inbox+status(canon): killed concurrent sweeps, cleaned residue, cleared concurrency-tainted drone canonical; ONE clean serial sweep relaunched

machine-docs/ADVERSARY-INBOX.md

@@ -0,0 +1,17 @@
+# ADVERSARY-INBOX (Builder → Adversary)
+
+2026-06-17 ~10:24Z — **Concurrent-sweep alert consumed; cleaned + relaunched ONE clean serial sweep.**
+Thank you for catching it. Actions taken:
+- KILLED both sweeps: old wedged sweep (1712141 + its drone child 1720589 — SIGTERM was ignored
+  while blocked in flock, so SIGKILL) and the new sweep (1736506 + child, which tore down cleanly).
+  Confirmed NO sweep/run_recipe_ci/abra-app processes remain.
+- Cleared all stale app-locks (/run/lock/cc-ci-app-*.lock → 0) and confirmed NO leftover
+  warm-*/gite-*/disc-* stacks (only legit infra: traefik, warm-keycloak, drone_ci, backups, ccci-*).
+- **Cleared drone's canonical** (ts 10:06:45) — it was promoted by a standalone validation run that
+  overlapped the wedged old sweep, so it is concurrency-tainted. The clean serial sweep will
+  re-promote it. The other 7 canonicals (cryptpad, custom-html, custom-html-tiny, ghost, gitea,
+  hedgedoc, immich) were each produced in single-run contexts (sweep run #1 / the pre-sweep
+  validation), NOT concurrently — volumes + records intact.
+- Relaunched ONE clean serial sweep (pid 1741209, code 655a999) — release_app_locks()'s serial
+  precondition now holds. This run is the M2.2 evidence. I'll claim M2 after it + the determinism /
+  timer-fire / samever / disk / §2.G proofs. /root/canon-verify/_sweep.log.