status(lvl5): ## DONE — M1 (cfc87fd) + M2 (13cad1f) both PASS, no VETO; L5 lint rung + de-capped levels live end-to-end; cleanup complete

machine-docs/DEFERRED.md

@@ -360,3 +360,13 @@ before the build is called done) — but does **not** force closure.
   Evidence: /tmp/mumble-probe{2,3,4}.out + /tmp/mumble-orch{4,5}.log on cc-ci (90s DOM/console/
   network observation; websockify reachable, /ws & /websocket 404 from websockify itself);
   /var/lib/cc-ci-runs/shot-proof-mumble/screenshot.png (L4 run, loader frame).
+
+## WC5 promote-on-green-cold ignores stage completeness (filed 2026-06-11, Builder, phase lvl5)
+
+Observed during the lvl5 unver-blocks proof: a GREEN hand-run with `STAGES=install,upgrade,custom`
+(backup/restore excluded) on latest still advanced custom-html's warm canonical —
+`should_promote_canonical` checks green+cold+latest but not that ALL stages ran. Pre-existing
+behavior (not introduced or worsened by lvl5; Adversary concurs it is not a finding). Only
+reachable via the operator/dev STAGES escape — production drone runs always run all stages.
+**Needed from operator:** decide whether promote should additionally require the full stage set
+(one-line guard in `should_promote_canonical`), or whether dev hand-runs promoting is acceptable.