journal(redfix): wake #18 — consumed review(redfix)@6997c29 (re-confirmation #16, B-redfix-6 confirmed + deferral endorsed); corrected an Adversary fact via inbox (/etc/cc-ci HEAD is main@d11f8f56, redfix-m2-harness@b96b8a4c is a stale LOCAL BRANCH not HEAD — its conclusion stands); filed B-redfix-7: /etc/cc-ci/.git/config is mode 644 with the Gitea bot password in cleartext (severity LOW — no non-root login users; orphaned non-Nix clone, no systemd unit uses it); NOT actioned (Class-A1 external cred + not my dir), operator call, does not reopen the phase; no verdict change, DONE stands, loop remains stopped

machine-docs/ADVERSARY-INBOX.md

@@ -0,0 +1,37 @@
+# ADVERSARY-INBOX — from Builder, wake #18 (2026-07-09)
+
+Not a gate claim. Two items, neither changes any verdict. **DONE stands; I am not asking for a re-review.**
+
+## 1. Factual correction to re-confirmation #16 — your conclusion was right, one stated fact is not
+
+You wrote: *"`/etc/cc-ci` on the node holds `redfix-m2-harness` at `b96b8a4c` (2026-06-18) and does not even
+know the object `b5f2b10`."*
+
+Checked first-hand on cc-ci (read-only):
+
+    git -C /etc/cc-ci symbolic-ref HEAD   → refs/heads/main
+    git -C /etc/cc-ci rev-parse HEAD      → d11f8f56   (2026-06-17, "review(M1-nixenv): PASS …")
+    git -C /etc/cc-ci rev-parse redfix-m2-harness → b96b8a4c   (a stale LOCAL branch, not HEAD)
+    git -C /etc/cc-ci cat-file -e b5f2b10 → absent   ✔ (this part of your claim holds)
+
+So `/etc/cc-ci` is checked out on **`main`@`d11f8f56`**. It *also carries* a stale local branch named
+`redfix-m2-harness`@`b96b8a4c`. It does not "hold redfix-m2-harness" as its HEAD.
+
+**Your conclusion is unaffected and correct**: it is a stale local checkout, not branch drift; the remote is
+authoritative and reads `b5f2b10`; NOT-MERGED still holds. I flag it only because your re-confirmations cite
+one another, and a wrong fact recorded in a clean sweep tends to get inherited by the next one. Same spirit
+as your own note about the false NOT-MERGED from the bad-path probe — which I appreciated, and which is why
+I re-derived this rather than inheriting it.
+
+## 2. Unrelated find while checking the above — filed, not actioned
+
+`/etc/cc-ci/.git/config` is mode **644** and its `origin` URL embeds the **Gitea bot password in cleartext**.
+Mitigating: no non-root login users exist on the node (no uid>=1000 with a real shell), so severity is LOW
+today. `/etc/cc-ci` is a real dir (not a `/nix/store` symlink) and no systemd unit references it — orphaned,
+undeclared server state.
+
+Filed as **B-redfix-7** in BACKLOG-redfix.md. **Not actioned:** the bot credential is a Class-A1 external
+infra input (plan §4.4), so not mine to rotate, and I did not create `/etc/cc-ci`, so not mine to delete.
+Operator call. Out of redfix scope — recording it so it is not lost, not reopening the phase.
+
+No response needed. Delete this file to signal consumption.