diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md
index 3b671e8..4e39336 100644
--- a/machine-docs/REVIEW-redfix.md
+++ b/machine-docs/REVIEW-redfix.md
@@ -473,3 +473,33 @@ CLOSED). **No VETO.** The Builder is cleared to write `## DONE` to STATUS-redfix
   reachable but still the right commits. Rot is confined to discourse (already CLOSED as F-redfix-3,
   content re-verified at `ede6399`). No new finding; no gate reopened.
   Terminal condition met (DONE + fresh PASS on every gate + no VETO). Loop stopped.
+
+### Post-reboot re-confirmation #7 @2026-07-08T23:47Z — DONE stands, no VETO
+
+Pulled: zero delta since #6 apart from a Builder JOURNAL append (`7ac7eb0`, wake #6, "Loop stopped").
+`## DONE` still in STATUS-redfix.md; every gate has a fresh PASS; no VETO; no `ADVERSARY-INBOX.md`.
+
+**Break-it probe (new angle — fix CONTENT, not sha reachability).** #6 proved the M2 evidence anchors
+were still *reachable* with matching subjects. That is a weaker claim than "the fix is really there":
+a reachable sha with a plausible subject could still carry no fix. So I cold `--bare` cloned each
+recipe from `git.autonomic.zone/recipe-maintainers/` into a fresh scratch dir and grepped the TREE at
+each asserted sha, with the parent commit as a negative control:
+
+  * **mattermost-lts @`4ca7f418`** — `compose.yml:63 backupbot.restore.post-hook: "/pg_backup.sh restore"`
+    present. Parent `4ca7f418^`: **0 matches**. The M1 root cause (missing restore post-hook) is exactly
+    what the fix commit adds. ✔
+  * **gitea @`a0f2db8`** — config target is `/etc/gitea/app.ini.init` (`compose.yml:9`) and
+    `docker-setup.sh.tmpl:27` does `cp /etc/gitea/app.ini.init /etc/gitea/app.ini`, i.e. the RO docker
+    config no longer overlays the file gitea must persist its JWT into. Parent: **0** occurrences of
+    `app.ini.init`. Matches the M1 read-only-file-system FATA root cause. ✔
+  * **bluesky-pds @`4987ba9`** — fix adds `APP_HOST=${STACK_NAME}_app` (fully-qualified swarm name);
+    diff vs parent is purely additive (parent has no `APP_HOST` at all), and a tree-wide grep at the fix
+    sha finds **no** leftover bare `- app` network alias. Matches the M1 `app`-alias collision root cause. ✔
+
+Three for three: the asserted commits contain the asserted fixes, and their parents demonstrably do not
+(so these are not vacuous greps against content that predates the fix). Combined with #6's anchor-
+reachability result and F-redfix-3's content re-verification of discourse at `ede6399`, all four recipe
+fixes are now content-anchored, not merely sha-anchored.
+
+No new finding. No gate reopened. All findings CLOSED (F-redfix-1, F-redfix-2, F-redfix-3).
+Terminal condition met (DONE + fresh PASS on every gate + no VETO). Loop stopped.