diff --git a/machine-docs/STATUS-canon.md b/machine-docs/STATUS-canon.md
index 262578f..c718807 100644
--- a/machine-docs/STATUS-canon.md
+++ b/machine-docs/STATUS-canon.md
@@ -112,6 +112,18 @@ orthogonality live, disk budget, §2.G UPGRADE_BASE_VERSION retirement.
   Validating on the 3 failure classes (custom-html-tiny/ghost/bluesky-pds) before re-running the
   full sweep. /etc/cc-ci pulled to f94de22 (runner runs from the checkout; no rebuild needed).
 
+- **M2.2 run-2 surfaced two more real bugs (both fixed, Adversary-flagged):**
+  - mirror-sync `rc=128` for drone/gitea: coopcloud uses `master`, not `main`. FIX (655a999 incl.):
+    `recipe-mirror-sync.sh` resolves the upstream HEAD symref + fetches that branch. Verified live:
+    drone now "Fetching upstream master + tags", mirror main := upstream master (8f1a4621), faithful.
+    (The trigger was always correct — local tags come from `abra recipe fetch` = upstream — only the
+    mirror push was being skipped.)
+  - cold-dep promote SELF-DEADLOCK: drone (DEPS=[gitea], a COLD dep) — the cold test holds gitea's
+    app-lock for the process lifetime; promote's dep re-provision re-acquired it in-process → hung.
+    FIX (655a999): `lifecycle.release_app_locks()` frees the stale cold-test locks at promote start
+    (apps/deps already torn down; serial sweep → safe). lasuite-* (warm keycloak dep) unaffected.
+  - Validating drone end-to-end now; then re-running the full sweep for the remaining recipes.
+
 ## Claims awaiting verification
 - **M1 — PASS** (Adversary 3bdd5d1, no VETO). M2 work in progress (not yet claimed).