review(rcust): M2 PASS — merged-main regression sweep cold-verified. Canaries 7/7 (re-ran myself incl. false-green detector); all 21 recipes reconciled (every baseline deviation proven rcust-neutral via same-ref old-vs-new A/B or stale-schema w/ coverage preserved, all in DEFERRED); drone-path 356/357 custom success; customizations execute (manifest 21/21, mumble tcp, ghost overlay+chaos, immich seeds); zero leaks; both fix-forwards cleared. M1+M2 both PASS → DoD handshake satisfied, Builder may write ## DONE. No VETO.

REVIEW-rcust.md

@@ -477,3 +477,65 @@ baseline for all 21; (b) bluesky-pds is L0 on BOTH old & new main (upstream imag
 ANY current run → needs a DECISIONS/DEFERRED note as non-rcust upstream breakage, not a silent
 mismatch; (c) the 2 drone-path !testme runs (immich#2/plausible#3); (d) zero-leak teardown sweep;
 (e) my own independent re-check of ≥5 recipes' logs + ALL mismatches before any M2 PASS.
+
+---
+
+## M2 — merged-main real-CI regression sweep: **PASS** @2026-06-11T01:15Z
+
+Cold-verified the M2 claim (STATUS gate "M2 CLAIMED ~01:30Z") from my own clone + direct on cc-ci,
+re-running/ re-parsing rather than trusting Builder logs. Every M2.0–M2.4 item holds.
+
+**M2.2 canaries — cold RE-RAN myself** from a fresh `origin/main` checkout (/root/adv-be2026a @
+origin/main): `cc-ci-run -m pytest tests/regression/ -m canary -v` → **7/7 passed (301s)**, incl.
+`bad-false-green` (the false-green detector) + all four RED canaries (bad-install/upgrade/backup/
+restore) caught at their designed tier. The level system is NOT inflating. (log /root/adv-canary.log)
+
+**M2.3 per-recipe — all 21 reconciled (cold jq on each run dir):**
+- 13 clean: cryptpad/custom-html/ghost/hedgedoc/keycloak/matrix-synapse/n8n/uptime-kuma = L4;
+  mailu/custom-html-tiny = L2 (backup_restore N/A); mumble = L4 (deploy-count=1) — all == baseline,
+  clean_teardown=true.
+- 2 designed-bad canaries genuinely exercised: bkp-bad rungs backup_restore=**fail** (backup=fail);
+  rst-bad backup_restore=**fail** (backup=pass→restore=fail). The L1 cap is upgrade-N/A ladder
+  semantics; the designed failure is recorded in the rung (verified — NOT a coincidental
+  level-match).
+- immich/mattermost-lts/plausible: **L4 @ exact baseline refs** (m2b-*) — baseline REPRODUCED on the
+  restructured harness (cold-verified earlier this session).
+- discourse: m2p-discourse (NEW main) == ab-discourse-7ae7b0f-oldmain (OLD main) — SAME ref/PR=2,
+  SAME stage, SAME upgrade-HC1 message (`eb96de94+U`), SAME L1. **old==new ⇒ rcust-neutral**; the
+  L4(184)→L1 is pre-existing env drift since 06-05 (DEFERRED.md), NOT caused by the restructure.
+- lasuite-docs/-meet/-drive: L4 all-rungs-pass + requires_deps OIDC test PASSED (skip-count 0)
+  [lasuite-drive m2p2 also MinIO PASSED, post-both-fixes, rc=0]. Their "L5" baselines are STALE:
+  the 6→4-rung ladder landed in mainline c51cd84 (PR#6), which `git merge-base --is-ancestor
+  c51cd84 01e6d49^` confirms PREDATES the rcust merge; level.py untouched by the merge, derive_rungs
+  byte-identical old↔new. **rcust-innocent; integration coverage preserved** (OIDC tests execute &
+  pass). Accepted equivalence old L5 ≡ new L4-all-pass + OIDC-pass.
+- bluesky-pds: EXCLUDED — `Cannot find module /app/index.js` crash-loop on BOTH old & new main at
+  every ref → upstream image breakage, rcust-neutral. DEFERRED.md note present.
+
+**M2.3 drone→harness path:** drone builds **356 (immich) + 357 (plausible)** = `build_event=custom`
+(bridge-triggered; distinct from push builds 358-361), trigger=autonomic-bot, both **success**
+(verified in drone sqlite DB); run dirs 356/357 = immich L4 pr=2 / plausible L4 pr=3, customization
+manifest present, clean_teardown=true.
+
+**M2.4 customizations actually executed (cold-grep):** manifest block **21/21** logs; mumble
+`ready-probe OK (tcp 3x) 127.0.0.1:64738`; ghost `ccci-overlay: provided compose.ccci.yml ...
+base deploy auto-chaos` (P2a first-class path live); cryptpad `EXTRA_ENV='<hook>'`; immich
+`ops.py[pre_backup,pre_restore,pre_upgrade]` + `pre-op seed` lines (migrated ctx hooks run).
+
+**Teardown:** `docker stack ls` = infra (backups/bridge/dashboard/reports/drone/traefik) +
+warm-keycloak ONLY, **zero leaked app stacks** (checked after ALL runs incl. drone-path).
+
+**Fix-forwards (both Adversary-approved, additive):** 1357544 (lasuite-drive best-effort poll, appr
+57c66ad) + be2026a/6cabbe7 (services_converged completed-one-shot, appr a531746) — merged diff ==
+branch diff, all 3 be2026a conditions cleared (24a203a). Cold unit suite on post-fix main = 199
+passed, lint PASS.
+
+**VERDICT: M2 PASS.** No regression CAUSED BY the restructure: every deviation from the baseline
+matrix is proven rcust-neutral by same-ref old-vs-new A/B (discourse, bluesky) or is a pre-rcust
+stale-schema artifact with coverage preserved (3 lasuite), all documented in DEFERRED.md — not a
+silent mismatch. The false-green detector is green on my own cold canary run. No findings filed,
+no VETO.
+
+**M1 PASS (01f9f70) + M2 PASS (this entry) both stand** → the phase DoD handshake is satisfied; the
+Builder may write `## DONE` to STATUS-rcust.md. (M1's unit+lint acceptance still holds on post-fix
+main: 199 passed / lint PASS, the fix-forwards being additive + separately approved.)