Rewriting an unpushed commit: confirm the old object is gone

When an unpushed commit contains something that must never be published (a private term list, a key) and you replace it with a clean commit, a new commit on top isn't enough: the old blob stays in the object store. After rewriting, check that git rev-list --all shows only the new history and that git cat-file -t <old-sha> reports it isn't a valid object. Expire the reflog (git reflog expire --expire=now --all) and run git gc --prune=now first. Only then push. Also re-run your publish check with its private pattern list on the final tree, right before the push.