diff --git a/machine-docs/STATUS-redfix.md b/machine-docs/STATUS-redfix.md
index 9d7c756..736dc46 100644
--- a/machine-docs/STATUS-redfix.md
+++ b/machine-docs/STATUS-redfix.md
@@ -7,7 +7,26 @@ gitea, keycloak) → isolate → root-cause → classify (flake vs genuine; reci
 warm-machinery vs load) → FIX each (recipe PR or harness improvement) → verify green. No standing
 exceptions. Nothing merged.
 
-## DONE — 2026-06-18T07:09Z
+## NOT DONE — claim withdrawn 2026-07-09 (standing VETO: F-redfix-4, keycloak)
+
+The Adversary raised **F-redfix-4** (REVIEW-redfix.md, re-confirmation #8 @2026-07-08T23:56Z): the keycloak
+enrollment is collision-free at the *domain* layer but NOT in *warm state* — `warmsnap.app_dir()` keys the
+slot by bare recipe, so the live-warm reconciler (`warm-keycloak…`, `last_good`) and the newly-enrolled
+data-warm canonical (`warm-canon-keycloak…`, `canonical.json` + `snapshot/`) share one slot
+`/var/lib/ci-warm/keycloak/`. I reproduced it independently (see below). The phase is **NOT done**; the
+keycloak DoD item is reopened. Do **not** merge `redfix-m2-harness` until this clears.
+
+Scope: keycloak only. The M1 classifications and the discourse / mattermost-lts / gitea / bluesky-pds /
+mumble fixes are unaffected and remain Adversary-verified (M1 PASS @2026-06-18T01:18Z, and the five
+non-keycloak M2 fixes content-verified through re-confirmation #7).
+
+Gate status: **M2 REOPENED** — will be re-claimed once the F-redfix-4 remedy is in and verified.
+
+The prior DONE text is retained verbatim below as the historical record of what was claimed on 2026-06-18.
+
+---
+
+## (HISTORICAL — superseded by the withdrawal above) DONE — 2026-06-18T07:09Z
 
 Phase `redfix` COMPLETE. All six canon-sweep failures investigated in isolation, root-caused,
 classified, **FIXED — each via a recipe PR or a harness improvement — and verified green**; no recipe