decisions(canon): record 4 recipe RED exceptions (discourse upstream-compose / mattermost+mumble test-red / bluesky warm-routing) — genuine, tests unmodified, left intact

machine-docs/DECISIONS.md

@@ -1503,3 +1503,28 @@ warm/infra reconciler, WC1.1, run before the per-recipe loop), so it has full co
 data-warm canonical. Verified live: a sweep keycloak-promote attempt FAILed cleanly (recipe compose
 mismatch) and left the running live keycloak healthy (200 on /realms/master) — no disruption — but the
 collision is structural, so keycloak is de-enrolled rather than relying on the promote failing safely.
+
+## Phase canon (2026-06-17) — recipe RED exceptions (canonical not promoted; left intact)
+
+These enrolled recipes did NOT get a canonical in the authoritative sweep. Each is a genuine
+recipe/upstream issue, NOT a canon-machinery defect — recorded per §2.B/guardrail ("a red test is
+information; never weaken a test to make a recipe promote"). The sweep correctly left each intact.
+
+- **discourse — UPSTREAM compose defect at the latest release `0.8.1+3.5.0`.** The base recipe
+  compose.yml (`git show 0.8.1+3.5.0:compose.yml`) declares `sidekiq.depends_on: [discourse]` but the
+  main service is named `app` (not `discourse`) → `abra app deploy` FATAs "service sidekiq depends on
+  undefined service discourse: invalid compose project". This is upstream coop-cloud/discourse's bug,
+  not cc-ci's overlay (tests/discourse/compose.ccci.yml does not add that dependency). Cold deploy
+  cannot converge → red → canonical unchanged. (Re-enroll-able once upstream fixes the 0.8.1 compose.)
+- **mattermost-lts — recipe test red at latest.** `tests/mattermost-lts/test_restore.py::
+  test_restore_returns_state` FAILED on the latest release's cold run. The test is UNMODIFIED this
+  phase (last touched in phase "2": 012a477/80ad0a9) — a real restore-state failure, not weakened.
+- **mumble — recipe test red at latest.** `tests/mumble/custom/test_protocol_handshake.py::
+  test_handshake_completes_with_channel_presence` FAILED on the latest release's cold run. Test
+  UNMODIFIED this phase (last touched in phase "cfold": 44e0242) — a real voice-handshake failure.
+- **bluesky-pds — warm-domain routing (recipe-specific).** Cold test GREEN, but the warm-canonical
+  promote deploy never becomes healthy over HTTPS (`/xrpc/_health` → 000) even though the PDS
+  container is healthy internally (200 on localhost:3000) — traefik does not route the caddy-fronted
+  warm domain. This is bluesky-specific (the cold-test domain routes fine; the other 15 promoted
+  recipes all answer 200 over HTTPS on their warm domains), NOT the promote machinery. canonical not
+  written (correct — never promote an unhealthy state).