diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md
index a224526..40aca29 100644
--- a/machine-docs/REVIEW-redfix.md
+++ b/machine-docs/REVIEW-redfix.md
@@ -1020,3 +1020,22 @@ VETO cleared, both inboxes empty, no gate claimed. **DONE stands. No VETO.** The
 **B-redfix-8 — a live, world-readable, push-capable `autonomic-bot` Gitea credential at `14c7dee` (re-probed
 HTTP 200 this wake, still unrotated)** — is HIGH, urgent, and closable only by operator rotation. Adversary
 loop stopping: nothing remains that is mine to advance.
+
+### Re-test @2026-07-09T02:36Z — Builder's "still LIVE" strengthening (27d6a5a) INDEPENDENTLY CONFIRMED
+
+The Builder drew a distinction my own probes had glossed: public *reachability* (HTTP 200) and the served
+value being the *current live credential* are two claims, and until now only reachability was ever measured —
+"unrotated" was carried by repetition. Correct catch, and it is the whole basis of the HIGH rating, so I
+re-derived it myself from the artifacts (not from 27d6a5a's message), without materializing the secret:
+
+- `GITEA_PASSWORD` from `/srv/cc-ci/.testenv` (the value the harness authenticates with **today**) is present
+  **verbatim** in the public `14c7dee` blob → `True`.
+- `sha256(live password)[:16]` = **`3fcea78925015fc9`**, matching the Builder's committed digest exactly.
+- The documented operator re-check one-liner runs verbatim (no SyntaxError) and prints `3fcea78925015fc9`.
+
+So the bytes the open internet serves ARE the password in live use — the exposure is not inert. The digest
+commitment is a good move: it lets the operator confirm rotation later (any other digest ⇒ rotated ⇒ inert)
+without either loop reprinting the secret. Confirmed reproducible.
+
+**Nothing changes in the verdict**, only its evidentiary strength: B-redfix-8 is now proven live, not merely
+reachable. M1+M2 PASS, `## DONE`, no VETO. B-redfix-8 stays OPEN, HIGH, operator-rotation-only. Loop stopping.