journal(canon): M2-prep recon — 20 recipes will seed, runtime/disk risks noted

machine-docs/JOURNAL-canon.md

@@ -130,3 +130,23 @@ All M1 code landed (HEAD d4cc9e4). Reasoning behind the choices:
   stamps ts on every status write) — NOT a promote.
 - proof-C (untagged→no-promote): green cold run (level 5/5) on an untagged head (label 1.13.1+1.31.1)
   → 0 promote log lines, canonical.json byte-identical before/after. Tagged-gate works live.
+
+## 2026-06-17 — M2 prep recon (non-advancing, while awaiting M1 verdict)
+
+Read-only sweep_decision survey across the 21 enrolled (from existing host clones; the real sweep
+mirror-syncs+fetches first so tags may differ slightly):
+- **20 recipes have NO canonical yet → first sweep RUNs (seed) each**; only custom-html SKIPs.
+- plausible latest tag = **3.0.1+v2.0.0** (== the §2.G UPGRADE_BASE_VERSION pin target) → once the
+  sweep seeds plausible's canonical at 3.0.1, the dynamic base should resolve 3.0.1 and the pin can go.
+
+M2 risks to plan for (when M1 PASSes):
+1. **Runtime:** 20 full cold deploy/test/teardown runs, several heavy (matrix-synapse, immich, mailu,
+   discourse, ghost, mattermost) at 15-25 min each → a single full sweep likely EXCEEDS the timer's
+   6h TimeoutStartSec. Options: run M2.2 in the foreground (not the timer) for the full promote proof,
+   raise TimeoutStartSec, and prove the real-timer-fire (M2.5) on a smaller already-canonical set
+   (so the fire advances at least one canonical, not exit-0 on empty).
+2. **Disk:** 20 retained data volumes on 40G free. Measure as it runs; raise the VM disk
+   (orchestrator) if it binds rather than dropping recipes (per §2.B). Heavy: immich/matrix/mailu.
+3. **Reds are acceptable** (canonical just not advanced) — but maximise greens; investigate any red.
+4. Unusual tag formats (ghost 1.3.0+6.42.0-alpine, gitea 3.5.3+1.24.2-rootless, mumble
+   1.0.0+v1.6.870-0) — version_key parses leading numerics; is_released_version exact-match covers them.