status(rcust): M2 sweep first pass — canaries 7/7, 15/21 at baseline, 6 flake-shaped reds re-running serially; spot-grep evidence + zero leaks

STATUS-rcust.md

@@ -81,13 +81,35 @@ sweep runs, not retroactively here.
 
 - M2.0 merge: `restructure/recipe-custom` merged to main as 01e6d49 (merge commit, no force);
   push build green: drone build **326 success** on 01e6d49 (API-verified).
-- M2.2 canary suite: running on cc-ci from a FRESH clone of merged main at /root/m2-sweep
-  (`cc-ci-run -m pytest tests/regression -m canary -v`, log /root/m2-canary.log). First canary
-  good-simple PASSED; 7 total expected.
-- M2.3 per-recipe sweep: driver staged at /root/m2-driver.sh on cc-ci (max 2 concurrent, all 21
-  dirs, REF = mirror default-branch heads recorded in the driver); launches after canaries
-  complete. Logs: /root/m2-logs/<recipe>.log, results under /var/lib/cc-ci-runs/.
-- Drone→harness path: !testme on two open recipe PRs planned after the direct sweep.
+- M2.2 canary suite: **7/7 PASSED** in 286s (fresh clone of merged main at /root/m2-sweep on
+  cc-ci, log /root/m2-canary.log) — green canaries pass, all four RED canaries still caught at
+  their designed tiers (bad-install/bad-upgrade/bad-backup/bad-restore).
+- M2.3 per-recipe sweep (driver /root/m2-driver.sh, 2 concurrent, REF = mirror heads; logs
+  /root/m2-logs/<r>.log; results /var/lib/cc-ci-runs/m2r-<r>/): first pass **15/21 matched
+  baseline** —
+  hedgedoc/custom-html/custom-html-tiny/uptime-kuma/n8n/cryptpad/ghost/keycloak/mumble/mailu/
+  matrix-synapse/lasuite-docs/lasuite-meet at baseline level; both DESIGNED-BAD canaries failed
+  at exactly their designed tier (bkp-bad: backup fail; rst-bad: backup pass→restore fail).
+  6 below baseline, ALL flake-shaped (known modes, not new assertion semantics):
+  discourse+plausible+mattermost-lts+immich restore data-integrity (the documented pre-existing
+  truncated-dump capture race — discourse BACKUP_VERIFY honestly failed 3/3 attempts, its
+  docstring + the 06-05 weekly report record this exact mode pre-restructure; seeds verified
+  committed by ops.py read-back asserts, i.e. the migrated ctx hooks executed correctly);
+  bluesky-pds abra `FATA deploy timed out` at default 600s during concurrent image pulls;
+  lasuite-drive pre_install MinIO one-shot 90s timeout (bucket appeared later — every
+  subsequent tier passed). Serial re-runs (MAX=1, /root/m2-rerun.sh, logs /root/m2-rerun-logs/,
+  results m2rr-<r>/) IN PROGRESS for those 6.
+- M2.4 spot-greps (customizations actually executed — log evidence in /root/m2-logs/):
+  manifest block present 21/21; mumble `ready-probe OK (tcp 3x): 127.0.0.1:64738`; ghost+discourse
+  `ccci-overlay: provided compose.ccci.yml ... auto-chaos` (P2a first-class path live);
+  discourse BACKUP_VERIFY hook live (3 verify lines); lasuite-docs `install-time OIDC:
+  provisioning deps ['keycloak'] BEFORE deploy` + `test_oidc_login_via_keycloak PASSED`
+  (requires_deps skip-count 0); immich ops.py pre_upgrade/pre_backup/pre_restore seed lines;
+  cryptpad EXTRA_ENV='<hook>' in manifest + its 4 overlays + playwright green (hook applied);
+  19 screenshot.png across m2r-* dirs.
+- Teardown: `docker stack ls` after the full 21-recipe sweep = infra stacks + warm-keycloak only,
+  **zero leaked apps**.
+- Drone→harness path: !testme on two open recipe PRs pending after the re-runs.
 
 **Gate history: M1 CLAIMED 2026-06-10 → PASS** (branch head 858e0f5)