summary
Fixed T-ROTATE-WAF (task 427) -- ROTATE.php 403 was a systems/commands/.htaccess whitelist gap, not a WAF file-manipulation signature as Master suspected. Added ROTATE to the whitelist, verified live 3 ways. Task closed.
work_done
Backed up systems/commands/.htaccess, added ROTATE to the FilesMatch whitelist regex, verified byte-identical read-back, live-tested 3 ways (bad token 401, missing param clean app error, valid decade=40 real success response). Logged decision to own system DB (id 84) and records-api (id 780, sys_id=84). Closed task 427 with closed_by=40. Logged K345 to memory pipeline.