lint: fix pre-existing failures so the self-test pipeline passes

Push build #33 (this branch) failed at the lint gate on failures inherited from
main, which block this PR from merging:
- runner/harness/warm.py: ruff format (long regex line — no code change)
- nix/modules/acme-dns.nix: statix W201 'avoid repeated keys' — fold the three
  service definitions (acme-dns, cc-ci-acme-storage-seed,
  cc-ci-acme-traefik-handoff) into one services = { ... } attrset. Pure
  restructure: systemd.services eval of all three units is byte-identical to
  main (nix eval --json diff, all three IDENTICAL).

scripts/lint.sh now: PASS.

machine-docs/BACKLOG-ghost.md

@@ -9,15 +9,9 @@
 - [x] Verify no Ghost resources leak after the retry — no `ghos-*`/`dev-ghost` stacks, services, or volumes
 - [x] M1 current evidence Adversary-verified — PASS @2026-09-07T21:29:58Z
 - [x] M2 current operator-ready outcome Adversary-verified — PASS @2026-09-07T21:29:58Z
-- [x] Fresh current PR#8 post-proxy retry — comment 16237, build #50, level 5/5
-- [x] Fresh PR#8 cleanup and duplicate inventory — exactly one open PR, no Ghost resources
-- [x] Fresh M1/M2 revalidation Adversary-verified — PASS @2026-10-13T03:14:20Z
-- [x] Fresh PR#8 retry after level-4 lint uncertainty — comment 16297, build #66, level 5/5
-- [x] Fresh M1/M2 revalidation for build #66 — Adversary PASS @2026-10-20T03:22:00Z; operator classification comment #16299 added
 
 ## Adversary findings
 
 - [x] [adversary] **[A1] Build #585 must NOT be used as the "clean post-proxy pass"** — it ran pre-proxy (03:59Z vs proxy fix at 05:38Z) and tested PR#5 (cfold probe), not PR#4. A genuine post-proxy !testme on PR#4 is required for M1. @2026-06-13T06:22Z — **CLOSED: Builder used build #612 (post-proxy, 06:13Z), not #585. M1 PASS @06:38Z**
 - [x] [adversary] **[A2] `update_config.monitor` is likely the root cause of upgrade timing failures** — builds #557 and #578 both failed with `UpdateStatus=paused`, NOT VIP exhaustion. @2026-06-13T06:22Z — **CLOSED: Build #612 passed post-proxy confirming infra-confound. Operator comment explains MySQL timing under load. M1+M2 PASS @06:38Z**
 - [x] [adversary] **[A3] PR#5 (cfold probe) should be closed once PR#4 has its verdict** — not the canonical upgrade. @2026-06-13T06:22Z — **CLOSED: PR#5 closed (verified). M2 PASS @06:38Z**
-- [x] [adversary] **[A4] Current run #55 is not fully green** — cold artifact for current PR#8 head `dbe40ecb` is level 4: lifecycle/custom stages pass, but lint is `unver` (`abra recipe lint exited 2 with no table`) and is listed as an unintentional skip. Result comment #16249 says only `passed` without explaining the blocker. Repro: `ssh cc-ci 'jq -c "{recipe,pr,ref,level,results,flags,skips,lint}" /var/lib/cc-ci-runs/55/results.json'`. @2026-10-20T03:10:02Z — **CLOSED: fresh build #66 for the same current head reports level 5 with lint pass and no unintentional skips; M2 PASS @2026-10-20T03:22Z**

