claim(M2): dashboard redeployed (image 15addbc7bf45 -> 11ac2a1e6c07), live full per-recipe history verified

bluesky-pds 8 rows in exact host ts order (753 556 435 427 423 ab-* m2rr-* m2r-*),
plausible 30 (capped from 33), ghost 24; overview+badges 200; service 1/1.
Deploy via path: flake (git-flake drops secrets/ submodule). Retention: no trim
job on /var/lib/cc-ci-runs (439 dirs / 17 days) — adequate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

machine-docs/STATUS-dash.md

@@ -62,7 +62,51 @@ runs out of view, so most recipes showed 1 run). Overview (`/`), `/badge/<recipe
 - Status pill derived from the per-stage `results` map (`results.json` has no top-level status):
   any `fail`/`error` → failure; all `pass`/`skip` → success; else unknown.
 
-## Gate: M2 — NOT STARTED (deploy + live verify; begins after M1 PASS)
+## Gate: M2 CLAIMED, awaiting Adversary
+
+**WHAT** — the dashboard service is rebuilt + redeployed with the M1 fix; the LIVE per-recipe
+history page now shows the full (display-capped) local-artifact history. Verified on `bluesky-pds`
+(8 runs) + `plausible` (30, capped from 33) + `ghost` (24); overview + badges + host health intact.
+
+**WHERE** —
+- Deployed image: `cc-ci-dashboard:11ac2a1e6c07` (content hash of the M1 dashboard.py; rolled FROM
+  `15addbc7bf45`). Source built from commit `84ac65f`+ (origin/main; this push adds the M2 status).
+- Deploy: host flake clone `/etc/cc-ci` pulled, then `nixos-rebuild switch` from a `path:` flake of
+  the synced working tree (`path:/root/ccci-build#cc-ci`) — a plain git-flake build drops the
+  `secrets/` submodule (gitlink), the `path:` copy includes the on-disk `secrets/secrets.yaml`. The
+  `deploy-dashboard` reconcile rolled the swarm service on the new content-hash tag.
+- Live: `https://ci.commoninternet.net/recipe/<recipe>`.
+
+**HOW to verify (cold)** —
+1. Deployed image + service health:
+   ```
+   ssh cc-ci 'docker service ls --filter name=ccci-dashboard --format "{{.Replicas}} {{.Image}}"'
+   ```
+   EXPECTED: `1/1  cc-ci-dashboard:11ac2a1e6c07`.
+2. Live full history (count rows = run count on host):
+   ```
+   for r in bluesky-pds plausible ghost; do
+     echo -n "$r: "; curl -s https://ci.commoninternet.net/recipe/$r \
+       | grep -coE '<tr><td><a href'; done
+   ```
+   EXPECTED: `bluesky-pds 8`, `plausible 30` (capped from 33), `ghost 24` — matching the host run
+   counts (`history_for` cap = 30).
+3. Live order matches host timestamp order (mixed numeric+named id trap):
+   ```
+   curl -s https://ci.commoninternet.net/recipe/bluesky-pds | grep -oE '>#[^<]+</a>' \
+     | sed 's/[>#<]//g; s|/a||'
+   ```
+   EXPECTED exactly: `753 556 435 427 423 ab-bluesky-pds-oldmain m2rr-bluesky-pds m2r-bluesky-pds`.
+4. Other routes unaffected:
+   ```
+   curl -s -o /dev/null -w '%{http_code}\n' https://ci.commoninternet.net/            # 200 overview
+   curl -s -o /dev/null -w '%{http_code}\n' https://ci.commoninternet.net/badge/bluesky-pds.svg  # 200
+   ```
+   EXPECTED: both `200`; overview still latest-per-recipe (Drone-sourced, unchanged).
+
+**EXPECTED — retention** confirmed adequate: no nix module/tmpfiles/cron trims `/var/lib/cc-ci-runs`
+(`grep -rn cc-ci-runs nix/` shows no rm/find-delete/prune/maxage). Host: 439 run dirs spanning
+2026-05-31 → 2026-06-17 (17 days). No growth cap needed now (recorded in DECISIONS).
 
 ## Blocked
 (none)