diff --git a/machine-docs/ADVERSARY-INBOX.md b/machine-docs/ADVERSARY-INBOX.md
new file mode 100644
index 0000000..3912ace
--- /dev/null
+++ b/machine-docs/ADVERSARY-INBOX.md
@@ -0,0 +1,16 @@
+# ADVERSARY-INBOX (Builder → Adversary)
+
+2026-06-17 ~09:10Z — **DEFECT-1 + DEFECT-2 fix (f94de22) validated; full sweep re-run in flight.**
+- DEFECT-2 root cause: promote_canonical did a bare warm deploy lacking the cold install's wiring.
+  Fixed: clean tree (re-checkout tag + git clean -fd) → provision deps → deploy_app WITH
+  install_steps_hook + overlay + ready-probes. Validated live: custom-html-tiny PROMOTED
+  (1.2.0+2.43.0, was 404) and ghost PROMOTED (1.4.0+6.45.0-alpine, was app-new dirty-tree FATA).
+- bluesky-pds: secret + deploy now succeed, but warm health fails — PDS healthy INTERNALLY (200 on
+  localhost:3000) yet not routed by traefik on the warm domain (000). A bluesky-specific warm-domain
+  routing issue (cold domain worked), not the promote bug. Treating as a documented RED (left intact).
+- DEFECT-1 fixed: nightly_sweep result label now derives from "does a canonical record now exist at
+  the tested version", not rc.
+- 7 canonicals currently exist (cryptpad, custom-html, custom-html-tiny, ghost, gitea, hedgedoc,
+  immich). Full sweep re-run running now (/root/canon-verify/_sweep.log): the 7 SKIP (determinism),
+  the rest RUN. I'll write the M2 claim to STATUS-canon.md when the sweep + determinism + timer-fire
+  + samever + disk + §2.G evidence is captured. No gate claimed yet.
diff --git a/machine-docs/JOURNAL-canon.md b/machine-docs/JOURNAL-canon.md
index 2646dab..3340e78 100644
--- a/machine-docs/JOURNAL-canon.md
+++ b/machine-docs/JOURNAL-canon.md
@@ -150,3 +150,15 @@ M2 risks to plan for (when M1 PASSes):
 3. **Reds are acceptable** (canonical just not advanced) — but maximise greens; investigate any red.
 4. Unusual tag formats (ghost 1.3.0+6.42.0-alpine, gitea 3.5.3+1.24.2-rootless, mumble
    1.0.0+v1.6.870-0) — version_key parses leading numerics; is_released_version exact-match covers them.
+
+## 2026-06-17 — promote fix validated (DEFECT-1/2 response)
+
+Validated f94de22 on the 3 distinct failure classes via run_on_tag from /etc/cc-ci:
+- custom-html-tiny (install_steps content): PROMOTED 1.2.0+2.43.0 ✓
+- ghost (dirty-tree app-new FATA): PROMOTED 1.4.0+6.45.0-alpine ✓
+- bluesky-pds (special secret): secret now inserted in promote + deploy succeeds, but warm health
+  fails — PDS is healthy INTERNALLY (200 on localhost:3000) yet not routed via traefik on the warm
+  domain (000). This is a bluesky-specific WARM-DOMAIN ROUTING issue (cold-test domain worked),
+  NOT the promote-wiring bug. Documented as a known red pending follow-up (the sweep leaves it
+  intact per guardrails). DEFECT-1 (label) fixed: sweep result now derives from canonical existence.
+Full sweep re-run launched (skips the 7 already-promoted = determinism evidence; runs the rest).