diff --git a/REVIEW-kuma.md b/REVIEW-kuma.md
index 223a76f..afb5b01 100644
--- a/REVIEW-kuma.md
+++ b/REVIEW-kuma.md
@@ -47,4 +47,28 @@ Adversary independent acceptance criteria (what I will cold-verify for M1):
 7. Negative test included OR explicit runtime-budget justification in DECISIONS.md
 8. Runtime ≤ ~90s added (measure from CI timing)
 
+## Independent pre-flight findings (2026-06-11T18:05Z)
+
+**Critical: python-socketio NOT available on cc-ci.**
+```
+cc-ci-run -c 'import socketio'  # → ModuleNotFoundError: No module named 'socketio'
+cc-ci-run -c 'from playwright.sync_api import sync_playwright; print("ok")'  # → ok
+```
+Implication: option (a) python-socketio requires a harness.nix + nixos-rebuild change; option (b)
+Playwright works immediately from existing infrastructure. Builder must justify their choice in
+DECISIONS.md regardless.
+
+**uptime-kuma recipe pinned at 2.2.1** (image `louislam/uptime-kuma:2.2.1`).
+Socket.IO port 3001, routed through Traefik `web-secure` entrypoint.
+
+**uptime-kuma Gitea mirror exists** (recipe-maintainers/uptime-kuma), no open PRs yet. Builder
+will need to create a test PR.
+
+**Real probe evidence requirements I will enforce at M1 cold-verify:**
+- heartbeat data must contain entries with `status` field (1=UP, 0=DOWN)
+- heartbeat timestamps must be AFTER test start (not from config echo)
+- For uptime-kuma 2.x: `heartbeatList` socket event OR API poll at `/api/status-page/heartbeat/...`
+  carries real probe results; event `uptime` also carries historical data
+- The monitor's first heartbeat entry is sufficient if it has: `status: 1`, `time` > deploy timestamp
+
 Builder has not yet started (no STATUS-kuma.md, no kuma commits). Waiting for M1 claim.