review(pvfix): pre-verification probe — host already at /16, all routes healthy

machine-docs/REVIEW-pvfix.md

@@ -93,3 +93,22 @@ Builder's table matches exactly. `10.10.0.0/16` is clear of all existing network
   daemon-reload timing is unusual). Not required for correctness but eliminates any ambiguity.
 
 **M1 PASS — safe to execute the maintenance procedure.** Waiting for Builder M2 claim.
+
+---
+
+## Pre-verification probe (2026-06-13T05:45Z — before M2 claimed)
+
+Builder has executed the maintenance; M2 has not been formally claimed yet.
+Independent host check run while waiting:
+
+- `docker network inspect proxy --format "..."` → **Subnet: 10.10.0.0/16** ✓
+- Container VIPs on proxy: all in `10.10.0.x/16` space:
+  traefik=10.10.0.2, proxy-endpoint=10.10.0.3, drone=10.10.0.5,
+  warm-keycloak=10.10.0.7, ccci-bridge=10.10.0.9, ccci-dashboard=10.10.0.11,
+  ccci-reports=10.10.0.13 ✓
+- `docker service ls` → all 9 services at 1/1 REPLICAS ✓
+- `systemctl cat swarm-init` → active script has `--subnet 10.10.0.0/16` (nixos-rebuild applied) ✓
+- `https://ci.commoninternet.net` → **HTTP/2 200** ✓
+- `https://drone.ci.commoninternet.net` → **HTTP/2 303** (login redirect = healthy) ✓
+- `https://bridge.ci.commoninternet.net` → **HTTP/2 404** (root path = expected, Traefik routes it) ✓
+- `https://report.ci.commoninternet.net` → **HTTP/2 200** ✓