docs(deferred): operator housekeeping pass 2026-06-11

- CLOSED: plausible enrollment (overtaken — enrolled+running), discourse
  bitnami pin (superseded — enrolled, L4 baseline), immich pg_dump (PR#2
  green, operator merge pending), plausible Q4.7b ClickHouse (PR#3 green,
  operator merge pending)
- RE-ENTERED per operator: mailu backupbot -> phase mailu, drone enrollment
  -> phase drone, uptime-kuma create-a-monitor -> phase kuma, discourse
  abra-stamp drift -> phase dstamp, bluesky-pds -> phase bsky (in progress)

machine-docs/DEFERRED.md

@@ -118,6 +118,7 @@ before the build is called done) — but does **not** force closure.
 - **Linked IDEA:** —
 
 ### 2026-05-28 — uptime-kuma create-a-monitor (§4.3 prescribed)
+- [x] **RE-ENTERED @2026-06-11:** operator approved — executing as phase `kuma` (cc-ci-plan/plan-phase-kuma-monitor.md).
 - [ ] **What:** Add a test that completes uptime-kuma's first-run setup wizard via Socket.IO,
       logs in to obtain a JWT, creates a monitor (`monitor add` Socket.IO emit), and asserts the
       monitor appears in the listed-monitors response.
@@ -210,6 +211,7 @@ before the build is called done) — but does **not** force closure.
 (none yet — append `### YYYY-MM-DD — <slug> CLOSED (commit/PR)` here when re-entered.)
 
 ### 2026-05-28 — plausible (Q4.7) recipe enrollment
+- [x] **CLOSED @2026-06-11 (operator housekeeping):** overtaken — plausible is enrolled and running in CI (§4.3 floor `71af595`); the full-lifecycle remainder is the Q4.7b entry below (recipe PR#3 green, operator merge pending).
 - [ ] **What:** Enroll plausible in cc-ci with parity health_check + ≥2 specific tests (per
       plan §4.3: "track a test event, query it back"). `tests/plausible/recipe_meta.py` +
       `tests/plausible/functional/test_health_check.py` are drafted (commit pending) but the
@@ -237,6 +239,7 @@ before the build is called done) — but does **not** force closure.
   Defensible defer; lift when the operator wants the deeper coverage OR Phase-4 reviews.
 
 ### 2026-05-29 — immich recipe needs a pg_dump backup hook for reliable DB restore (P4)
+- [x] **CLOSED @2026-06-11:** cc-ci-authored immich recipe PR#2 (pg_dump hook) verified green; operator confirmed 2026-06-11 — merge pending, no further loop work.
 - [ ] **What:** immich's upstream recipe backs up the LIVE postgres data VOLUME via restic
       (`backupbot.backup=true` on `database`, no pg_dump hook), so a DB row does NOT survive
       `abra app restore` (diagnosed: seed→backup→drop→restore→row absent; app healthy). Real
@@ -256,6 +259,7 @@ before the build is called done) — but does **not** force closure.
 - **Linked IDEA:** —
 
 ### 2026-05-29 — discourse: upstream recipe pins removed bitnami images (undeployable)
+- [x] **CLOSED @2026-06-11 (operator housekeeping):** superseded — discourse is enrolled and runs the full lifecycle in CI (L4 baseline run 184, 2026-06-05); the bitnami-pin blocker no longer applies.
 - [ ] **What:** discourse (Q4.6) cannot be enrolled/tested because the recipe pins
       `image: bitnami/discourse:<tag>` (app + sidekiq) and **Docker Hub no longer serves any
       `bitnami/discourse:*` tag** (bitnami's 2024/2025 legacy migration). Proven on cc-ci:
@@ -282,6 +286,7 @@ before the build is called done) — but does **not** force closure.
 - **Linked IDEA / BACKLOG:** Q4.6.
 
 ### 2026-05-29 — mailu: no backup config (P4 N/A) — recipe-PR to add backupbot
+- [x] **RE-ENTERED @2026-06-11:** operator approved the backupbot recipe-PR route — executing as phase `mailu` (cc-ci-plan/plan-phase-mailu-backup.md).
 - [ ] **What:** mailu (Q4.9) ships **no `backupbot.backup` label** on any service, so cc-ci's
       backup/restore tiers cleanly SKIP (`backup_capable=False`) — P4 (backup data-integrity) is N/A
       for mailu as published (no backup mechanism to exercise). Durable fix = a recipe-PR adding
@@ -296,6 +301,7 @@ before the build is called done) — but does **not** force closure.
 - **Linked IDEA / BACKLOG:** Q4.9.
 
