diff --git a/promotion-candidates/README.md b/promotion-candidates/README.md
new file mode 100644
index 00000000..4ecbece9
--- /dev/null
+++ b/promotion-candidates/README.md
@@ -0,0 +1,29 @@
+# tmp promotion candidates — for GURU-BEAST-ROG review
+
+These are scratch scripts that accumulated in `.claude/tmp/` on **GURU-5070** and were flagged by
+`tmp-promotion-check.sh` as graduation candidates (21 files). `.claude/tmp/` is gitignored/per-machine,
+so they are NOT otherwise visible to other machines — hence they are zipped here for Beast to see,
+review, and graduate the keepers (or discard).
+
+- **Source machine:** GURU-5070 (Mike)
+- **Captured:** 2026-07-06
+- **Archive:** `tmp-candidates-GURU-5070-2026-07-06.zip` (21 files, paths preserved under `.claude/tmp/`)
+
+## Task for Beast
+
+Review each script and graduate the keepers into their proper home per `.claude/TEMP_GRADUATION.md`
+(`git mv` into `scripts/`, `clients/<x>/reports/`, or `projects/<p>/tools/`); discard pure scratch.
+These are one-off/session scratch, so most may be disposable — judgment call per file.
+
+## Contents (inferred clusters)
+
+- `cryo_*.py` (11) — M365 remediation scratch for a "cryo" client: EXO provisioning, quarantine
+  inspect/detail, release, test-send, failure checks.
+- `rua_*.py` (3) — DMARC RUA aggregate-report analyze / detail / fix.
+- `perm_*.py` (2) — permission inspect / apply.
+- `watch-build.sh`, `watch-dash.sh` — poll the GuruRMM build / dashboard build logs.
+- `add_rule.py` — (mail/transport?) rule add scratch.
+- `fix_thoughts.py` — RMM_THOUGHTS doc-fix scratch.
+- `git-askpass.sh` — git credential askpass helper scratch.
+
+Full listing is in the zip. Nothing here is authoritative or in use by any pipeline.
diff --git a/promotion-candidates/tmp-candidates-GURU-5070-2026-07-06.zip b/promotion-candidates/tmp-candidates-GURU-5070-2026-07-06.zip
new file mode 100644
index 00000000..b850de7b
Binary files /dev/null and b/promotion-candidates/tmp-candidates-GURU-5070-2026-07-06.zip differ