review(redfix): wake #45 — 186b0ba rewrite VERIFIED cold; A-redfix-2/3/4 CLOSED; A-redfix-1 = same live credential as B-redfix-8 (sentinel 3fcea789…, still unrotated)

machine-docs/REVIEW-redfix.md

@@ -1433,3 +1433,57 @@ deferred/open. B-redfix-8 unchanged (OPEN/HIGH/operator-rotation-only; not re-pr
 Three asks of the Builder in A-redfix-4 — all STATUS text, no code, nothing reopens.
 
 Did not read JOURNAL-redfix.md before forming this verdict.
+
+---
+
+## Wake #45 — 2026-07-09T09:02:52Z — Builder's A-redfix-4 rewrite (`e356698`) **VERIFIED**; A-redfix-2/3/4 CLOSED; A-redfix-1 re-confirmed live and linked to B-redfix-8 at value level. Still no VETO.
+
+Autonomous tick. `BUILDER-INBOX.md` consumed by the Builder (deleted); no `ADVERSARY-INBOX.md`; no gate
+CLAIMED (STATUS:433 is the historical M2 claim, superseded by `## DONE` at :10). **M1 + M2 PASS stand,
+`## DONE` stands, no VETO, merge target `b5f2b10` unchanged.**
+
+**All three A-redfix-4 asks applied — and I re-verified the rewrite rather than accepting it.** The lone
+surviving `grep -i keycloak` string in STATUS (:152) is prose *warning against* the probe, not prescribing it;
+the prescribed probe is now `git grep -n warm_reconcile -- runner/ nix/`, which is falsifiable and does find
+both invokers. Deleted, not fixed — correct.
+
+**Every new claim in the rewrite checked cold; all hold:**
+- `write_alert()` call sites `:493,500,503,539` ✓; `write_last_good()` `:478,484,491,527` ✓, all inside
+  `reconcile()` (`:448`–`:551`, `main()` at `:552`) ✓.
+- "on `main` the same sites sit two lines earlier" ✓ exactly: `514→512`, `523→521`, `552→550`.
+- `abra.undeploy` = single `_run(["app","undeploy",domain,"-n"], …, check=False)`, no `.env` handling ✓.
+- fresh-deploy branch `:472 if not deployed` → `:479 return deployed-fresh:{target}`, no `warmsnap` ✓.
+- `_assert_slot_not_foreign`: raises iff `meta and meta["domain"] != domain`; "a slot with no snapshot yet is
+  free to claim" ✓ (verbatim in the docstring).
+- **"`python3` is absent there"** — I expected this to be the Builder's own unfalsifiable-probe slip. It is
+  **true**: `command -v python3` on cc-ci → not found. Claim survives.
+- Trap not armed: slot holds `last_good` only, no `snapshot/meta.json`, no `/var/lib/ci-warm/canon-keycloak` ✓.
+  Live `https://warm-keycloak…/realms/master` → **200** ✓.
+- Sound probe also surfaces a **third** invoker the Builder's EXPECTED text omits: `nix/modules/proxy.nix:27`
+  → `warm_reconcile.py traefik`. Not a defect — traefik is `stateful: False`, never snapshots, so blast radius
+  is unchanged. Noted, not filed.
+
+**I hardened my own wake-#44 evidence.** My mtime proof rests on "`write_last_good()` is reachable only from
+`reconcile()`" — but I had verified that against `b5f2b10`, when the tree that actually ran on 2026-07-05 is
+the **deployed** one. Re-checked repo-wide at `origin/main`: no caller outside `warm_reconcile.py`, all four
+sites inside `reconcile()` (`:476,482,489,525`; `reconcile` `:446`, `main` `:550`). The proof holds **on the
+correct tree**. Closing that gap is the same discipline that caught A-redfix-2.
+
+**A-redfix-2, A-redfix-3, A-redfix-4 → CLOSED** (I own closing them). A-redfix-4's *behaviour* remains open
+under **B-redfix-5**, which stays deferred — the text is fixed, the wedge is not.
+
+**A-redfix-1: re-probed, STILL OPEN, and now pinned to B-redfix-8 at value level.** `/etc/cc-ci/.git/config`
+is `644 root:root` and carries userinfo in the remote URL; extracting that password and hashing it (never
+echoing it) yields **`3fcea78925015fc9`** — byte-identical to the B-redfix-8 rotation sentinel, re-confirmed
+this wake from `/srv/cc-ci/.testenv` on the **orchestrator**. Two exposures, one credential, **still
+unrotated**. New: `/etc/cc-ci` is a **manual `git clone`** (`nix/hosts/cc-ci-hetzner/configuration.nix:7`),
+not nix-generated — so rotation neither scrubs this file nor regenerates it, and re-embedding the new password
+recreates the exposure. Rotation blast radius is small (`GITEA_PASSWORD` is used only by
+`scripts/bootstrap-drone-oauth.sh`; `recipe-mirror-sync.sh` pushes with an OAuth **token**), so there is no
+operational reason to delay it. Addendum + recommendation filed under A-redfix-1.
+**B-redfix-8 remains OPEN/HIGH/operator-rotation-only** — the sentinel check above is the sanctioned
+non-republishing probe, and it says: not yet rotated.
+
+**Verdict: no VETO. `## DONE` stands. M1 + M2 PASS stand. Merge target `b5f2b10` unchanged.**
+
+Did not read JOURNAL-redfix.md before forming this verdict.