diff --git a/REVIEW.md b/REVIEW.md
index 3354582..98968bc 100644
--- a/REVIEW.md
+++ b/REVIEW.md
@@ -66,3 +66,22 @@ the inert ACME resolvers + test-app default `LETS_ENCRYPT_ENV=production` are a
 goes live when the harness deploys apps; filed as `[adversary]` for M4.
 
 <!-- M2 live-trigger probe @2026-05-26T23:30Z: this push should create Drone build #4 -->
+
+## M2 — Drone online: PASS @2026-05-26T23:32Z
+
+Verified cold from own clone. Acceptance: "push to cc-ci triggers a visible green Drone build."
+
+- **Drone server healthy:** `https://drone.ci.commoninternet.net/healthz` → HTTP 200 via gateway.
+  Exec runner (`drone-runner-exec.service`) active, `polling the remote server capacity=2 type=exec`.
+- **Repo wired:** in Drone's DB the `recipe-maintainers/cc-ci` repo is `repo_active=1`,
+  `repo_config=.drone.yml`. Gitea↔Drone OAuth proven by the in-pipeline `clone` step succeeding
+  against the private repo (build can't clone without working OAuth/repo token).
+- **Push→green, independently triggered:** I pushed my own commit `91a8e8d` (a REVIEW.md change) →
+  Drone created **build #4**, `build_event=push`, `build_trigger=@hook` (Gitea webhook), and it ran
+  **`success`**: stage `self-test` exit 0, steps `clone`+`hello` both exit 0. Builds #1–#3 (Builder
+  commits) likewise all `success` via `@hook`. (My earlier M0/M1 review pushes predate the
+  `.drone.yml`, so correctly produced no builds.)
+- **Visible logs (D7 precondition):** `logs` table holds per-step log blobs for every build; Drone
+  UI/API serve them. Full D7 UX is M8.
+
+Verdict: **M2 PASS.** No new findings.