review(bsky): M2 PASS @5b0e42a — fresh independent !testme re-trigger (comment 14344) → build 435 level 5 at PR head f7b6c8df, real functional tests (account/post/auth), clean teardown, no leak, screenshot real==427; DEFERRED both entries closed w/ pointers; operator summary crisp; 0.5.x has NO release tag (re-pin fully justified); no canonical to reseed; PR open/unmerged. Both M1+M2 fresh PASS, no VETO — Builder cleared for ## DONE.

REVIEW-bsky.md

@@ -168,3 +168,64 @@ swarm secret/stack residue for the run).
 fresh cold pass: independent re-trigger/confirm green at PR head, PNG re-Read, level/baseline
 reconciliation, DEFERRED entries closed with pointers, and the operator summary checked —
 plus I will then consult JOURNAL/DECISIONS to contextualise (noting it there).
+
+---
+
+## M2 — PASS @2026-06-11T15:48Z  (operator handoff complete)
+
+Fresh Adversary cold pass. Verdict formed from the plan (§3 M2 SSOT), the code/deliverables,
+the STATUS-bsky verification info, and my OWN independent re-trigger — BEFORE reading
+JOURNAL.md (anti-anchoring respected; I may consult it after, noting so).
+
+### 1. Green at PR head — independently RE-TRIGGERED ✔ (the decisive proof)
+I posted `!testme` on PR #2 myself (comment **14344**, 15:46:21Z). Bridge:
+`[poll] triggered build 435 for bluesky-pds@f7b6c8df (PR #2, comment 14344) by
+autonomic-bot`. Fresh **build 435** results.json: **level=5**, ref=f7b6c8dfb81c (PR head),
+pr=2; rungs install/backup_restore/functional/lint=**pass**, upgrade=**skip**
+(skips.intentional.upgrade=declared reason, skips.unintentional=[]); clean_teardown +
+no_secret_leak=true. Recipe checkout = PR head `f7b6c8d`, image `:0.4.219`. Identical rung
+profile to run 427 → reproducibly green, not a one-off.
+- **Real stages, not a no-op:** junit shows install/backup(generic+cc-ci)/restore
+  (generic+cc-ci) and FOUR live functional tests — `test_health_check`,
+  `test_describe_server`, `test_session_auth`, `test_account_and_post`. A no-op could not
+  pass account-creation/post/session-auth against a live PDS. (Wall-clock ~70s is plausible:
+  lightweight 2-service recipe, image cached on host.)
+
+### 2. PNG independently Read ✔
+Fresh build 435 screenshot.png sha256 == run 427's (bdb71d3e…) == the image I Read at M1:
+genuine PDS landing page (Bluesky ASCII butterfly, "AT Protocol Personal Data Server",
+/xrpc/ pointer, upstream links), **no credentials**. Deterministic, real.
+
+### 3. Level under new semantics + baseline reconciled ✔
+level=5 under the de-capped ladder (upgrade=skip climbs; only fail/unver block). Old Phase-2
+baseline ("full lifecycle green", e45e0ee, pre-results era) is genuinely unreproducible —
+the moving-tag republish broke ALL published recipe versions; the PR restores deployability.
+Reconciliation recorded in the DEFERRED closure + the M2 claim. Independently corroborated:
+**0.5.x has NO release tag** (upstream git: 0 `0.5.x` tags, highest v0.4.219 + anomalous
+v0.4.5001; ghcr `0.5.0/0.5.1/v0.5.1` all absent) — so an exact-version pin REQUIRES 0.4.x.
+This fully resolves the §2.2 "prefer upgrade" scrutiny: re-pinning to 0.4.219 (newest exact)
+is not "old over new" — there is no exact 0.5.x tag to upgrade to; 0.5.x lives only on the
+moving tag the recipe must never pin. Justified.
+
+### 4. DEFERRED entries closed with pointers ✔
+machine-docs/DEFERRED.md: ✅ RESOLVED @2026-06-11 (phase bsky). Explicitly closes BOTH the
+re-pin follow-up AND the rcust M2 baseline-exclusion note, with pointers to PR #2 / run 427 /
+negative control 423 / upstream registry / DECISIONS. Original entry preserved (append-only).
+
+### 5. Operator summary ✔
+STATUS-bsky "Operator summary": crisp + complete — what was wrong (moving tag → index.ts vs
+recipe's index.js; broke both published versions), what the PR changes (2-line re-pin
+0.4.219 + label bump; why not 0.5.1 = no release tag + entrypoint migration), and a 5-step
+post-merge runbook (merge → publish version → drop EXPECTED_NA + set
+UPGRADE_BASE_VERSION="0.3.0+v0.4.219" → no canonical to reseed → never re-pin :0.4).
+Corroborated: ci-warm has NO bluesky entry (only custom-html/keycloak/traefik) → "nothing to
+reseed" is true.
+
+### 6. PR left OPEN ✔
+PR #2 head f7b6c8df, state=open, merged=**false** (re-confirmed at re-trigger). The phase is
+done WITH the PR open — merging is the operator's, post-merge reseeding documented not done.
+
+**M2 PASS. No VETO.** Both M1 (@369f4f4) and M2 are fresh Adversary PASSes; no gate
+weakening, no secret leak, screenshot real, PR unmerged. The Builder is cleared to write
+`## DONE` to STATUS-bsky.md. (Post-verdict I will consult JOURNAL/DECISIONS only to
+contextualise — it does not change this verdict.)