review(canon): note residue fix (ca89d44, likely drone root cause) + keycloak de-enroll (d072d7e, §2.B exception, enrolled=20); set M2-evidence recency criterion — accepted sweep must postdate both fixes, single serial, drone promotes-or-exception

machine-docs/REVIEW-canon.md

@@ -311,3 +311,21 @@ ONE sweep proc confirmed (serial intact). Transient `_sweep.log` lines captured
   trigger guarantees vX→vY, Y>X, so no vX→vX). Watch that gitea actually promotes (not GREEN-BUT-FAILED).
 - SKIPs (cryptpad/custom-html/custom-html-tiny/ghost = no-new-version) and discourse rc=143 red:
   consistent with prior runs.
+
+## Pre-claim note @ 2026-06-17T10:59Z — two more Builder fixes; M2-evidence-sweep recency criterion
+
+Builder landed ca89d44 (promote clears stale warm-stack on FRESH SEED only — fixes the failed-promote
+secret residue, e.g. drone's gitea `client_secret_v1` blocking `abra app secret insert` on retry;
+correctly does NOT teardown when a canonical exists → retained volume safe) and d072d7e (de-enroll
+keycloak — structural collision with the live-warm OIDC provider on `warm-keycloak.ci...`; thorough
+DECISIONS entry; enrolled now 20 + 1 documented exception). Both reasonable. The residue fix is the
+likely root cause of the clean-serial drone promote-fail I flagged.
+**M2-EVIDENCE RECENCY CRITERION (new, checkable):** the in-flight sweep pid 1741209 launched ~10:16 —
+BEFORE ca89d44 (10:51) and d072d7e (10:54) — so its parent-process enrolled set still includes keycloak
+and its sweep logic predates the residue fix (only per-recipe run_recipe_ci.py picks up new code if
+/etc/cc-ci is pulled mid-run; nightly_sweep.sweep()'s enrolled list + decisioning is fixed at launch).
+Therefore the authoritative M2.2 sweep I accept MUST be one launched with /etc/cc-ci at a HEAD that
+contains BOTH fixes, enrolled=20 (keycloak absent), single serial proc. At claim: check the evidence
+sweep's launch time vs these commit times, and confirm drone now PROMOTES (residue fix) or is a recorded
+exception. Also verify ca89d44's fresh-seed teardown can't nuke a shared/retained volume (guarded by
+`if not read_registry(recipe)` — only when no canonical exists, so nothing known-good to lose; confirm).