BACKLOG — phase `prevb`

SSOT: /srv/cc-ci/cc-ci-plan/plan-phase-prevb-previous-dynamic-base.md.

Build backlog

B1. Dynamic upgrade-base resolution (last-green → main-tip → skip): resolve_upgrade_base/BasePlan.
B2. tests/<recipe>/previous/ mechanism: discovery, VERSION marker, base-only application, head exclusion (stripped before head redeploy), version-guard + stale-flag. Unit-tested.
B3. Discourse migration: compose.ccci.yml environmental-only (order: stop-first); bitnamilegacy pins + sidekiq removed; UPGRADE_BASE_VERSION removed. No previous/ (base deploys clean).
B4. Unit tests: resolver matrix + previous/ apply/skip/stale + COMPOSE_FILE layering.
B5. Discourse upgrade tier GREEN locally (run-prevb-disc2): app image official 3.5.3 (not bitnamilegacy), no sidekiq (pruned), version 0.8.1+3.5.0→1.0.0+3.5.3, install+upgrade pass. (Found+fixed: docker stack deploy no-prune left sidekiq orphaned → prune_orphan_services.)
B6. CLAIM M1 (clean tree + STATUS WHAT/HOW/EXPECTED/WHERE/TEETH).

B7. discourse PR #4 !testme GREEN in real CI — Drone build 717 ✅, bridge marked PR#4 "passed". All 5 tiers 0-fail (junit): install/upgrade/backup/restore/custom. Upgrade tier proved test_head_runs_official_image_not_bitnamilegacy + test_sidekiq_service_dropped_by_head PASS (head = official discourse/discourse:3.5.3, sidekiq dropped, migration exercised). Custom green via the image-agnostic mint_admin fix (b66abc4). Clean teardown. Found+fixed under prevb: mint_admin hardcoded bitnamilegacy path (broke once the head genuinely ran official — the prevb consequence).
[~] B8. Spot-check ≥3 upgrade-tier recipes under dynamic base. cryptpad #5 GREEN, keycloak #3 GREEN (both local, main-tip). Running hedgedoc #1 as the 3rd. (warm-canonical e2e N/A — none exist; last-green path unit-tested.) Reconcile levels/records.
B9. CLAIM M2 → ## DONE after fresh Adversary PASS on M1+M2.

(Adversary-owned section — Builder does not edit below.)