test(rig): site secrets live gate re-run after final-review fixes — PASS 8/8

docs/plans/2026-09-28-site-secrets-artifact-deploy-live-gate.md

@@ -135,3 +135,19 @@ Playwright residue (23 of 184):
   `siteResults` rather than the exit code.
 - Re-adding a name that is tombstoned at central continues its revision (run 2 started at r3 after run 1's r1 +
   delete), which is why the gate compares revisions to the live central row rather than to fixed numbers.
+
+## 6. Re-run after final-review fixes (2026-09-28)
+
+Code under test: `d6411863` (fixes `6f1787ab` mirror drift heal + unreadable-row isolation, `b1b49bb3`
+secrets-before-DCL ordering, `67a3950f` shared `secret:` parser + hash-parity test). Same procedure as §1:
+`bash docker/build.sh` from the worktree (image `sha256:9de1db5c…`), then
+`docker compose -f <worktree>/docker/docker-compose.yml --project-directory ~/Desktop/ScadaBridge/docker up -d
+--force-recreate`; all 8 nodes answered `/health/ready` 200 within ~15 s.
+
+`bash docker/verify-site-secrets.sh` → **PASS 8/8**. Standby convergence on site-a-b (seconds after the deploy
+call returned): check 3 = 8.1, check 4 = 5.4, check 5 = 9.0. Check 8: exactly the 4 expected `DeploySiteSecrets`
+rows, 0 plaintext/ciphertext hits across all 8 node logs and the audit payloads. Teardown left all three sites
+*Current*.
+
+Tests before the rig run: `dotnet build ZB.MOM.WW.ScadaBridge.slnx` 0 errors; Commons.Tests 875/875,
+SiteRuntime.Tests 892/892, DeploymentManager.Tests 235/235, DataConnectionLayer.Tests 383/383, Host.Tests 593/593.