Merge pull request 'docs(website): record the demo's re-check after DM27/DM28 and the play-review walk' (#388) from docs/demo-step5-recheck into main

Reviewed-on: #388

website/DEMO_MODE.md

@@ -610,12 +610,24 @@ through that proxy.
    - **The credential check over-flags.** `SECRET_WORDS` matches words such as `key` and `auth`
      inside longer names ("Allow Master Key", "TC Auth Only", a drone preset key), so on the demo
      those harmless fields are hidden and read-only. **Left as is (DM29).**
-   - **`play-review` was not walked**: its password is only in the host's `.env`. It is read on the
-     host and walked after the two fixes land.
+   - **`play-review` was not walked**: its password is only in the host's `.env`. The org lead read
+     it there and handed it over, and it was walked with the re-check below.
    - `demo-player` could remove its stand-in Steam link, and staff could remove it for them.
      **Locked (DM27).**
    - The public URL did not open in Chrome on the walker's PC, while curl and the emulator reached
      it; the org lead opened it through the proxy without trouble, so it is local to that PC.
    - Nothing seeds the moderation queues, so the moderator tour shows empty lists.
+
+   **Re-checked after the fixes** (2026-10-28, the 12:00 UTC wipe, Module-Rust **v0.6.3**, whose run
+   tagged a v0.6.2 first and then failed to publish it):
+   - **`play-review`, 19/19.** It is not among the published logins; it signs in as admin and reads
+     settings, users, servers and events; its own username, password, email, two-factor, recovery
+     codes and sessions are refused, as are the site's admin locks. The app's path works too: mobile
+     sign-in, a bearer read, a refused lock and sign-out. Its web sign-in was checked through the
+     API, which is the call the page makes.
+   - **Seeded events, W1.** The three actions are on, uncapped, straight after the wipe, and
+     Server greeting ran to completion.
+   - **Steam link, W4.** `demo-player`'s unlink and staff's unlink both answer `403 DEMO_LOCKED`, and
+     the link stays.
 6. **Play**: the sign-in details in the Play Console point at `play-review`;
    runicgateway.com `/beta` publishes the logins.