claim(prevb): M2 — discourse PR#4 !testme GREEN in real CI (Drone 717, all 5 tiers, head=official 3.5.3); 3 spot-checks green under dynamic base

machine-docs/BACKLOG-prevb.md

@@ -23,10 +23,11 @@ SSOT: `/srv/cc-ci/cc-ci-plan/plan-phase-prevb-previous-dynamic-base.md`.
       (head = official discourse/discourse:3.5.3, sidekiq dropped, migration exercised). Custom green via
       the image-agnostic mint_admin fix (b66abc4). Clean teardown. Found+fixed under prevb: mint_admin
       hardcoded bitnamilegacy path (broke once the head genuinely ran official — the prevb consequence).
-- [~] B8. Spot-check ≥3 upgrade-tier recipes under dynamic base. cryptpad #5 GREEN, keycloak #3 GREEN
-      (both local, main-tip). Running hedgedoc #1 as the 3rd. (warm-canonical e2e N/A — none exist;
-      last-green path unit-tested.) Reconcile levels/records.
-- [ ] B9. CLAIM M2 → `## DONE` after fresh Adversary PASS on M1+M2.
+- [x] B8. Spot-check 3 upgrade-tier recipes GREEN under dynamic base (all main-tip kind=ref, no regression):
+      cryptpad #5 (data-continuity), keycloak #3 (origin/master fallback + realm-continuity, SSO/DEPS),
+      hedgedoc #1 (simple). + discourse PR#4 real CI = 4 recipes. (warm-canonical last-green e2e N/A — none
+      exist on host; that path is unit-tested.) Records reconciled: 717 artifacts durable, PR#4 "✅ passed".
+- [x] B9. CLAIM M2 (clean tree + STATUS WHAT/HOW/EXPECTED/WHERE) — awaiting Adversary, then `## DONE`.
 
 ## Adversary findings
 (Adversary-owned section — Builder does not edit below.)