review(redfix): wake #38 — B-redfix-8 re-probed unchanged (HTTP 200/33408, blob sha256 1994fd8d matches immutable git object; rotation sentinel still 3fcea78925015fc9 ⇒ unrotated). Self-caught a false alarm: momentarily read the whole-blob sha256 as a change vs the credential-value rotation sentinel — two different quantities, no actual change, blob is immutable and matches git exactly. Terminal condition intact (DONE, M1+M2 PASS, no VETO). Item stays OPEN/HIGH/operator-only. Loop standing down.

machine-docs/REVIEW-redfix.md

@@ -1121,3 +1121,28 @@ public history at `14c7dee`). Neither automated loop can advance it, and re-conf
 operator-only exposure every ~10min adds nothing. B-redfix-8 remains **OPEN, HIGH, operator-only**; its
 sole close path is a future digest differing from `3fcea78925015fc9`. Restart the loop (or the watchdog
 reboots it) if that changes and the finding needs to be formally closed.
+
+### Re-probe @2026-07-09T07:25Z (wake #38) — B-redfix-8 unchanged; a self-caught false alarm, resolved
+
+Re-measured both load-bearing claims cold. Result: no change, terminal condition intact.
+
+- **Public reachability** — `GET …/raw/commit/14c7dee/machine-docs/BACKLOG-redfix.md` → HTTP 200, 33408
+  bytes, served cleartext to the unauthenticated public internet. Its sha256 is
+  `1994fd8de3fc780337098f72491f829c00743f7d82f6c9e5a373a7d639613f37`, identical across repeated fetches
+  and **exactly equal** to `git cat-file blob 14c7dee:machine-docs/BACKLOG-redfix.md | sha256sum` — i.e.
+  the open web is serving the immutable git blob byte-for-byte. Still public.
+- **Rotation sentinel** — `sha256(GITEA_PASSWORD from /srv/cc-ci/.testenv)[:16]` = `3fcea78925015fc9`,
+  identical to the committed sentinel ⇒ **operator has NOT rotated** ⇒ `14c7dee` still live.
+
+**Self-correction (recorded for honesty).** On first probe this wake I computed the sha256 of the whole
+33408-byte blob (`1994fd8d…`) and momentarily read it as a *change* against the `3fcea789…` value carried
+in wakes #33/#36/#37 — as if the immutable blob had mutated. It had not. Those two hashes measure
+**different things**: `3fcea789…` is the rotation sentinel `sha256(credential value)[:16]`, whereas
+`1994fd8d…` is sha256 of the entire served file. Both are correct; there is no discrepancy and no content
+change (a raw blob at a fixed commit sha cannot mutate, and it matches the git object exactly). Noting it
+so the two digests are never again conflated in this file.
+
+**Verdict unchanged.** M1 PASS @2026-06-18T01:18Z, M2 PASS @2026-07-09T00:18Z, `## DONE` @2026-07-09T00:18Z,
+VETO cleared, both inboxes absent, no gate claimed. **DONE stands. No VETO.** B-redfix-8 remains **OPEN,
+HIGH, operator-rotation-only**; sole close path is a future sentinel differing from `3fcea78925015fc9`.
+Loop terminal — standing down again (as at wake #37); nothing here is mine to advance.