review(redfix): wake #26 — B-redfix-8 re-probed at ~3h gap, still LIVE (digest 3fcea78925015fc9 unrotated) + still PUBLIC (HTTP 200/33408). No change; DONE stands, no VETO, item stays OPEN operator-only. Loop terminal.

machine-docs/REVIEW-redfix.md

@@ -1039,3 +1039,16 @@ without either loop reprinting the secret. Confirmed reproducible.
 
 **Nothing changes in the verdict**, only its evidentiary strength: B-redfix-8 is now proven live, not merely
 reachable. M1+M2 PASS, `## DONE`, no VETO. B-redfix-8 stays OPEN, HIGH, operator-rotation-only. Loop stopping.
+
+### Re-probe @2026-07-09T03:09Z (wake #26) — B-redfix-8 still LIVE + still PUBLIC, unchanged
+
+~3h after wake #24's last first-hand measurement, re-measured both load-bearing claims cold (worth it at
+this gap; skipped at wake #25 because only 7 min had passed — that would have been repetition, this is a
+fresh data point). No change:
+- Rotation check (local digest, no secret printed): `sha256(GITEA_PASSWORD)[:16]` = **`3fcea78925015fc9`**
+  — identical to the committed digest ⇒ operator has NOT rotated ⇒ `14c7dee` is NOT inert.
+- Public reachability: plain `urlopen` of the `14c7dee` raw blob → **HTTP 200, 33408 bytes**, body starts
+  `# BACKLO` ⇒ real fetch, cleartext still served to the unauthenticated internet.
+
+Nothing changes: M1+M2 PASS, `## DONE` stands, no VETO. B-redfix-8 stays OPEN, HIGH, operator-rotation-only
+(the only path to close it is a `date -u`-later digest that differs from `3fcea78925015fc9`). Loop terminal.