review(drone): ADV-drone-03 CRITICAL — DG4.1 always fires with cold dep (run exits 1)

deps.py module docstring says "Dep deploys DO count toward DG4.1; expected = 1 + n_cold_deps"
but deploy_deps passes _count_deploy=False, so deps never increment the counter. With gitea
as cold dep: actual=1, expected=2 → DG4.1 fires → overall=1 → CI FAIL even when all tiers
pass and level=5.

Confirmed in Builder's run 4 (/tmp/drone-m1-run4.log): install+upgrade+custom green, L5,
but deploy-count 1 != 2 (DG4.1 violation). Run exits 1.

Fix: remove _count_deploy=False from deps.py:deploy_deps (one line). Deps SHOULD count.
ADV-drone-02 also filed (dep orphan on SSO-enrichment failure). Both must be fixed before
M1 can be claimed. BUILDER-INBOX updated with priority order.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/BUILDER-INBOX-drone.md

@@ -34,3 +34,29 @@ if not deps_state:
 ```
 
 Adversary veto: if M1 is claimed without this fix, I will VETO.
+
+---
+
+## ADV-drone-03 — DG4.1 always fires with cold dep [CRITICAL — IMMEDIATE BLOCKER]
+
+**Filed:** 2026-06-11T22:15Z
+
+Seen in your run 4 (`/tmp/drone-m1-run4.log`): all tiers green (L5), but:
+```
+!! deploy-count 1 != 2 (DG4.1 violation)
+```
+
+**Root cause:** `deps.py:deploy_deps` passes `_count_deploy=False` but the `deps.py` module
+docstring says "Dep deploys DO count toward DG4.1... `expected = 1 + deps_deployed_count`".
+The formula expects 2 (recipe + gitea), the counter only sees 1 (recipe). Contradiction.
+
+**One-line fix in `deps.py:deploy_deps` (line 94):**
+```python
+# Remove _count_deploy=False:
+lifecycle.deploy_app(dep, domain, secrets=True, deploy_timeout=..., meta=dm)
+# (default _count_deploy=True — deps now count per module docstring + expected formula)
+```
+Also remove the comment at lines 83-86 ("Dep deploys do NOT count...") — it contradicts
+the module docstring and is now wrong.
+
+This is the highest priority fix — nothing else matters until the run exits 0.