review+inbox(canon): final-sweep crux — drone PROMOTED CLEAN (residue fix works, DEFECT-2 closing) but gitea 3.6.0 advance FAILED AGAIN (GREEN-BUT-PROMOTE-FAILED, canon kept 3.5.3) → CLAIM-BLOCKER for M2.6 (advance undemonstrated) + M2.3 (green recipe re-runs, not a red); heads-up sent

machine-docs/REVIEW-canon.md

@@ -384,3 +384,30 @@ at claim: it ran start→finish with no second sweep proc.)
   over HTTPS on their warm domains (already favorable — 15 promoted healthy).
 ALL FOUR must be recorded as DECISIONS exceptions with reasons (not silent no-canonicals) before M2.
 Expected from this sweep: ~14 SKIP (determinism), drone PROMOTES (residue fix), gitea 3.5.3→3.6.0 advance.
+
+## Pre-claim findings @ 2026-06-17T11:58Z — final sweep crux outcomes (drone ✓, gitea advance ✗)
+
+Cold-read from cc-ci (raw canonical.json, my own check). 16 canonical recipes on disk: cryptpad,
+custom-html, custom-html-tiny, drone, ghost, gitea, hedgedoc, immich, lasuite-{docs,drive,meet}, mailu,
+matrix-synapse, n8n, plausible, uptime-kuma. 16 promoted + 4 documented reds (discourse, mattermost-lts,
+mumble, bluesky-pds) = 20 enrolled. Clean accounting.
+- **drone — PROMOTED CLEAN ✓ (favorable, DEFECT-2 closing evidence).** `/var/lib/ci-warm/drone/
+  canonical.json` = `{version 1.9.0+2.26.0, commit 91b27ceb…, status idle, ts 20260617T115046Z}` —
+  fresh, from THIS final post-fix sweep; log `sweep: drone rc=0 (PASS (promoted 1.9.0+2.26.0))`. The
+  fresh-seed-teardown residue fix (ca89d44) resolved the once-failed-promote secret residue. (At the
+  formal claim I'll re-derive that commit == the 1.9.0+2.26.0 tag's commit, and confirm warm reattach.)
+- **gitea — ADVANCE FAILED AGAIN ✗ (CLAIM-BLOCKER for M2.6 + M2.3).** Log: `sweep: gitea RUN — new
+  release 3.6.0+1.24.2-rootless > canonical 3.5.3+1.24.2-rootless … rc=0 (GREEN-BUT-PROMOTE-FAILED
+  (canonical=3.5.3…, expected 3.6.0…))`. canonical.json still `3.5.3+1.24.2-rootless` (ts 083930Z, OLD)
+  — known-good correctly PRESERVED on the failed advance, but the advance did NOT happen. Impact:
+  1. **M2.6 not demonstrated:** gitea was the live new-tag→`canonical(older)→new` advance proof. The
+     trigger fired (RUN on the newer tag) and old-known-good was kept, but a SUCCESSFUL promote to the
+     new tagged version — which §3/§5 M2.6 requires — did not occur. Needs a real fix or the plan's
+     alternative (construct custom-html older→new).
+  2. **M2.3 determinism dirtied:** on a 2nd sweep `sweep_decision(gitea, 3.6.0, 3.5.3) → RUN`, so gitea
+     re-runs — and it is NOT a genuine red (cold test is GREEN; only the warm advance promote times
+     out ~600s). So it is NOT covered by "reds correctly retry"; it is a green recipe whose promote
+     deterministically fails, which both wastes a CI rerun AND breaks "run-twice → skip-all". A plain
+     retry won't fix a deterministic timeout — needs the warm-advance timeout raised / the in-place
+     version-bump deploy diagnosed, OR gitea documented like the reds (but it's green, so that's weaker).
+  Sending the Builder a heads-up so they don't claim M2 with this open.