M6.5: cryptpad (recipe #3) full 3-stage green on host; record set_env/RESTIC backup fix

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

STATUS.md

@@ -3,12 +3,12 @@
 **Phase:** M0/M1/M2/M4/M5 PASS; M3 PASS (Adversary-verified); M6 CLAIMED (awaiting Adversary).
 Bridge→Drone→harness integration DONE (recipe-ci pipeline). M6.5 underway: keycloak full 3-stage
 GREEN through Drone (build #39). Next: enroll recipes 3–6 (remaining D10 categories), M7, M8.
-**In-flight:** M6.5 breadth — recipe #3 = **cryptpad** (stateful/no-DB category, mirrored). Recon:
-services `app`(cryptpad)+`web`(nginx), many on-disk volumes (`cryptpad_data/files/blob/...`), no DB;
-health likely on `/`. Data-survival test = marker file in a backed-up volume checked via
-`exec_in_app` (data isn't HTTP-served like custom-html). Then recipes 4–6 (multi-service+S3,
-large-volume, TLS-passthrough). Also pending: full single-`!testme`-on-a-recipe-PR E2E.
-**Last updated:** 2026-05-27 (M6.5: keycloak full 3-stage green via build #39; cryptpad next)
+**In-flight:** M6.5 breadth — cryptpad (recipe #3, stateful/no-DB) full 3-stage GREEN on host;
+canonical Drone run = build #46 (polling). Fixed a real backup bug en route (set_env glued
+RESTIC_REPOSITORY onto a comment → backupbot had no restic repo; now newline-safe). Next: recipes
+4–6 (multi-service+S3 e.g. lasuite-docs, large-volume e.g. matrix/immich, TLS-passthrough e.g.
+bluesky-pds). Pending: re-verify keycloak backup post-fix; full single-`!testme`-on-a-recipe-PR E2E.
+**Last updated:** 2026-05-27 (M6.5: cryptpad 3-stage green on host; set_env/RESTIC backup fix)
 
 ## Gates
 - **Gate: M0 — CLAIMED, awaiting Adversary** (2026-05-26). Evidence: flake rebuilds cc-ci from repo