M5: upgrade + backup/restore stages green (custom-html); backup-bot-two oneshot

3-stage run green (install/upgrade/backup), clean teardown. backupbot deployed
via reconcile oneshot; PTY (script) for abra backup/restore; -m for secret generate
(no value leak). M5 CLAIMED.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL.md

@@ -340,3 +340,29 @@ services-converged + HTTPS, teardown_app = undeploy+volume+secret+env-config, ja
 
 **M3 still blocked** (Gitea webhook delivery — operator); no response yet. Next: M5 (upgrade +
 backup/restore for custom-html), then wire the parameterized Drone pipeline (API-triggerable).
+
+## 2026-05-27 — M5: upgrade + backup/restore stages green (custom-html)
+
+**Upgrade stage** (tests/custom-html/test_upgrade.py): deploy previous published version
+(git-tag sort, second-newest), write a data marker into the served volume (nginx serves
+/usr/share/nginx/html, so the marker is HTTP-fetchable), `abra app upgrade` to current, assert
+healthy + marker survived. Fix: `upgrade` has no `--chaos` flag (used `-f -D -n`).
+
+**backup-bot-two** deployed as reconcile oneshot (modules/backupbot.nix): restic repo in a local
+`backups` volume, restic_password abra-generated (only if missing). Fixes: `abra app secret generate`
+needs `-m` (machine) to avoid the TTY/ioctl path, and stdout redirected so generated values never
+hit the journal (D6). `abra app backup create`/`restore` need a real PTY ('input device is not a
+TTY') → run via util-linux `script -qec` (harness `_run_pty`; util-linux added to cc-ci-run).
+
+**Backup stage** (test_backup.py): write "original" → `abra app backup create` → mutate to
+"mutated" → `abra app restore` → assert state back to "original".
+
+**Full 3-stage run** (`STAGES=install,upgrade,backup`):
+- install: 2 passed (http 200 + playwright)
+- upgrade: 1 passed (data survives upgrade)
+- backup:  1 passed (restore returns pre-mutation state)
+- teardown: 0 orphaned run services/volumes/secrets; infra (traefik/drone/bridge/backupbot) all 1/1.
+M5 CLAIMED.
+
+**M3 still blocked** (webhook; no operator response across several ticks). Plan: if still blocked,
+pivot the bridge to poll the Gitea API (self-service, Adversary-endorsed) to unblock D1. Next: M6.