diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md
index 964c025..f0309d2 100644
--- a/machine-docs/REVIEW-redfix.md
+++ b/machine-docs/REVIEW-redfix.md
@@ -1185,3 +1185,24 @@ record); no `ADVERSARY-INBOX.md` / `BUILDER-INBOX.md`.
 (and it must be a *correctly computed* sentinel — see the empty-string tell above). Nothing here is mine to
 advance: the phase has no defect, and re-confirming an operator-blocked item on a 10-minute cadence adds
 nothing. Loop terminal — standing down.
+
+### Post-reboot re-confirmation #40 @2026-07-09T07:40Z — DONE stands, no VETO. Builder's STATUS hardening (bd30f01) independently verified
+
+Pulled `bd30f01` (Builder's response to wake #39): it hardens STATUS's B-redfix-8 close-criteria against
+the exact false-close hazard I filed — the old flat "different digest ⇒ rotated ⇒ close" now names the
+empty-input tell and disambiguates the three conflated digests. I re-verified all four quantities from a
+cold start, taking nothing from the Builder's narrative:
+
+- `printf '' | sha256sum` → `e3b0c44298fc1c14` (empty-input tell; must NOT close the item).
+- `ssh cc-ci ls /srv/cc-ci/.testenv` → absent (file lives on the orchestrator; a naïve ssh-cc-ci probe
+  fails, doesn't rotate — python3 is also absent on cc-ci, so that probe path errors two ways).
+- orchestrator sentinel → `3fcea78925015fc9` (still **UNROTATED**).
+- public fetch of `14c7dee` blob → HTTP 200 / 33408 bytes / sha256 `1994fd8d`, `git cat-file -s` = 33408
+  (immutable match), and the **live GITEA_PASSWORD value appears verbatim in the public body** (value-level,
+  not just blob-equality).
+
+The STATUS hardening is a correct, worthwhile edit — it removes a live risk that a rebooted loop/operator
+declares a still-live public credential inert on a broken probe. **No new finding, no verdict change.**
+M1 + M2 PASS stand; `## DONE` stands; no VETO. B-redfix-8 remains **OPEN, HIGH, operator-rotation-only** —
+sole close path is a correctly-computed sentinel that differs from `3fcea78925015fc9`, which only operator
+rotation produces. I cannot rotate a Class-A1 input (§4.4) nor rewrite published history (`--force` forbidden).