review(canon): production-env real timer fire COMPLETED clean (Result=success, single serial) — custom-html promoted 1.11→1.13, 14 SKIP, 6 documented exceptions; DEFECT-3 prod re-validation favorable, closes at M2 claim

machine-docs/REVIEW-canon.md

@@ -524,3 +524,20 @@ re-derive each promoted canonical's commit==tag-commit and a warm reattach; (c)
 exception, discourse/mattermost/mumble reds, and bluesky warm-routing exception are all recorded in
 DECISIONS (not silent no-canonicals); (d) the formal M2 claim arrives in STATUS with WHAT/HOW/EXPECTED.
 Staying read-only off the node while the sweep is in flight (single node).
+
+**Update @ 2026-06-17T14:39Z — production-env timer fire COMPLETED cleanly (still NOT a verdict).**
+`nightly-sweep.service` finished **14:37:22 UTC**, `Result=success`, `ExecMainStatus=0`, single serial
+(no leftover sweep/run_recipe_ci procs). Final per-recipe summary (journalctl, my own read):
+- **custom-html: PASS (promoted 1.13.0+1.31.1)** — a REAL non-hollow timer advance 1.11.0→1.13.0 in
+  production env (M2.5 real-fire + M2.6 constructed older→new advance, both in one live timer fire).
+- **14 SKIP no-new-version** (cryptpad, custom-html-tiny, drone, ghost, hedgedoc, immich, lasuite-{docs,
+  drive,meet}, mailu, matrix-synapse, n8n, plausible, uptime-kuma) — live determinism: promoted-at-latest
+  recipes correctly no-op in the production fire.
+- **6 documented exceptions:** gitea GREEN-BUT-PROMOTE-FAILED (cold-green via lfs PASS; app.ini warm-advance
+  exception, 3.5.3 kept); bluesky-pds GREEN-BUT-PROMOTE-FAILED (warm-routing); discourse/mattermost-lts/
+  mumble red (canonical unchanged). No NEW promote failures the manual env masked.
+This resolves the "won't close DEFECT-3 until the fire completes" condition: the fire DID complete cleanly
+under real Drone-parity env. I am NOT yet closing DEFECT-3 or accepting M2 — that happens at the formal M2
+claim, where I will cold re-derive each promoted canonical's commit==tag-commit + a warm reattach, confirm
+all 6 exceptions are recorded in DECISIONS, and re-run/inspect determinism myself. DEFECT-3 stays OPEN
+(narrowly: pending the claim-time confirmation), but its production re-validation is now favorable.