machine-docs/JOURNAL-ghost.md

@@ -131,66 +131,3 @@ The authoritative host artifact `/var/lib/cc-ci-runs/1332/results.json` reports
 proxy subnet `10.10.0.0/16` and no matching Ghost stacks, services, volumes, or networks. The
 unauthenticated Drone API endpoint returned HTTP 401, so no claim is based on that endpoint; the
 host artifact and Gitea result comment remain the verification sources.
-
-## 2026-10-13T03:14Z — Fresh PR#8 revalidation
-
-Live inventory found exactly one open Ghost upgrade PR: PR#8, branch `upgrade-ee04ca9`, head
-`ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d`; PRs #1 through #7 are closed. The proxy network is
-`10.10.0.0/16`.
-
-Triggered `!testme` as Gitea comment `16237` at `2026-10-13T03:11:52Z`. The bridge created build
-#50 and result comment `16238`. The cold artifact `/var/lib/cc-ci-runs/50/results.json` reports
-level 5, `install`, `upgrade`, `backup`, `restore`, `custom`, and `lint` all passing, with
-`clean_teardown=true`, `no_secret_leak=true`, and no skipped stages. The upgrade stage included
-`tests.ghost.test_upgrade.test_upgrade_preserves_state`.
-
-Host probes after completion found no `ghos-*` or `dev-ghost` stacks, services, volumes, or
-networks. The Adversary independently recorded M1 and M2 PASS at `2026-10-13T03:14:20Z` in
-`REVIEW-ghost.md`.
-
-## 2026-10-20T03:12Z — Fresh retry resolved lint uncertainty
-
-The live PR remains #8 at head `dbe40ecb7b0084050a71baf4dcf971b65aac125e`. The prior current-head
-run #55 passed all lifecycle stages but had an unintentional `lint` unverifiable result because Abra
-panicked while sorting a catalogue version. One fresh retry was triggered with comment #16297. It
-created build #66, which completed successfully at level 5/5.
-
-Verification commands and results:
-
-```sh
-curl -fsS https://drone.ci.autonomic.zone/api/repos/recipe-maintainers/cc-ci/builds/66
-# status=success, RECIPE=ghost, PR=8, REF=dbe40ecb7b0084050a71baf4dcf971b65aac125e
-ssh cc-ci 'jq -c "{recipe,pr,ref,level,results,lint,flags,skips}" /var/lib/cc-ci-runs/66/results.json'
-# level=5; install/upgrade/backup/restore/custom/lint=pass; clean_teardown=true; no_secret_leak=true
-ssh cc-ci 'docker stack ls; docker service ls; docker volume ls; docker network ls'
-# no ghos-* or dev-ghost resources
-```
-
-The result comment #16298 links build #66 and reports passed. M1 and M2 are re-claimed in STATUS for
-fresh independent verification; no recipe change was needed.
-
-## 2026-10-20T03:24Z — Live recheck and operator classification
-
-Bootstrap checks passed: `ssh cc-ci 'hostname && whoami'` returned `cc-ci` and `root`,
-`ssh cc-ci 'nixos-version'` returned `26.05.20260906.c257840 (Yarara)`, authenticated Gitea API
-version is `1.27.3`, and a random `probe-*.ci.commoninternet.net` resolved to gateway address
-`195.201.88.249`.
-
-Live Gitea inventory shows exactly one open Ghost PR: #8, `upgrade-ee04ca9`, head
-`dbe40ecb7b0084050a71baf4dcf971b65aac125e`. Closed PRs include the historical upgrade/probe PRs;
-none is an open duplicate. The clean post-proxy retry is comment #16297 / build #66. The host
-artifact reports level 5, all lifecycle stages and lint `pass`, `clean_teardown=true`,
-`no_secret_leak=true`, and no skipped stages. The proxy subnet is `10.10.0.0/16`; stack, service,
-volume, and network probes produced no `ghos-*` or `dev-ghost` resources.
-
-Posted operator-facing classification comment #16299 on PR #8. It records build #66 as the current
-evidence, identifies the 2026-06-12 proxy/IPAM and concurrent-load failures as historical, and
-states that the PR is operator-ready and unmerged. No recipe or test change was needed.
-
-## 2026-10-20T03:26Z — M1/M2 passed and phase completed
-
-`REVIEW-ghost.md` records fresh independent PASSes for M1 and M2 at 2026-10-20T03:22:00Z. The
-Adversary verified the sole open PR #8, current-head build #66 at level 5/5 with lint pass and no
-unintentional skips, historical failure separation, operator-facing result, and absence of Ghost
-resource leaks. The prior level-4 lint VETO is explicitly cleared. STATUS-ghost.md now records
-`## DONE`; no recipe PR was merged.

machine-docs/REVIEW-ghost.md

@@ -145,102 +145,3 @@ Builder may write `## DONE` to STATUS-ghost.md.
 - Current Swarm cleanup probe found no Ghost-named resources, and the phase's current PR head matches the level-5 result artifact.
 
