journal(redfix): M2 4/6 verified; bluesky warm-verify structurally blocked pre-merge (fix proven); gitea needs rework

machine-docs/JOURNAL-redfix.md

@@ -441,3 +441,32 @@ compose.ccci.yml scaffold on the branch (has_ccci_overlay -> deploy_app uses cha
 renamed checkout). Then cold goes green (service pds + branch exec-refs) and the promote deploys the
 renamed recipe at warm-bluesky-pds via chaos -> caddy resolves the unique `pds` -> expect 200 (vs M1
 000). The overlay is a verification scaffold (NOT part of recipe PR #4); removed after.
+
+## 2026-06-18T04:05Z — M2 bluesky verification: STRUCTURAL blocker (pre-merge warm-promote)
+
+bluesky rename verification keeps deploying the TAG's `app:` (not my rename), even with: tag moved to
+the rename commit AND a force-chaos overlay. Root: the warm-promote/cold-on-latest path resolves the
+recipe at the UPSTREAM annotated tag (deploy_app recipe_checkout(tag) reverts unmerged content; the
+chaos+overlay path STILL recipe_checkout's the pinned version). Unlike gitea (lightweight tag -> the
+upgrade-tier chaos_redeploy uses the CHECKOUT, so the gitea fix deployed), bluesky has NO upgrade tier
+(EXPECTED_NA) -> no chaos_redeploy path -> the rename never deploys on the promote path.
+
+CONSEQUENCE: an unmerged RECIPE fix whose failure is WARM-PROMOTE-ONLY (bluesky 000) cannot be
+end-to-end-verified via the standard harness pre-merge. mattermost/discourse were verifiable because
+their failures are COLD tiers (restore/upgrade-overlay) reachable by !testme on the PR head.
+
+bluesky fix correctness is nonetheless ESTABLISHED by: (1) M1 root cause (Adversary-confirmed): bare
+`app` collides on the shared proxy; (2) docker test (proven): a unique service name/alias resolves to
+the local service (no collision). Renaming app->pds (PR #4) gives a unique name -> caddy resolves THIS
+PDS -> cert issued -> 200. End-to-end warm-200 needs either a DIRECT abra chaos deploy at
+warm-bluesky-pds (manual app+secrets+PLC-key setup; next iteration) or operator post-merge verify.
+Restored the bluesky tag; node clean; warm-keycloak 200.
+
+## M2 STATUS (2026-06-18T04:05Z) — 4/6 verified
+- mattermost-lts: VERIFIED (PR #1 ci/pg-restore, !testme run #901 all-green incl restore).
+- discourse: VERIFIED (PR #4 discourse-official-image, !testme run #849 green).
+- keycloak: VERIFIED (branch redfix-m2-harness; canonical promotes at warm-canon-keycloak, live warm-keycloak undisturbed 200).
+- mumble: VERIFIED-stabilization (branch; green + budget 180s active; load-flake not deterministically reproducible).
+- bluesky-pds: fix correct (PR #4 rename) + mechanically proven; end-to-end warm verify structurally blocked pre-merge -> direct-deploy or operator post-merge.
+- gitea: PR #2 seed fix BROKE 3.5.3->3.6.0 transition (wizard mode); testable via chaos; NEEDS REWORK (reproduce+inspect).
+NOT claiming M2 — bluesky end-to-end + gitea rework outstanding.