review(redfix): re-confirmation #16 — refs swept cold via ls-remote (harness==b5f2b10, NOT-MERGED, 3 recipe pins exact, discourse already content-verified at ede63991); B-redfix-6 independently confirmed REAL but docstring-only (WARM_DOMAINS is a singleton ⇒ invariant is structural, not numeric); noted a false NOT-MERGED from an earlier bad-path probe so it isn't mistaken for evidence; no finding, DONE stands, no VETO

machine-docs/REVIEW-redfix.md

@@ -855,3 +855,36 @@ checks read-only: `ls`/`ls-remote`/`merge-base`, a shallow fetch into the scratc
 B-redfix-5 remains open, deferred, non-blocking.
 
 Terminal condition met (DONE + fresh PASS on every gate + no VETO). Loop stopped.
+
+## re-confirmation #16 @2026-07-09T01:52Z — B-redfix-6 verified independently; ref sweep clean; no finding
+
+Cold sweep of every pinned ref, plus first-hand check of the one Builder claim (B-redfix-6) I had
+not yet verified myself.
+
+**Refs — authoritative `git ls-remote`, not a local checkout.**
+- harness `redfix-m2-harness` = `b5f2b104e6dd41f5…` — exactly the M2-PASS pin `b5f2b10`. ✔
+- `refs/heads/main` = `594824d9` = my clone's tip. `merge-base --is-ancestor redfix-m2-harness main`
+  → false ⇒ **NOT-MERGED**, the phase's "nothing merged" constraint still holds. ✔
+- Recipe PRs: mattermost-lts `ci/pg-restore`@4ca7f418 ✔, gitea `ci/app-ini-writable`@a0f2db88 ✔,
+  bluesky-pds `ci/warm-routing-alias`@4987ba91 ✔ (the latter two "differ" from STATUS only in that
+  STATUS abbreviates to 7 chars — same commits, my first comparison was the bug, not the repo),
+  discourse `discourse-official-image`@ede63991 — moved off STATUS's 53ba0910, already re-verified
+  BY CONTENT at this tip in re-confirmation #14 (official image 3.5.3, 0 sidekiq). No new drift.
+
+**Trap avoided.** `/etc/cc-ci` on the node holds `redfix-m2-harness` at `b96b8a4c` (2026-06-18) and
+does not even know the object `b5f2b10`. That is a stale local checkout, NOT branch drift — the
+remote is authoritative and reads b5f2b10. An earlier probe of mine that `cd`'d to a nonexistent path
+printed a *false* NOT-MERGED from a failed command; re-run properly, the true answer is the same, but
+the reasoning behind the first one was worthless. Recording so it is not mistaken for evidence.
+
+**B-redfix-6 — CONFIRMED REAL, cosmetic only.** `runner/harness/canonical.py`, `canonical_ns()`
+docstring: "zero blast radius on the 15 existing canonicals" — same stale count the Builder corrected
+in STATUS (real: 17 seeded). It sits inside a triple-quoted docstring; no runtime effect. The code it
+documents is unchanged and correct:
+`if recipe in warm.WARM_DOMAINS: return f"canon-{recipe}"` / else `recipe`, and
+`runner/harness/warm.py:27` shows `WARM_DOMAINS = {"keycloak": …}` — a **singleton**, so exactly one
+recipe re-keys and 20 of 21 enrolled canonicals are untouched. The invariant is structural, not
+numeric; the wrong number cannot make it false. Builder's choice to defer rather than amend b5f2b10
+(which M2's PASS pins) is the right call — I do not want the branch moved to fix a comment.
+
+**Verdict: no finding. M1 + M2 PASS stand. DONE stands. No VETO.**