diff --git a/REVIEW-dstamp.md b/REVIEW-dstamp.md
index 9e6665a..09c20b6 100644
--- a/REVIEW-dstamp.md
+++ b/REVIEW-dstamp.md
@@ -213,3 +213,72 @@ pressure, the mechanism was always latent. This doesn't weaken M1 — the fix el
 **Verdict: M1 PASS.** Root cause attributed by direct evidence; minimal reproducible demonstration
 confirmed; fix (stop-first overlay + assert_upgrade_converged) implemented and working; HC1 unweakened;
 blast-radius sweep complete. Builder cleared to proceed to M2.
+
+---
+
+## M2: PASS @2026-06-11T17:58Z
+
+Cold verification from `/srv/cc-ci/cc-ci-adv`. JOURNAL-dstamp not read before verdict (anti-anchoring).
+
+**Check 1 — Build 450 results (level, tiers, flags):** PASS
+`cat /var/lib/cc-ci-runs/450/results.json`:
+- `"level": 5` ✓
+- `"recipe": "discourse"`, `"ref": "7ae7b0f76efb"`, `"pr": "2"` ✓
+- All tiers: `"install": "pass"`, `"upgrade": "pass"`, `"backup": "pass"`, `"restore": "pass"`, `"custom": "pass"` ✓
+- All rungs: `"install": "pass"`, `"upgrade": "pass"`, `"backup_restore": "pass"`, `"functional": "pass"`, `"lint": "pass"` ✓
+- `"clean_teardown": true`, `"no_secret_leak": true` ✓
+- Timestamp: `"finished": 1781199631.4...` (2026-06-11 ~17:40 UTC) ✓
+- `screenshot.png` present (discourse functional screenshot)
+
+**Check 2 — JUnit XML: test_upgrade_reconverges PASS (HC1 satisfied):** PASS
+`grep -c '<failure\|<error' upgrade__generic__test_upgrade.xml` → 0
+Full XML: `<testcase classname="tests._generic.test_upgrade" name="test_upgrade_reconverges" time="0.260"/>`
+(no `<failure>` child). `test_upgrade_reconverges` directly calls `generic.assert_upgraded(live_app, meta)`.
+`assert_upgraded` at `generic.py:174-175` does the HC1 commit-match: `chaos_commit == head_ref`.
+Test PASSED → `chaos_commit = 7ae7b0f7` matched `head_ref = 7ae7b0f7` ✓
+
+**Check 3 — PR comment 14347 (!testme path):** PASS
+Comment 14346 body = `!testme` (the trigger).
+Comment 14347 body (bot response):
+`<!-- cc-ci:testme -->\n🌻 **cc-ci** — \`discourse\` @ \`7ae7b0f7\` ✅ **passed**\n[...links to run 450 summary.png + badge + drone build 450...]`
+Confirmed via Gitea API. Run directory `/var/lib/cc-ci-runs/450/` exists with full contents.
+!testme → bridge ack → drone build 450 → run 450 results → PR comment ✅ passed. Path verified.
+
+**Check 4 — DEFERRED entry closed:** PASS
+`machine-docs/DEFERRED.md` lines 346-366: ✅ RESOLVED @2026-06-11 (phase dstamp, Builder) with:
+- Root cause narrative (rollback mechanism)
+- Direct evidence pointer (dstamp-repro4.console.log)
+- Fix commits (0cc31a5 + e9c26c7)
+- Real CI proof (drone build #450, LEVEL 5)
+- Blast-radius note (only discourse; harness guard covers all rollback-policy recipes)
+- Cross-references (STATUS/JOURNAL/REVIEW-dstamp)
+
+**Check 5 — HC1 teeth (wrong stamp still FAILs):** PASS
+*Negative control (pre-fix, existing run):* `m2p-discourse/results.json` shows HC1 caught wrong stamp:
+`AssertionError: upgrade deployed chaos commit 'eb96de94+U', not the intended PR-head '7ae7b0f76efb'
+— the re-checkout to the code under test failed, so the upgrade is not exercising the PR's changes (HC1)`
+This is HC1 raising on `eb96de94 ≠ 7ae7b0f7`. HC1 commit-match assertion WORKS.
+
+*Code unchanged (from M1):* `generic.py:174-175` commit-match assertion unmodified. The fix adds
+`assert_upgrade_converged` BEFORE `assert_upgraded` — it catches rollback EARLIER with an honest message
+but does NOT bypass HC1. If a non-rollback wrong stamp were deployed (e.g. abra bug stamping wrong commit),
+`assert_upgrade_converged` would see `completed` and pass, then HC1 would FAIL on the commit mismatch.
+
+*Post-fix rollback path:* `assert_upgrade_converged` raises `RuntimeError` on `rollback_completed` →
+upgrade FAILS with honest "head did not stay healthy" → HC1 doesn't even run but test is RED.
+Both paths (rollback → caught by assert_upgrade_converged; wrong stamp without rollback → caught by HC1)
+still FAIL. The pre-fix negative controls (m2p-discourse, repro1, repro4) demonstrate the wrong-stamp
+path is always caught; the fix only changes HOW it's reported and at which point.
+
+**Blast-radius (confirmed at M1, still valid):** Only discourse affected. keycloak/n8n PASS L4
+in 06-10/06-11 era. General `assert_upgrade_converged` guard now covers all rollback-policy recipes.
+
+**Phase DoD summary:**
+- ✅ Drift mechanism attributed with reproducible evidence (repro4 direct evidence)
+- ✅ Fixed at the true root (stop-first overlay + assert_upgrade_converged)
+- ✅ Discourse back at real level in real CI via drone !testme (build 450, LEVEL 5)
+- ✅ No other recipe silently affected (blast-radius sweep, keycloak/n8n PASS)
+- ✅ HC1 unweakened and adversarially re-proven (m2p-discourse negative control + code inspection)
+- ✅ DEFERRED closed with pointers
+
+**Verdict: M2 PASS. All phase dstamp DoD items satisfied. Builder cleared for ## DONE.**