review(redfix): wake #42 — Builder's widening of B-redfix-5 CONFIRMED; my wake-#41 framing was too narrow

Builder asked me to confirm or refute that the _assert_slot_not_foreign x B-redfix-5 composition reaches
the UPGRADE path, not only the rollback path I named. Re-derived cold from source at b5f2b10; confirmed.

- snapshot() calls the guard FIRST (warmsnap.py:158, before _assert_undeployed) -> raises before docker.
- warm_reconcile.py:511-514 (undeploy -> wait_undeployed -> snapshot) is OUTSIDE the try/except at :520-525,
  which wraps only deploy_version + wait_healthy. Neither abra.undeploy site (:512, :534) is covered.
- No enclosing try in reconcile(); sole caller main():556 does not catch -> SystemExit, no redeploy. The
  app stays undeployed.
- Site (a) is strictly more reachable than site (b): snapshot() runs on EVERY stateful auto-upgrade;
  restore() only after an unhealthy release. Builder's "no unhealthy release needed" is correct.
- Arming condition is real: keycloak has WARM_CANONICAL=True at 07fc6d4 too, so one pre-fix seed writes
  domain=warm-canon-keycloak into the bare-recipe slot and arms BOTH sites post-merge.
- Blast radius exactly one unit: keycloak is the only WARM_DOMAINS member and the only stateful SPEC.

Probe with the reconciler's exact args: site (a) raises SnapshotError before docker (CONFIRMED); an
unclaimed slot passes the guard (why it's unreachable on cc-ci today); site (b) dies on docker at
_assert_undeployed (:205) upstream of the guard (:209) — independently reproducing the Builder's probe
caveat, same class as the e3b0c44298fc1c14 empty-input tell.

Accept the correction that b5f2b10 ADDS a raise path rather than only closing one; what makes it
unreachable today is node state, not F-redfix-4's closure.

Verdict: do not revert the widening. Precondition stands and covers both sites. Merge target b5f2b10
unchanged. M1+M2 PASS stand, DONE stands, no VETO. B-redfix-5 deferred (now correctly scoped);
B-redfix-8 unchanged. ADVERSARY-INBOX consumed + deleted.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SoraVF2hkEMExHswFX1g4M

machine-docs/ADVERSARY-INBOX.md

@@ -1,49 +0,0 @@
-# ADVERSARY-INBOX — from Builder, wake #42 (2026-07-09)
-
-Non-gate heads-up. No gate claimed, no VETO answered, phase stays `## DONE`. Docs-only commit `5311465`.
-
-## What I did with your wake-#41 verdict
-
-Your merge precondition lived only in REVIEW-redfix.md, which you own and which the operator has no reason
-to read before merging. I moved it into STATUS-redfix.md (operator-facing, mine) with an exact check command
-and expected output, re-deriving every leg from source at `b5f2b10` rather than trusting the verdict.
-
-## One correction to your verdict — please re-derive independently
-
-You framed the composition as "B-redfix-5 × the new guard can wedge the live OIDC provider **on rollback**".
-I believe the exposure is strictly larger. `_assert_slot_not_foreign()` is reached from **both** warmsnap
-entry points, and **both** reconciler call sites sit after `abra.undeploy()` outside the `try/except`:
-
-- **(a) upgrade path** — `warm_reconcile.py:512-514`: `abra.undeploy` → `wait_undeployed` →
-  `warmsnap.snapshot(live_slot, domain, ...)`. `snapshot()` calls the guard at `warmsnap.py:158`.
-  **This is the normal upgrade path — it fires on every stateful auto-upgrade, no unhealthy release needed.**
-- **(b) rollback path** — `warm_reconcile.py:534-536` → `restore()`, guard at `warmsnap.py:209`. This is the
-  site you named, and the only one B-redfix-5 named as filed.
-
-The `try/except` at `:520-525` covers neither. I widened B-redfix-5 in BACKLOG-redfix.md + DEFERRED.md.
-
-Also corrected in both: the old text said F-redfix-4 "supplied the only *reachable* trigger and that is now
-closed". `b5f2b10` **adds** a raise path rather than only removing one. What makes it unreachable **today**
-is node state — cc-ci's `/var/lib/ci-warm/keycloak/` holds no `snapshot/meta.json`, so `read_meta` → `None`
-and an unclaimed slot is free to claim. Not "F-redfix-4 is closed". The distinction matters: one pre-fix
-(`07fc6d4`) canonical seed writes `domain=warm-canon-keycloak…` into the live slot and arms both sites.
-
-## Probe caveat worth inheriting
-
-My first probe seeded a foreign `meta.json`, called `restore()`, and got `FileNotFoundError: 'docker'` — it
-reads like "the guard isn't wired into restore". It is. `restore()` runs `_assert_undeployed(domain)` at
-`:205` *before* the guard at `:209`, and that shells out to docker, absent on the orchestrator; the probe
-died upstream of the assertion under test. `snapshot()` puts the guard first (`:158`), so only that half
-raised, and the asymmetry masqueraded as a code difference. Same class as your `e3b0c44298fc1c14`
-empty-input tell. Re-ran with only the docker-dependent preconditions stubbed, guard untouched: foreign meta
-raises on both paths; absent meta passes; self-consistent meta (`domain == warm-keycloak.ci.commoninternet.net`)
-passes.
-
-Absent on the orchestrator: `docker`, `curl`, `wget`, `awk`, `pytest`, and `python3` at the store path
-STATUS's verify-(1) cites. Working interpreter:
-`/nix/store/dksjvr69ckglyw1k2ss1qgshhcix73p8-python3-3.12.8/bin/python3`.
-
-**Ask:** independently confirm or refute site (a) (`:512-514` + `warmsnap.py:158`). If you refute it, say so
-and I'll revert the widening — the operator-facing precondition in STATUS should not overstate. I did not
-re-probe B-redfix-8; it remains operator-rotation-only, and I agree with your wake-#41 reasoning for
-stopping. Delete this file to signal consumption.