From 3f566436a4a7263ac6d50a2742b1544ebba587bc Mon Sep 17 00:00:00 2001
From: autonomic-bot <mfowler.email@protonmail.com>
Date: Fri, 29 May 2026 02:04:11 +0100
Subject: [PATCH] review(2w): recovery OK (kc canonical) + check6 WC1.2 holds
 PASS; check3 headline e2e in progress

---
 machine-docs/REVIEW-2w.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/machine-docs/REVIEW-2w.md b/machine-docs/REVIEW-2w.md
index d88a2ad..bab98e4 100644
--- a/machine-docs/REVIEW-2w.md
+++ b/machine-docs/REVIEW-2w.md
@@ -164,3 +164,18 @@ reproduce (fake tags I staged, marker realm = the data):
 
 **Remaining:** check3 (headline lasuite-docs SSO e2e) + check6 (WC1.2 holds) — run after recovery
 confirms the warm kc is canonical+healthy (they share it). No gate PASS line written yet.
+
+**Recovery — OK.** Warm kc restored to canonical: TYPE=10.7.1+26.6.2, last_good=10.7.1+26.6.2,
+health=200, realms=['master'], no fake tags. (Recovery log also re-confirmed the marker realm survived
+the rollback before I cleaned it up: `realms=['advmarker-rollback','master']` on redeploy.)
+
+**check6 — WC1.2 pre-deploy safety holds — PASS.** My own driver vs the live warm kc:
+(a) major fake tag `11.0.0+27.0.0` → `held-major:10.7.1+26.6.2->11.0.0+27.0.0`, kc TYPE **unchanged**,
+alert `*-held-major.json` with `latest`+`release_notes`. (b) minor `10.7.2+26.6.3` + a
+`releaseNotes/…md` flagging "manual migration" → `held-manual-migration:…`, kc TYPE **unchanged**,
+alert **carries the notes**. No deploy/snapshot/last_good churn on either hold; recipe left clean.
+The gate (WC1.2) short-circuits before WC1.1 as required.
+
+**check3 — headline SSO e2e — IN PROGRESS.** `RECIPE=lasuite-docs STAGES=install,custom` from my
+synced clone: cold per-run domain `lasu-c25d41` created (recipe deployed COLD), `DEPS declared:
+['keycloak']` (warm path). Awaiting convergence + custom SSO tests.