journal(redfix): post-reboot re-confirmation #2 — phase still DONE (M1+M2 PASS, no VETO); record warm-gitea pre-merge crash-loop (= M1 root cause, awaits PR #2), foreign wedged procs, and untracked root files left untouched (config.json holds a live-looking API key)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KKptqtbUkaLHDCmwomwDjy

machine-docs/JOURNAL-redfix.md

@@ -545,3 +545,31 @@ stack/canonical (untagged migrated head doesn't promote), recipe reset to publis
 
 Other 5 (keycloak/mumble/gitea/bluesky-pds/mattermost-lts) Adversary-PASS already, fixes unchanged — not
 re-run. 6/6. Re-claiming M2.
+
+## 2026-07-08 — post-reboot re-confirmation #2 (no work performed)
+
+Terminal condition re-checked, unchanged: `STATUS-redfix.md` = `## DONE`; `REVIEW-redfix.md` shows
+M1 PASS @2026-06-18T01:18Z and M2 PASS @07:06Z (6/6, supersedes the 06:42Z FAIL after F-redfix-1 was
+closed); no standing `## VETO`; no `BUILDER-INBOX.md`. Loop remains stopped. No new work claimed.
+
+Node observations (informational — none are phase regressions, none actioned):
+
+- `warm-gitea_ci_commoninternet_net_app` is crash-looping, `0/1`. Cause confirmed from
+  `docker service logs`: `error saving JWT Secret for custom config: failed to save
+  "/etc/gitea/app.ini": open /etc/gitea/app.ini: read-only file system`. This is *exactly* the M1
+  root cause, and it is the expected pre-merge state: the fix lives in unmerged recipe PR #2
+  (`ci/app-ini-writable`), and the phase guardrail is "nothing merged — the operator merges". The warm
+  service deploys the published (unfixed) release, so it will keep crash-looping until PR #2 is merged.
+  Live corroboration of the M1 classification, not a new defect.
+
+- Two stray wedged processes on cc-ci, both blocked on interactive `abra` prompts, both started
+  AFTER this phase completed (2026-06-18): pid 577140/577187 (`dev-bluesky-pds` secret insert, started
+  2026-06-26) and pid 580348 (`abra app config dev-drone`, started 2026-06-19). They are not this
+  phase's and left nothing deployed (`docker stack ls` shows no `dev-` stacks). Not killed — foreign
+  session, not mine to reap.
+
+- Two untracked files in the repo ROOT, not created by this phase (mtime 2026-06-23, five days after
+  DONE): `main.go` (a hello-world HTTP server) and `config.json` (LLM provider config containing what
+  looks like a **live Tinfoil API key**). Deliberately NOT committed — staging `config.json` would
+  write a credential into git history — and deliberately NOT deleted, since this loop did not create
+  them. Flagged to the operator. Staged nothing via `git add -A` for this reason.