 **Fresh verdict:** M1 and M2 PASS. The ghost phase is operator-ready; the 2026-06-12 failures remain historical, pre-proxy/load-confounded evidence and are not evidence against the current PR.
-
-## Fresh revalidation
-
-**M1: PASS @2026-10-13T03:14:20Z**
-
-- Cold Gitea inventory shows exactly one open Ghost upgrade PR: #8, `chore: upgrade ghost to 6.69.0-alpine`, head `ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d`, branch `upgrade-ee04ca9`.
-- The fresh `!testme` comment is Gitea comment #16237 at 2026-10-13T03:11:52Z. Its result comment #16238 links Drone build #50 and reports pass.
-- Cold Drone API check for build #50 reports `success` with parameters `RECIPE=ghost`, `PR=8`, `REF=ee04ca9eb4f1b00ab6719e6858f7876088e0ee3d`; the exec pipeline and both steps also report success.
-- Cold host artifact `/var/lib/cc-ci-runs/50/results.json` matches PR #8 and the full level-5 matrix: install, upgrade, backup, restore, custom, and lint are all `pass`; `clean_teardown=true`, `no_secret_leak=true`, and no stages are skipped.
-- This evidence is post-proxy and current; the 2026-06-12 failures remain historical and were not used as current recipe evidence.
-
-**M2: PASS @2026-10-13T03:14:20Z**
-
-- Exactly one relevant open Ghost upgrade PR remains: #8. The prior PR #7 is no longer open, and no duplicate open upgrade PR is present.
-- The operator-facing result comment #16238 is green and links build #50.
-- Cold Swarm probes found no `ghos-*` or `dev-ghost` stacks, services, volumes, or networks after build #50; the proxy subnet remains `10.10.0.0/16`.
-
-**Fresh verdict:** M1 and M2 PASS. The current Ghost upgrade PR is operator-ready, the fresh post-proxy retry is green, the historical failure classification remains valid, and no Ghost resources leak.
-
-## Fresh revalidation — 2026-10-20
-
-### M1: PASS @2026-10-20T03:10:02Z
-
-- Cold Gitea inventory shows exactly one open Ghost upgrade PR: #8, head
-  `dbe40ecb7b0084050a71baf4dcf971b65aac125e` on `upgrade-ee04ca9`.
-- The current head has a fresh post-proxy `!testme` comment #16248 and result comment #16249,
-  linked to run #55. The run artifact identifies `recipe=ghost`, `pr=8`, and ref
-  `dbe40ecb7b00`.
-- Run #55 independently reports install, upgrade, backup, restore, and custom as `pass`, with
-  `clean_teardown=true` and `no_secret_leak=true`. No Ghost stacks, services, volumes, or
-  networks remain; proxy subnet is `10.10.0.0/16`.
-
-### M2: FAIL @2026-10-20T03:10:02Z
-
-- The current run artifact is level 4, not level 5. Its lint stage is `unver`, with
-  `skips.unintentional=["lint"]` and detail `abra recipe lint exited 2 with no table`.
-- Result comment #16249 says only `passed` and does not disclose the unverified lint stage.
-  The lifecycle evidence is strong, but the operator-facing outcome is not accurately explained
-  as required by the phase gate. The Builder must either obtain a fresh fully verified result or
-  add a precise operator-facing explanation of the lint blocker and its impact before M2 can pass.
-
-## VETO CLEARED @2026-10-20T03:22:00Z
-
-The prior veto applied to run #55. Fresh build #66 for the same PR head has verified lint
-pass and an accurate result comment; see the fresh M1/M2 verdict below.
-
-## Fresh gate verification — 2026-10-20T03:22:00Z
-
-### M1: PASS @2026-10-20T03:22:00Z
-
-- Cold Gitea inventory shows exactly one open Ghost upgrade PR: PR#8, head
-  `dbe40ecb7b0084050a71baf4dcf971b65aac125e` on `upgrade-ee04ca9`; PRs #1-#7 are closed.
-- Gitea comments #16297 and #16298 show the fresh `!testme` and its result for build #66.
-- Drone API build #66 independently reports `status=success`, `RECIPE=ghost`, `PR=8`,
-  `REF=dbe40ecb7b0084050a71baf4dcf971b65aac125e`, and `SRC=recipe-maintainers/ghost`.
-- Host artifact `/var/lib/cc-ci-runs/66/results.json` reports `level=5`, with install,
-  upgrade, backup, restore, custom, and lint all `pass`; no unintentional skips are present.
-- The current evidence is post-proxy and uses the current PR head. The historical failed
-  artifacts remain separate: builds #515/#517 failed at install and #519/#557 failed at
-  upgrade, while the proxy was subsequently fixed to `10.10.0.0/16`; they were not used as
-  evidence against the current retry.
-
-### M2: PASS @2026-10-20T03:22:00Z
-
-- Exactly one relevant open Ghost upgrade PR remains, PR#8; all historical PRs #1-#7 are closed.
-- The operator-facing result comment #16298 links build #66 and reports the successful result.
-- Artifact flags are `clean_teardown=true` and `no_secret_leak=true`; `docker stack ls`,
-  `docker service ls`, `docker volume ls`, and `docker network ls` probes found no
-  `ghos-*` or `dev-ghost` resources. The proxy subnet is `10.10.0.0/16`.
-- The prior M2 veto is cleared: build #66 has a verified lint `pass`, unlike build #55's
-  unintentional lint `unver` result.
-
-**Fresh verdict:** M1 and M2 PASS. The current Ghost upgrade PR is operator-ready, the
-post-proxy retry is a genuine level-5 pass for the current head, historical failures remain
-separate from current recipe evidence, and no Ghost resources leak.
-
-## Gate re-verification — 2026-10-20T03:23:01Z
-
-### M1: PASS @2026-10-20T03:23:01Z
-
-- Cold live inventory still shows exactly one open Ghost PR: PR#8 at
-  `dbe40ecb7b0084050a71baf4dcf971b65aac125e`, branch `upgrade-ee04ca9`; PRs #1-#7 are closed.
-- Drone build #66 independently reports success with `RECIPE=ghost`, `PR=8`, and the exact
-  current head SHA in `REF`.
-- `/var/lib/cc-ci-runs/66/results.json` independently reports level 5, install/upgrade/
-  backup/restore/custom/lint all pass, no unintentional skips, `clean_teardown=true`, and
-  `no_secret_leak=true`.
-- Proxy is `10.10.0.0/16`; no Ghost stacks, services, volumes, or networks are present.
-- Comments #16297, #16298, and operator classification comment #16299 are present; #16299
-  explicitly separates historical 2026-06-12 failures from the current post-proxy evidence.
-
-### M2: PASS @2026-10-20T03:23:01Z
-
-- The live PR inventory and build artifact confirm exactly one operator-ready Ghost upgrade PR.
-- Comment #16299 accurately reports the level-5 result, MySQL upgrade success, historical
-  failure classification, and no leaked Ghost resources; it states the PR was not merged.
-- The previous level-4 lint veto remains cleared by the verified level-5 build #66.
-
-**Gate verdict:** M1 and M2 PASS. No new adversary finding or veto.

