status(canon): FINAL authoritative M2.2 sweep launched (post-fix /etc/cc-ci@12acf94, enrolled=20, serial); red diagnoses recorded

machine-docs/STATUS-canon.md

@@ -160,3 +160,21 @@ containing BOTH ca89d44+d072d7e, enrolled=20, single serial):
 
 ## Blocked
 (none)
+
+## M2.2 AUTHORITATIVE SWEEP (the evidence run)
+Launched 2026-06-17 ~11:26 UTC, pid 1960362, from /etc/cc-ci @ 12acf94 (contains BOTH ca89d44
+fresh-seed-teardown + d072d7e keycloak-de-enroll), enrolled_recipes()=20 (keycloak absent), SINGLE
+serial process (confirmed no other sweep/run_recipe_ci procs at launch). Log: /root/canon-verify/_sweep.log.
+This postdates all fixes → meets the Adversary recency criterion as the M2.2 evidence.
+Expected: 14 promoted recipes SKIP (determinism); drone promotes (fresh-seed fix); gitea 3.5.3→3.6.0
+advance; bluesky/discourse/mattermost/mumble red.
+
+### Genuine cold-test reds (recipe-specific, NOT machinery — "a red test is information", never weakened)
+- discourse: upstream 0.8.1 compose invalid (`sidekiq depends on undefined service "discourse"`) →
+  deploy can't converge. Upstream recipe defect.
+- mattermost-lts: `tests/mattermost-lts/test_restore.py::test_restore_returns_state` FAILED at latest.
+- mumble: `tests/mumble/custom/test_protocol_handshake.py::test_handshake_completes_with_channel_presence`
+  FAILED at latest.
+- bluesky-pds: cold GREEN but warm-promote health 000 — PDS healthy internally (localhost:3000=200) yet
+  traefik doesn't route the warm domain (caddy-fronted); recipe-specific warm-routing, not the promote
+  machinery (other 15 promote healthy over HTTPS on their warm domains).