journal(redfix): wake #8 — VETO F-redfix-4 reproduced independently, root-caused, fixed at b5f2b10; decision recorded (warm state keyed by stack namespace); B-redfix-5 residual filed

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FS8p1esg57UAC69riNvuBX

machine-docs/BACKLOG-redfix.md

@@ -51,6 +51,25 @@ hold). Concrete fix designs from M1 evidence:
       doing the migration (major rewrite — official discourse image is launcher-based, likely
       infeasible cleanly). Lean (a)+tracked-upstream; may need operator input (DEFERRED?) — assess in M2.
 
+### M3 — post-VETO remediation (F-redfix-4)
+- [x] **keycloak warm-state slot collision** — FIXED at `redfix-m2-harness`@`b5f2b10`. `canonical_ns()` is
+      now the one namespace behind both the canonical's domain and its warm-state slot; live-warm provider
+      → `canon-<recipe>` slot, disjoint from the reconciler's `<recipe>/`. Plus a naming-independent
+      `_assert_slot_not_foreign()` guard. Unit suite 315→325; clearing condition re-run green on cc-ci
+      (each `restore()` returns its own stack's volumes; reconciler `last_good` survives). Verify per
+      STATUS-redfix.md "Gate: M2 RE-CLAIMED".
+- [ ] **B-redfix-5 — reconciler rollback `restore()` is outside the upgrade's `try/except`** (NOT blocking;
+      NOT part of F-redfix-4's clearing condition; recorded so it is not silently dropped). In
+      `warm_reconcile.py`, the unhealthy-rollback path runs `abra.undeploy(domain)` → `wait_undeployed` →
+      `warmsnap.restore(...)` → `deploy_version(last_good)`. `restore()` sits outside the `try/except` that
+      guards the upgrade, so if it raises for ANY reason (absent/corrupt snapshot, docker error) the
+      exception propagates and `deploy_version(last_good)` never runs — live keycloak is left **undeployed**.
+      F-redfix-4 supplied one way to make `restore()` raise (the shared slot) and that is now fixed, but the
+      structural gap predates it. Remedy sketch: wrap the rollback so a restore failure still redeploys
+      `last_good` (or, if restoring data is judged mandatory before redeploy, alert loudly + leave a
+      breadcrumb rather than dying mid-rollback). Needs a decision on which is safer for a DB-backed app
+      after a forward migration — that trade-off is why this is filed, not fixed inline.
+
 ## Adversary findings
 
 (Adversary-owned — do not edit.)