review(redfix): break-it probe — F-redfix-4 remedy verified against REAL cc-ci disk state; no defect; DONE stands, no VETO

Probed the one claim in b5f2b10 that is empirical rather than diff-checkable: "no migration on
cc-ci; keycloak's canonical was never seeded". If false, the new _assert_slot_not_foreign() guard
would wedge the live-warm reconciler's snapshot() on every stateful keycloak auto-upgrade.

Cold, read-only on cc-ci: keycloak/ + traefik/ hold only last_good (never seeded — claim TRUE);
all 17 existing canonical metas carry domain=warm-<recipe> and none is in WARM_DOMAINS, so the
guard passes unchanged (backward compatible); the dropped meta["recipe"] key has no consumer;
slot<->stack is 1:1 over all 21 enrolled recipes with live/canonical disjoint exactly for
WARM_DOMAINS; prune_stale's keep-set covers all 17 dirs and skips keycloak/ structurally.

No new finding. Merge target redfix-m2-harness@b5f2b10 unchanged. Loop stopped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AYMsxDCEMh92Qvgf38PjEU

machine-docs/REVIEW-redfix.md

@@ -651,3 +651,49 @@ live `warm-keycloak…/realms/master` → **200** throughout.
 M2 keycloak item: **PASS**. All six recipes now have a fresh Adversary PASS;
 F-redfix-1/2/3/4 all CLOSED; no open blocking finding. The Builder may re-assert `## DONE`.
 JOURNAL not consulted before this verdict.
+
+### Post-reboot re-confirmation #11 @2026-07-09T00:58Z — DONE stands, no VETO. Break-it probe: F-redfix-4 remedy vs. REAL cc-ci disk state — **no defect found**
+
+Terminal state re-checked cold: `## DONE` in STATUS-redfix.md; M1 PASS @2026-06-18T01:18Z + M2 PASS
+@2026-07-09T00:18Z; no standing VETO (the `## VETO` heading is annotated CLEARED); no
+`ADVERSARY-INBOX.md`; `redfix` is still the newest phase plan (mtime 2026-06-17). Merge target
+`redfix-m2-harness` @ `b5f2b10` resolves and is the pushed branch tip; origin/main @ `0539c46`.
+
+**Probe angle (new, not covered by #4–#8).** Prior probes checked evidence-sha *reachability* (#4/#6),
+fix *content* vs parent (#7), and the keycloak slot collision itself (#8, → F-redfix-4). None tested the
+remedy's **migration claim**, which is an empirical assertion about cc-ci's disk, not about the diff:
+b5f2b10's message claims "zero on-disk change for the existing canonicals, and no migration on cc-ci
+(keycloak's canonical was never seeded: its dir holds only last_good)". If that were false, the NEW
+`warmsnap._assert_slot_not_foreign()` guard would make the live-warm reconciler's `snapshot()` raise on
+every stateful keycloak auto-upgrade — a fail-closed but self-inflicted wedge of the shared OIDC provider,
+introduced by the very commit that fixes F-redfix-4. Worth breaking.
+
+**Cold evidence (read-only, `ssh cc-ci`, nothing mutated).**
+1. `find /var/lib/ci-warm -maxdepth 2` — **17** canonical dirs each with `canonical.json` + `snapshot/`;
+   `keycloak/` and `traefik/` hold **only `last_good`** — no `snapshot/`, no `canonical.json`. The
+   Builder's "never seeded" claim is **TRUE as observed**, not merely asserted.
+2. Read all 17 `snapshot/meta.json`: every one carries `"domain": "warm-<recipe>.ci.commoninternet.net"`
+   and the legacy `"recipe"` key. None of those 17 recipes is in `warm.WARM_DOMAINS` (which is
+   `{keycloak}` alone), so post-fix `canonical_slot(r) == r` and `canonical_domain(r) == warm-<r>…` — the
+   guard compares `meta["domain"] == domain` and passes. **Backward compatible; no migration needed.**
+3. The removed `meta["recipe"]` key is vestigial: `git grep` over b5f2b10 shows **no consumer** reads it
+   (the `"recipe"` hits in canonical.py/results.py/deps.py are the *registry*/results/deps records, a
+   different file). So dropping it for `"slot"` regresses nothing.
+4. Re-derived the invariants directly against the real on-disk/enrolled sets (worktree at b5f2b10, no
+   pytest needed — pure path logic): slot↔stack is 1:1 across all 21 enrolled recipes; live/canonical
+   slots are disjoint **exactly** for `WARM_DOMAINS` (`keycloak → canon-keycloak` vs `keycloak`); all 17
+   legacy metas pass the guard; the empty `keycloak/` slot is free to claim while a *foreign* canonical
+   meta planted there is refused in both `snapshot()` and `restore()`.
+5. `prune_stale()` blast radius: enrolled = 21, so `keep = {canonical_slot(r)}` covers **all 17** on-disk
+   dirs → prunes nothing. `keycloak/` is skipped **structurally** (no `canonical.json`), so the
+   reconciler's `last_good` cannot be `rmtree`'d — the claimed consequence-4 invariant holds on real disk,
+   and `prune_stale` derives the stale stack's volumes from `warm.stable_domain(<ns>)`, so pruning a
+   `canon-keycloak/` canonical would remove `warm-canon-keycloak…` volumes, never the live `warm-keycloak…`
+   ones.
+
+**Verdict: no new finding. DONE stands, no VETO.** The F-redfix-4 remedy at `b5f2b10` is safe to merge
+against cc-ci's actual state; its "no migration" claim is verified, not taken on trust. Node left
+untouched (read-only `find`/`head`; probe worktree removed). B-redfix-5 remains open, deferred,
+non-blocking — unchanged by this probe.
+
+Terminal condition met (DONE + fresh PASS on every gate + no VETO). Loop stopped.