review(redfix): wake #43 — A-redfix-2 REFUTES "no code path redeploys it"; A-redfix-3 voids the "both clones" evidence

Probed the two operator-facing claims in the Builder's new commits (cbeceea, d5dc547). No inbox, no gate.

A-redfix-2 (LOW-MED) — "The wedge does not self-heal ... no code path redeploys it. Recovery is manual."
Conclusion right, mechanism wrong. abra.undeploy() does not remove the app .env, so the next reconcile()
sees current_version resolvable + is_deployed False and takes the fresh-deploy branch
(warm_reconcile.py:471-479), which redeploys and NEVER calls warmsnap -- the guard is unreachable there.
What actually blocks self-healing is the lack of a re-trigger: warm-keycloak.service is Type=oneshot with
no timer and no Restart=. So it heals on the next reboot / nixos-rebuild switch, then RE-WEDGES on the next
due upgrade because the foreign snapshot/meta.json is still in the slot. The failure therefore presents as
an intermittent flake, and the correct remediation is removing the foreign snapshot/, not redeploying
keycloak. Asked the Builder to correct two sentences; the precondition itself is unchanged and still right.

A-redfix-3 (INFO) — "main.go present in both clones => written outside git". Evidence void: /srv/cc-ci is a
SYMLINK to /srv/cc-ci-orch, so both paths are the same inode (2049:3254604, links=1). One file, one clone.
Risk bounded: 281-byte hello-world net/http listener, no go.mod, go not installed, nothing on :8080, in no
commit, unreferenced, inert. Concur with leaving it in place.

No VETO. DONE stands, M1+M2 PASS stand, merge target b5f2b10 unchanged. B-redfix-8 unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SoraVF2hkEMExHswFX1g4M

machine-docs/REVIEW-redfix.md

@@ -1321,3 +1321,41 @@ B-redfix-5 stays deferred/open (now correctly scoped to both call sites). B-redf
 (OPEN/HIGH/operator-rotation-only; not re-probed, by design — Builder concurs).
 
 Inbox consumed and deleted. Did not read JOURNAL-redfix.md before forming this verdict.
+
+---
+
+## Wake #43 — 2026-07-09T08:31Z — two new Builder claims probed; **one REFUTED** (A-redfix-2), one's evidence void (A-redfix-3). Still no VETO.
+
+Autonomous tick. No inbox, no gate claimed. Two new Builder commits (`68b51d5`, `42bc4e4`) each assert an
+operator-facing claim I had never verified. Probed both cold.
+
+**1. `68b51d5` — "The wedge does not self-heal … no code path redeploys it. Recovery is manual."**
+The *conclusion* holds; the *mechanism* is wrong → filed **A-redfix-2**.
+`abra.undeploy()` (`abra.py:295-297`) does not remove the app `.env`, so the next `reconcile()` finds
+`current_version` resolvable and `is_deployed` False, and takes the **fresh-deploy branch**
+(`warm_reconcile.py:471-479`) which redeploys `current or latest`. That branch **never calls `warmsnap`**, so
+the guard is never reached and the foreign meta cannot block it. A code path **does** redeploy it.
+What actually blocks self-healing is the absence of a **re-trigger**: `warm-keycloak.service` is
+`Type=oneshot`, `RemainAfterExit=true`, **no timer, no `Restart=`** (`git grep warm-keycloak -- nix/ | grep -iE
+'timer|OnCalendar|Restart='` → empty). So it heals on the next reboot / `nixos-rebuild switch`, then
+**re-wedges on the next due upgrade** because the foreign `snapshot/meta.json` is still in the slot.
+Consequence the Builder's wording hides: **the failure presents as an intermittent flake, and the correct
+remediation is deleting the foreign `snapshot/`, not redeploying keycloak.** I checked myself before filing
+(wake-#38 taught me to): confirmed no timer, confirmed `.env` survives undeploy, read the branch verbatim.
+
+**2. `42bc4e4` — untracked `main.go` "present in both clones ⇒ written by something outside git".**
+Evidence void → filed **A-redfix-3**. `/srv/cc-ci` is a **symlink to `/srv/cc-ci-orch`**
+(`ls -la /srv/`), so `/srv/cc-ci/cc-ci/main.go` and `/srv/cc-ci-orch/cc-ci/main.go` are the **same inode**
+(`2049:3254604`, `links=1`). One file, one clone. The "two clones" premise — and with it the "a git operation
+cannot leave the same untracked file in two clones" inference — carries no information. Same symlink applies
+to my own clones (`cc-ci-adv` → inode `3206945` via both paths), which is why I saw the file in neither: it
+sits in the Builder's tree only.
+Risk bounded read-only: 281-byte hello-world `net/http` listener, `sha256 bdbc3bf1…`, no `go.mod`, `go` **not
+installed**, **nothing listening on :8080**, in no commit on any ref, not gitignored, unreferenced by any
+tracked file. Inert. Concur with leaving it in place — neither of us created it.
+
+**Verdict: no VETO. `## DONE` stands; M1 + M2 PASS stand; merge target `b5f2b10` unchanged.** Both findings
+are LOW-MED/INFO and concern operator-facing *descriptions*, not DoD items. The B-redfix-5 **precondition
+itself is unchanged and still correct** — A-redfix-2 corrects only the mechanism + remediation sentences.
+B-redfix-8 unchanged (OPEN/HIGH/operator-rotation-only; not re-probed, by design).
+Did not read JOURNAL-redfix.md before forming these verdicts.