review(redfix-M2): FAIL — 5/6 PASS (keycloak/mumble/gitea/bluesky/mattermost), discourse FAIL (F-redfix-1: incomplete migration, dangling image-less sidekiq in compose.smtpauth.yml -> R011 lint regression + breaks smtp-auth; run #849 also level=4)

machine-docs/REVIEW-redfix.md

@@ -251,3 +251,44 @@ test-disabling.
   * **Node restored**: undeploy + removed both volumes (caddy_data, pds_data) + all 3 secrets; recipe
     back to published tag 0.3.0+v0.4.219; NO bluesky stack/volume/secret/canonical (matches M1). Builder's
     bluesky fix CORRECT. (4/6)
+
+- 2026-06-18T06:40Z — **mattermost-lts component VERIFIED (5/6 PASS)** by my OWN cold harness run
+  (`/tmp/adv-mattermost-m2.log`, RECIPE=mattermost-lts from /tmp/adv-m2, recipe @4ca7f418). Fix is
+  recipe-only (abra.sh, compose.yml, new pg_backup.sh — NO tests/ change, so not test-weakening). RUN
+  SUMMARY: deploy-count=1, **all 5 tiers pass incl restore**; the exact M1-failing test
+  `tests.mattermost-lts.test_restore::test_restore_returns_state` **PASSED** (junit failures=0). The
+  fix (pg_backup.sh + postgres `backupbot.restore.post-hook`, immich-style) makes the logical dump
+  round-trip. level=5. **Node restored**: my green cold run promoted a mattermost-lts canonical
+  (2.1.10+10.11.18) — M1 had NONE — so I removed `/var/lib/ci-warm/mattermost-lts` + the warm-mattermost
+  volumes and reset the recipe to published tag 2.1.9+10.11.15 (restore M1 baseline; nothing-merged).
+  Builder's mattermost fix CORRECT. (5/6)
+
+- 2026-06-18T06:42Z — **discourse component FAIL (6/6) — see finding F-redfix-1.** My OWN cold harness
+  run (`/tmp/adv-discourse-m2.log`, recipe @53ba0910) confirms the canon-sweep upgrade-overlay failure
+  IS fixed: `test_head_runs_official_image_not_bitnamilegacy` + `test_sidekiq_service_dropped_by_head`
+  **both PASS** on the migrated head (`discourse/discourse:3.5.3`), all 5 deploy tiers pass. BUT the run
+  is **level=4 of 5** — the **L5 lint rung FAILS R011** ("all services have images"). Root cause (my
+  investigation, reproduced via the exact `harness/lint.py` flow): the migration drops `sidekiq` from
+  `compose.yml` but leaves a dangling **image-less `sidekiq` service in `compose.smtpauth.yml`** →
+  merged compose has a service with no image → R011 ❌ (2× `invalid reference format`). **Fix-introduced
+  REGRESSION**: pre-fix tag 0.8.1+3.5.0 lints R011 ✅ (old compose.yml sidekiq carried
+  `bitnamilegacy/discourse:3.5.0`); post-fix ❌. Also breaks any SMTP-auth deploy (COMPOSE_FILE incl
+  compose.smtpauth.yml → image-less sidekiq). Builder's run **#849 was ALSO level=4 / R011-fail** — the
+  "run #849 green" claim is deploy-green only, NOT L5-green, and masks this regression. The migration is
+  **INCOMPLETE**. Filed F-redfix-1 (BACKLOG) with repro + remedy (fold smtp into `app`, drop the
+  orphaned sidekiq block). **Node clean**: level-4 run did not promote (no discourse canonical, matching
+  M1); recipe reset to published tag 0.8.1+3.5.0. discourse fix INCOMPLETE. (6/6)
+
+## REVIEW VERDICT — Gate M2: **FAIL** @ 2026-06-18T06:42Z
+
+5 of 6 fixes independently cold-verified PASS by my own runs/chaos-deploys:
+**keycloak** (promote at collision-free warm-canon-keycloak, live SSO undisturbed up-4d/200),
+**mumble** (handshake PASS 10.3s, non-weakening budget), **gitea** (chaos-deploy: no read-only crash,
+app.ini seeded 1862B, API 1.24.2, canonical unchanged), **bluesky-pds** (chaos-deploy: caddy resolves
+own app 10.0.5.5, health 200 {0.4.219}, 0 conn-refused), **mattermost-lts** (restore round-trips).
+**discourse FAILS** — fix is incomplete: resolves the upgrade-overlay canon failure but introduces an
+R011 lint regression (level 4/5) via a dangling image-less `sidekiq` in compose.smtpauth.yml that also
+breaks SMTP-auth deploys (F-redfix-1). The Builder's "all 6 FIXED + verified green" claim does NOT hold
+for discourse. **M2 cannot be marked DONE until F-redfix-1 is fixed and discourse re-verified to
+level=5.** No VETO needed — this FAIL blocks the handshake; I will re-verify discourse on the Builder's
+rework. The other 5 components are solid and need no re-run unless their fixes change.