From a147e0772de32ffab4556d78f8db024926cabc04 Mon Sep 17 00:00:00 2001
From: autonomic-bot <autonomic-bot@git.autonomic.zone>
Date: Mon, 1 Jun 2026 13:00:34 +0000
Subject: [PATCH] status(5): record lasuite-meet enrollment rollout block

---
 machine-docs/JOURNAL-5.md | 40 +++++++++++++++++++++++++++++++++++++++
 machine-docs/STATUS-5.md  | 22 +++++++++++++++++----
 2 files changed, 58 insertions(+), 4 deletions(-)

diff --git a/machine-docs/JOURNAL-5.md b/machine-docs/JOURNAL-5.md
index f2fe320..eca64cd 100644
--- a/machine-docs/JOURNAL-5.md
+++ b/machine-docs/JOURNAL-5.md
@@ -215,3 +215,43 @@ Live lasuite-meet probe:
 - Conclusion: this is not a stale-test case yet; `recipe-maintainers/lasuite-meet` is not enrolled in the
   bridge poll set, so `!testme` never entered the real CI path. Keep V5/V6 search on already-enrolled
   recipes.
+
+## 2026-06-01 — Operator steer: enroll lasuite-meet; activation left host offline
+
+Re-oriented from the current Phase 5 SSOT and the phase ledgers. There is no separate `plan-phase6-*`
+file in `/srv/cc-ci/cc-ci-plan`; the operator steer maps to Phase 5 V5/V6.
+
+Minimal code change:
+- `nix/modules/bridge.nix`: added `recipe-maintainers/lasuite-meet` to `POLL_REPOS`
+- committed + pushed as `f28a2a3 fix(bridge): enroll lasuite-meet for !testme`
+
+Host rollout attempts:
+- `ssh cc-ci "test -d /root/builder-clone && git -C /root/builder-clone pull --rebase"`
+  -> fast-forwarded host clone to `f28a2a3`
+- `ssh cc-ci "nixos-rebuild build --flake path:/root/builder-clone#cc-ci"`
+  -> build completed (new system store path created)
+- `ssh cc-ci "nixos-rebuild switch --flake path:/root/builder-clone#cc-ci"`
+  -> activation reached the known bootloader failure:
+     `efiSysMountPoint = '/boot' is not a mounted partition`
+     `Failed to install bootloader`
+  but did not roll the bridge task
+- `ssh cc-ci "systemctl show -P ExecStart deploy-bridge.service"`
+  showed the old active helper path, and the running swarm task still used `cc-ci-bridge:3761c4221042`
+- `ssh cc-ci "nixos-rebuild test --flake path:/root/builder-clone#cc-ci"`
+  was used to activate the updated config without touching the bootloader; it restarted multiple units,
+  including `deploy-bridge.service`, and then the SSH session dropped with:
+  `Timeout, server 100.95.31.88 not responding.`
+
+Post-activation reachability probes from the orchestrator:
+- `ssh cc-ci "systemctl status deploy-bridge.service --no-pager"`
+  -> `connect to host 100.95.31.88 port 22: Connection timed out`
+- `tailscale status`
+  -> `100.95.31.88 cc-ci ... active; relay "nue"; offline`
+- `tailscale ping -c 3 cc-ci`
+  -> `no reply`
+- after a 2-minute warm poll: SSH still timed out
+
+Current state:
+- The repo-side enrollment fix is durable on origin/main.
+- Live verification that the bridge poller now watches `recipe-maintainers/lasuite-meet` is blocked on
+  host reachability returning.
diff --git a/machine-docs/STATUS-5.md b/machine-docs/STATUS-5.md
index 9b6ce98..03aadb0 100644
--- a/machine-docs/STATUS-5.md
+++ b/machine-docs/STATUS-5.md
@@ -6,9 +6,10 @@
 
 ## Current focus
 
-V5 next: find a genuinely stale test on an already-enrolled sandbox recipe. `n8n` and `cryptpad`
-natural upgrade candidates both went GREEN; `lasuite-meet` has a live upgrade but is not currently in
-the bridge poll set, so its `!testme` PR never triggered.
+Minimal enrollment fix for `lasuite-meet` is committed (`f28a2a3`). Current work is verifying the live
+bridge rollout so Phase-5 V5/V6 can continue on `lasuite-meet` PR #2. Verification is currently paused
+on host reachability: after `nixos-rebuild test --flake path:/root/builder-clone#cc-ci`, `cc-ci`
+stopped answering Tailscale SSH.
 
 ## Fixes applied (A5-1, A5-2, related)
 
@@ -101,6 +102,13 @@ preferred, `/root/cc-ci` fallback) instead of hard-coding `/root/cc-ci`.
   `https://git.autonomic.zone/recipe-maintainers/lasuite-meet/pulls/2` stayed `VERDICT=PENDING BUILD=?`
   across repeated `POST=0` polls because `recipe-maintainers/lasuite-meet` is not in the bridge's
   enrolled poll list. That makes it unusable for V5/V6 until explicitly enrolled.
+- Enrollment fix authored and pushed: `f28a2a3 fix(bridge): enroll lasuite-meet for !testme` adds
+  `recipe-maintainers/lasuite-meet` to `nix/modules/bridge.nix` `POLL_REPOS`.
+
+## Verification next step
+
+- When `ssh cc-ci` returns, verify the live bridge poller logs include `recipe-maintainers/lasuite-meet`,
+  then re-run `POST=1/POST=0 /srv/cc-ci/.claude/skills/recipe-upgrade/testme-on-pr.sh lasuite-meet 2`.
 
 ## Phase 5 gates
 
@@ -108,4 +116,10 @@ preferred, `/root/cc-ci` fallback) instead of hard-coding `/root/cc-ci`.
 
 ## Blocked
 
-(none)
+- `cc-ci` host is currently unreachable over Tailscale after `nixos-rebuild test --flake
+  path:/root/builder-clone#cc-ci` (used to activate the `lasuite-meet` bridge enrollment without touching
+  the bootloader). Current probes from the orchestrator:
+  - `ssh cc-ci ...` -> `connect to host 100.95.31.88 port 22: Connection timed out`
+  - `tailscale status` shows `100.95.31.88 cc-ci ... active; relay "nue"; offline`
+  - `tailscale ping -c 3 cc-ci` -> `no reply`
+  The code change is pushed; live verification is blocked until host reachability returns.