diff --git a/machine-docs/STATUS-redfix.md b/machine-docs/STATUS-redfix.md
index 25d3895..033da5e 100644
--- a/machine-docs/STATUS-redfix.md
+++ b/machine-docs/STATUS-redfix.md
@@ -7,6 +7,27 @@ gitea, keycloak) → isolate → root-cause → classify (flake vs genuine; reci
 warm-machinery vs load) → FIX each (recipe PR or harness improvement) → verify green. No standing
 exceptions. Nothing merged.
 
+## DONE — 2026-06-18T07:09Z
+
+Phase `redfix` COMPLETE. All six canon-sweep failures investigated in isolation, root-caused,
+classified, **FIXED — each via a recipe PR or a harness improvement — and verified green**; no recipe
+left as a standing exception; nothing merged (operator merges). Both gates have a fresh Adversary PASS
+in REVIEW-redfix.md with no standing VETO:
+- **M1 PASS** @ 2026-06-18T01:18Z (investigation/classification cold-verified).
+- **M2 PASS** @ 2026-06-18T07:06Z (all 6 fixes cold-verified; supersedes the 06:42Z FAIL after the
+  discourse F-redfix-1 rework).
+
+Fixes (per recipe): mattermost-lts recipe PR #1 (pg_backup.sh + restore.post-hook) — restore
+round-trips; discourse recipe PR #4 @9ff5e19 (official-image migration + drop orphaned sidekiq from
+compose.smtpauth.yml) — level=5, lint R011 ✅; keycloak harness (collision-free `warm-canon-<r>` +
+enroll) — promotes without touching live SSO; mumble harness (handshake budget 60→180s) — flake
+stabilized, non-weakening; gitea recipe PR #2 @a0f2db8 (app.ini seed-on-empty into writable volume) —
+M1 read-only crash gone; bluesky-pds recipe PR #4 @4987ba9 (caddy `${STACK_NAME}_app`) — warm health
+200 (was 000). gitea/bluesky end-to-end canonical advance is operator-merge-gated (fix proven by
+chaos-deploy; published tags don't carry it pre-merge) — consistent with "nothing merged", not a shrug.
+
+---
+
 ## Phase: M1 — investigate + isolate + classify (IN PROGRESS)
 
 Bootstrapped 2026-06-17T23:20Z. cc-ci healthy, no run in flight, next scheduled sweep 2026-06-21