review(redfix): post-reboot re-confirmation #4 — DONE stands, no VETO (M1+M2 intact, both findings closed) + NEW non-blocking F-redfix-3 (CLOSED): discourse M2 evidence shas 9ff5e19/53ba0910 gone from mirror (branch rebased+extended by later phases), but fix CONTENT re-verified at HEAD ede6399 — official image + 0 sidekiq; other 3 recipe shas + harness branch pin exactly

machine-docs/REVIEW-redfix.md

@@ -380,3 +380,42 @@ CLOSED). **No VETO.** The Builder is cleared to write `## DONE` to STATUS-redfix
   Residual (NOT closed, correctly escalated by the Builder to the operator, not decided by either loop): the
   key remains on disk unrotated. Git is not a reason to rotate given it provably never entered history.
   Terminal condition still met: DONE + fresh M1/M2 PASS + no VETO. Loop stopped.
+
+- 2026-07-08T23:24Z — **Post-reboot re-confirmation #4 + evidence-durability probe. Phase `redfix` remains
+  DONE; M1 PASS @2026-06-18T01:18Z + M2 PASS @2026-06-18T07:06Z intact; no standing VETO; no
+  `ADVERSARY-INBOX.md`; no pending claim; F-redfix-1 and F-redfix-2 both CLOSED.**
+
+  Instead of re-asserting a 20-day-old verdict, I probed whether the DoD evidence still *resolves* — a PASS
+  that points at commits nobody can fetch is not a verified PASS. **Result: 3 of 4 recipe fixes pin exactly;
+  discourse's two recorded shas no longer exist.** New non-blocking finding **F-redfix-3** (filed + CLOSED
+  below).
+
+  Cold checks, none of them trusting the Builder's record:
+  - `git ls-remote` each mirror. `mattermost-lts ci/pg-restore` = `4ca7f418` ✅ (STATUS `4ca7f418`);
+    `gitea ci/app-ini-writable` = `a0f2db88` ✅ (`a0f2db8`); `bluesky-pds ci/warm-routing-alias` = `4987ba91` ✅
+    (`4987ba9`); cc-ci `refs/heads/redfix-m2-harness` = `07fc6d4a` ✅ (`07fc6d4`). Four-for-four.
+  - discourse: branch `discourse-official-image` now = `ede6399`, matching **neither** sha in STATUS
+    (`9ff5e19` in the fix list, `53ba0910` in the WHERE-refs list). Fetched **every** `refs/heads/*` **and**
+    `refs/pull/*/head` (17 refs) into one clone, then `git cat-file -t` on both: **not a valid object name**.
+    They are gone from the mirror, not merely off-branch. (I discarded my first two probes as inconclusive: a
+    `blob:none` clone can miss objects, and `git fetch <sha>` fails on any sha when `allowReachableSHA1InWant`
+    is off — neither would have proven absence. Reachability from all refs is the test that does.)
+  - **The fix itself survives, and I checked the content rather than the label.** At the current head
+    `ede6399`: `compose.yml` → `image: discourse/discourse:3.5.3` (the official-image migration, M2's claim)
+    and `compose.smtpauth.yml` → **0** `sidekiq` hits (the F-redfix-1 remedy). Same on `refs/pull/4/head`
+    (`0c4539b7`). So redfix's discourse change is present and independently re-verifiable at HEAD.
+  - Cause is benign drift, not a retraction: the branch was rewritten and extended by **later** work
+    (`ede6399` = `refs/pull/5/head`; new commits swap postgres to `discourse/postgres:pg18` and add
+    `POSTGRES_USER` to `pg_backup.sh` — none of it redfix's). redfix's PR is no longer PR #4 either; #4 now
+    heads at `0c4539b7` (pgvector).
+
+  **Verdict: DONE stands, no VETO.** M2 was verified against the shas that existed on 2026-06-18 and the
+  verified *behaviour* is still in the branch; a later phase rebasing a shared branch does not retroactively
+  unfix a fix. What it does invalidate is the *reproducibility* of my evidence pointers — recorded as
+  F-redfix-3 so a future auditor of redfix content-checks rather than sha-pins.
+
+  Node health (cold, `ssh cc-ci`): up 25d, load 0.76, `/` 37% used (91G free), swarm node Ready/Leader.
+  Live stacks include `warm-keycloak`, `warm-gitea`, `warm-bluesky-pds` — post-redfix state owned by later
+  phases; I touched nothing. Did NOT re-run the six recipe CIs: no gate is pending, the phase is closed, and
+  burning a shared single node to re-prove a closed gate is exactly the pointless re-verification the loop
+  protocol tells me not to do.