journal(redfix): wake #21 — no-op re-check; corrected two inherited facts: stray root main.go was created 2026-07-09T00:01:57Z (ctime==mtime), not 2026-06-23, so it was written mid-phase rather than being an old leftover; and /srv/cc-ci vs /srv/cc-ci-orch are one path (same inode+git dir), so there is one main.go not two. Still untracked/unreferenced/secret-free => cannot affect a cold clone; still not mine to delete. DONE stands, no VETO, loop stopped; B-redfix-8 (public bot-password leak) remains open on operator rotation.

machine-docs/JOURNAL-redfix.md

@@ -1281,3 +1281,40 @@ canon-sweep DoD and clearable only by an external action, so neither of us vetoe
 phase without helping. **M1/M2 PASS, DONE stands, no VETO.** This is the one item in this whole tail of
 re-confirmations that genuinely needs the human, so I am surfacing it to the operator plainly and not
 burying it in the loop files.
+
+## Wake #21 — 2026-07-09T02:14Z — no-op re-check; one recorded fact corrected (`main.go` mtime)
+
+Re-derived the terminal predicate first-hand rather than trusting the last entry:
+`## DONE` present in STATUS-redfix.md (2026-07-09T00:18Z); the only `## VETO` in REVIEW-redfix.md is
+the F-redfix-4 one, explicitly `CLEARED @2026-07-09T00:18Z`; no `machine-docs/BUILDER-INBOX.md`.
+Terminal condition met. Nothing to build, nothing to re-verify. Loop stays stopped.
+
+**Correction to wake #7.** That entry described the stray untracked root `main.go` as having
+`mtime 2026-06-23`. That is false as of now, and I am not going to inherit it:
+
+    stat -c 'mtime=%y ctime=%z uid=%u mode=%a size=%s' main.go
+    -> mtime=2026-07-09 00:01:57.842057029 +0000  ctime=2026-07-09 00:01:57.842057029 +0000
+       uid=1000 mode=644 size=281
+    sha256=bdbc3bf167cd20f30c00880005f4f994f17f3722660973c9c65c7bf33e81ffaf
+
+`ctime == mtime` means the inode was created (or wholly rewritten) at **2026-07-09T00:01:57Z** — during
+today's wake sequence, ~16 min *before* the DONE marker — not in June. So the file is not the inert
+leftover "stable since June" that wake #7 implied; something wrote it mid-phase. I cannot attribute the
+writer: `git log --all -- main.go` is empty (0 commits, never tracked on any ref), and no plan or phase
+file references it. It is the sole `.go` file in a Python/Nix harness.
+
+Also corrected: earlier entries treat `/srv/cc-ci/cc-ci` and `/srv/cc-ci-orch/cc-ci` as two clones that
+each grew a copy. They are one path — same inode (3254604), same dev, same absolute git dir. There is
+exactly **one** `main.go`, not two.
+
+**Position unchanged, and unchanged for the right reason.** I did not write it, so I surface it rather
+than delete it — that call is the operator's. It is harmless to verification regardless: `git status
+--porcelain main.go` -> `??` (untracked, not ignored), so it cannot reach a cold clone or perturb any
+Adversary cold-verify. It contains no secret (16-line net/http "Hello, World!" on :8080). The *only*
+thing that changed is that "unexplained and old" is now "unexplained and recent" — which is mildly more
+interesting, not more dangerous.
+
+No DoD item touched. DONE stands, no VETO, loop remains stopped. The one genuinely open item remains
+**B-redfix-8** (HIGH): the live Gitea bot password is on `origin/main` and served unauthenticated to the
+public internet. Redaction at HEAD is done; history cannot be rewritten without `--force` (forbidden), so
+**operator credential rotation is the only remediation** and it is outside my authority.