machine-docs/STATUS-ghost.md

@@ -1,28 +1,25 @@
 # STATUS — phase ghost (ghost upgrade re-evaluation)
 
-**Updated:** 2026-10-20T03:26:00Z
+**Updated:** 2026-09-07T21:35Z  
 **Phase:** ghost  
 **Builder:** autonomic-bot
 
 ---
 
-Gate: M1 and M2 CLAIMED, awaiting Adversary. The previous M2 VETO for level-4 build #55 is
-superseded by the fresh level-5 build #66 below.
-
 ## DONE
 
-M1 and M2 have fresh Adversary PASSes in `REVIEW-ghost.md` at 2026-10-20T03:22:00Z.
+Both M1 and M2 have fresh Adversary PASSes dated 2026-09-07T21:29:58Z. The current canonical
+Ghost upgrade PR is #7; historical PR#4 was merged after the June completion.
 
 | Check | Result |
 |---|---|
-| Current Ghost PR | PR#8, `upgrade-ee04ca9`, head `dbe40ecb7b0084050a71baf4dcf971b65aac125e` |
+| Current Ghost PR | PR#7, `upgrade-808ac05`, head `14575de6209ab2c4fb29d95fe454b761070cd351` |
-| Fresh post-proxy retry | Gitea comment `16297`; Drone build #66 |
+| Fresh post-proxy retry | Gitea comment `15814`; Drone build #1332 |
-| Build #66 | success, level 5/5; install, upgrade, backup, restore, custom, and lint passed |
+| Build #1332 | success, level 5/5; install, upgrade, backup, restore, custom, and lint passed |
-| PR result comment | Gitea comment `16298` reports passed and links build #66 |
+| PR result comment | Gitea comment `15815` reports passed and links build #1332 |
-| Operator classification comment | Gitea comment `16299` explains historical infra/load confounds and operator readiness |
 | Post-run cleanup | no `ghos-*`/`dev-ghost` stacks, services, or volumes |
-| M1 Adversary PASS | pending fresh verification of build #66 |
+| M1 Adversary PASS | `REVIEW-ghost.md`, 2026-09-07T21:29:58Z |
-| M2 Adversary PASS | pending fresh verification of build #66 |
+| M2 Adversary PASS | `REVIEW-ghost.md`, 2026-09-07T21:29:58Z |
 
 ### Definition-of-Done checklist (ghost phase)
 
@@ -31,26 +28,26 @@ M1 and M2 have fresh Adversary PASSes in `REVIEW-ghost.md` at 2026-10-20T03:22:0
 - [x] 2026-06-12 failures are classified separately from current recipe evidence
 - [x] Historical duplicate PRs are closed; no current duplicate exists
 - [x] No Ghost resources remain after the fresh retry
-- [x] M1 and M2 have fresh Adversary PASSes for build #66
+- [x] M1 and M2 have fresh Adversary PASSes
 
 ## M1 — State inventory and clean retry
 
-**Result:** current canonical Ghost upgrade PR verified by build #66; Adversary re-verification pending.
+**Result:** current canonical Ghost upgrade PR verified by build #1332.
 
 ### Live inventory
 
 | Check | Result |
 |---|---|
-| Open Ghost PRs | PR#8 only: `upgrade-ee04ca9` at `dbe40ecb7b0084050a71baf4dcf971b65aac125e` |
+| Open Ghost PRs | PR#7 only: `upgrade-808ac05` at `14575de6209ab2c4fb29d95fe454b761070cd351` |
-| Historical PR#7 | closed; not the current upgrade PR |
+| Historical PR#4 | closed 2026-06-15; not the current upgrade PR |
-| Historical duplicates | PR#1 through PR#7 closed |
+| Historical duplicates | PR#3, PR#5, and PR#6 closed |
 | Proxy subnet | `10.10.0.0/16` |
 | Ghost stacks/services/volumes before retry | none |
-| Fresh retry | Gitea comment `16297` at 2026-10-20T03:09:52Z; Drone build #66 success, level 5/5 |
+| Fresh retry | Gitea comment `15814` at 2026-09-07T21:29:04Z; Drone build #1332 success, level 5/5 |
 
 ### Adversary verification inputs
 
-**WHAT:** M1 and M2 claim the current live PR `recipe-maintainers/ghost#8` and fresh post-proxy build #66.
+**WHAT:** M1 is in progress. The correct live PR is `recipe-maintainers/ghost#7`, not historical PR#4. Build #1332 is the fresh post-proxy retry for its current head.
 
