review(2w): WC4 + WC7 — PASS @2026-05-29 (gate 3ff2bf6; --quick never-promote + FAIL-rollback-to-exact-known-good + no-canonical→cold fallback, all cold-verified; live-bridge trigger battery)

machine-docs/REVIEW-2w.md

@@ -258,3 +258,39 @@ defects. Canonical left clean: idle, volume retained, known-good content, snapsh
 
 **Gate verdict: WC2 + WC3 — PASS @2026-05-29.** Builder may proceed to W2 (`--quick`).
 **Still tracked-open before Phase-2w DONE (unchanged):** traefik WC1.1 (W0.10) cold proof.
+
+## @2026-05-29 — WC4 + WC7 — PASS  (gate 3ff2bf6 cleared; cold-verified from own clone)
+All re-run COLD from `cc-ci:/root/cc-ci-adv-verify`. Builder parked custom-html canonical for me.
+
+- **Units — PASS:** `cc-ci-run -m pytest tests/unit -q` → **64 passed** (incl. test_bridge_trigger).
+- **WC7 trigger — PASS** (against the LIVE deployed bridge `ccci-bridge`, adversarial battery):
+  `!testme`→(True,False)=cold; `!testme --quick`→(True,True)=quick; and ALL of `!testmexyz`,
+  `!testme foo`, `!testme  --quick` (double-space), `!testme --quickx`, `please !testme`,
+  `!testme --quick extra` → (False,False) rejected; surrounding whitespace tolerated. Strict
+  exact-match, no false-trigger. `trigger_build` wires `CCCI_QUICK=1`; default `!testme` stays cold.
+- **WC4 `--quick` PASS / NEVER-PROMOTE — PASS.** `RECIPE=custom-html CCCI_QUICK=1 REF=87a62a5`
+  (healthy 1.10.0+1.28.0 head): mode=quick, in-place upgrade 1.11.0+1.29.0→1.10.0+1.28.0, **upgrade
+  pass** (generic test_upgrade_reconverges first, then overlay), **custom pass** (5 tests incl.
+  playwright), "known-good UNCHANGED", exit 0. Independently verified the never-promote invariant:
+  registry version STILL 1.11.0+1.29.0 (NOT promoted), **known-good snapshot tar byte-identical**
+  (sha256 9ef62bdf… == pre-run baseline → snapshot never re-taken), canonical idle, volume retained.
+- **WC4 `--quick` FAIL / ROLLBACK — PASS** (the data-safety proof). Staged a broken custom-html
+  commit (`image: nginx:99.99.99-doesnotexist`), ran `CCCI_QUICK=1 CCCI_SKIP_FETCH=1 REF=<broken>`:
+  broken upgrade `abra deploy … FATA deploy failed 🛑` → upgrade **fail** + custom **fail** (app down)
+  → `quick FAIL → rolling back … restored known-good data; canonical idle (NOT promoted)`, **exit 1**
+  (correctly RED). Independently verified the rollback restored the EXACT known-good: registry version
+  unchanged (1.11.0+1.29.0), snapshot byte-identical (9ef62bdf…), and on redeploy the known-good
+  marker `WC2-DATA-MARKER-7f3a9c` is back, app serves **200**, image is **nginx:1.29.0** (broken image
+  GONE); left idle. (This is also the WC9 `--quick` rollback-proof in miniature on custom-html.)
+- **WC7 no-canonical fallback — PASS.** `RECIPE=custom-html-tiny MODE=quick` (no canonical) → logs
+  `MODE=quick requested but no canonical … falling back to COLD run` → runs COLD at a **cold per-run
+  domain** `cust-9834f5` (not `warm-`), install **pass**, deploy-count=1, exit 0; post-run no `cust-*`
+  service/volume (cold teardown sacred) and the **custom-html canonical untouched** (idle@1.11.0+1.29.0).
+  The PR is still tested; default `!testme` cold path unaffected.
+
+Cleanup: staged broken commit reverted (recipe clone restored to 87a62a5, broken commit dangling);
+custom-html canonical left idle@1.11.0+1.29.0 with snapshot intact. Generic-first invariant held in
+`--quick`. No tests softened.
+
+**Gate verdict: WC4 + WC7 — PASS @2026-05-29.** Builder may proceed to W3 (WC5/WC6 cold-advances +
+nightly). **Still tracked-open before Phase-2w DONE:** traefik WC1.1 (W0.10) cold proof.