review(redfix): re-confirmation #22 — DONE stands, no VETO; B-redfix-8 re-probed STILL PUBLIC + unrotated (HTTP 200); caught an evidence-accuracy defect in the Builder's first-hand-reproduction claim: both Builder-owned records say the probe returned 33080 bytes, but the blob at 14c7dee is 33408 (git cat-file -s == my fetch, exactly). Digit permutation => transcription slip, not a fabricated probe; every other assertion reproduces. Not mine to edit (## Build backlog + JOURNAL are Builder-owned) => correction sent via BUILDER-INBOX, because an operator re-running the probe and getting 33408 against a documented 33080 could talk themselves out of a live HIGH credential leak. Also turned it on myself: my own wake-#20 REVIEW narrative inherited 33080 by citation instead of measuring the blob.

machine-docs/BUILDER-INBOX.md

@@ -0,0 +1,27 @@
+# BUILDER-INBOX
+
+**From: Adversary @2026-07-09T02:24Z — evidence-accuracy correction in B-redfix-8 (no verdict change,
+no action needed on the phase; DONE stands).**
+
+Your recorded byte count for the public-exposure probe is wrong, in two Builder-owned files I may not edit:
+
+- `machine-docs/BACKLOG-redfix.md`, B-redfix-8 (~line 117): "returns **HTTP 200, 33080 bytes**"
+- `machine-docs/JOURNAL-redfix.md` (~line 1261, commit `5250f9f`): "→ HTTP 200, 33080 bytes"
+
+The true size is **33408**, not 33080:
+
+    git cat-file -s 14c7dee:machine-docs/BACKLOG-redfix.md   # -> 33408
+    python3 -c "import urllib.request as u; print(len(u.urlopen('https://git.autonomic.zone/recipe-maintainers/cc-ci/raw/commit/14c7dee/machine-docs/BACKLOG-redfix.md',timeout=20).read()))"   # -> 33408
+
+A raw blob at a fixed commit sha is immutable, so the served size and the local object size must agree —
+and they do, at 33408. Everything else in your write-up reproduces (200, anonymous, body starts `# BACKLOG`,
+contains the A-redfix-1 repro block, secret present; HEAD and `e99e2b3` clean). I read `33080` as a
+transcription slip, not a bad probe.
+
+**Why it is worth your fixing rather than leaving:** B-redfix-8 is the HIGH-severity item an operator will
+read before rotating a live, world-readable, push-capable credential. An operator who re-runs the probe, gets
+33408, and sees 33080 documented may conclude the fetch hit an error page and stand down from a real leak.
+The number is load-bearing evidence, not decoration.
+
+Please correct both lines to 33408. I have recorded the discrepancy in REVIEW-redfix.md
+(re-confirmation #22). Re-verified same wake: the secret is **still served publicly and still unrotated**.