status(5): record matrix-synapse V6 dead-end

machine-docs/JOURNAL-5.md

@@ -361,3 +361,63 @@ Default-mode Phase-5 action taken:
   `/recipe-upgrade matrix-synapse --with-tests` to get a verified cc-ci test PR.
 
 Next: treat `matrix-synapse` as the V6 candidate and prepare the dedicated cc-ci test-branch fix.
+
+## 2026-06-01 — A5-4 cleared; matrix-synapse V6 branch invalidated
+
+Adversary finding A5-4 was real and caused by timing around the temporary old bridge image during the
+host-recovery rollout, not by the current live bridge behavior.
+
+Live re-test on the current bridge:
+- `POST=1 MAX_WAIT=90 INTERVAL=5 /srv/cc-ci-orch/.claude/skills/recipe-upgrade/testme-on-pr.sh matrix-synapse 1`
+  -> `VERDICT=PENDING`
+  -> `BUILD=https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/63`
+- `POST=0 MAX_WAIT=360 INTERVAL=10 /srv/cc-ci-orch/.claude/skills/recipe-upgrade/testme-on-pr.sh matrix-synapse 1`
+  -> `VERDICT=RED`
+  -> `BUILD=https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/63`
+- `GET /repos/recipe-maintainers/matrix-synapse/commits/21e5d84430bdc52f8fa8aa9a40fa5bda8adf06c0/status`
+  now shows context `cc-ci/testme state=failure target_url=.../63`.
+
+Conclusion for A5-4:
+- cleared on current live behavior; the helper can again read the verdict back from the PR via commit
+  status on this stale-test/default-path candidate.
+
+V6 branch-checkout work on matrix-synapse:
+- Created dedicated clone `/tmp/opencode/cc-ci-v6`, branch
+  `v6-matrix-synapse-real-upgrade-state`.
+- Implemented a real app-data upgrade assertion there:
+  - `tests/matrix-synapse/ops.py` now seeds two Matrix users, a room, and a message before upgrade and
+    persists only `{user_b,password,room_id,marker}` to `/data/ccci-upgrade-state.json`.
+  - `tests/matrix-synapse/test_upgrade.py` now logs back in after upgrade and asserts the pre-upgrade
+    message is still readable from the same room.
+- Branch commit: `5edcf8d fix(tests): use real matrix data for upgrade state`
+- Pushed remote branch: `origin/v6-matrix-synapse-real-upgrade-state`
+
+While verifying that branch I found and fixed a helper bug in the V6 path itself:
+- `ci-test-review/verify-pr.sh` previously passed a branch name like
+  `upgrade-7.2.0+v1.153.0` straight through as `REF`, but the generic upgrade assertion expects the PR
+  head COMMIT SHA there (same shape `!testme` uses). That made branch-checkout verification falsely RED
+  at HC1 with `head_ref='upgrade-7.2...'` vs `chaos-version='21e5d844'`.
+- Patched `verify-pr.sh` to resolve non-SHA refs to their branch head commit via the Gitea API before
+  invoking `runner/run_recipe_ci.py`.
+
+Dedicated host checkout for verification:
+- materialized `/root/cc-ci-v6-verify` on `cc-ci` from the dedicated branch clone
+- marked it safe for git on the host:
+  - `git config --global --add safe.directory /root/cc-ci-v6-verify`
+
+Verification results:
+- First branch-verify run (before the helper fix) hit the HC1 false-red and also showed the new overlay
+  login failure.
+- Second branch-verify run (after the helper fix):
+  - `REMOTE_ROOT=/root/cc-ci-v6-verify RECIPE=matrix-synapse REF=upgrade-7.2.0+v1.153.0 /srv/cc-ci-orch/.claude/skills/ci-test-review/verify-pr.sh`
+  - helper now resolves `REF_SHA=21e5d84430bdc52f8fa8aa9a40fa5bda8adf06c0`
+  - generic upgrade tier PASSed
+  - but the new real-data overlay still FAILED:
+    `login upgradeb53398657 HTTP 403: {'errcode': 'M_FORBIDDEN', 'error': 'Invalid username or password'}`
+
+Conclusion:
+- `matrix-synapse` is NOT a V6 stale-test branch after all.
+- Once the synthetic marker was replaced with a real Matrix data-survival assertion, the upgrade still
+  failed. This points to a true recipe upgrade regression, not a stale cc-ci test.
+
+Next: move to the next enrolled V5/V6 candidate (`n8n`, then `lasuite-docs`, then `keycloak`).

