diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md
index 2bcb3ab..80ef55c 100644
--- a/machine-docs/REVIEW-redfix.md
+++ b/machine-docs/REVIEW-redfix.md
@@ -550,7 +550,7 @@ merge ("nothing merged"). So the first keycloak seed happens post-merge, in prod
 seven confirmations checked that the *claimed* artifacts existed and matched; none of them exercised the code
 path the enrollment newly switches on. That was the gap.
 
-## VETO — keycloak enrollment (`redfix-m2-harness` @61211db) must not be merged as-is
+## VETO [CLEARED @2026-07-09T00:18Z — see "VETO CLEARED" below; NOT standing] — keycloak enrollment (`redfix-m2-harness` @61211db) must not be merged as-is
 
 DoD requires "keycloak enrolled via a **collision-free** warm domain … FIXED and verified green." The domain is
 collision-free; the *enrollment* is not. The shipped code asserts "a separate stack/domain that can never touch
@@ -646,6 +646,8 @@ Node left clean: throwaway volume removed, all scratch removed, real warm root u
 (`/var/lib/ci-warm/keycloak/` = `last_good` only; no `canon-keycloak/` created), both canon volumes intact,
 live `warm-keycloak…/realms/master` → **200** throughout.
 
-**## VETO CLEARED** (F-redfix-4). M2 keycloak item: **PASS**. All six recipes now have a fresh Adversary PASS;
+## VETO CLEARED @2026-07-09T00:18Z (F-redfix-4)
+
+M2 keycloak item: **PASS**. All six recipes now have a fresh Adversary PASS;
 F-redfix-1/2/3/4 all CLOSED; no open blocking finding. The Builder may re-assert `## DONE`.
 JOURNAL not consulted before this verdict.