review(redfix): wake #54 — cold re-verify on closed phase; DONE + no-VETO reaffirmed; 'never deploy 07fc6d4' invariant HOLDS on the live node (07fc6d4 not an ancestor of deployed HEAD d11f8f5; keycloak WARM_CANONICAL=False is a real assignment). STATUS mechanism CORRECTED: sweep runs deployed /etc/cc-ci, not origin/main — guarantee is a property of what is deployed. No gate impact.

machine-docs/REVIEW-redfix.md

@@ -1592,3 +1592,41 @@ the single file) is insufficient and rotation alone re-exposes the new value. It
 (remove userinfo from git's URL layer; use a 0600 credential helper) but touches **no gate / no DoD item** —
 the dashboard invariant holds and this is host-local FS exposure inside existing operator-only A-redfix-1/
 B-redfix-8 scope. **No VETO; `## DONE` stands.**
+
+---
+
+## Wake #54 @2026-07-09T10:2xZ — cold re-verify on closed phase; "never deploy `07fc6d4`" invariant HOLDS (mechanism corrected)
+
+Reboot on a closed phase. Re-confirmed cold, no reliance on prior notes: `## DONE` stands in
+STATUS-redfix.md; the two `## VETO` headings in this file remain historical (one CLEARED, one the
+clearing record) — **no standing VETO**; no `ADVERSARY-INBOX.md`; local `HEAD == origin/main`
+(`4c62cd0`), zero Builder commits since my last verdict. No gate pending.
+
+Rather than idle-re-verify a settled gate, I probed the one thing that could **drift** on a closed
+phase: the B-redfix-5 precondition, re-anchored at wake #44 to **"never deploy `07fc6d4`"**.
+
+**Verdict: the invariant HOLDS. The trap is not armed.** But STATUS's stated *mechanism* is loose,
+and I record the correction:
+
+- STATUS says the wedge is disarmed because "*`origin/main`, the tree the sweep runs*, has
+  `WARM_CANONICAL = False`." **The sweep does not run `origin/main`.** Grepping the callee rather
+  than the claim: `nightly-sweep.service` ExecStart is a nix-store wrapper that sets
+  `CCCI_REPO=/etc/cc-ci` and `exec`s `cc-ci-run "$CCCI_REPO/runner/nightly_sweep.py"`. The tree that
+  actually executes is the **deployed checkout `/etc/cc-ci`**, currently branch `main` @ `d11f8f5`,
+  working tree **clean**.
+- Against that real tree, the load-bearing fact checks out: `tests/keycloak/recipe_meta.py:16` is a
+  genuine assignment `WARM_CANONICAL = False` (not merely the prose "stays False" in the comment at
+  line 15 — I confirmed the assignment separately, since a comment is not a value).
+- `07fc6d4` **exists** as a commit object in that repo but is **NOT an ancestor of the deployed
+  HEAD** (`git merge-base --is-ancestor 07fc6d4 HEAD` → false). The precondition is satisfied on the
+  live node, not just in the plan.
+- `nightly-sweep.timer` is live (last fired 2026-07-05T03:04Z, next 2026-07-12T03:05Z), so A-redfix-4's
+  "recurring, silent" characterisation stands — the disarm rests on tree content, not on the timer
+  being dormant.
+
+**Impact: none on any gate or DoD item.** The conclusion STATUS draws is correct; only its reasoning
+about *which* tree confers the guarantee was wrong. That distinction matters for the operator: the
+guarantee is a property of **what is deployed to `/etc/cc-ci`**, so a future deploy — not a merge to
+`origin/main` — is what could arm the wedge. Recorded as a precision fix, not a defect.
+
+`## DONE` stands. No VETO. Loop stopped; terminal state re-verified.