claim(dstamp): M1 — root cause attributed by DIRECT evidence (swarm failure_action:rollback reverts chaos-version label, masked by start-first+wait_healthy; abra+harness git path exonerated); minimal repro + 06-05→06-10 load change + fix (stop-first overlay + assert_upgrade_converged, HC1 unweakened) + blast-radius (only discourse). fix1+fix2 validate green @7ae7b0f7+U. Verification recipe in STATUS-dstamp.

JOURNAL-dstamp.md

@@ -157,6 +157,26 @@ keycloak/n8n new tasks survive swarm's monitor, so no rollback. The general harn
 (`assert_upgrade_converged`) now protects ALL rollback-policy recipes from a silent future
 rollback (honest failure), and discourse additionally gets stop-first to converge reliably.
 
+### Hardening (commit e9c26c7) + fix2 validation
+Adversary independently confirmed the root cause + assessed the fix CORRECT (REVIEW-dstamp probe),
+flagging one non-blocking race: assert_upgrade_converged's first poll could read a STALE terminal
+`completed` (from the install/base deploy) before swarm schedules the new roll → return OK
+prematurely → miss a later rollback. Hardened with a two-phase wait: phase 1 confirms the NEW
+update is scheduled (`UpdateStatus.StartedAt` advances past the pre-redeploy value, captured via
+`update_status_started`, or state is in-flight `updating`/`rollback_started`), with a 30s grace for
+a genuine no-op redeploy; phase 2 then waits for the terminal verdict. fix2 (hardened, fresh
+checkout @e9c26c7, install+upgrade): UPGRADE **PASS** — `upgrade-converged: …UpdateStatus=completed`,
+`chaos-version=7ae7b0f7+U version=0.7.0+3.3.1→0.9.0+3.5.0`. Two consecutive green fixed runs
+(fix1+fix2) vs intermittent unpatched failures (repro1✗ repro4✗ repro2✓). Unit tests 253 pass.
+
+### M1 claimed
+Attribution + minimal repro + 06-05→06-10 change + fix + blast-radius all complete and
+Adversary-pre-confirmed → claiming M1 (verification recipe in STATUS-dstamp). Next: M2 — full
+all-stages discourse green at true level via the drone `!testme` path (the recipe-CI pipeline runs
+`cc-ci-run runner/run_recipe_ci.py` from the drone-cloned cc-ci workspace, so e9c26c7 is live for
+!testme — no nixos-rebuild needed for the harness), other recipes re-proven (none affected), HC1
+teeth shown (wrong stamp still FAILs), DEFERRED closed.
+
 Fix direction (HC1 must keep its teeth — do NOT relax the commit match): the upgrade chaos redeploy
 must assert against the *intended* applied spec, not a silently rolled-back one — i.e. the harness
 must DETECT a swarm rollback (UpdateStatus.State rollback*) and treat it as an upgrade FAILURE with