status(redfix): wedge does not self-heal + blast radius bounded to keycloak (Adversary-confirmed widening)

Adversary (75f6655) independently re-derived the upgrade-path site and CONFIRMED the widening of B-redfix-5:
"my wake-#41 framing was too narrow; do not revert". Nothing reverted.

It supplied three facts I had not established. Re-derived each from source rather than accepting them:
- reconcile()'s only try is :520-525; sole caller main():556 does not catch -> a raise at :514/:536 escapes
  to SystemExit with keycloak already undeployed. Nothing redeploys it; recovery is MANUAL.
- WARM_CANONICAL = True at 07fc6d4 -> the pre-fix canonical seed is a real arming action, not hypothetical.
- WARM_DOMAINS == {keycloak}; keycloak is the only stateful:True SPECS entry (traefik is False) -> blast
  radius is exactly one warm unit.

Folded the two operator-actionable ones into STATUS (does-not-self-heal; bounded to keycloak) and tightened
the pre-fix-seed line from hypothetical to fact. The bound also stops the precondition reading as a
fleet-wide hazard.

No DoD item touched. M1+M2 PASS stand, ## DONE stands, no VETO. Docs-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZmH4rVNue3irZ6EsZzavb

machine-docs/JOURNAL-redfix.md

@@ -1719,3 +1719,32 @@ canonical seed writes `domain=warm-canon-keycloak…` into the live slot and arm
 
 No VETO to answer, no DoD item touched, no gate to claim. Docs-only. B-redfix-8 not re-probed — still
 operator-rotation-only, and wake #41 deliberately stopped re-probing it for the same reason I do here.
+
+## Wake #43 — 2026-07-09 — Adversary CONFIRMED the widening; folded its three new facts into STATUS
+
+`543d566`: the Adversary re-derived site (a) cold from `b5f2b10` and **confirmed** it — "my wake-#41 framing
+was too narrow; the Builder is right. Widening CONFIRMED, do not revert." It also independently reproduced
+my docker-absent probe artifact on `restore()` (dies at `_assert_undeployed:205`, upstream of the guard at
+`:209`) and accepted the reachability correction. Nothing to revert; my open question is answered.
+
+It asserted three facts I had *not* established. Symmetry demands I not take those on faith either, so I
+re-derived all three from source before letting them into STATUS:
+
+- **Nothing upstream catches.** `reconcile()` spans `:448-551`; its only `try` is `:520-525`, wrapping
+  `deploy_version` + `wait_healthy`. Sole caller `main():556` is a bare `result = reconcile(argv[1])`.
+  So a raise at `:514`/`:536` escapes to `SystemExit` with keycloak already undeployed. **Confirmed.**
+- **Arming condition is real.** `git show 07fc6d4:tests/keycloak/recipe_meta.py` → `WARM_CANONICAL = True`.
+  A pre-fix canonical seed genuinely writes the foreign domain into the bare-recipe slot. **Confirmed.**
+- **Blast radius one unit.** `WARM_DOMAINS == {"keycloak"}`; `SPECS["keycloak"]["stateful"] is True`,
+  `SPECS["traefik"]["stateful"] is False`. **Confirmed.**
+
+Two of those change what an operator would *do*, so they went into STATUS: the wedge **does not self-heal**
+(no code path redeploys; recovery is manual), and it is **bounded to keycloak**. The third (arming condition
+real) tightened the existing "do not run a pre-fix canonical seed" line from a hypothetical into a fact.
+The "blast radius" note also stops the precondition reading as a whole-fleet hazard, which would be its own
+kind of overstatement.
+
+Both loops have now independently derived the same structure from source and agree. B-redfix-5 stays
+deferred, correctly scoped to both call sites; it still needs the operator's safety call (redeploy
+`last_good` on unrestored data vs. die loudly), which is exactly why it was filed rather than fixed inline.
+No VETO, no gate, no DoD item touched. Phase remains `## DONE`. B-redfix-8 untouched — operator rotation.

machine-docs/STATUS-redfix.md

@@ -84,8 +84,18 @@ because the live slot holds no snapshot at all (`read_meta` → `None` → "a sl
 to claim"). It is unreachable for that reason — **not** because F-redfix-4 is closed.
 
 The only state that creates a foreign live-slot meta is a **pre-fix (`07fc6d4`) canonical seed**, which
-wrote the canonical's domain into the shared slot `/var/lib/ci-warm/keycloak/`. So: do not run a canonical
-keycloak seed from `07fc6d4` between now and the merge.
+wrote the canonical's domain into the shared slot `/var/lib/ci-warm/keycloak/`. The seed is a real, not
+hypothetical, arming action: `tests/keycloak/recipe_meta.py` carries `WARM_CANONICAL = True` at `07fc6d4`
+too. So: do not run a canonical keycloak seed from `07fc6d4` between now and the merge.
+
+**The wedge does not self-heal.** `reconcile()`'s only `try/except` is `warm_reconcile.py:520-525` (it wraps
+`deploy_version` + `wait_healthy`), and its sole caller `main():556` does not catch either. A raise at `:514`
+or `:536` therefore escapes to `SystemExit` with live keycloak already undeployed by the preceding
+`abra.undeploy()` — no code path redeploys it. Recovery is manual.
+
+**Blast radius: keycloak only.** `warm.WARM_DOMAINS == {"keycloak"}` and `keycloak` is the only `SPECS` entry
+with `stateful: True` (`traefik` is `stateful: False` — version-rollback-only, never snapshots). No other
+warm unit reaches either call site.
 
 **HOW to verify the precondition** (on cc-ci; `python3` is absent there, so `ls`/`cat`):