claim(cfold): claim M2 full sweep green

machine-docs/JOURNAL-cfold.md

@@ -405,3 +405,83 @@ comment-bridge listening on 0.0.0.0:8080 (poll primary + optional webhook)
 
 This fix addresses the replay hole exposed during cfold's Ghost retrigger. It does not change the cfold
 bottom line: Ghost's upgrade tier remains the lone M2 blocker, while custom discovery continues to pass.
+
+## 2026-06-13 — Ghost upgrade blocker fixed in cc-ci; same-ref real CI rerun now green
+
+I stayed on the Ghost blocker until I had a same-ref real-`!testme` proof, since M2 could not be claimed
+while Ghost remained the only non-green recipe in the sweep.
+
+Focused investigation sequence:
+
+- Preserved-current-code repros showed the old failure mode honestly: during the base->head crossover, the
+  new Ghost app task could start before the replacement mysql service was usable, exiting on
+  `ENOTFOUND` / `ECONNREFUSED` against `${STACK_NAME}_db`, which made swarm pause the update before the
+  head spec settled.
+- My first attempt (`restart_policy.delay`) was insufficient because swarm paused the update on the first
+  failed new task before any retry delay could matter.
+- My second attempt (wrapping Ghost in `command: sh -ec ...`) proved the DB wait idea but regressed the
+  base install: it bypassed Ghost's normal docker-entrypoint first-boot path, so the default `source`
+  theme was never seeded and `/` stayed 500 (`The currently active theme "source" is missing`).
+- Final fix: move the DB wait into the app `entrypoint`, then exec the normal
+  `/abra-entrypoint.sh node current/index.js` path. That preserved both the first-boot seeding behavior
+  and the upgrade crossover guard.
+
+The finished overlay in `tests/ghost/compose.ccci.yml` now does three things and nothing more:
+
+1. keep the existing 15m app healthcheck grace,
+2. keep the existing 15m db healthcheck grace,
+3. wait for the DB TCP socket before entering the normal Ghost entrypoint on the base->head crossover.
+
+Verification:
+
+```bash
+$ ssh cc-ci 'jq -r ".results, .stages" /var/lib/cc-ci-runs/ghost-repro-cfold-3/results.json'
+{
+  "install": "pass",
+  "upgrade": "pass"
+}
+[
+  {"name":"install","status":"pass",...},
+  {"name":"upgrade","status":"pass",...},
+  {"name":"lint","status":"pass",...}
+]
+
+$ ssh cc-ci 'tok=$(cat /run/secrets/bridge_drone_token); curl -fsS -H "Authorization: Bearer $tok" https://drone.ci.commoninternet.net/api/repos/recipe-maintainers/cc-ci/builds/585 | jq -r "[.number,.status,.after,.params.RECIPE,.params.PR,.params.REF] | @tsv"'
+585	success	d44f799de945d0775933aad58726d46509154a64	ghost	5	d42d0f7c7cf9946077a583ffa3f7c96abfe94a77
+
+$ ssh cc-ci 'jq -r "{level,recipe,ref,results,stages:(.stages|map({name,status}))}" /var/lib/cc-ci-runs/585/results.json'
+{
+  "level": 5,
+  "recipe": "ghost",
+  "ref": "d42d0f7c7cf9",
+  "results": {
+    "backup": "pass",
+    "custom": "pass",
+    "install": "pass",
+    "restore": "pass",
+    "upgrade": "pass"
+  },
+  "stages": [
+    {"name":"install","status":"pass"},
+    {"name":"upgrade","status":"pass"},
+    {"name":"backup","status":"pass"},
+    {"name":"restore","status":"pass"},
+    {"name":"custom","status":"pass"},
+    {"name":"lint","status":"pass"}
+  ]
+}
+
+$ ssh cc-ci 'printf "ghost custom junit="; ls /var/lib/cc-ci-runs/585/junit/custom__cc-ci__*.xml | wc -l; printf " ghost upgrade junit="; ls /var/lib/cc-ci-runs/585/junit/upgrade*.xml | wc -l'
+ghost custom junit=4
+ ghost upgrade junit=2
+
+$ ssh cc-ci 'printf "live_pr_apps="; docker stack ls --format "{{.Name}}" | grep -c -- "-pr" || true'
+live_pr_apps=0
+```
+
+Outcome:
+
+- Ghost is no longer the M2 blocker.
+- The real PR-triggered build (`585`) on the same Ghost ref that previously failed (`d42d0f7c`) is now L5.
+- The custom tier remained intact throughout: still 4 canonical custom JUnit files on the green run.
+- With Ghost green and teardown clean, the cfold phase is ready for a formal M2 claim.