journal(redfix): wake #58b — Adversary CONFIRMED both findings; chased the 3061-vs-3099 discrepancy to hardlinked local clones + unreachable objects; 'record the invariant, not the measurement'; loop STOPPED

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018XE43k4DaeMXHMK51wBUu2

machine-docs/JOURNAL-redfix.md

@@ -2308,3 +2308,45 @@ scanned after committing: still exactly 2 password blobs — my correction added
 Sent `ADVERSARY-INBOX.md` (`29d2b22`) for cold adjudication. No gate CLAIMED, no VETO sought.
 `## DONE` stands. Operator-scope; the credential rotation and the (now two-commit) scrub remain the
 operator's to perform. Loop continues until the Adversary adjudicates.
+
+---
+
+## Wake #58b — 2026-07-09 — Adversary adjudicated (`63f7001`): both findings CONFIRMED. One residual discrepancy chased down; loop STOPPED.
+
+The Adversary cold-verified my wake-#58 correction from its own clone and **confirmed both results**: the
+`oauth2` token is in **0** blobs (filesystem-only, not mirror-served), the password is in **exactly 2**
+(`fd21fcb8@14c7dee` + `bcc31b55@223cc16`, both published ancestors of `origin/main`). It also **accepted the
+catch** that its wake-#57 "the invariant now holds for both credentials" sentence overreached — it had not
+probed the mirror surface. Inbox consumed. No VETO; `## DONE` stands.
+
+**I did not accept the confirmation as-is.** Their scan reported **3061** blobs where mine reported **3099**.
+A verdict that agrees with me on the conclusion but disagrees on the evidence is still a disagreement, and the
+cheap read ("close enough, both found 2") would have left an unexplained number in a security artifact.
+
+Root cause, verified rather than guessed — **three** independent drifts, none of them an error:
+1. My own wake-#58 commits added blobs after I scanned (same host now reads **3104**).
+2. `--batch-all-objects` counts **unreachable** objects that `git rev-list --all` omits — **49** here;
+   reachable-only is **3026**.
+3. `git clone /local/path` **hardlinks the whole object store**, so my "cold" local clone inherited those
+   unreachable objects and *also* read 3104. A clone from the **remote** receives only reachable objects —
+   which is exactly why the Adversary's number is lower, and why its scope is the *more* correct one for a
+   question about what the mirror serves.
+
+**The real defect this exposed was mine, again.** My STATUS documented the reproduction with `# → 3099 lines`
+as the expected output. That figure was an **incidental measurement recorded as an assertion**. A future agent
+running the documented command would see a different number every time and could read the mismatch as a broken
+probe or a tampered repo — both false. Corrected: the repro now asserts a `wc -l > 100` sanity floor and names
+the **scope-independent invariants — password ⇒ 2, token ⇒ 0** — which held across all four scans
+(3099 / 3104 / 3026 / 3061) precisely *because* they don't depend on scan scope.
+
+Same failure shape as this wake's earlier `awk` near-miss, one level up: there, an unvalidated probe produced a
+false negative; here, a valid probe's incidental byproduct got frozen into a spec. **Record the invariant, not
+the measurement.** Both lessons are now in STATUS and BACKLOG, where the next agent will actually meet them.
+
+**Terminal state re-verified:** `## DONE` present; the two `^## VETO` headings are historical (self-marked
+CLEARED); latest Adversary verdict = "no VETO, `## DONE` stands"; both inboxes absent (consumed); tree synced
+with `origin/main`; STATUS + BACKLOG re-scanned post-commit and carry no credential value. Only `main.go`
+remains untracked — inert, unexplained, operator-flagged, not mine to delete.
+
+Handshake complete, counterparty stopped, no gate pending, nothing an agent loop can advance. The credential
+rotation and the **two-commit** history scrub are the operator's. Stopping the loop.