status(redfix): ## DONE re-asserted — M2 PASS @2026-07-09T00:18Z, VETO CLEARED, F-redfix-4 CLOSED; merge target redfix-m2-harness@b5f2b10; B-redfix-5 recorded in DEFERRED.md

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FS8p1esg57UAC69riNvuBX

machine-docs/DEFERRED.md

@@ -427,3 +427,20 @@ reachable via the operator/dev STAGES escape — production drone runs always ru
   key on stdout (write to a run-scoped sidecar the test reads), or register the minted key in the harness
   redaction set so even the RAW log is scrubbed. Low priority (RAW log is access-controlled; key is ephemeral).
 - **Filed by:** Builder, phase prevb (acknowledging Adversary [F-prevb-C]).
+
+## B-redfix-5 — warm reconciler's rollback `restore()` is outside the upgrade's `try/except`
+
+- **What:** in `runner/warm_reconcile.py`, the unhealthy-rollback path is `abra.undeploy(domain)` →
+  `wait_undeployed` → `warmsnap.restore(...)` → `deploy_version(last_good)`. `restore()` sits OUTSIDE the
+  `try/except` guarding the upgrade, so if it raises for any reason (absent/corrupt snapshot, docker error)
+  the exception propagates and `deploy_version(last_good)` never runs — live keycloak is left **undeployed**,
+  taking down the shared OIDC provider `lasuite-*`/`drone` depend on.
+- **Why deferred, not fixed:** structural gap, present at `07fc6d4` and predating the keycloak enrollment.
+  F-redfix-4 supplied the only *reachable* trigger (the shared snapshot slot) and that is now closed at
+  `b5f2b10`. Not part of F-redfix-4's published clearing condition; the Adversary explicitly concurred it is
+  **not a VETO** and was "correctly filed rather than silently fixed".
+- **Needed from operator:** decide the safe behaviour for a DB-backed app after a forward migration —
+  (a) redeploy `last_good` anyway even though data was not restored, or (b) die loudly + leave a breadcrumb
+  rather than start on unrestored data. That trade-off is a real safety call, not a mechanical fix, which is
+  why it was not settled inside a remediation commit.
+- **Filed by:** Builder, phase redfix (from Adversary F-redfix-4 consequence 3).

machine-docs/STATUS-redfix.md

@@ -7,10 +7,31 @@ gitea, keycloak) → isolate → root-cause → classify (flake vs genuine; reci
 warm-machinery vs load) → FIX each (recipe PR or harness improvement) → verify green. No standing
 exceptions. Nothing merged.
 
-## Gate: M2 RE-CLAIMED (F-redfix-4 remedy), awaiting Adversary — 2026-07-09
+## DONE — 2026-07-09T00:18Z
 
-Prior DONE was withdrawn under the standing VETO F-redfix-4 (REVIEW-redfix.md re-confirmation #8
-@2026-07-08T23:56Z). The remedy is in. Re-claiming M2 for the keycloak item only.
+Phase `redfix` COMPLETE. All six canon-sweep failures investigated in isolation, root-caused, classified,
+**FIXED — each via a recipe PR or a harness improvement — and verified green**; no recipe left as a standing
+exception; nothing merged (operator merges). Every gate has a fresh Adversary PASS in REVIEW-redfix.md and
+there is **no standing VETO**:
+- **M1 PASS** @ 2026-06-18T01:18Z (investigation/classification cold-verified).
+- **M2 PASS** @ 2026-07-09T00:18Z (F-redfix-4 remedy cold-verified; VETO CLEARED; supersedes the
+  2026-06-18T07:06Z M2 PASS, which was given against parent `07fc6d4`).
+
+Adversary findings F-redfix-1/2/3/4 are all **CLOSED**; no open blocking finding.
+
+**Merge target: `redfix-m2-harness` @ `b5f2b10`** (not `07fc6d4` — that tip carries the F-redfix-4 defect).
+The earlier `## DONE` of 2026-06-18T07:09Z was **withdrawn** on 2026-07-09 under the standing VETO
+F-redfix-4 and is re-asserted here only after the remedy was Adversary-verified. Details of that cycle,
+and the still-open non-blocking B-redfix-5, are below.
+
+One deferred, non-blocking item remains recorded (NOT part of any DoD item, NOT a standing finding):
+**B-redfix-5** in BACKLOG-redfix.md — `warm_reconcile.py`'s rollback `warmsnap.restore()` sits outside the
+upgrade's `try/except`. Pre-dates the enrollment (present at `07fc6d4`); F-redfix-4 supplied the only
+*reachable* trigger and that is now closed. Adversary concurred it is not a VETO.
+
+---
+
+### F-redfix-4 remedy (the reason DONE was withdrawn and re-asserted) — 2026-07-09
 
 **WHAT.** F-redfix-4 is fixed at `redfix-m2-harness` @ **`b5f2b10`** (parent `07fc6d4`, the sha the M2 PASS
 was given against). Warm state is now keyed by a **stack namespace**, not a bare recipe:
@@ -107,7 +128,7 @@ The prior DONE text is retained verbatim below as the historical record of what
 
 ---
 
-## (HISTORICAL — superseded by the withdrawal above) DONE — 2026-06-18T07:09Z
+## (HISTORICAL — withdrawn 2026-07-09 under VETO F-redfix-4; superseded by the DONE above) DONE — 2026-06-18T07:09Z
 
 Phase `redfix` COMPLETE. All six canon-sweep failures investigated in isolation, root-caused,
 classified, **FIXED — each via a recipe PR or a harness improvement — and verified green**; no recipe