status(redfix): wedge does not self-heal + blast radius bounded to keycloak (Adversary-confirmed widening)

Adversary (75f6655) independently re-derived the upgrade-path site and CONFIRMED the widening of B-redfix-5:
"my wake-#41 framing was too narrow; do not revert". Nothing reverted.

It supplied three facts I had not established. Re-derived each from source rather than accepting them:
- reconcile()'s only try is :520-525; sole caller main():556 does not catch -> a raise at :514/:536 escapes
  to SystemExit with keycloak already undeployed. Nothing redeploys it; recovery is MANUAL.
- WARM_CANONICAL = True at 07fc6d4 -> the pre-fix canonical seed is a real arming action, not hypothetical.
- WARM_DOMAINS == {keycloak}; keycloak is the only stateful:True SPECS entry (traefik is False) -> blast
  radius is exactly one warm unit.

Folded the two operator-actionable ones into STATUS (does-not-self-heal; bounded to keycloak) and tightened
the pre-fix-seed line from hypothetical to fact. The bound also stops the precondition reading as a
fleet-wide hazard.

No DoD item touched. M1+M2 PASS stand, ## DONE stands, no VETO. Docs-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YZmH4rVNue3irZ6EsZzavb

machine-docs/STATUS-redfix.md

@@ -84,8 +84,18 @@ because the live slot holds no snapshot at all (`read_meta` → `None` → "a sl
 to claim"). It is unreachable for that reason — **not** because F-redfix-4 is closed.
 
 The only state that creates a foreign live-slot meta is a **pre-fix (`07fc6d4`) canonical seed**, which
-wrote the canonical's domain into the shared slot `/var/lib/ci-warm/keycloak/`. So: do not run a canonical
-keycloak seed from `07fc6d4` between now and the merge.
+wrote the canonical's domain into the shared slot `/var/lib/ci-warm/keycloak/`. The seed is a real, not
+hypothetical, arming action: `tests/keycloak/recipe_meta.py` carries `WARM_CANONICAL = True` at `07fc6d4`
+too. So: do not run a canonical keycloak seed from `07fc6d4` between now and the merge.
+
+**The wedge does not self-heal.** `reconcile()`'s only `try/except` is `warm_reconcile.py:520-525` (it wraps
+`deploy_version` + `wait_healthy`), and its sole caller `main():556` does not catch either. A raise at `:514`
+or `:536` therefore escapes to `SystemExit` with live keycloak already undeployed by the preceding
+`abra.undeploy()` — no code path redeploys it. Recovery is manual.
+
+**Blast radius: keycloak only.** `warm.WARM_DOMAINS == {"keycloak"}` and `keycloak` is the only `SPECS` entry
+with `stateful: True` (`traefik` is `stateful: False` — version-rollback-only, never snapshots). No other
+warm unit reaches either call site.
 
 **HOW to verify the precondition** (on cc-ci; `python3` is absent there, so `ls`/`cat`):