journal(redfix): wake #9 — consumed M2 PASS (VETO cleared, F-redfix-4 closed); DONE re-asserted at b5f2b10; phase closed, loop stopped

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FS8p1esg57UAC69riNvuBX

machine-docs/JOURNAL-redfix.md

@@ -876,3 +876,39 @@ reflog) and built on `07fc6d4`. Check `git rev-parse <branch> origin/<branch>` b
 long-lived branch you last touched three weeks ago.
 
 `## DONE` is NOT restored. M2 is re-claimed and awaits an Adversary verdict on `b5f2b10`.
+
+---
+
+## Wake #9 — 2026-07-09T00:18Z — M2 PASS, VETO cleared, phase closed
+
+Consumed the Adversary's verdict on `b5f2b10`: **M2 PASS, VETO CLEARED, F-redfix-4 CLOSED**, with an explicit
+"the Builder may re-assert `## DONE`". Re-asserted it. Merge target is `redfix-m2-harness`@**`b5f2b10`**, not
+`07fc6d4` — the old tip carries the defect, and that distinction is the one thing an operator could still get
+wrong from a stale note.
+
+Its re-test went past my own in three ways worth recording. (a) **Mutation testing**: it reverted
+`canonical_ns()` and confirmed 4 of my new tests go red, then removed `_assert_slot_not_foreign()` and
+confirmed 2 more do — so the 315→325 delta is load-bearing, not vacuous. I had asserted the tests pass; I had
+not proven they can fail. That is a strictly better verification of a regression test than the one I ran, and
+I'll reach for it next time I claim "+N tests that would have caught this". (b) It checked the guard in
+**both** directions (foreign snapshot AND foreign restore); my probe only exercised the snapshot side, even
+though I'd written the restore guard. (c) It verified all 21 enrolled recipes still resolve to their existing
+on-disk dirs (`registry_path("bluesky-pds")` character-identical at parent and fix), which is the real proof
+of "zero blast radius / no migration" — I had only checked keycloak's own dir.
+
+It also independently confirmed `b5f2b10`'s diff touches only the four source files plus two test files and
+`tests/keycloak/recipe_meta.py`, so the other five recipe fixes are provably untouched by the remedy. That is
+the check that lets a scoped VETO clear without re-verifying the whole phase.
+
+B-redfix-5 stands as the single deferred item: recorded in BACKLOG-redfix.md and now also in the shared
+DEFERRED.md, since the phase closes and a phase-namespaced backlog entry would die with it. The Adversary
+concurred it is not a VETO and was "correctly filed rather than silently fixed".
+
+**What the phase cost, and what it bought.** The 2026-06-18 DONE was wrong for three weeks. Seven
+re-confirmations at the same probe angle (does the artifact exist? does it match the claim?) found nothing,
+because the defect was one layer below: an enrollment flag gated a data path that never ran, so everything
+observable was consistent. It fell out the moment the Adversary changed angle to "what does this code newly
+switch on, and has that ever executed?" — a lesson worth more than the fix. Deploy-only verification of an
+enrollment verifies the domain layer and nothing beneath it.
+
+Terminal condition met: `## DONE` + fresh PASS on every gate + no standing VETO. Loop stopped.