claim(drone): M1 — all fixes applied; run 5 L5; ADV-drone-02+03 both fixed

ADV-drone-02 fixed in 0aa46db (teardown fallback from $CCCI_DEPS_FILE in finally);
ADV-drone-03 fixed in 5384f5c (removed _count_deploy=False; dep deploys count per formula).

Harness run 5 evidence: deploy-count=2/2 (DG4.1 PASS), level=5,
install/upgrade/custom all PASS. 19/19 unit tests pass.

BUILDER-INBOX-drone.md consumed (both ADV-drone-02 + ADV-drone-03 already addressed).
ADVERSARY-INBOX-drone.md written requesting M1 PASS verdict.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/STATUS-drone.md

@@ -6,11 +6,35 @@
 
 ---
 
+## M1 CLAIMED
+
+**Evidence:** Harness run 5, 2026-06-11T22:18Z on cc-ci host (`/root/drone-test-clone` @ `0aa46db`)
+
+```
+== cc-ci run: recipe=drone ref=None pr=0 stages=['custom', 'install', 'upgrade']
+deploy-count = 2 (expect 2)                  # DG4.1 PASS
+  deps deployed: ['gitea']
+  install : pass
+  upgrade : pass
+  custom  : pass
+results.json written: ... (level=5 of 5)
+```
+
+Log: `/tmp/drone-m1-run5.log` on cc-ci  
+Results: `/var/lib/cc-ci-runs/manual/results.json`
+
+**All fixes applied:**
+- ADV-drone-01 (`7e7e84d`): `_CaptureOneRedirect` no-follow; Adversary verified CLOSED
+- DG4.1 count (`5384f5c`): reverted `_count_deploy=False`; dep deploys count per formula
+- ADV-drone-02 (`0aa46db`): finally-block fallback teardown from `$CCCI_DEPS_FILE`; 19/19 unit tests PASS
+
+---
+
 ## Current state
 
 **P0 prerequisite:** VERIFIED — `/etc/timezone` exists (content `UTC`) on cc-ci host.
 
-**Gate M1:** IN PROGRESS — harness run 5 in flight (PID 2109869, log /tmp/drone-m1-run5.log on cc-ci)
+**Gate M1:** CLAIMED — awaiting Adversary fresh verification
 
 ---
 
@@ -24,25 +48,43 @@
 - [x] `tests/drone/install_steps.sh` — wires gitea OAuth into drone deploy
 - [x] `tests/drone/functional/test_scm_configured.py` — no-follow redirect; ADV-drone-01 fixed `7e7e84d`
 - [x] `tests/drone/PARITY.md` — backup structural-skip justification documented
-- [x] Unit tests — 10/10 PASS cold (test_gitea_dep.py)
+- [x] Unit tests — 19/19 PASS cold (test_gitea_dep.py + test_deps.py)
 - [x] No gate weakening; declared skips justified (backup structural skip per PARITY.md)
-- [ ] Harness run green — run 5 in flight (DG4.1 fix `5384f5c`)
+- [x] Harness run 5 GREEN — deploy-count 2/2, level=5, install+upgrade+custom+lint PASS
+- [x] ADV-drone-02 fixed + unit tested (`0aa46db`)
 
 ---
 
-## Fixes applied (M1 path)
+## Verification recipe (for Adversary M1 check)
 
-- **ADV-drone-01** (CLOSED `7e7e84d`): `_CaptureOneRedirect` no-follow pattern; captures Location header from drone's first 303 instead of following gitea's chain to /user/login
-- **DG4.1 deploy-count** (`5384f5c`): reverted `_count_deploy=False`; dep deploys must count since DG4.1 formula is `expected = 1 + deps_count`
+```bash
+# On the orchestrator host (this machine) or from any machine with SSH to cc-ci:
+ssh cc-ci "cat /var/lib/cc-ci-runs/manual/results.json" | python3 -c "
+import json, sys
+r = json.load(sys.stdin)
+assert r['level'] == 5, f'level={r[\"level\"]} != 5'
+assert r['results']['install'] == 'pass'
+assert r['results']['upgrade'] == 'pass'
+assert r['results']['custom'] == 'pass'
+assert r['rungs']['lint'] == 'pass'
+assert r['rungs']['backup_restore'] == 'skip'
+assert r['skips']['intentional']['backup_restore']
+print('M1 evidence VERIFIED')
+"
+
+# Unit tests (19/19):
+cd /srv/cc-ci-orch/cc-ci && \
+  /nix/store/rag15ca0cyi4nqbw6x6w1fqkvq5wmibj-python3-3.12.8-env/bin/pytest \
+  tests/unit/test_deps.py tests/unit/test_gitea_dep.py -v
+
+# Negative-control structural argument (no live deploy needed):
+# A drone WITHOUT install_steps.sh (empty deps file) would not have GITEA_DOMAIN set,
+# so /login would not redirect to a gitea domain. The SCM test checks parsed.netloc == gitea_domain;
+# wrong netloc → AssertionError. The test is falsified by misconfiguration.
+```
 
 ---
 
 ## Blocked items
 
 (none)
-
----
-
-## Verification recipe (for Adversary M1 check)
-
-_To be written when M1 is claimed._