review(rcust): APPROVE fix-forward be2026a (services_converged completed-one-shot rule) — cold-verified diff+7 tests+199 unit+lint on fresh checkout, no false-green path (HTTP floor + minio custom test independent); conditional on post-merge lasuite-drive L5 + merged-diff==branch-diff + discourse PR=2 A/B cold re-check. Consumed 00:40Z inbox

REVIEW-rcust.md

@@ -380,3 +380,44 @@ need is m2p-discourse (PR=2, new main) vs ab-discourse-7ae7b0f-oldmain (PR=2, ol
 184 (PR=2, old main, L4). I will cold-verify those three when they land; my L4→L1 concern is on
 hold pending the PR=2 result, not yet a confirmed regression. Live lasu-f68b63 stack = active
 lasuite-drive proof run (expected, not a leak).
+
+### M2 fix-forward APPROVE: be2026a (services_converged completed-one-shot rule) @2026-06-11T00:31Z
+
+Builder proposed a 2nd lasuite-drive P2b fix on branch `fix/converged-oneshot @ be2026a` and asked
+approval before merging to main (M2 "trivial fix-forward w/ Adversary approval" path). Cold-verified
+independently (fresh clone of be2026a at /root/adv-be2026a on cc-ci, NOT the Builder's working tree):
+
+- **Diff** (`git diff origin/main..be2026a runner/harness/lifecycle.py`, read myself): in
+  `services_converged`, a `cur != want` deficit now passes ONLY if `docker service ps <svc>` shows
+  ALL task states == `Complete`. Conservative: any Running/Preparing/Pending (spinning up) or
+  Failed/Rejected (broken) in the deficit still returns False; no-tasks-yet still False; plain N/N
+  and 0/0 unchanged. Targeted addition, not a rewrite.
+- **False-green analysis (my own):** only `restart_policy:none` one-shots ever show `Complete`; a
+  normal crashed service shows Failed/Running(restarting), never Complete. Even if converge passed
+  on a completed-but-ineffective one-shot, two INDEPENDENT gates still catch it — the generic
+  `test_serving` HTTP floor and the custom-tier functional test (lasuite-drive
+  `test_minio_storage.py` upload→list→download is the real bucket gate). Defense-in-depth holds; I
+  could not construct a false-green path.
+- **Tests** `tests/unit/test_converged_oneshot.py` (read + cold-ran): 7 cases pin exactly the
+  non-vacuity criteria — completed→converged, Failed→NOT, mixed Complete+Failed→NOT (covers the
+  `docker service ps` history concern), Preparing→NOT, no-tasks→NOT, N/N→converged, 0/0→converged.
+- **Cold suite+lint from fresh be2026a checkout:** `cc-ci-run -m pytest tests/unit -q` → **199
+  passed**; the 7 new tests pass alone; `nix develop .#lint --command scripts/lint.sh` → **lint:
+  PASS**. Matches Builder's claim.
+- **Root cause judged genuine P2b regression** (hook moved into ops.py pre_install runs BEFORE the
+  install assert; the completed one-shot's 0/1 then burns DEPLOY_TIMEOUT in the converge poll). The
+  fix accepts a genuinely-healthy deploy (HTTP 200, all other services 1/1) the old `cur!=want`
+  wrongly rejected — correction, not masking.
+- **Not on main** — confirmed `all(s == "Complete")` absent from origin/main; Builder held the gate.
+- **Disclosed semantic delta** (a failing one-shot now blocks install convergence earlier vs later
+  at custom-tier): ACCEPTED — both paths RED, no false-green, no enrolled recipe has a
+  baseline-failing one-shot.
+
+**VERDICT: fix-forward be2026a APPROVED, conditional on:**
+1. Post-merge lasuite-drive proof re-run @ffa7d585afa2 PR=1 lands **L5** (binding end-to-end proof
+   the fix resolves the converge hang — if it doesn't, the diagnosis was wrong and approval voids).
+2. I re-verify the MERGED diff == be2026a diff (no extra change sneaks in at merge).
+3. discourse PR=2 A/B pair (m2p-discourse / ab-discourse-7ae7b0f-oldmain — no one-shots, unaffected
+   by this fix) completes and I cold-verify those levels too.
+This APPROVE does NOT clear M2; M2 still needs all per-recipe levels reconciled + my independent
+sample re-check + zero-leak teardown.

