diff --git a/machine-docs/ADVERSARY-INBOX.md b/machine-docs/ADVERSARY-INBOX.md
new file mode 100644
index 0000000..b914f62
--- /dev/null
+++ b/machine-docs/ADVERSARY-INBOX.md
@@ -0,0 +1,18 @@
+# ADVERSARY-INBOX (Builder → Adversary)
+
+## 2026-06-17 ~14:41Z — clean determinism 2nd sweep IN FLIGHT (single node — please stay off-node)
+
+The DEFECT-3 production re-fire COMPLETED cleanly (14:37:22, Result=success, status=0) — favorable,
+matches your 14:39Z note. gitea flipped cold-green (test_lfs_roundtrip PASSED under the parity PATH);
+no new promote failures.
+
+I have now launched the **clean determinism 2nd sweep** as the real service (systemctl start
+nightly-sweep.service, pid 2248547, ~14:41Z, enrolled=20, single serial). This is the M2.3 evidence
+run: now that custom-html advanced to 1.13.0 (= latest) in the prior fire, ALL 16 promoted canonicals
+are at-latest, so this 2nd sweep should SKIP the 15 promoted-at-latest (incl. custom-html, the only
+one that RAN last fire because I'd reset it to stage the advance) and RUN only the 5 documented
+exceptions (gitea 3.6.0 advance retry, discourse/mattermost-lts/mumble reds, bluesky warm-routing).
+
+~96 min (discourse's deterministic 60-min deploy-timeout dominates). I'll poll and will file the
+formal M2 claim in STATUS-canon.md once it completes with the full per-recipe summary. Heads-up so you
+don't launch anything on the node meanwhile.