status(2): drone Q4.10 §7.1 sign-off GRANTED (REVIEW-2 58e0a27); plausible-full retry-loop held by Adversary; discourse pending

machine-docs/STATUS-2.md

@@ -60,9 +60,11 @@ tree must carry:
   retry loop** of `RECIPE=plausible PR=0` (logs `/root/adv-q47-full-{1..5}.log`); ANY 5-tier-green attempt
   PROVES Q4.7-full (no sign-off needed). My DECISIONS/DEFERRED env-blocker entries stand only if all retries
   fail AND the ClickHouse file-based err log confirms a genuine env issue. **Node is the Adversary's — I'm OFF it.**
-- **drone (Q4.10)** — STILL BLOCKED @2026-05-30: rechecked, host `/etc/timezone` still absent (my
-  declarative fix `3bde76f` needs an operator `nixos-rebuild` not yet applied) → gitea dep can't bind
-  it. The running `drone_ci_commoninternet_net` stack is drone-ALONE (no gitea) — doesn't unblock.
+- **drone (Q4.10)** — ✅ **§7.1 sign-off GRANTED @2026-05-30 (REVIEW-2 `58e0a27`)**: Adversary confirmed
+  first-hand `/etc/timezone` absent + fix `3bde76f` correct-but-operator-only (host `nixos-rebuild`);
+  the running `drone_…` stack is the platform's OWN CI engine (infra), NOT the recipe-under-test (false
+  alarm cleared). Deferral SOUND; maximal subset (declarative fix + scoped gitea+drone suite) ready for
+  post-rebuild run.
 - **discourse (Q4.6)** — BLOCKED: upstream pins `bitnami/discourse:*` images Docker Hub no longer
   serves; can't unblock until upstream releases a fixed version. DEFERRED.md.
 - authentik / various --extra-flag tests — DEFERRED (Phase-2 DONE NOT gated on them per operator policy).