claim(2w): WC6 nightly full-cold sweep — timer+service roll warm/infra (health-gated) then serial cold sweep promoting canonicals (WC5); proven live

canonical.enrolled_recipes; runner/nightly_sweep.py (roll keycloak+traefik →
serial full-cold over enrolled on latest → green promotes; skip if test active;
operate against CCCI_REPO checkout for tests/); nix/modules/nightly-sweep.nix
(timer 03:00 Persistent + oneshot service) wired in. 2 bugs fixed via live
service run (repo-relative enrolled scan; util-linux for backup PTY). Live
SERVICE sweep: enrolled=['custom-html'] → all tiers green → canonical advanced
1.10.0→1.11.0; red-run correctly does NOT promote. 71 unit pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/unit/test_canonical.py

@@ -59,3 +59,18 @@ def test_registry_roundtrip(tmp_path, monkeypatch):
     # the file is valid JSON on disk
     with open(canonical.registry_path("custom-html")) as f:
         assert json.load(f)["status"] == "warm"
+
+
+def test_enrolled_recipes_scans_meta(tmp_path, monkeypatch):
+    # enrolled_recipes() lists recipes whose tests/<r>/recipe_meta.py sets WARM_CANONICAL=True.
+    fake_harness = tmp_path / "runner" / "harness"
+    fake_harness.mkdir(parents=True)
+    monkeypatch.setattr(canonical, "__file__", str(fake_harness / "canonical.py"))
+    for name, body in (("aaa", "WARM_CANONICAL = True\n"),
+                       ("bbb", "DEPS=['x']\n"),
+                       ("ccc", "WARM_CANONICAL = True\n")):
+        d = tmp_path / "tests" / name
+        d.mkdir(parents=True)
+        (d / "recipe_meta.py").write_text(body)
+    (tmp_path / "tests" / "ddd").mkdir(parents=True)  # no recipe_meta.py at all
+    assert canonical.enrolled_recipes() == ["aaa", "ccc"]