status(prevb): M1 PASS recorded; starting M2 (full local discourse run → !testme)

machine-docs/BACKLOG-prevb.md

@@ -16,10 +16,11 @@ SSOT: `/srv/cc-ci/cc-ci-plan/plan-phase-prevb-previous-dynamic-base.md`.
       (Found+fixed: docker stack deploy no-prune left sidekiq orphaned → `prune_orphan_services`.)
 - [x] B6. CLAIM M1 (clean tree + STATUS WHAT/HOW/EXPECTED/WHERE/TEETH).
 
-### M2 — proven in real CI + spot-check
+### M2 — proven in real CI + spot-check  [M1 PASS @01:03Z dbc7a3b]
 - [ ] B7. discourse PR #4 `!testme` GREEN in real CI; head ran `discourse/discourse:3.5.3`, migration exercised.
-- [ ] B8. Spot-check ≥3 other upgrade-tier recipes (warm-canonical / published-predecessor / ex-`.ccci`
-      e.g. keycloak/cryptpad/ghost) still green under dynamic base. Reconcile levels/records.
+      (Plan: full local run first to de-risk backup/restore/custom under the new model, then `!testme`.)
+- [~] B8. Spot-check ≥3 upgrade-tier recipes under dynamic base. cryptpad #5 GREEN, keycloak #3 GREEN
+      (both local, main-tip). Need a 3rd (ghost = ex-`.ccci`). Reconcile levels/records.
 - [ ] B9. CLAIM M2 → `## DONE` after fresh Adversary PASS on M1+M2.
 
 ## Adversary findings

machine-docs/JOURNAL-prevb.md

@@ -90,3 +90,20 @@ orphan `warm-keycloak_...` stack on the host (no registry record) — NOT from p
 
 Stopping new e2e launches now — the Adversary is running its own discourse cold-acceptance on the shared
 7GB node; piling on risks a memory-pressure false-failure in its run. Parking at M1 gate.
+
+## 2026-06-17T01:05Z — M1 PASS; starting M2
+
+Adversary M1 PASS (dbc7a3b), all 8 DoD cold-verified incl. teeth: break-it probe with head image
+`discourse/discourse:99.99.99-adversary-broken` → `manifest unknown` at prepull → upgrade:fail (level 1/5),
+base still resolved to main-tip — proves base/prune/previous can't paper over a broken head. No VETO.
+
+Note for record: the Adversary attributed the lingering `warm-keycloak_...` stack to "Builder's concurrent
+spot-check". It's actually a PRE-EXISTING orphan (a warm-<recipe> domain, created only by the canonical/warm
+system, not by a normal cold PR run) — my keycloak spot-check used a per-run `keycloak-pr3-*` domain and tore
+down clean (verified "no leftover keycloak run-stacks"). Not a prevb leak; pre-existing cruft.
+
+M2 plan: B7 = discourse PR#4 !testme GREEN in real CI (Drone). Infra confirmed healthy: ccci-bridge_app 1/1
+(polls POLL_REPOS incl. discourse every 30s), drone_...app 1/1, Drone healthz 200; Drone builds cc-ci@main
+(= my prevb code). Before posting !testme publicly on PR#4, running the FULL pipeline locally first
+(STAGES=install,upgrade,backup,restore,custom) to de-risk backup/restore/custom under the new model (my
+local runs so far were install,upgrade only). If a non-prevb tier fails I fix/triage first, then !testme.

machine-docs/STATUS-prevb.md

@@ -7,7 +7,10 @@ State files: this + BACKLOG-prevb.md, REVIEW-prevb.md (Adversary), JOURNAL-prevb
 Started 2026-06-17. Gates: **M1** (implemented + green locally), **M2** (proven in real CI + spot-check).
 
 ## Now
-- **Gate: M1 CLAIMED, awaiting Adversary.** (claim commit below.)
+- **M1: PASS** @2026-06-17T01:03Z (REVIEW-prevb, dbc7a3b) — all 8 DoD items cold-verified incl. teeth
+  (broken head → upgrade RED), no VETO.
+- **In flight: M2** — B7 discourse PR#4 `!testme` GREEN in real CI (Drone) + spot-checks + reconcile.
+  (Local spot-checks already green under dynamic base: cryptpad #5, keycloak #3 — see JOURNAL.)
 
 ## Gate: M1 — CLAIMED @2026-06-17T00:40Z (HEAD e1b32ea)