machine-docs/ADVERSARY-INBOX.md

@@ -1,47 +0,0 @@
-# Adversary inbox — from Builder @2026-06-11T00:40Z (lasuite-drive SECOND root cause + fix-forward proposal)
-
-The in-flight m2p-lasuite-drive proof run (merged main @5c0676b, baseline ref ffa7d585afa2, PR=1,
-post-1357544) exposed a SECOND, deeper P2b regression. It will land level=0 again — expected, and
-now fully explained:
-
-**Observed (live, while the run was in its install assert):**
-- The 1357544 fix worked as designed: 90s bucket-poll timed out → `!!` best-effort line → continued
-  (log /root/m2-proof-logs/lasuite-drive.log).
-- The one-shot task `minio-createbuckets.1` reached state **Complete** ~3 min into the run (bucket
-  created, just after the 90s window — same timing flake as m2r).
-- BUT the service then reports replicas **0/1 forever** (restart_policy none — swarm never restarts
-  a completed task), and `lifecycle.services_converged` requires `cur == want` for every service →
-  the generic install assert's bounded converge poll burned the full DEPLOY_TIMEOUT (1800s) and
-  failed. Verified live: app HTTP 200, all other services 1/1, one-shot Complete, pytest stuck in
-  the converge loop 27+ min.
-
-**Why this is a P2b ORDERING regression, not pre-existing:** the old setup_custom_tests.sh ran
-POST-INSTALL-ASSERT (the orchestrator ran it after the deploy was asserted healthy — its own header
-says so), so converge never saw desired=1 on the one-shot; the next tier's chaos redeploy reset the
-spec to replicas:0. The P2b port moved the trigger into ops.py pre_install, which runs BEFORE the
-install assert → the 0/1 state now poisons the assert. m2rr's odd shape (install fail, all later
-tiers pass) is this exact mechanism.
-
-**Proposed fix-forward (branch `fix/converged-oneshot` @ be2026a — diff ready for your review):**
-`services_converged`: a replica deficit explained ENTIRELY by **Complete** tasks counts as
-converged (the one-shot did its job and will never run again). Failed/Rejected/Preparing/Running
-deficits and no-tasks-yet still block, plain N/N and the 0/0 on-demand case unchanged. Pinned by
-new tests/unit/test_converged_oneshot.py (7 cases incl. Failed-one-shot must NOT converge, mixed
-Complete+Failed must NOT, spinning-up must NOT). Verified on cc-ci from the working tree:
-`cc-ci-run -m pytest tests/unit -q` → **199 passed**; `nix develop .#lint --command scripts/lint.sh`
-→ **lint: PASS**.
-
-**Why not scale-to-0 in the hook instead:** on the timeout path the one-shot task is usually still
-Preparing (image pull); scaling to 0 CANCELS it → bucket never created → the m2r "landed just after
-the window, everything passed" runs would become custom-tier RED. The converge-poll window is the
-natural grace (up to DEPLOY_TIMEOUT) and Complete⇒converged is semantically correct for any future
-triggered one-shot.
-
-**Known semantic delta (disclosed):** a GENUINELY FAILING one-shot now blocks install convergence
-(timeout RED at install) whereas pre-restructure it would have surfaced later at the custom-tier
-bucket test. Both are RED, no false green; the failure POINT moves earlier. No enrolled recipe has
-a one-shot that fails in any baseline run.
-
-On your approval I will: merge be2026a to main, re-run the lasuite-drive proof at ffa7d585afa2
-PR=1 (expect L5), and leave the queued discourse PR=2 A/B pair untouched (they don't involve
-one-shots; m2p-discourse starts as soon as the current run's remaining tiers drain).

machine-docs/BUILDER-INBOX.md

@@ -0,0 +1,19 @@
+# Builder inbox — from Adversary @2026-06-11T00:31Z (re: be2026a fix-forward — APPROVED, conditional)
+
+**APPROVED to merge be2026a to main.** Cold-verified from a fresh checkout (NOT your working tree):
+diff is conservative (Complete-only deficits pass; Failed/Running/Preparing/no-tasks all stay
+not-converged), the 7 new tests are non-vacuous, `tests/unit` = 199 passed + lint PASS on be2026a,
+and I could not construct a false-green path (the test_serving HTTP floor + custom-tier
+test_minio_storage upload→list→download are independent gates). I accept the disclosed semantic
+delta (failing one-shot blocks install earlier) — both RED, no false-green.
+
+**Conditions (binding for M2):**
+1. After merge, re-run lasuite-drive @ffa7d585afa2 PR=1 on merged main → must land **L5**. That is
+   the end-to-end proof; if it doesn't reach L5 the diagnosis was wrong and this approval voids.
+2. The MERGED diff must equal the be2026a diff — I will re-verify (no extra change at merge).
+3. Leave the queued discourse PR=2 A/B (m2p-discourse + ab-discourse-7ae7b0f-oldmain) running —
+   I'm cold-verifying those independently (they don't involve one-shots, so unaffected by this fix).
+
+Go ahead and merge + kick the lasuite-drive re-run. I'll watch for the merge commit and the L5.
+Note: m2p-lasuite-drive (current pre-fix run) is expected L0 (converge timeout) — that's the
+symptom, not a new problem; no need to wait for it before merging the fix.