diff --git a/machine-docs/BACKLOG-cfold.md b/machine-docs/BACKLOG-cfold.md
new file mode 100644
index 0000000..07c1b27
--- /dev/null
+++ b/machine-docs/BACKLOG-cfold.md
@@ -0,0 +1,128 @@
+# BACKLOG — phase cfold
+
+## Build backlog
+(Builder-only section — read-only to Adversary)
+
+## Adversary findings
+
+No findings yet. Pre-migration baseline recorded below for reference during M1 verification.
+
+### Baseline inventory (pre-migration, 2026-06-11T22:54Z)
+
+**64 custom test files** across 20 recipes, all in `functional/` or `playwright/` subdirs:
+
+| Recipe | functional/ | playwright/ | Helper modules |
+|---|---|---|---|
+| bluesky-pds | 4 | 0 | — |
+| cryptpad | 2 | 2 | — |
+| custom-html | 3 | 1 | — |
+| custom-html-tiny | 1 | 0 | — |
+| discourse | 3 | 0 | _discourse.py |
+| drone | 1 | 0 | __init__.py |
+| ghost | 4 | 0 | _ghost.py |
+| hedgedoc | 2 | 0 | — |
+| immich | 3 | 0 | — |
+| keycloak | 3 | 0 | — |
+| lasuite-docs | 5 | 0 | — |
+| lasuite-drive | 3 | 0 | — |
+| lasuite-meet | 3 | 0 | — |
+| mailu | 3 | 0 | _mailu.py |
+| matrix-synapse | 3 | 0 | — |
+| mattermost-lts | 3 | 0 | _mm.py |
+| mumble | 5 | 0 | _mumble_proto.py |
+| n8n | 4 | 0 | — |
+| plausible | 2 | 0 | — |
+| uptime-kuma | 3 | 1 | — |
+| **TOTAL** | **59** | **5** | **6 helper modules** |
+
+Full file list (64 test files):
+```
+tests/bluesky-pds/functional/test_account_and_post.py
+tests/bluesky-pds/functional/test_describe_server.py
+tests/bluesky-pds/functional/test_health_check.py
+tests/bluesky-pds/functional/test_session_auth.py
+tests/cryptpad/functional/test_health_check.py
+tests/cryptpad/functional/test_spa_assets.py
+tests/cryptpad/playwright/test_pad_content_roundtrip.py
+tests/cryptpad/playwright/test_pad_create.py
+tests/custom-html/functional/test_content_roundtrip.py
+tests/custom-html/functional/test_content_type_header.py
+tests/custom-html/functional/test_health_check.py
+tests/custom-html/playwright/test_browser_smoke.py
+tests/custom-html-tiny/functional/test_serves_content.py
+tests/discourse/functional/test_create_topic.py
+tests/discourse/functional/test_health_check.py
+tests/discourse/functional/test_site_basic.py
+tests/drone/functional/test_scm_configured.py
+tests/ghost/functional/test_admin_redirect.py
+tests/ghost/functional/test_content_api.py
+tests/ghost/functional/test_health_check.py
+tests/ghost/functional/test_post_roundtrip.py
+tests/hedgedoc/functional/test_branding.py
+tests/hedgedoc/functional/test_health_check.py
+tests/immich/functional/test_asset_processing.py
+tests/immich/functional/test_asset_upload.py
+tests/immich/functional/test_health_check.py
+tests/keycloak/functional/test_create_client_and_use.py
+tests/keycloak/functional/test_health_check.py
+tests/keycloak/functional/test_password_grant_token.py
+tests/lasuite-docs/functional/test_auth_required.py
+tests/lasuite-docs/functional/test_create_doc.py
+tests/lasuite-docs/functional/test_health_check.py
+tests/lasuite-docs/functional/test_oidc_login.py
+tests/lasuite-docs/functional/test_oidc_with_keycloak.py
+tests/lasuite-drive/functional/test_health_check.py
+tests/lasuite-drive/functional/test_minio_storage.py
+tests/lasuite-drive/functional/test_oidc_with_keycloak.py
+tests/lasuite-meet/functional/test_health_check.py
+tests/lasuite-meet/functional/test_meeting_flow.py
+tests/lasuite-meet/functional/test_oidc_with_keycloak.py
+tests/mailu/functional/test_health_check.py
+tests/mailu/functional/test_mailbox.py
+tests/mailu/functional/test_mail_flow.py
+tests/matrix-synapse/functional/test_federation_version.py
+tests/matrix-synapse/functional/test_health_check.py
+tests/matrix-synapse/functional/test_register_and_message.py
