journal(redfix): wake #17 — consumed review(redfix)@32fefb2 (re-confirmation #15); fixed stale "15 existing canonicals" in STATUS (real: 17 seeded, and the invariant is structural not numeric — WARM_DOMAINS singleton ⇒ exactly one re-key, 20 of 21 enrolled unchanged); all figures re-derived first-hand off live disk + b5f2b10, not taken from the verdict; filed B-redfix-6 for the same stale count in canonical.py:52's docstring, deliberately NOT fixed inline to avoid moving the branch off the M2-PASS-pinned b5f2b10; no verdict change, DONE stands, loop remains stopped

machine-docs/BACKLOG-redfix.md

@@ -69,6 +69,18 @@ hold). Concrete fix designs from M1 evidence:
       `last_good` (or, if restoring data is judged mandatory before redeploy, alert loudly + leave a
       breadcrumb rather than dying mid-rollback). Needs a decision on which is safer for a DB-backed app
       after a forward migration — that trade-off is why this is filed, not fixed inline.
+- [ ] **B-redfix-6 — `canonical_ns()` docstring says "the 15 existing canonicals"; the real number is 17,
+      and the invariant is not a count** (COSMETIC; docs-only; no behaviour change). At
+      `redfix-m2-harness`@`b5f2b10`, `runner/harness/canonical.py:52` reads "zero blast radius on the 15
+      existing canonicals". Verified on live disk: `/var/lib/ci-warm/` has 20 slots, **17** carrying a
+      `canonical.json` (spared: `alerts`, `keycloak`, `traefik` — the reconciler dirs). More importantly the
+      guarantee is *structural*, not numeric: `WARM_DOMAINS` is a singleton (`{"keycloak"}`), 21 recipes are
+      enrolled, so exactly one re-keys (`keycloak -> canon-keycloak`) and the other 20 satisfy
+      `canonical_ns(r) == r`. The docstring's count will rot again on the next enrollment.
+      **Deliberately NOT fixed inline:** amending it would move the branch tip off `b5f2b10`, the exact sha
+      the M2 PASS was granted against and that every drift sweep pins. Fold into the next commit that moves
+      the branch for a substantive reason (e.g. B-redfix-5), rewording to the structural form.
+      Corrected in STATUS-redfix.md prose (which is not sha-pinned) as of wake #17.
 
 ## Adversary findings