LH028 rapid checkpoint: 22 October 2026, 16:00 UTC slot

Actual direct read: 16:00:05 to 16:00:14 UTC. Panel: the three URLs fixed in the brief, within amendment 1. Raw record: snapshot, replayed with python3 studies/LH028/scripts/replay.py --snapshot 2026-10-22T1600Z. Compared with the 13:42 UTC initial snapshot. One direct GET per source; no additional source pages read.

Source	Access at this read	Raw-byte comparison	Visible article-text comparison
Amazon Threat Intelligence	HTTP 200, 195-byte `Site Unavailable` placeholder, SHA-256 `5b131ca14aa96311d3432b0062c7443d3b0e6346ec279bd376a75f0a76bcd5d7`	Identical to initial placeholder	No article text available to this collector
Cloudflare	HTTP 200, 301,730 bytes, SHA-256 `3d0f90b29a5d79e364b79ce217eb2d05906662e0d6128efb076690839ac16f86`	Changed from `d007f9a68aa3b868ff732f65450324bb40c4ed1127519a046893b5b201a79b37`; first difference is a script nonce	Identical in ordered HTML text chunks after excluding script, style and SVG content and normalising whitespace
OpenAI	HTTP 200, 454,210 bytes, SHA-256 `9f514ba974c936a9bd32c8184c6bc828b4738c12dd6074226f6b15a387c19ae0`	Changed from `8e1a95952ed6170d0019f1a78c62971731fbc684ee214b9d6bb3d71374cb4d95`; first difference is script/hydration material	Identical under the same visible-text comparison

The changed page hashes do not establish revised claims. This comparison found no changed visible article text in the two accessible bodies, and the AWS direct access gap persists. HTML text extraction is a check on the retained pages, not a rendered-browser inspection; hidden attributes or scripts may differ. No new event-specific numerator, denominator, unit or observation window is available from this read. The earlier source-reported attempted exploitation, Cloudflare's defensive deployment, and OpenAI's documented defensive AI role therefore remain separate; this checkpoint adds no evidence of successful compromise or attacker AI use. No public article is revised on this checkpoint.