 ### 2026-05-29 — drone (Q4.10) blocked on host /etc/timezone deploy (gitea SCM dep) + scoped integration
+- [x] **RE-ENTERED @2026-06-11:** operator approved — executing as phase `drone` (cc-ci-plan/plan-phase-drone-enroll.md); P0 host /etc/timezone deploy is orchestrator-owned.
 - [ ] **What:** drone (Q4.10, LAST §5 recipe) cannot be enrolled until two things land:
       (1) **HOST FIX — operator-deploy needed:** drone is a CI server that REQUIRES a git-provider SCM
       to boot; the only viable dep is **gitea**, which the recipe binds `/etc/timezone:ro` from the
@@ -322,6 +328,7 @@ before the build is called done) — but does **not** force closure.
 - **Linked IDEA / BACKLOG:** Q4.10; JOURNAL-2 f86a58a; commit 3bde76f.
 
 ### 2026-05-30 — plausible Q4.7 full (recipe-PR Q4.7b: fix ClickHouse entrypoint wget restart-storm)
+- [x] **CLOSED @2026-06-11:** recipe PR#3 (ClickHouse entrypoint + backup fixes) verified GREEN at PR head; operator confirmed 2026-06-11 — merge pending. Post-merge follow-up: full lifecycle on main to formally claim Q4.7.
 - [ ] **What:** Fix the recipe `entrypoint.clickhouse.sh` so ClickHouse boots reliably, then run
       plausible's FULL lifecycle (`install,upgrade,backup,restore,custom`) green + claim Q4.7. Suite
       authored (`tests/plausible/` ops + test_backup/restore/upgrade + event-roundtrips); §4.3 floor
@@ -335,8 +342,8 @@ before the build is called done) — but does **not** force closure.
 - **Re-entry trigger:** Builder authors recipe-PR Q4.7b (cache tarball on a volume / wget
   retry+backoff / drop `2>/dev/null` / `set +e` w/ fallback), then runs plausible-full green + claims.
 - **Linked:** REVIEW-2 `e850281` (root-cause + DENY), `71af595` (§4.3 floor); DECISIONS 2026-05-30.
-- discourse upgrade-HC1 @7ae7b0f stamps prev-base tag commit (eb96de94+U) on BOTH old+new harness since ~06-10 (baseline 184 was L4 on 06-05); harness-neutral (rcust exonerated, M2-closed) but abra stamp-resolution mechanism UNATTRIBUTED — worth a standalone dig outside rcust. Evidence: /var/lib/cc-ci-runs/{m2p-discourse,ab-discourse-7ae7b0f-oldmain}, JOURNAL-rcust 2026-06-11.
-- bluesky-pds: UPSTREAM IMAGE BREAKAGE (non-rcust, M2-justified exclusion from baseline match).
+- [RE-ENTERED @2026-06-11 → phase `dstamp` (cc-ci-plan/plan-phase-dstamp-discourse-drift.md)] discourse upgrade-HC1 @7ae7b0f stamps prev-base tag commit (eb96de94+U) on BOTH old+new harness since ~06-10 (baseline 184 was L4 on 06-05); harness-neutral (rcust exonerated, M2-closed) but abra stamp-resolution mechanism UNATTRIBUTED — worth a standalone dig outside rcust. Evidence: /var/lib/cc-ci-runs/{m2p-discourse,ab-discourse-7ae7b0f-oldmain}, JOURNAL-rcust 2026-06-11.
+- [RE-ENTERED @2026-06-11 → phase `bsky` (cc-ci-plan/plan-phase-bsky-fix.md), in progress] bluesky-pds: UPSTREAM IMAGE BREAKAGE (non-rcust, M2-justified exclusion from baseline match).
   The app container crash-loops `Error: Cannot find module '/app/index.js'` (MODULE_NOT_FOUND,
   Node v24.15.0) under the recipe's pinned tag on EVERY current run — new main @ mirror head
   (m2r-bluesky-pds), new main serial re-run (m2rr-bluesky-pds), AND old pre-rcust main @ old