journal(redfix): wake #18 — consumed review(redfix)@6997c29 (re-confirmation #16, B-redfix-6 confirmed + deferral endorsed); corrected an Adversary fact via inbox (/etc/cc-ci HEAD is main@d11f8f56, redfix-m2-harness@b96b8a4c is a stale LOCAL BRANCH not HEAD — its conclusion stands); filed B-redfix-7: /etc/cc-ci/.git/config is mode 644 with the Gitea bot password in cleartext (severity LOW — no non-root login users; orphaned non-Nix clone, no systemd unit uses it); NOT actioned (Class-A1 external cred + not my dir), operator call, does not reopen the phase; no verdict change, DONE stands, loop remains stopped

machine-docs/JOURNAL-redfix.md

@@ -1136,3 +1136,43 @@ obvious candidate. Recording it beats both silently fixing it and silently dropp
 
 Node untouched (the only remote command was a read-only `ls`/`find` under /var/lib/ci-warm). Nothing
 claimed, nothing pending, no ADVERSARY-INBOX written — this needs no verdict. DONE stands.
+
+## Wake #18 — 2026-07-09T02:00Z — consumed review(redfix)@6997c29 (re-confirmation #16); corrected an Adversary fact; found + filed B-redfix-7 (cleartext bot credential on the node)
+
+Consumed re-confirmation #16 (`6997c29`): refs swept cold via `ls-remote`, B-redfix-6 independently
+confirmed REAL-but-cosmetic, and my choice to defer it rather than move `b5f2b10` explicitly endorsed
+("I do not want the branch moved to fix a comment"). No finding, no VETO, DONE stands, loop stays stopped.
+
+The verdict carried one claim I had not verified, so I checked it instead of inheriting it — precisely
+because that verdict *also* retracted a false NOT-MERGED it had earlier derived from a bad-path probe. A
+sweep that has just caught itself citing a broken command is the last place to take a new fact on trust.
+
+**Adversary fact wrong, conclusion right.** It reported `/etc/cc-ci` as *holding* `redfix-m2-harness`
+@`b96b8a4c`. Actually:
+
+    symbolic-ref HEAD              → refs/heads/main
+    rev-parse HEAD                 → d11f8f56  (2026-06-17)
+    rev-parse redfix-m2-harness    → b96b8a4c  ← a stale LOCAL BRANCH, not HEAD
+    cat-file -e b5f2b10            → absent    ✔ (this half of the claim holds)
+
+HEAD is `main`; the stale `redfix-m2-harness` merely exists as a local branch alongside it. The inference
+drawn from it — stale checkout, not branch drift; remote authoritative; NOT-MERGED holds — is untouched.
+Sent as ADVERSARY-INBOX (non-gate side-channel) rather than left to rot, because these re-confirmations
+cite one another and an uncorrected fact in a clean sweep gets inherited by the next.
+
+**Incidental find, and the more serious one.** While inspecting that checkout: `/etc/cc-ci/.git/config` is
+mode **644** with the Gitea bot password embedded in cleartext in the `origin` URL. Before deciding what to
+do I calibrated rather than reflexively alarming — `awk` over `/etc/passwd` shows **no non-root login
+users**, so today only root can read it. So: a missing layer of defence, not a live compromise. Also
+`/etc/cc-ci` is a real dir (not a `/nix/store` symlink) with **no systemd unit referencing it** — orphaned,
+undeclared state that nothing runs from, which is itself a violation of "keep server state Nix-declared".
+
+**WHY I did not fix it.** Two independent rules bite. The Gitea bot credential is a Class-A1 EXTERNAL infra
+input (§4.4) — I do not rotate or invent those. And I did not create `/etc/cc-ci`, so deleting or chmod'ing
+it is not mine to do unasked; a `chmod 600` would also be undeclared drift papering over the real defect
+(credential-in-URL). Filed as **B-redfix-7** with the remedy ladder for the operator. It is out of redfix
+scope and does NOT reopen the phase — the DoD concerns the six canon-sweep failures, all of which remain
+fixed and verified.
+
+Node untouched: every command this wake was read-only (`git -C … rev-parse/cat-file/symbolic-ref`, `stat`,
+`awk`, `readlink`). Nothing claimed. DONE stands.