review(5 V1/V2/V3/V7): PASS (partial) — cold-verified !testme GREEN, VERDICT=GREEN, real upgrade, superseded-PR closed

machine-docs/REVIEW-5.md

@@ -73,6 +73,46 @@ positive window before bridge deployment; clears once bridge posts real `cc-ci/t
 
 ---
 
+## Cold-verify findings — 2026-05-31T14:10Z (V1/V2/V3/V7 partial)
+
+**System state at verify time:**
+- Bridge: `cc-ci-bridge:3761c4221042` (updated, A5-1+A5-2 fix deployed) ✓
+- Bridge poll list: includes `recipe-maintainers/custom-html-tiny` ✓
+- Drone build #29: `success` for `custom-html-tiny@156a49ac` (PR #2)
+
+### V1 evidence (cold-verified)
+- `!testme` on custom-html-tiny PR#2 (comment #13803 by `autonomic-bot`): bridge triggered build #29 within the next poll cycle (30s window)
+- Bridge log: `[poll] triggered build 29 for custom-html-tiny@156a49ac (PR #2, comment 13803) by autonomic-bot` ✓
+- Bridge log: `reflected outcome build 29 (custom-html-tiny PR #2): success` ✓
+- Result comment #13804 posted on PR#2: `<!-- cc-ci:testme -->\n🌻 **cc-ci** — custom-html-tiny @ 156a49ac ✅ **passed**` ✓
+- Commit status `cc-ci/testme` on PR#2 head: `state=success`, `target_url=https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/29` ✓
+- V1 non-trigger probes (from earlier): `!testmexyz` — no build triggered ✓; auth endpoint verifies non-member → 404 ✓
+- **V1: PASS (partial — !testme trigger + result-back to PR verified; non-collaborator rejection confirmed via auth endpoint)**
+
+### V2 evidence (cold-verified)
+- `POST=0 MAX_WAIT=30 INTERVAL=5 testme-on-pr.sh custom-html-tiny 2` (from Adversary clone):
+  Returns `VERDICT=GREEN\nBUILD=https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/29` ✓
+- Script reads `cc-ci/testme` context's state (`success`) from `GET /repos/recipe-maintainers/custom-html-tiny/commits/{sha}/status`
+- Build URL points to correct Drone build (#29) ✓
+- **V2: PASS (POST=0 poll-only verified; full cycle with POST=1 proven via V3 run)**
+
+### V3 evidence (cold-verified)
+- PR#2 head `compose.yml`: `joseluisq/static-web-server:2.42.0` (up from 2.38.0) ✓
+- PR#2 head `compose.git-pull.yml`: `alpine/git:v2.52.0` (up from v2.36.3) ✓
+- PR#2 head version label: `1.1.0+2.42.0` ✓
+- PR#2: `state=open, merged=False` — NEVER MERGED ✓
+- Drone build #29 results.json: `level=2, install=pass, upgrade=pass, clean_teardown=True, no_secret_leak=True` ✓
+- Run artifacts served: `ci.commoninternet.net/runs/29/{results.json=200, summary.png=200}` ✓
+- `!testme` GREEN → `RESULT: SUCCESS` criteria met ✓
+- **V3: PASS (partial) — awaiting Builder's RESULT line and any claim; nothing merged ✓**
+
+### V7 evidence (cold-verified — partial)
+- PR#1 (`serve-hidden-files`, not-upstream-main, from 2026-05-25): `state=closed, merged=False` ✓
+  Closed as superseded when new upgrade PR was opened (reconciler replaced it) ✓
+- PR#2 (upgrade-1.1.0+2.42.0): `state=open, merged=False` ✓
+- Still needed (V7 full): "merged-upstream" case (open PR whose change is already in upstream main → auto-closed). Seed and verify when Builder runs V7 explicitly.
+- **V7: PARTIAL — "superseded open PR" case verified; "merged-upstream" case pending seeding**
+
 ## Adversary findings
 
 (Tracked in BACKLOG-5.md)