review(canon): CONFIRMED final authoritative sweep @12acf94 contains both ca89d44+d072d7e (recency criterion MET); list red-diagnosis verifications (discourse/mattermost-lts/mumble/bluesky) — verify genuine+not-weakened+DECISIONS-recorded at claim

machine-docs/REVIEW-canon.md

@@ -363,3 +363,24 @@ Canonical count = 15. Two new claim-scrutiny points:
   then is dropping the pin safe. If not, the pin stays with a recorded reason (§2.G GATE).
 Builder's plan next: deploy fixes to /etc/cc-ci, re-promote drone (fresh-seed fix) + retry gitea 3.6.0,
 then launch the FINAL authoritative sweep = the M2.2 evidence (postdates ca89d44+d072d7e, enrolled=20).
+
+## Pre-claim @ 2026-06-17T11:35Z — FINAL authoritative sweep launched; recency criterion MET (confirmed)
+
+Builder launched the authoritative M2.2 sweep (pid 1960362, ~11:26Z) from `/etc/cc-ci @ 12acf94`. I
+INDEPENDENTLY confirmed `git merge-base --is-ancestor`: **ca89d44 (residue) AND d072d7e (keycloak) are
+both ancestors of 12acf94** → the evidence sweep postdates both fixes, enrolled=20, single serial.
+My M2-evidence recency criterion is satisfied — this run is the legitimate M2.2 evidence. (Still verify
+at claim: it ran start→finish with no second sweep proc.)
+
+**Red diagnoses to verify at claim (Builder posture = "red test is information, never weakened" — correct):**
+- discourse: upstream 0.8.1 compose invalid (`sidekiq` → undefined service `discourse`). VERIFY: it's a
+  genuine upstream defect (re-read the compose), not our overlay; canonical unchanged.
+- mattermost-lts: `test_restore.py::test_restore_returns_state` FAILED at latest. VERIFY: the test is
+  unmodified (git-blame the test vs main; not weakened/xfail'd to dodge), failure is real.
+- mumble: `custom/test_protocol_handshake.py::test_handshake_completes_with_channel_presence` FAILED.
+  VERIFY: test unmodified, real failure.
+- bluesky-pds: cold green, warm-promote health 000 (traefik doesn't route warm domain; PDS 200 on
+  localhost:3000). VERIFY recipe-specific (not machinery): confirm other promoted recipes DID answer 200
+  over HTTPS on their warm domains (already favorable — 15 promoted healthy).
+ALL FOUR must be recorded as DECISIONS exceptions with reasons (not silent no-canonicals) before M2.
+Expected from this sweep: ~14 SKIP (determinism), drone PROMOTES (residue fix), gitea 3.5.3→3.6.0 advance.