diff --git a/machine-docs/JOURNAL-redfix.md b/machine-docs/JOURNAL-redfix.md
index 44bf96a..34f2aaf 100644
--- a/machine-docs/JOURNAL-redfix.md
+++ b/machine-docs/JOURNAL-redfix.md
@@ -962,3 +962,37 @@ target `redfix-m2-harness`@`b5f2b10` unchanged. Nothing to build, nothing to cla
 `main.go` still sits untracked in the repo root and I still cannot account for it (see wake #10). Left
 exactly as found — not committed, not deleted, not added to `.gitignore`, since hiding it would be worse
 than leaving it visible. Surfaced to the operator.
+
+## Wake #12 — 2026-07-09T00:58Z — consumed review(redfix)@83758f5 (break-it probe, no finding); loop stays stopped
+
+Watchdog pinged on a `review(...)` commit. Read it before re-checking anything: `83758f5` is Adversary
+re-confirmation #11 — a **break-it probe, not a verdict change**. It attacked the one claim in `b5f2b10`
+that is empirical rather than diff-checkable: STATUS's "MIGRATION: none required — on cc-ci
+`/var/lib/ci-warm/keycloak/` contains only `last_good`". Had that been false, the new
+`warmsnap._assert_slot_not_foreign()` guard would raise inside the live-warm reconciler's `snapshot()` on
+every stateful keycloak auto-upgrade — the F-redfix-4 fix wedging the shared OIDC provider it was meant to
+protect. The right thing to probe, and it was cheap for me to assert and expensive for me to have wrong.
+
+Cold read-only on cc-ci, the Adversary found the claim **TRUE as observed**: `keycloak/` (and `traefik/`)
+hold only `last_good`; all 17 seeded canonicals carry `domain=warm-<recipe>…`, none is in `WARM_DOMAINS`,
+so `canonical_slot(r) == r` and the guard passes on every legacy meta — backward compatible, no migration.
+It also confirmed the dropped `meta["recipe"]` key has no consumer, slot↔stack is 1:1 across all 21
+enrolled recipes, and `prune_stale`'s keep-set covers all 17 dirs while skipping `keycloak/` structurally.
+
+Two facts I had not stated and now hold in the record: `traefik/` is likewise unseeded (harmless — same
+never-seeded shape as keycloak, and it is not in `WARM_DOMAINS`), and `prune_stale` derives a stale stack's
+volumes via `warm.stable_domain(<ns>)`, so pruning a `canon-keycloak/` canonical could only ever remove
+`warm-canon-keycloak…` volumes, never the live `warm-keycloak…` ones. Consequence-4 is structural on real
+disk, not just in the unit tests.
+
+**No new finding. No verdict changed. Nothing to fix.** A confirmatory probe does not reopen a gate.
+Predicate re-checked after the pull:
+
+    grep -E "^## VETO" machine-docs/REVIEW-redfix.md | grep -v CLEARED   -> (empty)
+    grep -n "^## DONE" machine-docs/STATUS-redfix.md                     -> 10:## DONE — 2026-07-09T00:18Z
+    git rev-parse redfix-m2-harness                                      -> b5f2b104e6dd…
+    ls machine-docs/{BUILDER,ADVERSARY}-INBOX.md                          -> none
+
+`## DONE` intact, M1 + M2 PASS fresh, no standing VETO, no inbox, merge target `redfix-m2-harness`@`b5f2b10`
+unchanged. Terminal condition still met. Loop remains stopped. `main.go` still untracked and unexplained
+(wakes #10/#11) — untouched.