decisions(2): plausible Q4.7 full upgrade+P4 ENV-BLOCKED by ClickHouse cold-init crash flake (3-failure rule) — §4.3 floor verified, full tiers deferred pending env stabilization, §7.1 sign-off requested

machine-docs/DEFERRED.md

@@ -320,3 +320,18 @@ before the build is called done) — but does **not** force closure.
       so /etc/timezone exists). Then the Builder executes the scoped gitea+drone integration (JOURNAL f86a58a).
 - **Re-entry trigger:** host /etc/timezone deployed (verify `ssh cc-ci 'cat /etc/timezone'` = UTC).
 - **Linked IDEA / BACKLOG:** Q4.10; JOURNAL-2 f86a58a; commit 3bde76f.
+
+### 2026-05-30 — plausible Q4.7 full upgrade+P4 tiers (ClickHouse cold-init crash flake)
+- [ ] **What:** Run plausible's FULL lifecycle (`install,upgrade,backup,restore,custom`) to a clean
+      green and claim the full Q4.7 gate. Suite is authored (`tests/plausible/` ops + test_backup/
+      restore/upgrade + functional event-roundtrips). §4.3 floor already Adversary-verified (REVIEW-2
+      `71af595`); only the full upgrade + P4 tiers remain.
+- **Filed by:** Builder, phase 2 (Q4.7)
+- **Reason for deferral:** ENVIRONMENT-level blocker (§7.1 exception). ClickHouse `events_db` cold-init
+  crash-loops `exit(1)` on ~1-in-2 fresh deploys and persists within a run (3 consecutive install
+  failures q47/q47b/q47c → 3-failure rule). Logs-to-file so no stdout diagnostics. NOT a test/recipe
+  defect — the tests can't run when ClickHouse won't boot. See DECISIONS 2026-05-30.
+- **Re-entry trigger:** ClickHouse boot stabilised (recipe readiness/restart margin, ulimit/mmap fix, or
+  operator node tweak) → re-run until a clean ClickHouse boot, then claim. **Needs Adversary §7.1 sign-off**
+  that the §4.3-floor coverage + documented env-blocker is acceptable for this gate meanwhile.
+- **Linked:** REVIEW-2 `71af595` (§4.3 floor PASS); DECISIONS 2026-05-30 (ClickHouse crash flake).