journal: redfix DONE — all 6 canon-sweep failures fixed + verified (4 recipe PRs, 2 harness); SEQUENCE-COMPLETE

cc-ci-plan/JOURNAL.md

@@ -735,3 +735,31 @@ session cc-ci-orchestrator-stale can be killed; recipe-mirrors org still private
 - Orchestrator notes: wrote samever's ## DONE marker once (Builder was opus-quota-blocked; work was
   Adversary-cleared); nudged regall's bold-wrapped marker fix; queued every phase + the design refinements
   live. Queue now drained → hourly wake stops; new work = queue a new phase in agents.toml.
+
+## 2026-06-18 ~07:10 — redfix DONE: all 6 canon-sweep failures fixed + verified; SEQUENCE-COMPLETE
+- Phase `redfix` (opus) M1+M2 fresh Adversary PASS, no VETO. Investigated all 6 canon-sweep failures in
+  ISOLATION (flake vs genuine), then fixed each via a recipe PR or harness improvement — none left as a
+  standing exception. Host verified healthy after (0 failed, services active, live keycloak SSO 302
+  undisturbed, 36G free).
+- **The six (operator: fix all, recipe PR or harness):**
+  - **mattermost-lts** — recipe PR: postgres dump + `backupbot.restore.post-hook` (immich pattern); restore
+    now round-trips. (genuine recipe defect, not the canon "load race")
+  - **discourse** — cc-ci overlay-scope fix (the `test_upgrade.py` overlay asserted an unreleased
+    official-image migration); Adversary FAILed the first claim (F-redfix-1: dangling image-less sidekiq in
+    compose.smtpauth.yml → R011 lint regression + broke smtp-auth), Builder fixed, re-verified level=5.
+    (canon's "timeout" root-cause was WRONG — no timeout)
+  - **keycloak** — harness: collision-free `canonical_domain` (`warm-canon-<r>`) for live-warm providers,
+    then enrolled; promotes without disturbing the live OIDC service.
+  - **mumble** — harness: handshake readiness/retry stabilization (it was a LOAD FLAKE — operator's
+    recollection was right; 2× green in isolation).
+  - **bluesky-pds** — recipe PR: reference the app svc as **`${STACK_NAME}_app`** (operator-directed; the
+    established pattern, cf. matrix-synapse) instead of the bare `app` that collided cross-stack on the
+    shared proxy. Dropped the earlier app→pds rename + coupled cc-ci exec-ref change (cleaner, recipe-only).
+  - **gitea** — recipe PR: render `app.ini` into the writable `config:/etc/gitea` volume so the
+    3.5.3→3.6.0 warm advance can persist the JWT secret (was crashing on the read-only config mount). v1
+    broke the wizard transition (reverted); rework verified chaos-deploy green.
+- Orchestrator notes: restarted the Builder once to shed a 692k-token context that was trapping it in the
+  opus usage limit (operator-authorized; loops resume only via a `{name}.id` file, none present → fresh
+  session; re-oriented from STATUS/journals via a nudge). Relayed the operator's `${STACK_NAME}_app`
+  bluesky guidance. 4 recipe PRs + 2 harness fixes; **nothing merged** (operator reviews/merges).
+- Queue drained again → hourly wake stops.