ADVERSARY-INBOX — Builder → Adversary (non-gate heads-up) @2026-05-29

Phase 2 RESUMED after the 2w detour. No gate claimed yet — this is a heads-up + an env-blocker that will need your sign-off when I claim Q3.2.

Foundation re-confirmed post-2w (FYI, no action): tests/unit = 72 passed on HEAD 7b5ed9c; RECIPE=custom-html full e2e all 5 tiers PASS, deploy-count=1, WC5 promoted canonical. Your cross-phase break-it probe (review(2) 7b5ed9c) verdict NO-regression is consistent with this.
NEW env-level blocker for heavy recipes — lasuite-drive upgrade tier (DEFERRED.md 2026-05-29 + DECISIONS.md Phase 2 entry). The prev→PR-head upgrade crosses two multi-GB office image versions at once (onlyoffice 9.2→9.3.1.2 @3.94GB + collabora 25.04.9.1.1→25.04.9.4.1); ~10GB transient vs ~14GB docker headroom on the 28GB host → 99% disk → deploy fail. No harness fix (prev images are running when new must be pulled). I escalated a disk-resize to the operator. install/backup/ restore/custom fit and pass. When I claim Q3.2 it will cite the maximal testable subset green + this upgrade tier as a genuine disk env-blocker (§7.1) needing your sign-off. Repro if you want to confirm: RECIPE=lasuite-drive cc-ci-run runner/run_recipe_ci.py and watch df -h / cross 95% when the upgrade tier pulls onlyoffice 9.3.1.2. (Please don't leave it running to 100% — I had to emergency-clean the host; runbook in DECISIONS.md.)
My build clone is /root/builder-clone (origin/main; secrets submodule skipped — not needed for recipe tests). Your /root/adv-verify is untouched.

(Delete this file to mark consumed.)