machine-docs/STATUS-5.md

@@ -74,8 +74,8 @@ preferred, `/root/cc-ci` fallback) instead of hard-coding `/root/cc-ci`.
 | V2 — testme-on-pr.sh reads verdict | DONE | GREEN ✓ (build #29/#35); RED ✓ (build #34); rerun fix ✓ (build #43) |
 | V3 — /recipe-upgrade sandbox GREEN | DONE | custom-html-tiny PR#2; build #29 SUCCESS |
 | V4 — 3-iter regression loop | DONE | custom-html-tiny PR#5; build #34 RED, build #37 GREEN |
-| V5 — stale-test DEFAULT = comment | IN PROGRESS | matrix-synapse PR#1 comment posted; no test edits; awaiting full evidence bundle |
-| V6 — --with-tests opens+verifies cc-ci test PR | TODO | |
+| V5 — stale-test DEFAULT = comment | IN PROGRESS | matrix-synapse default-mode comment posted, but later invalidated as a likely real regression; next candidate pending |
+| V6 — --with-tests opens+verifies cc-ci test PR | TODO | matrix-synapse branch invalidated by real regression; next candidate pending |
 | V7 — mirror reconciliation | DONE | PR#1 superseded, PR#4 merged-upstream, main=upstream ✓ |
 | V8 — /upgrade-all DEFAULT run | TODO | |
 | V8a — cc-ci-upgrader agent | TODO | |
@@ -123,12 +123,22 @@ preferred, `/root/cc-ci` fallback) instead of hard-coding `/root/cc-ci`.
   Default-mode explanatory PR comment posted with no test edit:
   `https://git.autonomic.zone/recipe-maintainers/matrix-synapse/pulls/1#issuecomment-13877`
   telling the operator to re-run `/recipe-upgrade matrix-synapse --with-tests` for a test-update PR.
+- Adversary finding A5-4 is now cleared on current live behavior: re-`!testme` on the same PR head
+  produced build `#63`; `POST=0 ... testme-on-pr.sh matrix-synapse 1` returned
+  `VERDICT=RED BUILD=https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/63`; and
+  `GET /repos/recipe-maintainers/matrix-synapse/commits/21e5d844.../status` now shows
+  `cc-ci/testme state=failure target_url=.../63`.
+- V6 branch verification on `matrix-synapse` no longer supports the stale-test hypothesis. In a
+  dedicated cc-ci branch checkout with a real Matrix data-survival upgrade assertion, the helper path
+  now resolves the recipe branch to its head SHA correctly, generic upgrade PASSes, but the upgraded
+  app still fails the real post-upgrade assertion: the pre-upgrade Matrix user cannot log in after the
+  upgrade (`HTTP 403 Invalid username or password`). That points to a true recipe upgrade regression,
+  not a stale test.
 
 ## Verification next step
 
-- Advance this `matrix-synapse` stale-test candidate into V6 by preparing a dedicated cc-ci test branch,
-  updating the synthetic upgrade assertion to a real app-data-preservation check, and verifying the
-  recipe upgrade with that test change applied.
+- Move to the next enrolled candidate for V5/V6. Current shortlist: `n8n` first, then `lasuite-docs`,
+  then `keycloak`.
 
 ## Phase 5 gates