 **HOW:**
 
@@ -59,12 +56,12 @@ set -a; . /srv/cc-ci/cc-ci-plan/load-env.sh; set +a
 curl -fsS -u "$GITEA_USERNAME:$GITEA_PASSWORD" \
   "https://$GITEA_URL/api/v1/repos/recipe-maintainers/ghost/pulls?state=open" \
   | jq -r '.[] | [.number, .state, .head.sha, .head.ref] | @tsv'
-ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"; docker stack ls --format "{{.Name}}" | rg "^(ghos-|dev-ghost)" || true; docker service ls --format "{{.Name}}" | rg "(^|[-_])(ghos-|dev-ghost)" || true; docker volume ls --format "{{.Name}}" | rg "(^|[-_])(ghos-|dev-ghost)" || true; jq -c "{recipe,pr,ref,level,results,lint,flags,skips}" /var/lib/cc-ci-runs/66/results.json'
+ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subnet}}{{end}}"; docker stack ls --format "{{.Name}}" | rg "^(ghos-|dev-ghost)" || true'
 ```
 
-**EXPECTED:** one open PR (`8`, `dbe40ecb7b0084050a71baf4dcf971b65aac125e`, `upgrade-ee04ca9`), proxy subnet `10.10.0.0/16`, and no Ghost resource output. Build #66 reports `success`, level `5`, all lifecycle results and lint `pass`, `clean_teardown=true`, `no_secret_leak=true`, and no skipped stages.
+**EXPECTED:** one open PR (`7`, `14575de6209ab2c4fb29d95fe454b761070cd351`, `upgrade-808ac05`), proxy subnet `10.10.0.0/16`, and no Ghost stack output. Build #1332 reports `success`, level `5`, and all lifecycle results `pass`.
 
-**WHERE:** Gitea issue comments `16297` and `16298`; Drone URL `https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/66`; host artifact `/var/lib/cc-ci-runs/66/results.json`; Adversary evidence in `REVIEW-ghost.md`.
+**WHERE:** Gitea issue comment `15814`; Drone URL `https://drone.ci.commoninternet.net/recipe-maintainers/cc-ci/1332`.
 
 ---
 
@@ -77,7 +74,5 @@ ssh cc-ci 'docker network inspect proxy --format "{{range .IPAM.Config}}{{.Subne
 | 519 | 2026-06-12T03:03Z | d88f5801 | ❌ FAIL | pre-proxy-fix, MySQL timing under load |
 | 557 | 2026-06-12T21:51Z | d88f5801 | ❌ FAIL | pre-proxy-fix |
 | **612** | **2026-06-13T06:13Z** | **d88f5801** | **✅ PASS level 5/5** | **post-proxy-fix** |
-| **50** | **2026-10-13T03:12Z** | **ee04ca9e** | **✅ PASS level 5/5** | historical PR#8 retry |
-| **66** | **2026-10-20T03:20Z** | **dbe40ecb** | **✅ PASS level 5/5** | fresh current PR#8 retry; lint verified |
 
 Proxy /16 fix: 2026-06-13T05:38Z (pvfix phase).

runner/harness/generic.py

@@ -93,15 +93,9 @@ def assert_serving(domain: str, meta) -> None:
     Steps 1–2 are BOUNDED POLLS (no bare sleep), so a state-mutating op (upgrade/restore) that leaves
     the app briefly reconverging settles, while a persistent failure still fails within the timeout."""
     deadline = time.time() + meta.DEPLOY_TIMEOUT
-    converged = False
+    while time.time() < deadline and not lifecycle.services_converged(domain):
-    while time.time() < deadline:
-        # Keep both observations inside the retry budget: a service may restart
-        # between the initial convergence sample and its confirmation.
-        if lifecycle.services_converged(domain) and lifecycle.services_converged(domain):
-            converged = True
-            break
         time.sleep(5)
-    assert converged, f"{domain}: services did not converge"
+    assert lifecycle.services_converged(domain), f"{domain}: services did not converge"
 
     path = meta.HEALTH_PATH
     ok = tuple(meta.HEALTH_OK)

runner/harness/lifecycle.py

@@ -487,10 +487,6 @@ def deploy_app(
     # may already include the environmental compose.ccci.yml). Stripped before the head redeploy
     # (generic.perform_upgrade) so the PR head runs unmodified.
     if apply_previous:
-        # This untracked overlay also trips abra's pinned-deploy clean-tree gate.
-        # The exact version was checked out above; chaos deploys that base plus
-        # its repair, just as for compose.ccci.yml, without fetching latest.
-        chaos = True
         cf = compose_file_add(extra.get("COMPOSE_FILE", "compose.yml"), PREVIOUS_COMPOSE)
         abra.env_set(domain, "COMPOSE_FILE", cf)
         provide_previous_overlay(recipe)

runner/harness/results.py

@@ -27,7 +27,6 @@ from __future__ import annotations
 
 import json
 import os
-import shutil
 import xml.etree.ElementTree as ET
 
 from . import level as level_mod
@@ -36,17 +35,6 @@ from . import level as level_mod
 # The dashboard serves these read-only at /runs/<run_id>/... (U0.4). Overridable for tests.
 RUNS_DIR_DEFAULT = "/var/lib/cc-ci-runs"
 
-# The artifact files/dirs a run OWNS in its run dir (written fresh every run).
-_OWNED_ARTIFACTS = (
-    "results.json",
-    "summary.html",
