Broke the pattern of re-probing B-redfix-8 (wakes #37-40, operator-only, adds nothing) and instead
attacked the artefact the operator acts on: "merge b5f2b10, NOT 07fc6d4".
Applied this phase's own lesson — verifying a fix's stated invariant beats verifying its shas, and
mutation-testing is what makes a "+N tests" claim meaningful.
- Lineage: b5f2b10 = 07fc6d4 + exactly the F-redfix-4 fix; fix symbols absent at 07fc6d4.
- Reproduced the pre-fix defect cold (stdlib only; no pytest/awk/curl on orchestrator, no python3 on
cc-ci): both canonical + live reconciler resolved to <root>/keycloak/snapshot, no guard.
- Invariants GREEN at b5f2b10. Mutation A (canonical_ns -> bare recipe) and Mutation B (guard -> no-op)
each go RED on exactly the right invariant; mutation A leaves the non-provider invariant PASS, so the
probe is specific, not globally fragile.
- Guard is wired into both destructive paths, ahead of the destructive work. Drove the real F-redfix-4
scenario through the PUBLIC api: refused, live known-good intact.
- Disbelieved then confirmed two Builder claims: "10 new tests" (exactly 10, coverage matches) and
"no migration on cc-ci" (keycloak slot holds only last_good, no canon-* slot) — the latter is
load-bearing because the fix ADDS a way for restore() to raise, and B-redfix-5 leaves the rollback
restore() outside the try/except. Unreachable today; recorded as a merge precondition.
- B-redfix-5 re-verified accurate at b5f2b10 (warm_reconcile.py:533-537).
- "Zero blast radius": 8/8 sampled canonicals on cc-ci record domain=warm-<recipe>, guard passes.
Verdict: merge guidance CONFIRMED. No new finding. M1+M2 PASS stand, DONE stands, no VETO.
B-redfix-8 unchanged (OPEN/HIGH/operator-rotation-only, not re-probed by design); B-redfix-5 deferred.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SoraVF2hkEMExHswFX1g4M
3131e39f64