review(shot): phase open — independent cold pre-audit ground truth (immich/n8n/cryptpad blank 4801-2B, keycloak/lasuite-docs loading-spinner, plausible null); awaiting M1 claim

REVIEW-shot.md

@@ -0,0 +1,52 @@
+# REVIEW-shot.md — Adversary verdicts, phase `shot` (recipe screenshot audit & repair)
+
+Owner: Adversary loop. Append-only verdict log. Gates: M1 (audit+diagnosis), M2 (all working).
+SSOT: `/srv/cc-ci/cc-ci-plan/plan-phase-shot-screenshots.md`.
+
+No gate CLAIMED yet (phase just opened; Builder has not bootstrapped STATUS-shot.md). Doing
+independent cold ground-truth prep below so M1/M2 cold-verify is fast and un-anchored.
+
+---
+
+## Independent cold pre-audit (Adversary, @2026-06-11T01:20Z)
+
+Method: ssh cc-ci, scanned `/var/lib/cc-ci-runs/*/results.json` for recipe + `screenshot` field +
+on-disk `screenshot.png` size; scp'd suspect PNGs locally and **looked at them** (Read tool).
+This is MY ground truth, formed before any Builder claim — to compare against the Builder's matrix.
+
+PNG sizes from latest representative runs (m2r-* sweep + numbered drone runs):
+
+| recipe | PNG bytes | my visual read | class |
+|---|---|---|---|
+| immich | 4801 | pure blank white frame | **BLANK** |
+| n8n | 4801 | blank near-white frame | **BLANK** |
+| lasuite-meet | 4801 | (size-identical to immich/n8n 4801B — blank tell) | BLANK (to confirm visually) |
+| cryptpad | 4802 | blank light-grey frame | **BLANK** |
+| keycloak | 8764 | spinner + "Loading the Administration Console" — paint-race loading state, NOT a real login form | **BLANK/LOADING** (not the "genuine sparse login" §2 guessed) |
+| lasuite-docs | 6022 | bare spinner on white | **BLANK/LOADING** |
+| lasuite-drive | ~5.9K | (size sibling of lasuite-docs — likely same spinner) | BLANK (to confirm) |
+| plausible | null / NO PNG | every run null (122→357 incl. 357); run dir has no screenshot.png; capture stdout not in run dir (goes to Drone build log) — root cause still to trace | **NULL** |
+| ghost | 444183 | (reference healthy, §2) | OK (visual-confirm at M2) |
+| mattermost-lts | 242139 | reference healthy | OK |
+| hedgedoc | 131967 | reference healthy | OK |
+| discourse | 66-67K | reference healthy | OK |
+| custom-html | 35707 | reference healthy | OK |
+| mailu | 33800 | reference healthy | OK |
+| matrix-synapse | 33296 | reference healthy | OK |
+| uptime-kuma | 30858 | reference healthy | OK |
+| custom-html-tiny | 12950 | reference healthy | OK |
+| mumble | 7913 | voice server — web-UI N/A candidate (confirm) | N/A? |
+
+Confirmed defect classes match the orchestrator pre-audit (§2): SPA paint-race (domcontentloaded
+fires before JS paints) → immich/n8n/cryptpad fully blank, keycloak/lasuite-docs/-drive caught at
+loading spinner; plausible never captures (null on every run). **The 4801B byte-identical size is a
+reliable blank-frame fingerprint.**
+
+Open items I must still resolve when verifying:
+- plausible NULL root cause — need the Drone build log for a plausible run (capture stdout: "capture
+  failed" vs "produced no file" vs step never reached). Run dir alone doesn't have it.
+- lasuite-meet / lasuite-drive / mumble — visual confirm.
+- Authoritative enrolled-recipe set: every `tests/<recipe>/recipe_meta.py` minus fixtures
+  (`_generic`, `regression`, `concurrency`, `custom-html-bkp-bad`, `custom-html-rst-bad`).
+
+No verdict yet. Awaiting `claim(shot): M1`.