review(regall): BP-1 baseline verified (A-regall-1: mailu upgrade=pass not skip); BP-2 upgrade-base=main-tip confirmed; batch-1 all L5

machine-docs/BACKLOG-regall.md

@@ -39,4 +39,26 @@
 - [ ] B11: Claim M2 gate (regressions fixed + verified)
 
 ## Adversary findings
-(empty — Adversary writes here)
+
+### A-regall-1 [adversary] OPEN — mailu baseline table has incorrect upgrade rung
+
+**Filed:** 2026-06-17T02:10Z
+**Severity:** LOW (informational — does not block the sweep, but affects regression classification)
+
+**Discrepancy:** STATUS-regall.md baseline table shows mailu upgrade rung = "skip (no deployable base)".
+The actual baseline run 526 (Jun 12) shows `upgrade: "pass"` in both `results` and `rungs` sections.
+
+**Evidence (cold-verified from /var/lib/cc-ci-runs/526/results.json):**
+```
+"results": { ..., "upgrade": "pass", ... }
+"rungs": { ..., "upgrade": "pass", "backup_restore": "skip", ... }
+```
+The `skip` in run 526 applies to `backup_restore` (mailu is not backup-capable), NOT to upgrade.
+
+**Impact:** If post-prevb mailu runs show upgrade=skip or upgrade=fail, it would be incorrectly
+considered within-baseline (the table says "skip") rather than a regression from the true baseline
+(upgrade=pass).
+
+**Required correction:** STATUS-regall.md should read: `mailu | 5 | pass | 526` for the upgrade rung.
+
+**Adversary closes:** after Builder corrects the baseline table in STATUS-regall.md.

machine-docs/BUILDER-INBOX.md

@@ -0,0 +1,22 @@
+# BUILDER INBOX (from Adversary)
+
+**2026-06-17T02:10Z — Baseline table correction needed: mailu upgrade rung**
+
+Hi Builder — cold-verified all 20 baseline runs from the STATUS-regall.md table. One discrepancy:
+
+STATUS says: `mailu | 5 | skip (no deployable base) | 526`
+
+Actual run 526 shows:
+- `"upgrade": "pass"` in both results and rungs sections
+- `"backup_restore": "skip"` (mailu is not backup-capable)
+- The upgrade rung ran and PASSED — it's not skip
+
+Please update STATUS-regall.md to `mailu | 5 | pass | 526` so the baseline is accurate.
+This affects regression classification for mailu in post-prevb runs.
+
+Filed as A-regall-1 in BACKLOG-regall.md.
+
+Everything else checks out — batch 1 results cold-verified (all L5, upgrade base=main-tip confirmed).
+Adversary is live, watching batch 2.
+
+(Consume and delete this file when read.)

machine-docs/REVIEW-regall.md

@@ -54,12 +54,30 @@ complete. Key facts verified independently:
 
 ## Break-it probes log
 
-### Probe BP-regall-1: planned — baseline spot-verification
-Will independently pull run records for baseline runs (e.g. run 554 cryptpad, 556 bluesky-pds)
-and confirm the baseline levels in STATUS match the actual results.json data.
+### Probe BP-regall-1: COMPLETE @2026-06-17T02:05Z — baseline table mostly accurate, one discrepancy
 
-### Probe BP-regall-2: planned — upgrade-base resolution cold check
-When batch 1-2 results are in, cold-inspect one run's log to confirm:
-- base resolution uses main-tip ref (kind=ref) per prevb logic
-- `previous/` overlay NOT applied (no previous/ dir for these recipes)
-- actual upgrade base is a main-tip commit, not a stale static version
+Cold-verified all 20 baseline runs referenced in STATUS-regall.md:
+- All runs 556, 554, 541, 510, 692, 657, 695, 608, 522, 553, 523, 524, 525, 526, 656, 529, 558, 528, 658, 531 confirmed level=5 ✓
+- bluesky-pds (556): upgrade=skip (EXPECTED_NA) ✓ — matches table
+- mailu (526): upgrade=PASS in actual results.json — table says "skip (no deployable base)" — **DISCREPANCY** (see A-regall-1)
+- All other recipes: all rungs match the table ✓
+
+**FINDING A-regall-1 filed** — mailu baseline upgrade rung is "pass" not "skip (no deployable base)".
+
+### Probe BP-regall-2: COMPLETE @2026-06-17T02:10Z — upgrade-base resolution confirmed correct
+
+Cold-read Drone logs for gitea run 727 (batch 1):
+- `upgrade base: kind=ref ref=e6a1cc79e99e (target-branch (main) tip)` — main-tip used as expected ✓
+- No `previous/` overlay applied (gitea has no previous/ dir) ✓
+- deploy message: `base = main-tip/ref e6a1cc79e99e → chaos deploy of the checked-out ref (the PR's true predecessor; not a published pin)` ✓
+- Upgrade sequence: L5, all tiers pass. `test_upgrade_preserves_marker_repo` PASS, `test_lfs_roundtrip` PASS ✓
+- This confirms the prevb dynamic-base resolution is working correctly in the regall sweep.
+
+### Batch 1 cold-verified @2026-06-17T02:10Z — all L5, no regressions
+
+From Drone build API + cc-ci run results.json:
+- **matrix-synapse** (run 725, Drone 725, PR#4): level=5, all rungs pass (upgrade=pass) ✓
+- **drone** (run 726, Drone 726, PR#1): level=5, upgrade=pass, backup_restore=skip (expected) ✓
+- **gitea** (run 727, Drone 727, PR#1): level=5, all rungs pass (upgrade=pass) ✓
+
+No regressions vs baseline in batch 1. Dynamic base resolution confirmed working (kind=ref, main-tip).