status(lvl5): P3 sweep complete — 19/19 enrolled recipes lint PASS (warn-only misses), no mirror PRs needed; before/after baseline table assembled

BACKLOG-lvl5.md

@@ -11,8 +11,78 @@
 - [x] B7 (P2) docs: results-ux.md, testing.md, recipe-customization.md §EXPECTED_NA wording — L5 ladder, de-cap semantics.
 - [x] B8 (P1) DECISIONS.md: semantics change record (replaces Phase-3 "N/A caps"); N/A classification table (every derive_rungs N/A source → intentional|unintentional); mirror-filter decision for lint (if any filtering).
 - [x] B9 — gate M1: claim (branch w/ P1+P2; clean tree; cold-verifiable).
-- [ ] B10 (P3) lint sweep over ALL enrolled recipes (scratch clones — never touch ~/.abra/recipes during builds); matrix here (pass/fail + rule hits); mechanical fixes → mirror PRs (never push main/never merge); rest → DEFERRED.md.
+- [x] B10 (P3) lint sweep over ALL enrolled recipes (scratch clones — never touch ~/.abra/recipes during builds); matrix here (pass/fail + rule hits); mechanical fixes → mirror PRs (never push main/never merge); rest → DEFERRED.md.
 - [ ] B11 (P4) real-CI proofs: ≥1 genuine L5; ≥1 lint-blocked L4 (synth branch ok); ≥1 N/A-skip climb; 2× drone !testme; canary suite at re-derived designed levels; 1 synthesized unver-blocks run; before/after level table for ALL enrolled recipes; card/dashboard PNG/SVG visually verified.
 - [ ] B12 — gate M2: claim; then ## DONE after fresh PASS.
 
 ## Adversary findings
+
+## P3 lint sweep matrix (B10) — all 19 enrolled, mirror main HEAD, 2026-06-11
+
+Method: per recipe, fresh scratch clone of its canonical origin (mirror for the 17
+recipe-maintainers recipes; coopcloud upstream for bluesky-pds/custom-html-tiny/mumble) +
+upstream version tags fetched (production fetch_recipe shape), then `harness.lint.run_lint`
+from phase-lvl5 @ 3d8d286 in a scratch ABRA_DIR (`/tmp/lvl5-sweep` on cc-ci; full outputs in
+`/tmp/lvl5-sweep/art/<recipe>/lint.txt`). Canonical `~/.abra/recipes` never touched.
+
+**Result: 19/19 PASS** (no error-severity rule unsatisfied anywhere). No recipe-mirror PRs and
+no DEFERRED entries needed. Warn-severity misses (informational, do not fail the rung):
+
+| recipe | lint | warn-rule misses |
+|---|---|---|
+| bluesky-pds | pass | R002 R007 R015 |
+| cryptpad | pass | R002 R005 R007 |
+| custom-html | pass | R002 R004 R005 |
+| custom-html-tiny | pass | R002 |
+| discourse | pass | R002 R007 R015 |
+| ghost | pass | R015 |
+| hedgedoc | pass | R015 |
+| immich | pass | R002 R005 |
+| keycloak | pass | R002 R015 |
+| lasuite-docs | pass | R005 |
+| lasuite-drive | pass | R002 R005 |
+| lasuite-meet | pass | R002 |
+| mailu | pass | R002 |
+| matrix-synapse | pass | R002 R015 |
+| mattermost-lts | pass | R002 R015 |
+| mumble | pass | R002 |
+| n8n | pass | R002 R015 |
+| plausible | pass | R002 R005 R007 |
+| uptime-kuma | pass | R015 |
+
+Note: lasuite-meet's historically-lightweight tag `0.3.0+v1.16.0` is now ANNOTATED upstream
+(verified `git cat-file -t` = tag on all three version tags) — R014 passes genuinely; the
+abra.py:105 lightweight-tag deploy fallback simply no longer triggers for it.
+
+## Before/after level table skeleton (§2.9 — "after" to be filled by P4 real runs)
+
+Baseline = latest results.json on cc-ci per recipe re-scored under the CURRENT (pre-lvl5,
+4-rung) rule; ancient 6-rung artifacts (builds ≤205, integration/recipe_local era) re-read on
+their four essential rungs. Predicted = same tier outcomes + sweep lint result under the new
+rule (assumption flagged; P4 produces the real values).
+
+| recipe | baseline rungs (latest artifact) | baseline level | predicted new level | why it shifts |
+|---|---|---|---|---|
+| bluesky-pds | no artifact (deploy-gated upstream, shot-phase N/A) | — | — | still deploy-gated |
+| cryptpad | I✔ U✔ B✔ F✔ (#181) | 4 | 5 | + lint pass |
+| custom-html | I✔ U✔ B✔ F✔ (#182) | 4 | 5 | + lint pass |
+| custom-html-tiny | I✔ U✔ B-na F-na (#205, predates functional/) | 2 | 5 | de-cap: backup skip declared; functional/ tests exist now; + lint |
+| discourse | I✔ U✔ B✔ F✔ (#184) | 4 | 5 | + lint pass |
+| ghost | I✔ U✔ B✔ F✔ (#185) | 4 | 5 | + lint pass |
+| hedgedoc | I✔ U✔ B✔ F✔ (#113) | 4 | 5 | + lint pass |
+| immich | I✔ U✔ B✔ F✔ (#370) | 4 | 5 | + lint pass |
+| keycloak | I✔ U✔ B✔ F✔ (#187) | 4 | 5 | + lint pass |
+| lasuite-docs | I✔ U✔ B✔ F✔ (#188) | 4 | 5 | + lint pass |
+| lasuite-drive | I✔ U✔ B✔ F✔ (#189) | 4 | 5 | + lint pass |
+| lasuite-meet | I✔ U✔ B✔ F✔ (#204) | 4 | 5 | + lint pass |
+| mailu | I✔ U✔ B-na F✔ (#191) | 2 | 5 | de-cap: not backup-capable → skip climbs (the §2.9 N/A-skip demo) |
+| matrix-synapse | I✔ U✔ B✔ F✔ (#203) | 4 | 5 | + lint pass |
+| mattermost-lts | I✔ U✔ B✔ F✔ (#196) | 4 | 5 | + lint pass |
+| mumble | no results.json artifact retained | — | — | P4 run to establish |
+| n8n | I✔ U✔ B✔ F✔ (#197) | 4 | 5 | + lint pass |
+| plausible | I✔ U✔ B✔ F✔ (#371) | 4 | 5 | + lint pass |
+| uptime-kuma | I✔ U✔ B✔ F✔ (#165) | 4 | 5 | + lint pass |
+
+Canaries (designed levels under the NEW formula, re-derived): custom-html-bkp-bad /
+custom-html-rst-bad — backup-capable with a failing backup/restore tier → backup_restore rung
+FAIL → level 2 (fail still blocks; run verdict red as today). To be proven in P4.