status(5): record A5-3 fix and consume inbox

machine-docs/BACKLOG-5.md

@@ -13,6 +13,7 @@ Single-writer: `## Build backlog` = Builder-only; `## Adversary findings` = Adve
 - [x] V3: /recipe-upgrade custom-html-tiny end-to-end GREEN (!testme PASS; PR #2 open)
 - [x] V7: mirror reconciliation (PR #1 superseded, PR #4 merged-upstream, main force-synced)
 - [x] V1/V2: !testme trigger + testme-on-pr.sh reads verdict (GREEN on PR #2/#35; RED on PR #5/#34)
+- [x] Fix A5-3: make `POST=1 testme-on-pr.sh` ignore stale prior status on same PR head
 - [x] V4: 3-iteration regression loop (seed bad tag → RED → fix → GREEN in 2 runs)
 - [ ] V5: stale-test DEFAULT = comment, no test edit
 - [ ] V6: --with-tests opens + verifies cc-ci test PR (verify-pr.sh run)

machine-docs/BUILDER-INBOX.md

@@ -1,15 +0,0 @@
-## 2026-06-01T03:22:00Z — A5-3 heads-up
-
-Fresh adversary probe on `custom-html-tiny` PR `#5` found a V2 rerun bug and I recorded it formally in
-`REVIEW-5.md` / `BACKLOG-5.md` as **A5-3**.
-
-Summary:
-- `POST=1 MAX_WAIT=40 INTERVAL=5 /srv/cc-ci/.claude/skills/recipe-upgrade/testme-on-pr.sh custom-html-tiny 5`
-  posted exactly one new `!testme` comment.
-- The helper then returned the stale old GREEN/build URL for build `#37` immediately.
-- About 40s later, the live PR/statuses showed the newly-triggered run was actually build `#41`
-  (`pending -> success`, PR comment updated to `/41`).
-
-Interpretation: on a rerun against the same PR head SHA, the helper can read a pre-existing terminal
-`cc-ci/testme` status before the bridge posts the new pending status, so `POST=1` does not reliably
-report the run it just triggered.

machine-docs/JOURNAL-5.md

@@ -101,3 +101,31 @@ Adversary follow-up:
 - `BUILDER-INBOX.md` noted that `POST=0` must be env-prefixed in `STATUS-5.md`; corrected here and the inbox is being consumed now.
 
 Next: V5 default stale-test case, then V6 `--with-tests`.
+
+## 2026-06-01 — Adversary finding A5-3 fixed; helper paths corrected
+
+Adversary review+inbox reported a real V2 rerun bug: on a re-`!testme` against the same PR head,
+`POST=1 testme-on-pr.sh` could read the previous terminal `cc-ci/testme` status before the bridge
+posted the new pending state, and return the old build URL.
+
+Fix authored in the orchestration repo helper:
+- `testme-on-pr.sh` now captures the current `cc-ci/testme` status tuple before posting a fresh
+  `!testme`, then ignores that unchanged tuple while polling. It returns only once the status changes
+  to the new run's state/URL.
+- `ci-test-review/{verify-pr.sh,run-all-recipes.sh}` also now resolve the live host checkout
+  dynamically (`/root/builder-clone`, fallback `/root/cc-ci`) because the current cc-ci box no longer
+  has `/root/cc-ci`.
+
+Verification:
+- `bash -n /srv/cc-ci-orch/.claude/skills/recipe-upgrade/testme-on-pr.sh && bash -n /srv/cc-ci-orch/.claude/skills/ci-test-review/verify-pr.sh && bash -n /srv/cc-ci-orch/.claude/skills/ci-test-review/run-all-recipes.sh`
+  → exit 0
+- `cmp -s /srv/cc-ci-orch/.claude/skills/recipe-upgrade/testme-on-pr.sh /srv/cc-ci/.claude/skills/recipe-upgrade/testme-on-pr.sh && echo same`
+  → `same`
+- `BEFORE=$(...) ; POST=1 MAX_WAIT=80 INTERVAL=5 /srv/cc-ci/.claude/skills/recipe-upgrade/testme-on-pr.sh custom-html-tiny 5 ; RC=$? ; AFTER=$(...) ; printf 'RC=%s\nBEFORE=%s\nAFTER=%s\n' "$RC" "$BEFORE" "$AFTER"`
+  → `VERDICT=GREEN`
+  → `BUILD=https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/43`
+  → `RC=0`
+  → `BEFORE=4`
+  → `AFTER=5`
+
+Next: consume `BUILDER-INBOX.md` in git, then continue with V5 stale-test candidate selection.

machine-docs/STATUS-5.md

@@ -23,6 +23,14 @@ has jq, not python3).
 **testme-on-pr.sh FIX (orchestrator repo):** `6910b19` — reads cc-ci/testme context URL
 instead of first-status URL (fixes wrong BUILD URL when multiple statuses exist).
 
+**A5-3 FIX (orchestrator repo, uncommitted):** `testme-on-pr.sh` now ignores a pre-existing
+`cc-ci/testme` status on the same PR head after `POST=1` until the status tuple changes, so a
+fresh re-`!testme` no longer returns a stale prior GREEN/build URL.
+
+**ci-test-review helper FIX (orchestrator repo, uncommitted):** `verify-pr.sh` and
+`run-all-recipes.sh` now resolve the live host checkout dynamically (`/root/builder-clone`
+preferred, `/root/cc-ci` fallback) instead of hard-coding `/root/cc-ci`.
+
 ## V3 — COMPLETE: /recipe-upgrade custom-html-tiny END-TO-END GREEN
 
 **Upgrade PR:** `https://git.autonomic.zone/recipe-maintainers/custom-html-tiny/pulls/2`
@@ -43,6 +51,8 @@ instead of first-status URL (fixes wrong BUILD URL when multiple statuses exist)
 - V1: !testme on PR #2 triggered build #29 within 30s (bridge poll) ✓; result posted to PR ✓
 - V2 GREEN: POST=1 posted one !testme; POST=0 polled and returned VERDICT=GREEN BUILD=<drone-url> ✓
 - V2 RED: poll-only on PR #5 returned VERDICT=RED BUILD=https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/34 ✓
+- V2 rerun edge: `POST=1 MAX_WAIT=80 INTERVAL=5 /srv/cc-ci/.claude/skills/recipe-upgrade/testme-on-pr.sh custom-html-tiny 5`
+  now returns the fresh rerun build `#43` (not the stale prior `#37`); PR comments `4 -> 5` ✓
 
 ## V4 — COMPLETE: 2-run regression loop (within the 3-run budget)
 
@@ -59,7 +69,7 @@ instead of first-status URL (fixes wrong BUILD URL when multiple statuses exist)
 | Item | Status | Evidence |
 |---|---|---|
 | V1 — !testme trigger + result-back | PARTIAL | build #29 triggered in <30s; commit status + PR comment posted ✓ |
-| V2 — testme-on-pr.sh reads verdict | DONE | GREEN ✓ (build #29/#35); RED ✓ (build #34) |
+| V2 — testme-on-pr.sh reads verdict | DONE | GREEN ✓ (build #29/#35); RED ✓ (build #34); rerun fix ✓ (build #43) |
 | V3 — /recipe-upgrade sandbox GREEN | DONE | custom-html-tiny PR#2; build #29 SUCCESS |
 | V4 — 3-iter regression loop | DONE | custom-html-tiny PR#5; build #34 RED, build #37 GREEN |
 | V5 — stale-test DEFAULT = comment | TODO | |