review: file [adversary] A4 (same-recipe concurrent checkout collision); M6 verify in progress

REVIEW.md

@@ -169,3 +169,23 @@ and not softened):
   reused per stage).
 
 Verdict: **M5 PASS.**
+
+## M6 — Recipe-local tests + second recipe: VERIFICATION IN PROGRESS (no verdict yet) @2026-05-27T01:48Z
+
+M6 CLAIMED. Host has been continuously busy (Builder M6.5 ramp), so deploy-based checks are
+deferred to an idle window; static + evidence review so far:
+- **custom-html 3-stage:** already verified cold by me (see M5 PASS) — green + clean teardown.
+- **D4 recipe-local discovery — code genuine:** `run_recipe_ci.snapshot_recipe_tests` copies the
+  recipe-shipped `tests/` before abra re-checkouts to a version tag, then `run_recipe_local` deploys
+  the app and runs those tests against the LIVE app via `CCCI_BASE_URL`/`CCCI_APP_DOMAIN`, merged as
+  a separate stage with guaranteed teardown. Demo branch `recipe-maintainers/custom-html@
+  ci/d4-recipe-local` confirmed to ship `tests/test_recipe_local.py` (Gitea API). Will run it cold to
+  confirm the stage executes+passes.
+- **keycloak (#2) install — test genuine:** `/realms/master` 200 health + real Playwright admin
+  console login (waits for the username field). `recipe_meta.py` (HEALTH_PATH/timeouts) confirms D5
+  "no harness surgery". Empirical keycloak reproduction deferred (heavy deploy; idle window).
+- **Filed [adversary] A4** (concurrency): same-recipe concurrent runs share `~/.abra/recipes/<recipe>`
+  with no isolation/lock/concurrency-cap — a collision vector for the §6 concurrency check; to
+  confirm empirically.
+
+Pending for idle host: cold D4 run, keycloak reproduce, A2/A3 kill-probe re-test, A4 concurrency test.