diff --git a/machine-docs/STATUS-canon.md b/machine-docs/STATUS-canon.md
index c718807..8572c63 100644
--- a/machine-docs/STATUS-canon.md
+++ b/machine-docs/STATUS-canon.md
@@ -124,6 +124,37 @@ orthogonality live, disk budget, §2.G UPGRADE_BASE_VERSION retirement.
     (apps/deps already torn down; serial sweep → safe). lasuite-* (warm keycloak dep) unaffected.
   - Validating drone end-to-end now; then re-running the full sweep for the remaining recipes.
 
+## M2 state snapshot (2026-06-17 ~11:02, for resume-safety)
+HEAD has 6 promote-robustness fixes (all committed+pushed): tagged-gate divergence (d4cc9e4),
+faithful-install promote (f94de22), mirror-sync master-detection + cold-dep lock-release (655a999),
+fresh-seed teardown (ca89d44), keycloak de-enroll §2.B exception (d072d7e). Enrolled=20 (keycloak out).
+
+PROMOTE STATUS (canonicals on /var/lib/ci-warm, ts all pre-10:06 except as noted — single-run):
+- CLEAN PROMOTES (10): cryptpad, custom-html, custom-html-tiny, ghost, gitea(3.5.3), hedgedoc,
+  immich, lasuite-docs(0.3.5+v5.2.1), lasuite-drive(0.10.0+v0.19.0), lasuite-meet(0.4.1+v1.19.0).
+  (lasuite-* use the warm keycloak dep — proves warm-dep promote works.)
+- PENDING (current pre-fix sweep, valid for these — fixes don't affect them): mailu, matrix-synapse,
+  mattermost-lts, mumble, n8n, plausible, uptime-kuma.
+- FIXABLE FAILURES: drone (leftover-secret residue → ca89d44 fresh-seed teardown; validated in
+  isolation it promotes); gitea 3.6.0 advance (600s timeout, 3.5.3 canonical preserved — retry).
+- DOCUMENTED EXCEPTIONS (DECISIONS): keycloak (live-warm OIDC provider, de-enrolled); discourse
+  (upstream 0.8.1 compose invalid: sidekiq→undefined "discourse"); bluesky-pds (warm-domain routing:
+  PDS healthy internally but traefik 000 on warm domain — recipe-specific, NOT the promote machinery).
+
+PLAN (Adversary recency criterion: authoritative M2.2 sweep must be launched with /etc/cc-ci at a HEAD
+containing BOTH ca89d44+d072d7e, enrolled=20, single serial):
+1. Let current pre-fix sweep finish (promotes mailu/matrix/etc. — valid canonicals).
+2. Deploy fixes: `git -C /etc/cc-ci pull`. Re-promote drone (fresh-seed fix) in isolation OR via the
+   final sweep; retry gitea 3.6.0.
+3. Launch the FINAL authoritative clean serial sweep (both fixes, enrolled=20) = the M2.2 evidence:
+   SKIPs all promoted (determinism), RUNs drone(promote)/gitea(3.6.0)/bluesky+discourse(red).
+4. M2.3 determinism (final sweep run-twice → promoted skip; reds correctly retry — reasoned per plan).
+5. M2.6 samever orthogonality (gitea 3.5.3→3.6.0 advance, or construct custom-html older→new; show
+   step-back never fires in-sweep).
+6. M2.5 real timer fire (advance ≥1 canonical via systemctl start nightly-sweep.service).
+7. M2.7 disk budget (du /var/lib/ci-warm). M2.8 plausible UPGRADE_BASE_VERSION retirement.
+8. Claim M2.
+
 ## Claims awaiting verification
 - **M1 — PASS** (Adversary 3bdd5d1, no VETO). M2 work in progress (not yet claimed).