diff --git a/machine-docs/STATUS-nixenv.md b/machine-docs/STATUS-nixenv.md
index cc87cc5..d55bf2e 100644
--- a/machine-docs/STATUS-nixenv.md
+++ b/machine-docs/STATUS-nixenv.md
@@ -18,14 +18,28 @@ warm-keycloak / swarm-init / drone-runner-exec all active; `nightly-sweep.timer`
 drone healthz + ci.commoninternet.net → 200. Live `cc-ci-run` = `zxlx9jnylh7la5m48bsqb1wfm5l9r0bd`
 (the M1-reviewed path); git-lfs/openssl/script/bash resolve on host PATH (openssl was MISSING pre-deploy).
 
-**Live parity witness — IN FLIGHT.** Diff scope: ONLY nix/ changed (dd6712c..d11f8f5: 5 nix files,
-zero runner/tests) → sweep SKIP/promote logic byte-identical to canon's PASSed sweep.
-- Real timer fire: `systemctl start nightly-sweep.service` @ 2026-06-17T17:35:38Z. The unit's systemd
-  PATH contains ONLY coreutils/findutils/gnugrep/gnused/systemd — NOT git-lfs, NOT /run/current-system/sw/bin
-  — so git-lfs MUST now resolve from cc-ci-run's runtimeInputs (the DEFECT-3 condition). ExecStart =
-  `gh02w1kc…-cc-ci-nightly-sweep` → execs `zxlx9j…/cc-ci-run`. gitea is RUN-eligible (canonical
-  3.5.3+1.24.2 < latest tag 3.6.0+1.24.2) → will exercise `test_lfs_roundtrip`. Awaiting completion.
-- Drone-path gitea witness: pending (after the sweep, to avoid the sweep's run-active defer).
+**Live parity witness — timer fire GREEN; Drone path pending.** Diff scope: ONLY nix/ changed
+(dd6712c..d11f8f5: 5 nix files, zero runner/tests) → sweep SKIP/promote logic byte-identical to
+canon's PASSed sweep.
+- **Real timer fire — PASS** @ 2026-06-17T17:57:54Z. `systemctl start nightly-sweep.service` @
+  17:35:38Z (PID 2743890; child run_recipe_ci PID 2808444). The unit's systemd PATH contains ONLY
+  coreutils/findutils/gnugrep/gnused/systemd — NOT git-lfs, NOT /run/current-system/sw/bin — so
+  git-lfs resolved from cc-ci-run's runtimeInputs (the DEFECT-3 condition). Verified live: the running
+  run_recipe_ci process PATH (`/proc/<pid>/environ`) carries `…-git-lfs-3.6.1/bin` from cc-ci-run.
+  gitea RUN (canonical 3.5.3+1.24.2 < tag 3.6.0+1.24.2) exercised LFS (upgrade-env COMPOSE_FILE
+  includes compose.lfs.yml) → `tests/gitea/custom/test_lfs_roundtrip.py::test_lfs_roundtrip PASSED`
+  (18.66s); all other gitea tiers PASSED.
+  - HOW (Adversary re-run): `ssh cc-ci 'journalctl -u nightly-sweep.service -o short-iso --since
+    "2026-06-17 17:55:57" --until "2026-06-17 17:58:07"' | grep -iE "lfs_roundtrip|PASSED|rc="`.
+    EXPECTED: `test_lfs_roundtrip PASSED` then `sweep: gitea rc=0`.
+  - NOTE (not a regression): the sweep line reads `rc=0 GREEN-BUT-PROMOTE-FAILED` — all TESTS green;
+    the WC5 promote (`abra app deploy warm-gitea… -o -n`) fails with `FATA warm-gitea… is already
+    deployed`. This is an abra deploy-idempotency quirk on the warm canonical (already running, volume
+    retained), NON-FATAL (known-good unchanged), and it occurred IDENTICALLY in the pre-deploy runs
+    (PID 2149231 @ 14:28Z, PID 2248547 @ 15:56Z) — orthogonal to the runtime-env refactor (abra is on
+    PATH unchanged in both). SKIPs in this fire are all correct (cryptpad/ghost/drone/hedgedoc/immich
+    no-new-version SKIP; custom-html RUN→promoted 1.13.0+1.31.1).
+- Drone-path gitea witness: pending (trigger after the sweep completes, to avoid run-active contention).
 
 ### (prior M1 claim block retained below for the record)
 ## M1 details — PASS