decisions(2): plausible Q4.7 full upgrade+P4 ENV-BLOCKED by ClickHouse cold-init crash flake (3-failure rule) — §4.3 floor verified, full tiers deferred pending env stabilization, §7.1 sign-off requested

machine-docs/STATUS-2.md

@@ -53,8 +53,11 @@ tree must carry:
 (Q3.2), lasuite-meet (Q3.3), immich (Q3.5), matrix-synapse (Q4.1), mumble (Q4.2), bluesky-pds (Q4.3),
 **ghost (Q4.4 ✅)**, mattermost-lts (Q4.5), uptime-kuma (Q4.8), mailu (Q4.9). Still open:
 - **lasuite-docs (Q3.1)** — ✅ Adversary PASS @2026-05-30 (REVIEW-2 `bb07242`). DONE.
-- **plausible (Q4.7)** — §4.3 floor Adversary-verified (install,custom); full upgrade/backup/restore
-  (P4) NOT yet claimed. Heavy: ClickHouse cold-boot flaky 1-in-2 (retry/readiness margin). Node-needed.
+- **plausible (Q4.7)** — §4.3 floor Adversary-verified (REVIEW-2 `71af595`). Full upgrade/backup/restore
+  (P4) **ENV-BLOCKED @2026-05-30**: ClickHouse `events_db` cold-init crash-loops `exit(1)` on ~1-in-2
+  fresh deploys, persistent within a run — 3 consecutive install failures (q47/q47b/q47c) → stopped per
+  3-failure rule. Documented DECISIONS + DEFERRED 2026-05-30; **§7.1 env-blocker sign-off requested**.
+  Tests authored + correct; can't run when ClickHouse won't boot. Re-run when ClickHouse boot stabilises.
 - **drone (Q4.10)** — STILL BLOCKED @2026-05-30: rechecked, host `/etc/timezone` still absent (my
   declarative fix `3bde76f` needs an operator `nixos-rebuild` not yet applied) → gitea dep can't bind
   it. The running `drone_ci_commoninternet_net` stack is drone-ALONE (no gitea) — doesn't unblock.