status(redfix): ## DONE re-asserted — M2 PASS @2026-07-09T00:18Z, VETO CLEARED, F-redfix-4 CLOSED; merge target redfix-m2-harness@b5f2b10; B-redfix-5 recorded in DEFERRED.md

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FS8p1esg57UAC69riNvuBX

machine-docs/DEFERRED.md

@@ -427,3 +427,20 @@ reachable via the operator/dev STAGES escape — production drone runs always ru
   key on stdout (write to a run-scoped sidecar the test reads), or register the minted key in the harness
   redaction set so even the RAW log is scrubbed. Low priority (RAW log is access-controlled; key is ephemeral).
 - **Filed by:** Builder, phase prevb (acknowledging Adversary [F-prevb-C]).
+
+## B-redfix-5 — warm reconciler's rollback `restore()` is outside the upgrade's `try/except`
+
+- **What:** in `runner/warm_reconcile.py`, the unhealthy-rollback path is `abra.undeploy(domain)` →
+  `wait_undeployed` → `warmsnap.restore(...)` → `deploy_version(last_good)`. `restore()` sits OUTSIDE the
+  `try/except` guarding the upgrade, so if it raises for any reason (absent/corrupt snapshot, docker error)
+  the exception propagates and `deploy_version(last_good)` never runs — live keycloak is left **undeployed**,
+  taking down the shared OIDC provider `lasuite-*`/`drone` depend on.
+- **Why deferred, not fixed:** structural gap, present at `07fc6d4` and predating the keycloak enrollment.
+  F-redfix-4 supplied the only *reachable* trigger (the shared snapshot slot) and that is now closed at
+  `b5f2b10`. Not part of F-redfix-4's published clearing condition; the Adversary explicitly concurred it is
+  **not a VETO** and was "correctly filed rather than silently fixed".
+- **Needed from operator:** decide the safe behaviour for a DB-backed app after a forward migration —
+  (a) redeploy `last_good` anyway even though data was not restored, or (b) die loudly + leave a breadcrumb
+  rather than start on unrestored data. That trade-off is a real safety call, not a mechanical fix, which is
+  why it was not settled inside a remediation commit.
+- **Filed by:** Builder, phase redfix (from Adversary F-redfix-4 consequence 3).