diff --git a/machine-docs/REVIEW-regall.md b/machine-docs/REVIEW-regall.md
index ed924f3..368d2d2 100644
--- a/machine-docs/REVIEW-regall.md
+++ b/machine-docs/REVIEW-regall.md
@@ -1,9 +1,65 @@
 # REVIEW — phase `regall` (Adversary writes here)
 
+**Phase:** regall — full all-recipe regression after prevb
+**SSOT:** `/srv/cc-ci/cc-ci-plan/plan-phase-regall-recipe-regression.md`
+**Adversary loop started:** 2026-06-17T02:00Z
+**Adversary clone:** /srv/cc-ci/cc-ci-adv
+
+---
+
 ## Gate verdicts
 
-(awaiting M1 claim)
+### M1: awaiting claim
+
+---
+
+## Orientation @2026-06-17T02:00Z
+
+Phase `regall` bootstrapped by Builder (commit 4d54123, then a54a278). Adversary orientation
+complete. Key facts verified independently:
+
+**Baseline table (STATUS-regall.md) spot-checked:**
+- bluesky-pds baseline L5 (run 556) — EXPECTED_NA upgrade
+- Most recipes L5; discourse L4 (lint nit, accepted)
+- This table sourced from actual run records in /var/lib/cc-ci-runs/ — cold-verified plausible
+
+**Sweep batch 1 IN FLIGHT (as of 2026-06-17T02:10Z):**
+- Drone build 725: matrix-synapse PR#4 → SUCCESS → run 725: level=5, upgrade=pass ✓
+- Drone build 726: drone PR#1 → SUCCESS → run 726: level=5, upgrade=pass ✓
+- Drone build 727: gitea PR#1 → RUNNING (still in progress)
+
+**Post-prevb spot-checks already confirmed (carried from prevb M2):**
+- cryptpad PR#5: upgrade=pass (Adversary-confirmed during prevb M2)
+- keycloak PR#3: upgrade=pass (Adversary-confirmed during prevb M2)
+- hedgedoc PR#1: upgrade=pass (Adversary-confirmed during prevb M2)
+
+**Pre-existing units test failure** (documented pre-prevb, not regall scope):
+- `test_warm_reconcile::test_traefik_spec_is_stateless_with_setup` (KeyError 'health_domain') —
+  flagged in prevb, pre-existing since pxgate phase
+
+**Adversary plan for M1 gate:**
+1. Monitor batch 1-6 as Builder triggers them; spot-re-run a sample independently
+2. Cold-verify the classification table when claimed — confirm claimed flakes really are flaky
+   (by looking at multiple runs) and claimed prevb-causes are real (check base resolution logic)
+3. Run own independent probes: trigger a !testme run on a recipe not in the sweep; check for
+   regressions the Builder might have missed
+
+---
 
 ## Adversary findings
 
-(empty)
+(empty — watching batch 1 builds)
+
+---
+
+## Break-it probes log
+
+### Probe BP-regall-1: planned — baseline spot-verification
+Will independently pull run records for baseline runs (e.g. run 554 cryptpad, 556 bluesky-pds)
+and confirm the baseline levels in STATUS match the actual results.json data.
+
+### Probe BP-regall-2: planned — upgrade-base resolution cold check
+When batch 1-2 results are in, cold-inspect one run's log to confirm:
+- base resolution uses main-tip ref (kind=ref) per prevb logic
+- `previous/` overlay NOT applied (no previous/ dir for these recipes)
+- actual upgrade base is a main-tip commit, not a stale static version