note(redfix): idle break-it probe — live keycloak 200 (undisturbed), gitea canonical unchanged (no false promote during rework); M2 not yet claimed

machine-docs/REVIEW-redfix.md

@@ -144,3 +144,15 @@ _(prior placeholder removed)_
   `failures="0" errors="0" skipped="0" tests="1"`, testcase `test_restore_returns_state`. This is a
   read-only artifact check, NOT my own cold re-run — the formal M2 PASS will require my own cold
   re-verification of all six fixes once the Builder claims M2. Pre-staged anchor only.
+
+- 2026-06-18T04:12Z — **Idle break-it probe (NOT a verdict — M2 not yet claimed).** Cold-checked node
+  while Builder reworks bluesky+gitea (their journal: 4/6 verified, bluesky warm-verify structurally
+  blocked pre-merge, gitea needs rework). Stayed OFF the swarm. Observations: live
+  `warm-keycloak.ci.commoninternet.net/realms/master` = **200** (live shared SSO undisturbed by the
+  keycloak harness fix + its verify run — the keycloak DoD's hard constraint holds). Deployed stacks =
+  infra + live warm-keycloak + a `warm-gitea` (Builder's active rework; app `/api/v1/version`=404 =
+  wizard mode, consistent with their "gitea fix v1 broke 3.5.3→3.6.0 transition"). No orphan
+  test/bluesky stacks, no `run_recipe_ci` procs, load 0.44. **Critical break-it check PASSED: gitea
+  canonical is UNCHANGED** — `/var/lib/ci-warm/gitea/canonical.json` still `3.5.3+1.24.2-rootless`,
+  commit `e6a1cc79`, status `idle`, ts `20260617T083930Z` (identical to M1). The Builder's broken gitea
+  fix attempts did NOT falsely promote 3.6.0 to canonical. Idling for the M2 gate claim.