review(prevb): M1 PASS — dynamic base (main-tip fallback live), previous/ base-only, overlay separated, head=official 3.5.3; TEETH: broken head → upgrade RED; clean teardown; no test weakened

machine-docs/REVIEW-prevb.md

@@ -78,7 +78,47 @@ UPDATE 2026-06-17T01:00Z (post-reboot, cold re-check of completed run):
 STILL TO CONFIRM: break-it `manual-1360025` → upgrade tier RED (broken head not papered over).
 
 ## Verdicts
-(none yet — M1 cold acceptance in flight)
+
+### M1: PASS @2026-06-17T01:03Z (code commit e1b32ea / claim bb79e91)
+Cold-verified from a fresh clone on cc-ci (`/root/cc-ci-adv-prevb`), independent of the Builder's tree.
+Every M1 DoD item (plan §4) re-executed and confirmed:
+
+1. **Dynamic base resolution (last-green → main-tip → skip).** e2e `manual-1344943` log: `upgrade base:
+   kind=ref ref=f87c612d71b4 (target-branch (main) tip)` — correctly falls back to main-tip (discourse has
+   NO last-green warm canonical and its only published tag is 0.7.0, behind main). Unit matrix re-run cold
+   (nix pytest, **64 passed**): override-wins / last-green-primary / main-tip-fallback / head==main-tip skip /
+   no-predecessor skip. Matrix EXPANDED vs old `upgrade_base`, not weakened.
+2. **`previous/` surface** (discovery + base-only application + version-guard/stale-flag): unit-covered
+   (`test_previous`), code-confirmed base-only (stripped before head redeploy via `perform_upgrade` →
+   `remove_previous_overlay` + COMPOSE_FILE strip). discourse ships NO `previous/` (base deploys clean) —
+   matches plan §3 thesis.
+3. **Environmental vs version-specific separated.** `tests/discourse/compose.ccci.yml` is env-only
+   (`app.deploy.update_config.order: stop-first`); bitnamilegacy image pins + `sidekiq` block removed;
+   `UPGRADE_BASE_VERSION` removed from `recipe_meta.py` (grep: none). Verified statically in cold clone.
+4. **discourse migrated** — confirmed via #3 + e2e behaviour.
+5. **discourse upgrade tier GREEN locally w/ proof head ran the REAL official image.** e2e `manual-1344943`:
+   generic `test_upgrade_reconverges` PASSED; discourse `test_head_runs_official_image_not_bitnamilegacy`
+   PASSED + `test_sidekiq_service_dropped_by_head` PASSED; RUN SUMMARY deploy-count=1 (expect 1),
+   install:pass, upgrade:pass, level=2/5. `upgrade→PR-head head_ref=ae5a8180 version=0.8.1+3.5.0→1.0.0+3.5.3`.
+6. **TEETH — deliberately-broken head still goes RED (base resolution did NOT paper it over).** Break-it
+   probe `manual-1360025`: broken-head commit `94ebaaa` sets head `app.image =
+   discourse/discourse:99.99.99-adversary-broken`. Base resolved to main-tip f87c612d (same as GREEN run),
+   **install:pass**, then the HEAD redeploy failed: `prepull: docker pull
+   discourse/discourse:99.99.99-adversary-broken failed — manifest unknown` → **upgrade:fail (level 1/5)**.
+   Proves the head's real (broken) image is what gets deployed; base/prune/previous machinery cannot mask a
+   broken head.
+7. **Clean teardown** after BOTH the GREEN run and the broken/failed run: `docker stack ls` / `secret ls` /
+   `volume ls` show NO discourse stack, secrets, or volumes. (warm-keycloak stack present = Builder's
+   concurrent spot-check, not discourse.)
+8. **No test weakened.** F-prevb-B addressed — `test_expected_na_other_rung_does_not_suppress_upgrade`
+   re-added (commit e1b32ea), present in cold clone. Net coverage up (+ resolver matrix + previous/ layering).
+
+SCOPE CAVEAT (not an M1 blocker): the FULL `tests/unit/` suite has 1 PRE-EXISTING unrelated red —
+`test_warm_reconcile.py::test_traefik_spec_is_stateless_with_setup` (KeyError 'health_domain'), failing
+identically at gtea-DONE 778720c, untouched by prevb (see [F-prevb-A]). prevb's own surface is all-green.
+
+(JOURNAL not consulted before this verdict, per anti-anchoring. M1 stands on the plan, the code/diff, the
+STATUS verification info, and my own cold re-runs.)
 
 ## Open VETOes
 (none)