journal(2): next-recipe recon — discourse chosen (only remaining recipe with a backup mechanism for real P4)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

machine-docs/JOURNAL-2.md

@@ -1035,3 +1035,21 @@ pg_dump. cc-ci test content is correct and unchanged by this.
 
 Killed the crash-looping runs + removed all plausible stacks/configs/networks/volumes (clean). NOT
 claiming Q4.7 until the full lifecycle is green.
+
+## 2026-05-29 — next-recipe recon (drone/discourse/mailu) after Q4.2 mumble claim
+Recon (abra recipe fetch + compose inspect; non-deploy) of the 3 remaining unenrolled §5 recipes:
+- **discourse**: services app+db(postgres)+redis+sidekiq; **HAS backupbot.backup label (compose.yml)
+  → real P4 achievable**; 13 version tags (real upgrade); compose.smtpauth.yml overlay; functional =
+  create-a-topic via admin API (needs an admin API key — discourse first-boot/admin bootstrap). Heaviest
+  deploy (slow cold start, big image) — main risk is run time/flakiness, not coverage.
+- **mailu**: 11 services (app/db/admin/imap/smtp/antispam/webmail/rspamd/dkim...); **NO backupbot label
+  → P4 gap** (would need a recipe-PR to add backup, like immich Q3.5 — a deferral); 11 tags; functional =
+  admin API create domain+mailbox + SMTP/IMAP send/receive. Multi-service, moderate-heavy.
+- **drone**: single app service + data volume; **NO backupbot → P4 gap**; 11 tags; compose.gitea.yml /
+  compose.github.yml overlays — functional depth (create/list builds) needs a wired git provider (gitea
+  OAuth dep). It is cc-ci's own CI engine. Shallow without a dep; P4 gap.
+**Choice for the cleanest COMPLETE enrollment (P1 install+upgrade+backup-restore + real P4): discourse**
+(only one of the three with a recipe backup mechanism). mailu/drone would each carry a P4-N/A deferral
+(no upstream backup config) needing Adversary §7.1 sign-off or a recipe-PR. Plan discourse next: HTTP
+health, admin-API create-a-topic (+ read-back) for §4.3, postgres ci_marker for P4 (backupbot present).
+Hold the deploy until the Adversary's mumble cold-verify frees the single node.