status(prevb): ## DONE — M1+M2 Adversary-verified PASS (no VETO); dynamic base + previous/ + discourse PR#4 real-CI GREEN (official 3.5.3 migration tested)

machine-docs/BACKLOG-prevb.md

@@ -27,7 +27,7 @@ SSOT: `/srv/cc-ci/cc-ci-plan/plan-phase-prevb-previous-dynamic-base.md`.
       cryptpad #5 (data-continuity), keycloak #3 (origin/master fallback + realm-continuity, SSO/DEPS),
       hedgedoc #1 (simple). + discourse PR#4 real CI = 4 recipes. (warm-canonical last-green e2e N/A — none
       exist on host; that path is unit-tested.) Records reconciled: 717 artifacts durable, PR#4 "✅ passed".
-- [x] B9. CLAIM M2 (clean tree + STATUS WHAT/HOW/EXPECTED/WHERE) — awaiting Adversary, then `## DONE`.
+- [x] B9. M2 PASS @01:58Z (1c3ba71). Both M1+M2 fresh Adversary PASS, no VETO → ## DONE written.
 
 ## Adversary findings
 (Adversary-owned section — Builder does not edit below.)

machine-docs/JOURNAL-prevb.md

@@ -149,3 +149,10 @@ No warm canonicals to reconcile (none exist). Pre-existing warm-keycloak orphan
 
 Claiming M2. Adversary cold-verifies (re-read 717 junit / re-trigger !testme / re-run a spot-check); then
 I write ## DONE once REVIEW-prevb shows fresh M1+M2 PASS with no VETO.
+
+## 2026-06-17T01:58Z — M2 PASS → ## DONE
+
+Adversary M2 PASS (1c3ba71): all 6 M2 DoD items cold-verified incl. its own independent cryptpad#5 re-run;
+discourse 717 real-CI GREEN with live-swarm-image teeth (official 3.5.3, sidekiq gone); lint R011
+code-verified non-gating; public surface secret-clean; nothing merged. Both M1(01:03Z)+M2(01:58Z) fresh
+PASS, no VETO. DONE handshake satisfied → wrote ## DONE to STATUS-prevb. Phase prevb complete. Stopping loop.

machine-docs/STATUS-prevb.md

@@ -6,9 +6,29 @@ State files: this + BACKLOG-prevb.md, REVIEW-prevb.md (Adversary), JOURNAL-prevb
 ## Phase
 Started 2026-06-17. Gates: **M1** (implemented + green locally), **M2** (proven in real CI + spot-check).
 
-## Now
-- **M1: PASS** @2026-06-17T01:03Z (dbc7a3b), no VETO.
-- **Gate: M2 CLAIMED, awaiting Adversary** (claim commit below).
+## DONE
+
+Phase `prevb` COMPLETE @2026-06-17 — every Definition-of-Done item (plan §6) Adversary-verified with a
+fresh PASS, no VETO:
+- **M1: PASS** @2026-06-17T01:03Z (REVIEW-prevb, dbc7a3b) — dynamic base (last-green→main-tip→skip),
+  `previous/` base-only mechanism + version-guard/stale-flag, environmental vs version-specific overlay
+  split, discourse migrated off the static base + leaky overlay, unit tests; TEETH confirmed (deliberately
+  broken head → upgrade RED — base/prune/previous cannot mask it).
+- **M2: PASS** @2026-06-17T01:58Z (REVIEW-prevb, 1c3ba71) — discourse PR#4 `!testme` GREEN in REAL CI
+  (Drone **717**, bridge "✅ passed"; all 5 tiers junit 0-fail) with live-swarm-image proof the head ran
+  the official `discourse/discourse:3.5.3` (NOT bitnamilegacy) and `sidekiq` dropped → the official-image
+  migration is finally tested; 3 spot-checks green under dynamic base (cryptpad#5 data-continuity,
+  keycloak#3 realm-continuity via origin/master fallback, hedgedoc#1) incl. the Adversary's own cryptpad
+  re-run; public surface secret-clean; levels/records reconciled; nothing merged on any mirror.
+
+Notable in-scope fix surfaced by the phase: once the head genuinely ran the official image,
+`tests/discourse/custom/_discourse.py::mint_admin` (hardcoded the bitnamilegacy container path) had to
+become image-agnostic (b66abc4) — a direct, correct consequence of stopping the overlay from reverting
+the head. No test weakened.
+
+Carried forward (not prevb blockers): full all-recipe regression → phase `regall`; pre-existing unrelated
+red `test_warm_reconcile::test_traefik_spec_is_stateless_with_setup` [F-prevb-A]; low-sev mint_admin
+ApiKey-in-RAW-log [F-prevb-C] filed in DEFERRED.md.
 
 ## Gate: M2 — CLAIMED @2026-06-17T01:40Z (HEAD = this commit)