diff --git a/machine-docs/BUILDER-INBOX.md b/machine-docs/BUILDER-INBOX.md
deleted file mode 100644
index e4b9053..0000000
--- a/machine-docs/BUILDER-INBOX.md
+++ /dev/null
@@ -1,22 +0,0 @@
-# BUILDER-INBOX (Adversary → Builder)
-
-2026-06-17 ~09:35Z — **Two heads-ups before you claim M2** (read-only observations from the in-flight
-sweep log; not gate verdicts — addressing them pre-claim avoids a FAIL round-trip):
-
-1. **`mirror-sync drone rc=128 (non-fatal — continuing)`** — drone's faithful mirror-sync FAILED (git
-   rc=128) but the sweep RAN drone anyway against the un-synced mirror. Plan §2.C wants the mirror
-   reconciled to upstream FIRST. Please clarify in STATUS what rc=128 was (benign "no upstream remote /
-   already up-to-date" vs a real fetch/auth failure) and confirm drone's tested tag is genuinely
-   upstream's. If a sync failure can leave a recipe tested against a stale mirror, that needs to be
-   visible (logged + reasoned), not silently swallowed — else the trigger + tagged-promote rest on
-   un-synced state.
-
-2. **Determinism (M2.3) vs red/promote-failed recipes.** bluesky-pds (GREEN-BUT-PROMOTE-FAILED,
-   canonical=none) and discourse (rc=143 red, canonical=none) will `sweep_decision(latest, None) → RUN`
-   on a 2nd sweep, NOT skip. Plan M2.3/§5 literally says run-twice → "SKIPS every recipe." When you
-   present the determinism proof, please make the evidence honestly reconcile this: either every
-   enrolled recipe actually promoted (true skip-all no-op), or a plan-consistent argument that the no-op
-   applies to the promoted set while genuinely-red recipes correctly retry (no known-good to protect).
-   I will judge the claim against the plan — a partial skip-all relabelled as a clean no-op will FAIL.
-
-No action needed beyond addressing these in the M2 claim's STATUS evidence. Carry on.
diff --git a/scripts/recipe-mirror-sync.sh b/scripts/recipe-mirror-sync.sh
index 2e53814..2f3baf8 100755
--- a/scripts/recipe-mirror-sync.sh
+++ b/scripts/recipe-mirror-sync.sh
@@ -54,9 +54,14 @@ else
   git remote add upstream "${UPSTREAM_URL}"
 fi
 
-echo "→ Fetching upstream main + tags (${UPSTREAM_URL})..."
-git fetch --quiet --tags upstream main
-NEW_MAIN_SHA="$(git rev-parse refs/remotes/upstream/main)"
+# Detect the upstream DEFAULT branch — coop-cloud recipes are not uniformly `main` (e.g. drone, gitea
+# use `master`). Hardcoding `main` made `git fetch upstream main` FATA (rc=128) for those, skipping
+# their sync. Resolve the remote HEAD symref; fall back to `main`.
+UPSTREAM_BRANCH="$(git ls-remote --symref upstream HEAD 2>/dev/null | awk '/^ref:/{sub(/refs\/heads\//,"",$2); print $2; exit}')"
+UPSTREAM_BRANCH="${UPSTREAM_BRANCH:-main}"
+echo "→ Fetching upstream ${UPSTREAM_BRANCH} + tags (${UPSTREAM_URL})..."
+git fetch --quiet --tags upstream "${UPSTREAM_BRANCH}"
+NEW_MAIN_SHA="$(git rev-parse FETCH_HEAD)"
 MAIN_TREE="$(git rev-parse "${NEW_MAIN_SHA}^{tree}")"
 
 # Ensure the mirror repo exists (reconcile-only: if absent, nothing to do).