From b8b698e2f56915b5960f8e3ee4004b71f0efd550 Mon Sep 17 00:00:00 2001
From: autonomic-bot <mfowler.email@protonmail.com>
Date: Fri, 29 May 2026 04:38:51 +0100
Subject: [PATCH] =?UTF-8?q?review(2w):=20WC6=20nightly=20full-cold=20sweep?=
 =?UTF-8?q?=20=E2=80=94=20PASS=20@2026-05-29=20(declarative=20timer=20Pers?=
 =?UTF-8?q?istent=20+=20orchestration=20+=20live=20systemd-service=20run:?=
 =?UTF-8?q?=20infra=20roll=20health-gated=20=E2=86=92=20serial=20cold=20sw?=
 =?UTF-8?q?eep=20=E2=86=92=20canonical=20advanced,=20infra=20healthy,=20no?=
 =?UTF-8?q?=20leftovers)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 machine-docs/REVIEW-2w.md | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/machine-docs/REVIEW-2w.md b/machine-docs/REVIEW-2w.md
index 33b8d7c..7ae8db6 100644
--- a/machine-docs/REVIEW-2w.md
+++ b/machine-docs/REVIEW-2w.md
@@ -348,3 +348,29 @@ DONE:** WC5, WC6, WC8, WC9.
 **Gate verdict: WC5 — PASS @2026-05-29.** Builder may proceed to W3's WC6 (nightly sweep).
 **Phase-2w gates verified so far:** WC1, WC1.1 (full), WC1.2, WC2, WC3, WC4, WC5, WC7.
 **Remaining for DONE:** WC6, WC8, WC9.
+
+## @2026-05-29 — WC6 nightly full-cold sweep — PASS  (gate 465e105; cold-verified)
+- **Units — PASS:** 71 passed (incl. enrolled_recipes).
+- **Declarative timer/service — PASS.** `nightly-sweep.timer` active; `OnCalendar=*-*-* 03:00:00`,
+  **Persistent=true** (catches up a missed nightly), RandomizedDelaySec=600, next Sat 03:05 UTC;
+  service = oneshot, 6h ceiling, after deploy-proxy/warm-keycloak/docker, packaged in the nix store
+  (D8-clean; runtimeInputs incl. util-linux for the backup PTY). Imported in
+  `nix/hosts/cc-ci/configuration.nix`.
+- **Orchestration — PASS (code read from own clone).** `nightly_sweep.py`: in-flight guard
+  `_another_run_active()` pgreps `run_recipe_ci.py` (excl. self) → skips/defers if a run is active;
+  `roll_warm_infra()` runs the health-gated keycloak+traefik reconcilers (WC1.1); `sweep()` iterates
+  `enrolled_recipes()` SERIALLY, each a cold latest run (REF/QUICK/MODE stripped) whose own promote
+  hook refreshes the canonical (WC5); red recipes reported FAIL but non-fatal and DON'T promote.
+- **Live sweep via the actual systemd SERVICE — PASS.** Forced custom-html canonical OLD
+  (1.10.0+1.28.0), `systemctl start nightly-sweep.service`. Journal: roll keycloak
+  `noop-healthy:10.7.1+26.6.2` rc=0 + traefik `noop-healthy:5.1.1+v3.6.15` rc=0 (health-gated);
+  `enrolled canonicals = ['custom-html']`; full-cold install/upgrade/backup/restore/custom **all
+  pass**; `WC5 promote: canonical custom-html advanced to known-good 1.11.0+1.29.0`; sweep summary
+  `custom-html: PASS`; service Finished. Independently verified after: registry **ADVANCED
+  1.10.0+1.28.0 → 1.11.0+1.29.0** (new ts), **no `cust-*` per-run leftover** (cold teardown sacred),
+  `ci.commoninternet.net=200` + `keycloak-through-traefik=200` (infra healthy post-roll), system
+  running / 0 failed.
+
+**Gate verdict: WC6 — PASS @2026-05-29.** Builder may proceed to W4 (WC8/WC9).
+**Phase-2w gates verified so far:** WC1, WC1.1 (full), WC1.2, WC2, WC3, WC4, WC5, WC6, WC7.
+**Remaining for DONE:** WC8, WC9 (incl. the full `--quick` rollback proof + docs).