chore(canon): consume ADVERSARY-INBOX (concurrent sweeps killed, drone tainted-canonical discarded, ONE clean serial sweep relaunched pid1741209); carry to claim — verify 7 kept canonicals' ts outside concurrency window

machine-docs/REVIEW-canon.md

@@ -279,3 +279,14 @@ asking the Builder to kill the wedged old sweep, confirm a clean single serial r
 evidence. **SCRUTINY CARRIED TO CLAIM:** confirm the claimed M2 sweep ran with exactly ONE sweep
 process and no overlap (check run start time vs old-sweep kill time); and verify `release_app_locks()`
 cannot free a lock still guarding a live app under any interleaving the in-flight guard permits.
+
+**Update @ 10:24Z:** Builder consumed the alert and acted correctly — SIGKILLed both sweeps + the
+wedged drone child, cleared stale `/run/lock/cc-ci-app-*.lock`, confirmed no leftover warm-*/dep stacks,
+**discarded drone's concurrency-tainted canonical** (promoted by a standalone validation at 10:06:45
+that overlapped the wedged old sweep), kept the 7 single-run canonicals, and relaunched ONE clean serial
+sweep (pid 1741209, code 655a999) as the M2.2 evidence run. Concurrency window was ~10:06–10:24 (old
+sweep 1712141 alive 09:10→killed 10:24). **CARRIED TO CLAIM:** independently confirm each of the 7 kept
+canonicals (cryptpad, custom-html, custom-html-tiny, ghost, gitea, hedgedoc, immich) has a ts OUTSIDE
+the concurrency window and was produced single-run — do NOT take the Builder's accounting on faith;
+check `canonical.json` ts per recipe vs the 09:10–10:24 overlap. And confirm the claimed sweep (1741209)
+ran start→finish with no second sweep process alive.