review(redfix): F-redfix-2 CLOSED — gitignore remedy cold-verified (fresh-clone + add -A replay, origin/main, no HTTP exposure); full 51-char key never committed (my prefix-grep was self-contaminated); Builder's symlink correction confirmed — one repo, fix fully applied; rotation left to operator; DONE stands, no VETO; consumed ADVERSARY-INBOX

machine-docs/REVIEW-redfix.md

@@ -358,3 +358,25 @@ CLOSED). **No VETO.** The Builder is cleared to write `## DONE` to STATUS-redfix
   dashboard/published-logs surface is unaffected. **Out of scope for redfix's Definition of Done → NO VETO;
   DONE stands.** Filed for the Builder to fix in a future phase (add to `.gitignore`). I did not touch the
   file. Terminal condition still met; loop stopped.
+
+- 2026-07-08T23:26Z — **F-redfix-2 CLOSED (non-blocking). Phase `redfix` remains DONE; still NO VETO.**
+  Consumed ADVERSARY-INBOX (Builder's F-redfix-2 remedy notice) and re-tested the fix from a cold start
+  rather than trusting it. The remedy @`8cf08fd` (gitignore `config.json`) **holds**: cold `git add -A` into a
+  scratch index stages `main.go` only, not `config.json`; `check-ignore` → `.gitignore:7`; the rule is on
+  `origin/main`, so a *fresh clone from origin* is protected too (a local-only edit would not have been).
+  Dashboard serves 200 but `/config.json` → 404; no tracked code reads it. No non-git exposure.
+
+  **I corrected an error of my own.** My "never committed" evidence used the 6-char prefix `tk_bhg`, which our
+  own finding/inbox/journal text now contains — so that grep was self-contaminating and would have kept
+  returning "hits" forever. Re-tested against the **full 51-char value**: 0 commits in either repo; binary
+  search shows the longest prefix ever committed is 6/51 chars, all of it in our own prose. Never leaked.
+
+  **The Builder also corrected me, and was right.** I claimed "BOTH Builder clones". `/srv/cc-ci` is a symlink
+  to `/srv/cc-ci-orch` — one repo, shared `.git` and `.gitignore` inodes. I verified this myself (`ls -ld`,
+  `rev-parse --show-toplevel`, inode compare) plus a filesystem sweep finding exactly one in-repo
+  `config.json`, now ignored. The fix is fully applied; there is no second un-ignored copy. Recording the
+  correction here because a finding that overstates its blast radius is a defect in the finding.
+
+  Residual (NOT closed, correctly escalated by the Builder to the operator, not decided by either loop): the
+  key remains on disk unrotated. Git is not a reason to rotate given it provably never entered history.
+  Terminal condition still met: DONE + fresh M1/M2 PASS + no VETO. Loop stopped.