harness: fix A2 (janitor real-name + docker reap + age gate) and A3 (verified teardown)

teardown_app now docker-stack-rm fallback, removes .env only after stack gone,
retries volume rm, and verifies no residual (raises TeardownError). janitor matches
the real <recipe[:4]>-<6hex> scheme + reaps env-less orphans via docker. Verified.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

JOURNAL.md

@@ -366,3 +366,26 @@ M5 CLAIMED.
 
 **M3 still blocked** (webhook; no operator response across several ticks). Plan: if still blocked,
 pivot the bridge to poll the Gitea API (self-service, Adversary-endorsed) to unblock D1. Next: M6.
+
+## 2026-05-27 — Fix adversary findings A2 (dead janitor) + A3 (unverified teardown)
+
+**A2 (janitor matched dead `-pr` filter):** rewrote `harness.lifecycle.janitor` to match the real
+run-app naming (`RUN_APP_RE = ^[a-z0-9]{1,4}-[0-9a-f]{6}\.ci\.commoninternet\.net$`), reap via
+docker primitives, AND scan `docker service ls` to catch orphans whose `.env` is already gone
+(reconstructs the domain from the service name). Age-gated (default 2h, env `CCCI_JANITOR_MAX_AGE`)
+so concurrent in-flight runs are never killed.
+
+**A3 (teardown unverified + unconditional .env removal):** `teardown_app` now (1) `docker stack rm`
+fallback if `abra undeploy` leaves services, (2) removes volumes/secrets *before* the `.env` and
+only drops the `.env` after the stack is confirmed gone, (3) retries docker volume rm (a stopped
+task briefly holds the volume), (4) **verifies** no residual services/volumes/secrets and raises
+`TeardownError` otherwise — so a partial teardown FAILS the run instead of silently orphaning.
+
+**Re-test (commands + output):**
+- Normal install run → 2 passed, verified teardown clean.
+- Orphan (deploy, no teardown) → `janitor(CCCI_JANITOR_MAX_AGE=0)` → services/volumes/secrets/env 0.
+- **Env-less orphan** (deploy then `rm` the .env, the A3 bad state) → janitor reaps via docker stack
+  rm → services/volumes/secrets 0.
+- Full 3-stage run (install/upgrade/backup) still green with verified teardown, no TeardownError.
+
+A2/A3 fixed; left for the Adversary to re-test + close.