status(5): record matrix-synapse V6 dead-end

machine-docs/JOURNAL-5.md

@@ -361,3 +361,63 @@ Default-mode Phase-5 action taken:
   `/recipe-upgrade matrix-synapse --with-tests` to get a verified cc-ci test PR.
 
 Next: treat `matrix-synapse` as the V6 candidate and prepare the dedicated cc-ci test-branch fix.
+
+## 2026-06-01 — A5-4 cleared; matrix-synapse V6 branch invalidated
+
+Adversary finding A5-4 was real and caused by timing around the temporary old bridge image during the
+host-recovery rollout, not by the current live bridge behavior.
+
+Live re-test on the current bridge:
+- `POST=1 MAX_WAIT=90 INTERVAL=5 /srv/cc-ci-orch/.claude/skills/recipe-upgrade/testme-on-pr.sh matrix-synapse 1`
+  -> `VERDICT=PENDING`
+  -> `BUILD=https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/63`
+- `POST=0 MAX_WAIT=360 INTERVAL=10 /srv/cc-ci-orch/.claude/skills/recipe-upgrade/testme-on-pr.sh matrix-synapse 1`
+  -> `VERDICT=RED`
+  -> `BUILD=https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/63`
+- `GET /repos/recipe-maintainers/matrix-synapse/commits/21e5d84430bdc52f8fa8aa9a40fa5bda8adf06c0/status`
+  now shows context `cc-ci/testme state=failure target_url=.../63`.
+
+Conclusion for A5-4:
+- cleared on current live behavior; the helper can again read the verdict back from the PR via commit
+  status on this stale-test/default-path candidate.
+
+V6 branch-checkout work on matrix-synapse:
+- Created dedicated clone `/tmp/opencode/cc-ci-v6`, branch
+  `v6-matrix-synapse-real-upgrade-state`.
+- Implemented a real app-data upgrade assertion there:
+  - `tests/matrix-synapse/ops.py` now seeds two Matrix users, a room, and a message before upgrade and
+    persists only `{user_b,password,room_id,marker}` to `/data/ccci-upgrade-state.json`.
+  - `tests/matrix-synapse/test_upgrade.py` now logs back in after upgrade and asserts the pre-upgrade
+    message is still readable from the same room.
+- Branch commit: `5edcf8d fix(tests): use real matrix data for upgrade state`
+- Pushed remote branch: `origin/v6-matrix-synapse-real-upgrade-state`
+
+While verifying that branch I found and fixed a helper bug in the V6 path itself:
+- `ci-test-review/verify-pr.sh` previously passed a branch name like
+  `upgrade-7.2.0+v1.153.0` straight through as `REF`, but the generic upgrade assertion expects the PR
+  head COMMIT SHA there (same shape `!testme` uses). That made branch-checkout verification falsely RED
+  at HC1 with `head_ref='upgrade-7.2...'` vs `chaos-version='21e5d844'`.
+- Patched `verify-pr.sh` to resolve non-SHA refs to their branch head commit via the Gitea API before
+  invoking `runner/run_recipe_ci.py`.
+
+Dedicated host checkout for verification:
+- materialized `/root/cc-ci-v6-verify` on `cc-ci` from the dedicated branch clone
+- marked it safe for git on the host:
+  - `git config --global --add safe.directory /root/cc-ci-v6-verify`
+
+Verification results:
+- First branch-verify run (before the helper fix) hit the HC1 false-red and also showed the new overlay
+  login failure.
+- Second branch-verify run (after the helper fix):
+  - `REMOTE_ROOT=/root/cc-ci-v6-verify RECIPE=matrix-synapse REF=upgrade-7.2.0+v1.153.0 /srv/cc-ci-orch/.claude/skills/ci-test-review/verify-pr.sh`
+  - helper now resolves `REF_SHA=21e5d84430bdc52f8fa8aa9a40fa5bda8adf06c0`
+  - generic upgrade tier PASSed
+  - but the new real-data overlay still FAILED:
+    `login upgradeb53398657 HTTP 403: {'errcode': 'M_FORBIDDEN', 'error': 'Invalid username or password'}`
+
+Conclusion:
+- `matrix-synapse` is NOT a V6 stale-test branch after all.
+- Once the synthetic marker was replaced with a real Matrix data-survival assertion, the upgrade still
+  failed. This points to a true recipe upgrade regression, not a stale cc-ci test.
+
+Next: move to the next enrolled V5/V6 candidate (`n8n`, then `lasuite-docs`, then `keycloak`).