS; discourse restore-hook root-caused + fixed (pg_hba block), re-running

machine-docs/STATUS-2.md

@@ -89,15 +89,22 @@ tree must carry:
 - authentik / various --extra-flag tests — DEFERRED (Phase-2 DONE NOT gated on them per operator policy).
 DoD P2/P5/P6/P7/P8 broadly satisfied; remaining is P1 coverage of the above + Q5 docs/sample re-verify.
 
-## In flight (@2026-05-30T19:3x — VETO-clearing cycle)
+## In flight (@2026-05-30T23:4x — VETO-clearing cycle)
 Standing VETO on DONE (REVIEW-2 @16:22:07Z) requires: ghost + discourse + mumble all run
 **upgrade-to-latest** green with justified `compose.ccci.yml` overlays. Current cycle:
-- **ghost F2-14b — CLAIMED, awaiting Adversary.** Full lifecycle GREEN incl upgrade-to-latest, with
-  reliable P4 backup-integrity via the new `BACKUP_VERIFY` harness hook. See `## Gate F2-14b` below.
-- **discourse Q4.6** — overlay committed `845b86c` (`tests/discourse/{compose.ccci.yml,install_steps.sh}`
-  + recipe_meta `UPGRADE_BASE_VERSION=0.7.0+3.3.1`, `CHAOS_BASE_DEPLOY`, `COMPOSE_FILE`). Run shape is
-  now full `install,upgrade,backup,restore,custom` (upgrade-tier deferral WITHDRAWN per Adversary
-  bdef282). Queued to run after ghost (single-node budget — heavy recipes sequenced). PR head `7a2e0e0`.
+- **ghost F2-14b — ✅ Adversary PASS @2026-05-30T22:42Z (REVIEW-2, COLD, `/root/adv-ghost-f214b.log`).**
+  Closes the GHOST portion of the DONE VETO checklist. DONE.
+- **discourse Q4.6 — restore-hook fix, RE-RUNNING.** full1 (`/root/ccci-discourse-full1.log`):
+  install/upgrade/backup PASS; **restore FAIL** (`test_restore_returns_state`: ci_marker gone) +
+  **custom FAIL** (both gate on `/site.json` 200, which never converged). ROOT CAUSE (single):
+  the pg_backup.sh restore hook only did a one-shot `pg_terminate_backend` — the discourse app +
+  sidekiq reconnect over TCP within ms and interfered with the drop/recreate/reimport, breaking the
+  DB → ci_marker lost AND `/site.json` 500 in the post-restore custom tier. FIX (recipe-PR
+  `recipe-maintainers/discourse#1`, new head `3758522`): block all non-local connections via
+  `pg_hba.conf` (`local all all trust` + reload) before drop, restore on exit — mirrors the PROVEN
+  matrix-synapse restore hook (identical backupbot wiring, restore PASSED there). Harness now echoes
+  abra restore output (backupbot post-hook) into the run log (cc-ci `4a29ca6`) so restore is no longer
+  opaque. Run shape full `install,upgrade,backup,restore,custom`. PR head `3758522` (was `7a2e0e0`).
 - mumble F2-14c + plausible Q4.7b still open.
 
 ## Gate F2-14b — CLAIMED @2026-05-30T22:10Z (ghost upgrade-to-latest + reliable P4 backup-integrity)