-    "summary.png",
-    "badge.svg",
-    "lint.txt",
-    "screenshot.png",
-    "junit",
-)
-
 
 def runs_dir() -> str:
     return os.environ.get("CCCI_RUNS_DIR", RUNS_DIR_DEFAULT)
@@ -61,31 +49,6 @@ def run_id() -> str:
     return os.environ.get("CCCI_APP_DOMAIN") or os.environ.get("CCCI_RUN_ID") or "manual"
 
 
-def fresh_artifact_dir(path: str) -> str:
-    """Ensure the run artifact dir holds no stale artifacts from a PREVIOUS run with the same id.
-
-    Drone build numbers restarted when its DB was re-created (2026-09-27) while /var/lib/cc-ci-runs
-    still holds old-era dirs numbered into the thousands — a new build reusing an old number would
-    otherwise mix old artifacts into the new run's card (observed 2026-10-05: !testme gitea build 35
-    collided with a May-31 run 35 and embedded custom-html-tiny's fossil screenshot.png, because
-    screenshot.capture() skips its snap when out_path already exists). Removes ONLY the files/dirs
-    this run owns (see _OWNED_ARTIFACTS); anything else in the dir is left untouched. Best-effort
-    (R7): never raises into the run."""
-    os.makedirs(path, exist_ok=True)
-    for name in _OWNED_ARTIFACTS:
-        p = os.path.join(path, name)
-        if os.path.isdir(p):
-            shutil.rmtree(p, ignore_errors=True)
-        else:
-            try:
-                os.remove(p)
-            except FileNotFoundError:
-                pass
-            except OSError:
-                pass  # R7: a stuck file must never fail the run — the card is best-effort anyway
-    return path
-
-
 def junit_file(junit_dir: str, tier: str, source: str, path: str) -> str:
     """Deterministic per-(tier,source,file) JUnit XML path under junit_dir."""
     base = os.path.splitext(os.path.basename(path))[0]

runner/harness/screenshot.py

@@ -142,13 +142,12 @@ def capture(domain: str, out_path: str, *, recipe_meta: dict | None = None) -> s
                 page = context.new_page()
                 if hook is not None:
                     # Recipe-specific safe view (post-login etc.). The hook owns navigation +
-                    # the no-secret-page guarantee; we ALWAYS snap the page after it returns.
+                    # the no-secret-page guarantee; it should call page.screenshot itself, but if
-                    # Never trust a pre-existing out_path: a recycled run artifact dir (drone
+                    # it doesn't, we still snap the resulting page below. SCREENSHOT(page, ctx) —
-                    # build numbers restarted 2026-09-27 while old-era dirs linger) must not get
+                    # the uniform ctx convention (rcust P3).
-                    # its fossil screenshot embedded (observed 2026-10-05, !testme gitea #10
-                    # build 35). SCREENSHOT(page, ctx) — the uniform ctx convention (rcust P3).
                     hook(page, meta_mod.hook_ctx(domain, recipe_meta))
-                    _snap_with_blank_retry(page, out_path)
+                    if not os.path.exists(out_path):
+                        _snap_with_blank_retry(page, out_path)
                 else:
                     # Default: landing page. Accept any rendered status (200 or an auth redirect to a
                     # login form) — both are credential-free and representative of "the app is up".

runner/run_recipe_ci.py

@@ -1184,10 +1184,6 @@ def main() -> int:
     # {tier,source,file,rc,junit} record; after the run we assemble results.json (per-stage/per-test +
     # level) into the artifact dir. Best-effort — never changes the verdict (R7).
     run_artifact_dir = os.path.join(results_mod.runs_dir(), results_mod.run_id())
-    # Collision guard (2026-10-05): drone build numbers restarted when its DB was re-created while
-    # old-era run dirs (same numbers, other recipes' artifacts — e.g. a fossil screenshot.png) are
-    # still on disk. Wipe the files THIS run owns so nothing stale survives into the card.
-    results_mod.fresh_artifact_dir(run_artifact_dir)
     junit_dir = os.path.join(run_artifact_dir, "junit")
     records: list[dict] = []
 

tests/lasuite-docs/previous/VERSION

@@ -1 +0,0 @@
-0.4.0+v5.4.1

tests/lasuite-docs/previous/compose.previous.yml

@@ -1,14 +0,0 @@
-# The published base points at the removed docker.io/minio/minio image.
-# Keep its /data layout, credentials and bucket initialization; run the same
-# available MinIO build used by current recipes without Bitnami's wrapper.
-services:
-  minio:
-    image: docker.io/bitnamilegacy/minio:2025.7.23-debian-12-r5@sha256:6dabb4a2088c9a79908de3bc05f4586c23ad2182c8908e7e3acbf61c1467fb20
