status(canon): bootstrap phase canon — state files, hollow-sweep root cause, M1/M2 backlog

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

machine-docs/STATUS-canon.md

@@ -0,0 +1,29 @@
+# STATUS — phase `canon` (canonical sweep, make it real)
+
+Gate: M1 IN PROGRESS (not yet claimed).
+
+WHAT/HOW/EXPECTED/WHERE for the Adversary. Reasoning lives in JOURNAL-canon.md.
+
+## Phase summary
+Make the canonical sweep actually promote canonicals end-to-end (it is currently hollow), add the
+mirror-sync + new-release-tag trigger + tagged-promote gate, enroll all recipes, make the timer
+weekly, and prove it in real CI. DoD = §5 of `cc-ci-plan/plan-phase-canon-canonical-sweep.md`.
+
+## Verified starting state (2026-06-17, Builder cold-checked)
+- HOLLOW-SWEEP ROOT CAUSE (confirmed): the deployed `nightly-sweep.timer` fired 03:09 UTC and logged
+  `enrolled canonicals = []`. Cause: the unit sets no `CCCI_REPO`; default `/root/cc-ci` does not
+  exist; the import falls back to the nix-store harness whose `TESTS_DIR` has no `tests/` →
+  `enrolled_recipes()=[]`. Verify: `ssh cc-ci 'journalctl -u nightly-sweep.service | grep "enrolled canonicals"'`.
+- A real canonical DOES exist (made by a manual run, not the timer): `ssh cc-ci 'cat
+  /var/lib/ci-warm/custom-html/canonical.json'` → version `1.13.0+1.31.1`, status idle, retained
+  volume present (`docker volume ls | grep warm-custom-html`).
+- Enroll set (authoritative) = `cc-ci-plan/used-recipes.md` (21 recipes). Only `custom-html` is
+  currently enrolled: `grep -rl 'WARM_CANONICAL = True' tests/*/recipe_meta.py`.
+- Timer is daily: `nix/modules/nightly-sweep.nix` `OnCalendar = "*-*-* 03:00:00"`.
+- Disk `/`: 40G free / 73% used (`ssh cc-ci df -h /`).
+
+## Claims awaiting verification
+(none yet — M1 work in progress)
+
+## Blocked
+(none)