status(dash): ## DONE — M1+M2 fresh Adversary PASS (3595e80, 4c0b289), no VETO

Per-recipe history now sources the full run list from local /var/lib/cc-ci-runs
artifacts; deployed (image 11ac2a1e6c07, 1/1) + verified live: bluesky-pds 8 in
exact host ts order, ghost 24/immich 28/discourse 25, plausible/custom-html
capped 30 newest; overview+badges 200; traversal/injection rejected; retention
no-trim. DoD plan §5 met.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

machine-docs/BACKLOG-dash.md

@@ -14,4 +14,4 @@
       (`sha256sum dashboard/dashboard.py | cut -c1-12`). Then verify live on `/recipe/bluesky-pds`
       (8 runs) + ≥2 recipes, overview + badges still 200, deploy-dashboard active, host health after.
 - [x] M2: retention confirmed — no trim job; does not trim `/var/lib/cc-ci-runs` (record in DECISIONS if a cap needed).
-- [ ] DONE: both gates Adversary-PASS in REVIEW-dash.md → write `## DONE` in STATUS-dash.md.
+- [x] DONE: both gates Adversary-PASS in REVIEW-dash.md → write `## DONE` in STATUS-dash.md.

machine-docs/STATUS-dash.md

@@ -3,7 +3,20 @@
 SSOT: /srv/cc-ci/cc-ci-plan/plan-phase-dash-recipe-history.md
 Gates: M1 (fix implemented + locally verified) · M2 (deployed + verified live)
 
-## Gate: M1 CLAIMED, awaiting Adversary
+## DONE
+
+Both gates fresh Adversary PASS in REVIEW-dash.md, no VETO:
+- **M1 PASS** @2026-06-17T16:30Z (claim 3595e80, cold) — local-artifact history sourcing.
+- **M2 PASS** @2026-06-17T16:40Z (claim 4c0b289, cold live) — deployed `cc-ci-dashboard:11ac2a1e6c07`
+  1/1; live `/recipe/<recipe>` shows full per-recipe history (bluesky-pds 8 in exact host ts order,
+  ghost 24, immich 28, discourse 25; plausible/custom-html capped 30 keeping newest); overview +
+  badges 200; live traversal/injection rejected; retention confirmed no-trim.
+
+DoD (plan §5) met: per-recipe history sources its run list from local `/var/lib/cc-ci-runs` artifacts,
+shows the full display-capped history, deployed + verified live on bluesky-pds + ≥2 recipes, other
+routes unaffected, dashboard stdlib-only + read-only, retention confirmed.
+
+## Gate: M1 PASS (84ac65f)
 
 **WHAT** — `history_for(recipe)` in `dashboard/dashboard.py` now sources the FULL per-recipe run
 history from the local run artifacts under `/var/lib/cc-ci-runs` (each run dir's `results.json`),
@@ -62,7 +75,7 @@ runs out of view, so most recipes showed 1 run). Overview (`/`), `/badge/<recipe
 - Status pill derived from the per-stage `results` map (`results.json` has no top-level status):
   any `fail`/`error` → failure; all `pass`/`skip` → success; else unknown.
 
-## Gate: M2 CLAIMED, awaiting Adversary
+## Gate: M2 PASS (7507cf4)
 
 **WHAT** — the dashboard service is rebuilt + redeployed with the M1 fix; the LIVE per-recipe
 history page now shows the full (display-capped) local-artifact history. Verified on `bluesky-pds`