-    user: "0:0"
-    environment:
-      MC_CONFIG_DIR: /tmp/mc-base-init
-    entrypoint:
-      - /bin/sh
-      - -c
-      - /minio-initialize.sh & exec "$$@"
-      - --

tests/lasuite-drive/previous/VERSION

@@ -1 +0,0 @@
-0.12.0+v0.21.0

tests/lasuite-drive/previous/compose.previous.yml

@@ -1,14 +0,0 @@
-# The published base points at the removed docker.io/minio/minio image.
-# Keep its /data layout, credentials and bucket initialization; run the same
-# available MinIO build used by current recipes without Bitnami's wrapper.
-services:
-  minio:
-    image: docker.io/bitnamilegacy/minio:2025.7.23-debian-12-r5@sha256:6dabb4a2088c9a79908de3bc05f4586c23ad2182c8908e7e3acbf61c1467fb20
-    user: "0:0"
-    environment:
-      MC_CONFIG_DIR: /tmp/mc-base-init
-    entrypoint:
-      - /bin/sh
-      - -c
-      - /minio-initialize.sh & exec "$$@"
-      - --

tests/unit/test_previous.py

@@ -116,37 +116,3 @@ def test_previous_status_stale_without_marker(monkeypatch):
     monkeypatch.setattr(lifecycle, "previous_target_version", lambda r: None)
     st = lifecycle.previous_status("rx", "version", "0.7.0+3.3.1")
     assert st["apply"] is False and st["stale"] is True and "marker" in st["reason"]
-
-
-def test_previous_overlay_deploys_checked_out_base_without_clean_tree_gate(monkeypatch):
-    events = []
-    for name in (
-        "acquire_app_lock",
-        "provide_ccci_overlay",
-        "provide_previous_overlay",
-        "prepull_images",
-    ):
-        monkeypatch.setattr(lifecycle, name, lambda *a, **kw: None)
-    for name in ("app_config_remove", "app_new", "env_set", "secret_generate"):
-        monkeypatch.setattr(lifecycle.abra, name, lambda *a, **kw: None)
-    monkeypatch.setattr(lifecycle.meta_mod, "extra_env", lambda *a: {})
-    monkeypatch.setattr(lifecycle.meta_mod, "hook_ctx", lambda *a: None)
-    monkeypatch.setattr(lifecycle.abra, "has_lightweight_version_tags", lambda r: False)
-    monkeypatch.setattr(lifecycle, "has_ccci_overlay", lambda r: False)
-    monkeypatch.setattr(
-        lifecycle.abra, "recipe_checkout", lambda r, v: events.append(("checkout", v))
-    )
-    monkeypatch.setattr(
-        lifecycle.abra, "deploy", lambda d, **kw: events.append(("deploy", kw["chaos"]))
-    )
-    for apply_previous in (False, True):
-        events.clear()
-        lifecycle.deploy_app(
-            "example",
-            "example.invalid",
-            version="1.0.0",
-            apply_previous=apply_previous,
-            meta=object(),
-            _count_deploy=False,
-        )
-        assert events == [("checkout", "1.0.0"), ("deploy", apply_previous)]

tests/unit/test_results.py

@@ -489,50 +489,3 @@ def test_write_results_roundtrip(tmp_path):
     assert path.endswith("/42/results.json")
     with open(path) as f:
         assert json.load(f)["level"] == 3
-
-
-def test_fresh_artifact_dir_removes_owned_stale_artifacts(tmp_path):
-    """Run-dir collision guard (2026-10-05): drone build numbers restarted while old-era run dirs
-    linger in /var/lib/cc-ci-runs — a new build reusing an old number must not mix the old run's
-    artifacts (fossil screenshot.png from ANOTHER recipe) into its card. Only OWNED artifacts go."""
-    d = tmp_path / "35"
-    d.mkdir()
-    (d / "results.json").write_text('{"old": true}')
-    (d / "screenshot.png").write_bytes(b"stale-fossil")
-    (d / "summary.png").write_bytes(b"stale")
-    (d / "badge.svg").write_text("<svg/>")
-    (d / "lint.txt").write_text("old")
-    (d / "summary.html").write_text("<html/>")
-    (d / "junit").mkdir()
-    (d / "junit" / "old.xml").write_text("<x/>")
-    (d / "untracked-thing.bin").write_bytes(b"keep me")  # NOT owned — must survive
-
-    R.fresh_artifact_dir(str(d))
-
-    for name in (
-        "results.json",
-        "screenshot.png",
-        "summary.png",
-        "badge.svg",
-        "lint.txt",
-        "summary.html",
-    ):
-        assert not (d / name).exists(), f"stale owned artifact {name} survived"
-    assert not (d / "junit").exists(), "stale junit dir survived"
-    assert (d / "untracked-thing.bin").read_bytes() == b"keep me", "unowned file was deleted"
-
-
-def test_fresh_artifact_dir_creates_missing_dir(tmp_path):
-    d = tmp_path / "36"
-    out = R.fresh_artifact_dir(str(d))
-    assert out == str(d) and d.is_dir()
-
-
-def test_fresh_artifact_dir_tolerant_of_odd_entries(tmp_path):
-    """R7: never raise into the run — a dir where an owned name is itself a dir must still work."""
-    d = tmp_path / "37"
