status(redfix): accept A-redfix-4 — weekly nightly-sweep.timer re-triggers reconcile; wedge is silent + recurring

Independently re-verified every leg against the node before editing (I adopted
A-redfix-2's probes wholesale at 8276ecd and inherited its error; not repeating that).

- Delete both 'no re-trigger' probes: they grep the app name, but the timer is
  named nightly-sweep, so they return empty while a timer drives it weekly.
  Sound probe greps the callee: git grep warm_reconcile -- runner/ nix/
- Replace 'recovery is manual' / 'heals on reboot' with the weekly DOWN/UP
  oscillation, and record that it is SILENT (roll_warm_infra discards the rc;
  the raise is upstream of every write_alert).
- Re-anchor the merge precondition: 'slot clean at merge time' -> 'never deploy
  07fc6d4'. A git merge executes nothing; b5f2b10 ships enrollment + fix together,
  so the precondition is self-maintaining.
- Line refs pinned to b5f2b10 coordinates (were main's, two lines off).
- BACKLOG B-redfix-5: severity corrected, remedy sketch extended to rc propagation.

Not armed and not self-arming: origin/main (the tree the sweep runs) has
WARM_CANONICAL = False. Nothing reopens; DONE stands, no VETO, b5f2b10 unchanged.
Inbox consumed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TkHo7RixQswYvvNnEcNaqW

machine-docs/BACKLOG-redfix.md

@@ -74,10 +74,26 @@ hold). Concrete fix designs from M1 evidence:
       `snapshot/meta.json` (`read_meta` → `None`, and an unclaimed slot is free to claim) — *not* because
       F-redfix-4 is closed. A pre-fix (`07fc6d4`) canonical seed is the one state that writes a foreign
       domain into the live slot; see the MERGE PRECONDITION in STATUS-redfix.md.
+      **Consequence, corrected (wake #44, A-redfix-4) — worse than recorded above, still not blocking.**
+      The wedge is neither manual-recovery-only (my `68b51d5`) nor reboot-healed (A-redfix-2). A weekly
+      `nightly-sweep.timer` (`OnCalendar=Sun *-*-* 03:00:00`, `Persistent=true`) re-invokes
+      `warm_reconcile.py keycloak` via `nightly_sweep.roll_warm_infra()` (`:60`), so once armed the wedge
+      **alternates DOWN/UP every 7 days, indefinitely**: sweep N wedges at site (a); sweep N+1 takes the
+      fresh-deploy branch (`:471-479`, no `warmsnap`) and comes back up on the old version; sweep N+2
+      wedges again. It is also **silent** — `roll_warm_infra()` discards the subprocess rc (`:59-62`) so
+      `nightly-sweep.service` reports `Result=success`, and site (a) is upstream of every `write_alert()`
+      (`:493,500,503,539`). A weekly outage of the shared SSO provider would surface nowhere. Verified
+      first-hand against the node, not adopted from the finding.
+      **Not armed, and not self-arming:** `origin/main` — the tree the sweep executes (`CCCI_REPO=/etc/cc-ci`)
+      — has `WARM_CANONICAL = False`; only `07fc6d4` and `b5f2b10` have `True`, and `b5f2b10` ships the
+      `canonical_ns()` fix so its seeds land in `canon-keycloak/`. The binding rule is **never deploy
+      `07fc6d4`**.
       Remedy sketch: wrap both sites so a warmsnap failure still redeploys `last_good` (or, if restoring
       data is judged mandatory before redeploy, alert loudly + leave a breadcrumb rather than dying mid-
-      rollback). Needs a decision on which is safer for a DB-backed app after a forward migration — that
-      trade-off is why this is filed, not fixed inline.
+      rollback), and make `roll_warm_infra()` propagate a non-zero rc so the failure is at least visible.
+      Needs a decision on which is safer for a DB-backed app after a forward migration — that
+      trade-off is why this is filed, not fixed inline. **Fixing it now would move the merge target off
+      `b5f2b10`, against which the M2 PASS was given, so it stays deferred for the operator.**
 - [ ] **B-redfix-6 — `canonical_ns()` docstring says "the 15 existing canonicals"; the real number is 17,
       and the invariant is not a count** (COSMETIC; docs-only; no behaviour change). At
       `redfix-m2-harness`@`b5f2b10`, `runner/harness/canonical.py:52` reads "zero blast radius on the 15