review(cfold): M2 PASS full sweep green

machine-docs/REVIEW-cfold.md

@@ -116,8 +116,6 @@ Verdict: no new finding and no gate pending. Waiting for a formal `M2` claim or
 
 Verdict: no new finding and no gate pending. Waiting for a formal `M2` claim or a Builder inbox message.
 
----
-
 ## 2026-06-13T03:33:37Z — Idle audit; teardown still clean, no formal M2 claim
 
 - Cold rebase in `/srv/cc-ci/cc-ci-adv`: `git pull --rebase` -> `Already up to date.`
@@ -133,6 +131,39 @@ Verdict: no new finding and no gate pending. Waiting for a formal `M2` claim or
 
 ---
 
+## 2026-06-13T04:11:00Z — M2 PASS
+
+Cold verification from `/srv/cc-ci/cc-ci-adv` against Builder inputs in `machine-docs/STATUS-cfold.md`
+and claim commit `abe5e33`:
+
+- Drone build metadata check:
+  - `ssh cc-ci 'tok=$(cat /run/secrets/bridge_drone_token); curl -fsS -H "Authorization: Bearer $tok" https://drone.ci.commoninternet.net/api/repos/recipe-maintainers/cc-ci/builds/585 | jq -r "[.number,.status,.after,.params.RECIPE,.params.PR,.params.REF] | @tsv"'`
+  - -> `585  success  d44f799de945d0775933aad58726d46509154a64  ghost  5  d42d0f7c7cf9946077a583ffa3f7c96abfe94a77`
+- Ghost real-CI run artifact check:
+  - `ssh cc-ci 'jq -r "{level,recipe,ref,results,stages:(.stages|map({name,status}))}" /var/lib/cc-ci-runs/585/results.json'`
+  - -> `level: 5`, `recipe: ghost`, `ref: d42d0f7c7cf9`, `results.install=pass`, `results.upgrade=pass`, `results.backup=pass`, `results.restore=pass`, `results.custom=pass`; stages `install`, `upgrade`, `backup`, `restore`, `custom`, `lint` all `pass`
+- Ghost junit counts match the expected custom coverage and upgrade execution:
+  - `ssh cc-ci 'printf "ghost custom junit="; ls /var/lib/cc-ci-runs/585/junit/custom__cc-ci__*.xml | wc -l; printf " ghost upgrade junit="; ls /var/lib/cc-ci-runs/585/junit/upgrade*.xml | wc -l'`
+  - -> `ghost custom junit=4`, `ghost upgrade junit=2`
+- Focused same-code-path repro after the fix is green:
+  - `ssh cc-ci 'jq -r ".results, .stages" /var/lib/cc-ci-runs/ghost-repro-cfold-3/results.json'`
+  - -> `install: pass`, `upgrade: pass`; the upgrade stage contains both the generic reconvergence test and `tests.ghost.test_upgrade::test_upgrade_preserves_state`
+- Full sweep matrix audit remains green at the expected level/custom counts for all 20 enrolled recipes:
+  - `ssh cc-ci 'for spec in ...; do ...; done'`
+  - -> `bluesky-pds 556 level=5/5 custom=4/4`, `cryptpad 554 5/5 4/4`, `custom-html 541 5/5 4/4`, `custom-html-tiny 510 5/5 1/1`, `discourse 521 5/5 3/3`, `drone 506 5/5 1/1`, `ghost 585 5/5 4/4`, `hedgedoc 555 5/5 2/2`, `immich 522 5/5 3/3`, `keycloak 553 5/5 3/3`, `lasuite-docs 523 5/5 5/5`, `lasuite-drive 524 5/5 3/3`, `lasuite-meet 525 5/5 3/3`, `mailu 526 5/5 3/3`, `matrix-synapse 527 5/5 3/3`, `mattermost-lts 529 5/5 3/3`, `mumble 558 5/5 5/5`, `n8n 528 5/5 4/4`, `plausible 530 5/5 2/2`, `uptime-kuma 531 5/5 4/4`
+- Teardown remains clean after the sweep:
+  - `ssh cc-ci 'printf "live_pr_apps="; docker stack ls --format "{{.Name}}" | grep -c -- "-pr" || true'`
+  - -> `live_pr_apps=0`
+- Focused source audit of the final Ghost fix:
+  - `git diff ee6b613..d44f799 -- tests/ghost/compose.ccci.yml`
+  - shows the app-side race mitigation changed from a restart delay to a tiny DB-ready TCP wait wrapped around the existing `/abra-entrypoint.sh node current/index.js` boot path, with the pre-existing 15m app/db healthcheck grace preserved.
+
+Verdict: **M2 PASS**. The cfold phase now has a green full real-CI `!testme` sweep with unchanged
+L5 outcomes and expected canonical custom-test coverage across all enrolled recipes, plus zero leaked
+live `-pr` stacks. Fresh M1 and M2 PASSes are both present within 24h.
+
+---
+
 ## 2026-06-12T22:25:33Z — Idle break-it audit; still no M2 claim
 
 - Cold rebase in `/srv/cc-ci/cc-ci-adv`: `git pull --rebase` -> `Already up to date.`