status(2): Q4.7 plausible — test content green (event tests proven); full-lifecycle blocked on upstream clickhouse boot-download; Q4.7b recipe-PR deferred

machine-docs/BACKLOG-2.md

@@ -169,7 +169,27 @@ Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase2-recipe-tests.md`
       P4-sweep (generic backup/restore covers the floor; same bar as ghost Q4.4). Mirror to
       recipe-maintainers needed only for the PR/!testme flow (catalogue-fetch e2e green now).
 - [ ] **Q4.6** — discourse: enroll; specific (create-a-topic round-trip).
-- [ ] **Q4.7** — plausible: enroll; specific (track a test event, query it back).
+- [~] **Q4.7** — plausible: enrolled. recipe_meta (DISABLE_AUTH/REGISTRATION, SECRET_KEY_BASE;
+      HEALTH_PATH=/api/health [200 w/ clickhouse+postgres+sites_cache ok — `/` 500s under headless
+      DISABLE_AUTH so not a valid probe]; DEPLOY/HTTP_TIMEOUT=1200) + PARITY.md (P2 vacuous, no
+      recipe-maintainer corpus) + lifecycle overlays (test_install asserts /api/health subsystems;
+      ops.py seeds postgres ci_marker via pg_dump-backed backup) + **§4.3 functional tests
+      (test_event_tracking.py): test_pageview_event_roundtrip + test_custom_event_roundtrip — register
+      site → POST /api/event (browser UA) → read back from clickhouse events_v2. Both PROVEN GREEN**
+      (`STAGES=install,custom` run, `2 passed in 73.58s`; custom tier pass). Commits 3943cd8 + b4f39cb.
+      **NOT CLAIMED — full-lifecycle deploy blocked by upstream clickhouse-backup boot-download
+      crash-loop (see DECISIONS + Q4.7b):** the recipe's clickhouse entrypoint downloads a 22MB binary
+      from GitHub at boot with `set -e`/no-retry; my back-to-back test churn exhausted the host IP's
+      GitHub budget → secondary rate-limit → crash-loop → `abra app deploy` 1200s timeout. Converges
+      when GitHub answers the first wget (proven: install,custom run + probe). Path to green: GitHub
+      cooldown + ONE clean full run. Test content is correct; this is upstream-recipe fragility.
+- [ ] **Q4.7b** — plausible recipe PR (DEFERRED robustness, like Q3.2b/immich): harden
+      `entrypoint.clickhouse.sh` — cache clickhouse-backup on the persistent `/var/lib/clickhouse`
+      volume (skip-if-present → no re-download amplification), retry-with-backoff, `set +e` so a
+      download failure never blocks clickhouse-server start. NOTE: only fixes the upgrade tier + FUTURE
+      installs once released (install tier deploys the prev PUBLISHED version), so it does NOT unblock
+      this gate's install tier under throttle. Use recipe-create-pr skill; merge rule per Q3.2b.
+- [ ] **Q4.7 gate** — full lifecycle (install+upgrade+backup-restore) green via clean run + Adversary.
 - [x] **Q4.8** — uptime-kuma: enrolled. PARITY.md + recipe_meta.py + 3 functional tests
       (health_check, socketio_handshake, spa_branding). Cold green (commit `1aaf3bd`).
       Create-a-monitor in DEFERRED.md (Socket.IO client primitive + --extra; F2-10 closed).