status(redfix): record the b5f2b10 MERGE PRECONDITION; widen B-redfix-5 to both post-undeploy sites

Acting on the Adversary's wake-#41 verdict (3131e39), which CONFIRMED the merge guidance but left a merge
precondition only in REVIEW-redfix.md — Adversary-owned, and not what an operator reads before merging.
Moved it into STATUS (operator-facing, mine), re-deriving every leg from source at b5f2b10 rather than
trusting the verdict.

- STATUS: MERGE PRECONDITION for b5f2b10, with the exact ssh check + expected output, and the corrected
  reason it is unreachable today (live slot has no meta.json — NOT "F-redfix-4 is closed").
- Sharpening the Adversary missed: the new guard is reached from snapshot() at warm_reconcile.py:514 as
  well as restore() at :536. Line :512-514 is undeploy -> wait_undeployed -> snapshot, also outside the
  try/except, and it is on the NORMAL upgrade path — it fires on every stateful auto-upgrade, not only on
  rollback. B-redfix-5 as filed named only the rollback site.
- BACKLOG + DEFERRED: widen B-redfix-5 to both sites (a) :512-514 and (b) :534-536; correct the claim that
  F-redfix-4 "supplied the only reachable trigger and that is now closed" — b5f2b10 ADDS a raise path
  (_assert_slot_not_foreign at warmsnap.py:158 and :209).

Verified: guard present in both callers at b5f2b10; reconciler structure at :512-514 / :520-525 / :534-537;
cc-ci live slot holds last_good only (no snapshot/, no meta.json, no canon-* slot). Probe with a seeded
foreign meta raises on both paths; absent meta and self-consistent meta both pass.

No DoD item touched. M1+M2 PASS stand, ## DONE stands, no VETO. Docs-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZmH4rVNue3irZ6EsZzavb

machine-docs/JOURNAL-redfix.md

@@ -1669,3 +1669,53 @@ differs from `3fcea78925015fc9`.
 **Unrelated, surfaced not touched:** an untracked `main.go` (281 B, Go hello-world HTTP server on :8080)
 sits at the repo root of this clone. Not mine, foreign to this Nix repo, absent from git and from
 `origin/main`. Left in place — not committed (would pollute the repo), not deleted (not mine to destroy).
+
+---
+
+## Wake #42 — 2026-07-09 — watchdog ping on the Adversary's wake-#41 verdict
+
+Pulled `cf1455f`. Verdict is a CONFIRM of the merge guidance (`b5f2b10`, not `07fc6d4`), no new finding, no
+VETO, M1+M2 PASS stand. So: nothing to unblock, no gate to re-claim. But the verdict carried a *merge
+precondition* that existed only in REVIEW-redfix.md, which is Adversary-owned and which the operator has no
+reason to read before merging. STATUS is the operator-facing artifact I own. Moving it across is the work.
+
+I did not take the Adversary's word for it. Re-derived every leg from source at `b5f2b10` in a detached
+worktree, plus one live check on the node:
+
+1. `restore()` really does call the new guard (`warmsnap.py:209`), and `snapshot()` calls it too (`:158`).
+   So `b5f2b10` *adds* a raise path to warmsnap — it does not only remove one.
+2. `warm_reconcile.py` rollback: `abra.undeploy` → `wait_undeployed` → `restore` → `deploy_version` at
+   `:534-537`, all outside the `try/except` at `:520-525`. Confirmed — this is B-redfix-5 as filed.
+3. cc-ci live slot: `ls -A /var/lib/ci-warm/keycloak/` → `last_good` only; no `snapshot/`, no `meta.json`;
+   no `canon-*` slot. So `read_meta` → `None` → guard passes. Composition unreachable **today**.
+
+Then the part the Adversary understated. It framed the risk as "B-redfix-5 × the new guard can wedge the
+live OIDC provider **on rollback**". But the guard is also reached via `snapshot()` at `warm_reconcile.py:514`
+— and `:512-514` is `abra.undeploy` → `wait_undeployed` → `snapshot`, likewise outside the try/except. That
+site is on the **normal upgrade path**: it fires on every stateful auto-upgrade, no unhealthy release
+required. So the blast radius of the precondition is strictly larger than "on rollback", and B-redfix-5 as
+originally filed named only one of the two sites. Widened it in BACKLOG + DEFERRED.
+
+Proving it needed care, and my first probe was wrong. Seeding a foreign `meta.json` and calling `restore()`
+gave `FileNotFoundError: 'docker'`, not `SnapshotError` — I briefly read that as "the guard isn't wired into
+restore after all", which would have contradicted the Adversary. It didn't: `restore()` runs
+`_assert_undeployed(domain)` at `:205` *before* the guard at `:209`, and that shells out to docker, which is
+absent on the orchestrator. The probe died upstream of the thing under test. `snapshot()` puts the guard
+first (`:158`, before `_assert_undeployed`), which is why that half raised cleanly and the asymmetry looked
+like a code difference rather than a probe artifact. Re-ran with the two docker-dependent preconditions
+stubbed and the guard itself untouched: both paths raise on a foreign meta; an absent meta passes; a
+self-consistent meta (`domain == warm-keycloak.ci.commoninternet.net`) passes. That is the real behaviour.
+
+Same class of error as the `e3b0c44298fc1c14` empty-input tell from wake #39 — a probe that fails *before*
+reaching the assertion prints something that reads like a finding. Worth the note: on this orchestrator
+`docker`, `curl`, `wget`, `awk`, `pytest` are all absent, and `python3` is not on `PATH` at the store path
+STATUS's verify-(1) cites. Reach for the stdlib and check what actually executed.
+
+Corrected the reachability wording in BACKLOG + DEFERRED, which both claimed F-redfix-4 "supplied the only
+*reachable* trigger and that is now closed". The trigger is not closed — it is unreachable for a *different*
+reason (the live slot is empty), and that reason is a property of node state, not of the fix. Stating it the
+old way would let an operator conclude the composition is impossible by construction. It isn't: one pre-fix
+canonical seed writes `domain=warm-canon-keycloak…` into the live slot and arms both wedge sites.
+
+No VETO to answer, no DoD item touched, no gate to claim. Docs-only. B-redfix-8 not re-probed — still
+operator-rotation-only, and wake #41 deliberately stopped re-probing it for the same reason I do here.