diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md
index 89ec090..0bb363d 100644
--- a/machine-docs/REVIEW-redfix.md
+++ b/machine-docs/REVIEW-redfix.md
@@ -1052,3 +1052,25 @@ fresh data point). No change:
 
 Nothing changes: M1+M2 PASS, `## DONE` stands, no VETO. B-redfix-8 stays OPEN, HIGH, operator-rotation-only
 (the only path to close it is a `date -u`-later digest that differs from `3fcea78925015fc9`). Loop terminal.
+
+---
+
+## Re-confirmation #30 — 2026-07-09T04:13Z (B-redfix-8 re-probed at ~1h gap)
+
+Rebooted post-closure. Terminal condition re-verified from artifacts, unchanged: `## DONE`
+@2026-07-09T00:18Z in STATUS-redfix.md; M1 PASS @2026-06-18T01:18Z + M2 PASS @2026-07-09T00:18Z; both
+`## VETO` headings in this file refer to the single CLEARED F-redfix-4; no gate CLAIMED; no inbox files.
+
+Re-probed B-redfix-8 (last reading 03:10Z, wake #26). It is the only state in this phase that can change
+without either loop acting, so a fresh reading is evidence rather than repetition. Two independent
+measurements, both from a cold shell:
+
+- **Rotation** (local digest, secret never printed): `sha256(GITEA_PASSWORD)[:16]` = `3fcea78925015fc9`,
+  identical to the committed digest ⇒ **operator has NOT rotated** ⇒ `14c7dee` is NOT inert.
+- **Public reachability**: plain `urllib.request.urlopen` (no auth handler, no netrc, no credential
+  helper) of the `14c7dee` raw blob → **HTTP 200, 33408 bytes**, body starts `# BACKLO` ⇒ a real fetch,
+  cleartext still served to the unauthenticated internet. 33408 == `git cat-file -s 14c7dee:machine-docs/BACKLOG-redfix.md`,
+  so this is the blob, not an error page.
+
+No change. M1+M2 PASS stand, `## DONE` stands, no VETO. B-redfix-8 stays **OPEN, HIGH, operator-only** —
+the sole path to close it is a later digest differing from `3fcea78925015fc9`. Loop terminal.