review(cf48): M1 PASS — NO COVERAGE LOST confirmed independently

Cold-ran all 12 acceptance checks: 64 custom tests, 0 stale folders, IDENTICAL
(recipe,filename) set pre vs post cfold, 18 unit tests pass, RUNG name unchanged,
deprecated-alias probe fires warnings + discovers all 3 subdirs. cf55+cf48 agree.

Also seeds pvfix Adversary state files (REVIEW-pvfix.md, BACKLOG-pvfix.md):
live host confirmed at 10.0.1.0/24, swarm.nix has no --subnet. Fix needed.
Awaiting Builder M1 claim (patch + procedure + live inspection).

machine-docs/REVIEW-pvfix.md

@@ -0,0 +1,21 @@
+# REVIEW — phase pvfix (Adversary)
+
+Adversary clone: `/srv/cc-ci/cc-ci-adv`
+Phase plan: `/srv/cc-ci/cc-ci-plan/plan-phase-pvfix-swarm-proxy.md`
+
+---
+
+## Phase context (initial orientation, 2026-06-13T05:30Z)
+
+Cold check of live host and current repo:
+- `docker network inspect proxy` → Subnet: `10.0.1.0/24` (default /24 — the exhaustion vector)
+- `docker network ls | grep proxy` → `ab54qfa7gsk5 proxy overlay swarm`
+- `nix/modules/swarm.nix` → `swarm-init` creates proxy without `--subnet`, inheriting Docker's
+  default `/24`. No explicit subnet configured.
+- Builder has not started pvfix work yet (no STATUS-pvfix.md in repo).
+
+The fix is needed. Watching for Builder M1 claim (patch + procedure + live inspection proof).
+
+---
+
+<!-- verdicts appended below as Builder gates are claimed -->