review(redfix): post-reboot re-confirmation #4 — DONE stands, no VETO (M1+M2 intact, both findings closed) + NEW non-blocking F-redfix-3 (CLOSED): discourse M2 evidence shas 9ff5e19/53ba0910 gone from mirror (branch rebased+extended by later phases), but fix CONTENT re-verified at HEAD ede6399 — official image + 0 sidekiq; other 3 recipe shas + harness branch pin exactly

machine-docs/BACKLOG-redfix.md

@@ -180,3 +180,31 @@ file; I verified the exposure surface (gitignore miss + never-committed) from a
 taking that note at face value. Only the Adversary closes this, after re-test.
 
 </details>
+
+### [adversary] F-redfix-3 — M2's discourse evidence shas (`9ff5e19`, `53ba0910`) no longer exist on the mirror; the fix content survives — **CLOSED @2026-07-08T23:24Z (non-blocking, no VETO)**
+
+**Severity:** does NOT block phase `redfix` (DONE stands). Evidence-durability defect in the *record*, not in
+the fix. Filed so a future auditor of redfix does not conclude "the discourse fix was withdrawn."
+
+**What.** `STATUS-redfix.md` pins the discourse fix at `9ff5e19` (fix list) and `53ba0910` (WHERE refs) on
+`recipe-maintainers/discourse` branch `discourse-official-image`. As of 2026-07-08 that branch heads at
+`ede6399` and **neither sha resolves**: fetching all 17 `refs/heads/*` + `refs/pull/*/head` into one clone and
+running `git cat-file -t` on each returns *not a valid object name*. The branch was force-pushed/rebased and
+extended by **later** phases (`ede6399` = `refs/pull/5/head`; adds `discourse/postgres:pg18` + `POSTGRES_USER`
+in `pg_backup.sh`). redfix's PR is also no longer "#4" — `refs/pull/4/head` is now `0c4539b7`.
+
+**Why it is CLOSED rather than a VETO.** I re-verified the *content* the M2 PASS actually asserted, at the
+current head: `compose.yml` → `image: discourse/discourse:3.5.3` (official-image migration) and
+`compose.smtpauth.yml` → 0 `sidekiq` occurrences (the F-redfix-1 remedy). Both hold at `ede6399` and at
+`0c4539b7`. The fix is present and re-verifiable; only the pointers rotted. M2 was correct when given.
+
+**Repro.** `git clone https://git.autonomic.zone/recipe-maintainers/discourse && cd discourse && git fetch
+origin 'refs/heads/*:refs/remotes/origin/*' 'refs/pull/*/head:refs/remotes/pr/*' && git cat-file -t 9ff5e19`
+→ fatal. Then `git show origin/discourse-official-image:compose.yml | grep image:` → official image present.
+(Note: `git fetch origin <sha>` and a `--filter=blob:none` clone both give false "absent" signals — use
+reachability from all refs.)
+
+**Lesson for future phases (no action required of the Builder now):** shared recipe branches get rewritten, so
+a sha alone is not durable evidence. Record the *content assertion* (file → expected line) alongside the sha,
+or push a tag. The other three redfix fixes pinned exactly (`4ca7f418`, `a0f2db88`, `4987ba91`), as did cc-ci
+`redfix-m2-harness`@`07fc6d4a` — discourse drifted only because a later phase reused its branch.

machine-docs/REVIEW-redfix.md

@@ -380,3 +380,42 @@ CLOSED). **No VETO.** The Builder is cleared to write `## DONE` to STATUS-redfix
   Residual (NOT closed, correctly escalated by the Builder to the operator, not decided by either loop): the
   key remains on disk unrotated. Git is not a reason to rotate given it provably never entered history.
   Terminal condition still met: DONE + fresh M1/M2 PASS + no VETO. Loop stopped.
+
+- 2026-07-08T23:24Z — **Post-reboot re-confirmation #4 + evidence-durability probe. Phase `redfix` remains
+  DONE; M1 PASS @2026-06-18T01:18Z + M2 PASS @2026-06-18T07:06Z intact; no standing VETO; no
+  `ADVERSARY-INBOX.md`; no pending claim; F-redfix-1 and F-redfix-2 both CLOSED.**
+
+  Instead of re-asserting a 20-day-old verdict, I probed whether the DoD evidence still *resolves* — a PASS
+  that points at commits nobody can fetch is not a verified PASS. **Result: 3 of 4 recipe fixes pin exactly;
+  discourse's two recorded shas no longer exist.** New non-blocking finding **F-redfix-3** (filed + CLOSED
+  below).
+
+  Cold checks, none of them trusting the Builder's record:
+  - `git ls-remote` each mirror. `mattermost-lts ci/pg-restore` = `4ca7f418` ✅ (STATUS `4ca7f418`);
+    `gitea ci/app-ini-writable` = `a0f2db88` ✅ (`a0f2db8`); `bluesky-pds ci/warm-routing-alias` = `4987ba91` ✅
+    (`4987ba9`); cc-ci `refs/heads/redfix-m2-harness` = `07fc6d4a` ✅ (`07fc6d4`). Four-for-four.
+  - discourse: branch `discourse-official-image` now = `ede6399`, matching **neither** sha in STATUS
+    (`9ff5e19` in the fix list, `53ba0910` in the WHERE-refs list). Fetched **every** `refs/heads/*` **and**
+    `refs/pull/*/head` (17 refs) into one clone, then `git cat-file -t` on both: **not a valid object name**.
+    They are gone from the mirror, not merely off-branch. (I discarded my first two probes as inconclusive: a
+    `blob:none` clone can miss objects, and `git fetch <sha>` fails on any sha when `allowReachableSHA1InWant`
+    is off — neither would have proven absence. Reachability from all refs is the test that does.)
+  - **The fix itself survives, and I checked the content rather than the label.** At the current head
+    `ede6399`: `compose.yml` → `image: discourse/discourse:3.5.3` (the official-image migration, M2's claim)
+    and `compose.smtpauth.yml` → **0** `sidekiq` hits (the F-redfix-1 remedy). Same on `refs/pull/4/head`
+    (`0c4539b7`). So redfix's discourse change is present and independently re-verifiable at HEAD.
+  - Cause is benign drift, not a retraction: the branch was rewritten and extended by **later** work
+    (`ede6399` = `refs/pull/5/head`; new commits swap postgres to `discourse/postgres:pg18` and add
+    `POSTGRES_USER` to `pg_backup.sh` — none of it redfix's). redfix's PR is no longer PR #4 either; #4 now
+    heads at `0c4539b7` (pgvector).
+
+  **Verdict: DONE stands, no VETO.** M2 was verified against the shas that existed on 2026-06-18 and the
+  verified *behaviour* is still in the branch; a later phase rebasing a shared branch does not retroactively
+  unfix a fix. What it does invalidate is the *reproducibility* of my evidence pointers — recorded as
+  F-redfix-3 so a future auditor of redfix content-checks rather than sha-pins.
+
+  Node health (cold, `ssh cc-ci`): up 25d, load 0.76, `/` 37% used (91G free), swarm node Ready/Leader.
+  Live stacks include `warm-keycloak`, `warm-gitea`, `warm-bluesky-pds` — post-redfix state owned by later
+  phases; I touched nothing. Did NOT re-run the six recipe CIs: no gate is pending, the phase is closed, and
+  burning a shared single node to re-prove a closed gate is exactly the pointless re-verification the loop
+  protocol tells me not to do.