M6: D4 recipe-local discovery + recipe #2 (keycloak, DB-backed) enrolled; M6 CLAIMED

D4 snapshots recipe-shipped tests/ and runs them against the live app. abra -C -o
everywhere + token clone for private mirror PRs. keycloak install green with no
harness surgery (D5). docs/enroll-recipe.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

BACKLOG.md

@@ -52,8 +52,13 @@ Two single-writer sections (§6.1): Builder edits only `## Build backlog`; Adver
       Full 3-stage run green: install(2)+upgrade(1)+backup(1) passed; teardown leaves 0 orphans, infra intact.
 
 ### M6 — Recipe-local tests + second recipe
-- [ ] Discover/run recipe-repo tests/; enroll DB-backed recipe #2
-- [ ] Gate: M6 — both green; recipe-local tests merged
+- [x] D4 recipe-local discovery: recipe-shipped tests/ snapshotted post-fetch + run against the live
+      app as a `recipe-local` stage (contract CCCI_BASE_URL/CCCI_APP_DOMAIN). Demo'd via mirror branch
+      recipe-maintainers/custom-html@ci/d4-recipe-local → recipe-local test PASSED against live app.
+- [x] Enroll DB-backed recipe #2 (keycloak + mariadb) via per-recipe tests/keycloak/ only (no harness
+      surgery): install green (realm health + Playwright admin login). docs/enroll-recipe.md written.
+- [x] Gate: M6 — both recipes green (custom-html 3-stage; keycloak install) + recipe-local merged →
+      CLAIMED 2026-05-27. keycloak full 3-stage (DB data survival) folds into the M6.5 breadth ramp.
 
 ### M6.5 — Breadth ramp (recipes 3→6)
 - [ ] Enroll recipes 3–6 covering remaining D10 categories, no harness surgery