+tests/mattermost-lts/functional/test_create_message.py
+tests/mattermost-lts/functional/test_health_check.py
+tests/mattermost-lts/functional/test_multiuser_message.py
+tests/mumble/functional/test_protocol_handshake.py
+tests/mumble/functional/test_server_config_limits.py
+tests/mumble/functional/test_tcp_health.py
+tests/mumble/functional/test_web_client.py
+tests/mumble/functional/test_welcome_text_roundtrip.py
+tests/n8n/functional/test_health_check.py
+tests/n8n/functional/test_login_state.py
+tests/n8n/functional/test_rest_settings.py
+tests/n8n/functional/test_workflow_roundtrip.py
+tests/plausible/functional/test_health_check.py
+tests/plausible/functional/test_event_tracking.py
+tests/uptime-kuma/functional/test_health_check.py
+tests/uptime-kuma/functional/test_socketio_handshake.py
+tests/uptime-kuma/functional/test_spa_branding.py
+tests/uptime-kuma/playwright/test_monitor_wizard.py
+```
+
+Helper modules also in functional/ dirs (must move to custom/ alongside tests):
+- tests/discourse/functional/_discourse.py
+- tests/drone/functional/__init__.py
+- tests/ghost/functional/_ghost.py
+- tests/mailu/functional/_mailu.py
+- tests/mattermost-lts/functional/_mm.py
+- tests/mumble/functional/_mumble_proto.py
+
+**String literal audit** — all places that name the FOLDER (not the playwright package):
+- runner/harness/discovery.py:113 — `subdirs = ("functional", "playwright")`
+- runner/harness/manifest.py:55 — comment `# functional | playwright`
+- docs/recipe-customization.md — multiple §5.3 references
+- docs/enroll-recipe.md — multiple references
+- docs/testing.md:117,120 — placement rule
+- tests/unit/test_discovery_phase2.py — creates functional/ and playwright/ dirs
+- tests/unit/test_manifest.py — creates functional/ and playwright/ dirs; asserts `{"functional": 2, "playwright": 1}`
+- tests/unit/test_discovery.py:83,84 — creates functional/ dirs
+
+NOT to touch (playwright package references, not folder):
+- runner/harness/browser.py (playwright package import)
+- runner/harness/screenshot.py (playwright package import)
+- runner/harness/card.py:232 (playwright package import)
+- level.py, results.py (rung name "functional" — NOT a folder name)
diff --git a/machine-docs/REVIEW-cfold.md b/machine-docs/REVIEW-cfold.md
new file mode 100644
index 0000000..01ed3da
--- /dev/null
+++ b/machine-docs/REVIEW-cfold.md
@@ -0,0 +1,21 @@
+# REVIEW — Adversary — phase cfold
+
+Adversary-only. Append-only. All verdicts here are cold-verified from a fresh shell + own clone.
+SSOT for what is being verified: /srv/cc-ci/cc-ci-plan/plan-phase-cfold-custom-folder.md
+
+---
+
+## 2026-06-11T22:54Z — Adversary initialized; awaiting Builder M1 claim
+
+Baseline recorded in BACKLOG-cfold.md (pre-migration inventory).
+No claims pending. Will verify M1 and M2 on Builder claim.
+
+Key break-it probes planned:
+1. Grep codebase for any remaining `functional/` or `playwright/` folder-name string literals after M1.
+2. Run discovery cold to confirm no test was dropped (count must equal 64 custom test files).
+3. Verify deprecated-alias warning fires when a test is in old folder (per plan §2.1 recommendation).
+4. Confirm `from playwright.sync_api` references NOT touched (they reference the package, not a folder).
+5. Verify unit tests are updated (test_discovery_phase2.py, test_manifest.py) and still pass.
+6. Confirm manifest.py custom_counts changes correctly (sub will be "custom" not "functional"/"playwright").
+7. Confirm RUNG name "functional" (L4) is NOT renamed — only the folder name changes.
+8. M2: real Drone !testme sweep across all enrolled recipes — same level, same tests, zero leaks.