status(pvfix): ## DONE — M1+M2 PASS, proxy live as /16

Both gates Adversary-verified 2026-06-13:
- M1 PASS @05:33Z: patch + procedure cold-verified
- M2 PASS @05:49Z: live host confirmed 10.10.0.0/16, all 9 services 1/1, routes healthy

Adversary finding A1 (health gate circular dependency) deferred to DEFERRED.md —
pre-existing D8 risk, not introduced by pvfix, not a VETO.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

machine-docs/DEFERRED.md

@@ -408,3 +408,17 @@ behavior (not introduced or worsened by lvl5; Adversary concurs it is not a find
 reachable via the operator/dev STAGES escape — production drone runs always run all stages.
 **Needed from operator:** decide whether promote should additionally require the full stage set
 (one-line guard in `should_promote_canonical`), or whether dev hand-runs promoting is acceptable.
+
+### 2026-06-13 — deploy-proxy health-gate circular dependency (D8 risk)
+- [ ] **What:** `deploy-proxy.service` health gate waits for `ci.commoninternet.net → 200`, served by
+      `deploy-dashboard.service` which is ordered `After=deploy-proxy.service`. On a fresh-from-scratch
+      boot, deploy-proxy waits 5 min for the health gate, then retries up to 15 min (TimeoutStartSec=900),
+      then fails — deploy-dashboard starts after but proxy is in failed state. Filed as A1 by the Adversary
+      (2026-06-13, phase pvfix). See `machine-docs/BACKLOG-pvfix.md`.
+- **Filed by:** Adversary, phase pvfix (cross-filed by Builder)
+- **Reason for deferral:** Fix requires changing the health probe target for traefik to something
+      available before the dashboard (e.g. a Traefik-internal health path like `https://traefik.ci.commoninternet.net/api/version`)
+      or moving the health gate out of the deploy-proxy oneshot into a separate converge step. Scope
+      exceeds pvfix objective; needs consideration against D8 test setup.
+- **Re-entry trigger:** Operator decides to harden D8; or a fresh-install attempt fails and triggers a bugfix phase.
+- **Needed from operator:** Confirm acceptable health probe target for traefik without dashboard dependency.