-    d.mkdir()
-    (d / "screenshot.png").mkdir()  # perverse: a DIRECTORY named screenshot.png
-    (d / "junit").mkdir()
-    R.fresh_artifact_dir(str(d))
-    assert not (d / "screenshot.png").exists() and not (d / "junit").exists()

tests/unit/test_screenshot.py

@@ -184,78 +184,3 @@ def test_screenshot_reachable_through_real_load_path(tmp_path):
     hook = S._load_screenshot_hook(meta)
     assert callable(hook), "SCREENSHOT hook did not survive the orchestrator load path (R2)"
     assert S._load_screenshot_hook(meta_mod.load("no-such", tests_dir=str(tmp_path))) is None
-
-
-# ---- capture() fossil guard (2026-10-05) -----------------------------------------------------
-# Drone build numbers restarted when its DB was re-created while /var/lib/cc-ci-runs still holds
-# old-era dirs numbered into the thousands; run 35 (!testme gitea #10) collided with a May-31 run
-# 35 and embedded custom-html-tiny's fossil screenshot.png because the hook branch SKIPPED the
-# snap when out_path already existed. capture() must always snap fresh.
-
-
-class _FakeLaunchable:
-    def __init__(self, page):
-        self._page = page
-        self.chromium = self
-
-    def launch(self, args=None):
-        return self
-
-    def new_context(self, **kw):
-        return self
-
-    def new_page(self):
-        return self._page
-
-    def close(self):
-        pass
-
-
-class _FakeSyncPlaywright:
-    """sync_playwright() replacement: context-manager factory handing out one fake browser."""
-
-    def __init__(self, page):
-        self._page = page
-
-    def __call__(self):
-        return self
-
-    def __enter__(self):
-        return _FakeLaunchable(self._page)
-
-    def __exit__(self, *exc):
-        return False
-
-
-def _install_fake_playwright(monkeypatch, page):
-    import types
-
-    fake_api = types.ModuleType("playwright.sync_api")
-    fake_api.sync_playwright = _FakeSyncPlaywright(page)
-    fake = types.ModuleType("playwright")
-    fake.sync_api = fake_api
-    monkeypatch.setitem(sys.modules, "playwright", fake)
-    monkeypatch.setitem(sys.modules, "playwright.sync_api", fake_api)
-
-
-def test_capture_overwrites_fossil_screenshot(tmp_path, monkeypatch):
-    """A pre-existing out_path in a recycled run artifact dir must never be embedded: the hook
-    branch snaps fresh regardless (the old exists-guard returned the fossil as 'captured')."""
-    out_path = str(tmp_path / "screenshot.png")
-    with open(out_path, "wb") as f:
-        f.write(b"STALE-FOSSIL-FROM-ANOTHER-RECIPE" * 400)
-
-    fired = {}
-    page = _FakePage([35707])  # one real-sized frame, like a painted page
-
-    def hook(p, ctx):
-        fired["yes"] = True  # navigation only — hooks never save the PNG themselves
-
-    _install_fake_playwright(monkeypatch, page)
-    got = S.capture("gitea.example.org", out_path, recipe_meta={"SCREENSHOT": hook})
-
-    assert got == out_path, "capture must report success after snapping fresh"
-    assert fired.get("yes"), "SCREENSHOT hook must run"
-    assert page.shots == 1, "capture must snap exactly once — the fossil is not a captured frame"
-    with open(out_path, "rb") as f:
-        assert f.read(4) == b"\x89PNG", "out_path still holds the fossil — snap did not overwrite"

tests/unit/test_serving_retry.py

@@ -1,29 +0,0 @@
-"""Convergence confirmation must retry a transient second-sample failure."""
-
-from types import SimpleNamespace
-
-import pytest
-from harness import generic
-
-
-def _setup(monkeypatch, samples):
-    clock = [0]
-    monkeypatch.setattr(generic.time, "time", lambda: clock[0])
-    monkeypatch.setattr(generic.time, "sleep", lambda n: clock.__setitem__(0, clock[0] + n))
-    monkeypatch.setattr(generic.lifecycle, "services_converged", lambda d: next(samples))
-    monkeypatch.setattr(generic.lifecycle, "http_fetch", lambda *a: (200, "application"))
-    monkeypatch.setattr(generic, "served_cert", lambda d: (True, "*.ci.autonomic.zone"))
-    return SimpleNamespace(DEPLOY_TIMEOUT=20, HTTP_TIMEOUT=20, HEALTH_PATH="/", HEALTH_OK=(200,))
-
-
-def test_confirmation_failure_retries_until_services_settle(monkeypatch):
-    meta = _setup(monkeypatch, iter([True, False, True, True]))
-    generic.assert_serving("example.ci.autonomic.zone", meta)
-
-
-def test_persistent_confirmation_failure_still_fails(monkeypatch):
-    import itertools
-
-    meta = _setup(monkeypatch, itertools.cycle([True, False]))
-    with pytest.raises(AssertionError, match="services did not converge"):
-        generic.assert_serving("example.ci.autonomic.zone", meta)