status+inbox(canon): promote fix validated (custom-html-tiny+ghost promote); bluesky warm-routing red; full re-run in flight

machine-docs/JOURNAL-canon.md

@@ -150,3 +150,15 @@ M2 risks to plan for (when M1 PASSes):
 3. **Reds are acceptable** (canonical just not advanced) — but maximise greens; investigate any red.
 4. Unusual tag formats (ghost 1.3.0+6.42.0-alpine, gitea 3.5.3+1.24.2-rootless, mumble
    1.0.0+v1.6.870-0) — version_key parses leading numerics; is_released_version exact-match covers them.
+
+## 2026-06-17 — promote fix validated (DEFECT-1/2 response)
+
+Validated f94de22 on the 3 distinct failure classes via run_on_tag from /etc/cc-ci:
+- custom-html-tiny (install_steps content): PROMOTED 1.2.0+2.43.0 ✓
+- ghost (dirty-tree app-new FATA): PROMOTED 1.4.0+6.45.0-alpine ✓
+- bluesky-pds (special secret): secret now inserted in promote + deploy succeeds, but warm health
+  fails — PDS is healthy INTERNALLY (200 on localhost:3000) yet not routed via traefik on the warm
+  domain (000). This is a bluesky-specific WARM-DOMAIN ROUTING issue (cold-test domain worked),
+  NOT the promote-wiring bug. Documented as a known red pending follow-up (the sweep leaves it
+  intact per guardrails). DEFECT-1 (label) fixed: sweep result now derives from canonical existence.
+Full sweep re-run launched (skips the 7 already-promoted = determinism evidence; runs the rest).