queue: Q19 record repaired (seventh tick) - the section asserted both execution and non-execution; resolved to execution (Gitea user cassian id 45, token sealed a5717ecf) and names what was NOT executed: repo write, since cassian is absent from the collaborator list so push=false is a permission gap and not a token-scope defect; new gate for Alexander (collaborator write or PR-only path); JOIN-THE-TROUPE.md omits the grant as an onboarding step; his Q5 330 figure does not reproduce (314 measured across the nine public org repos)

WORK-QUEUE.md

@@ -1322,6 +1322,11 @@ actually is remains unverified (the key arrived over a cron-channel note, not a
 proposed members (Grok, Mistral) stay unadmitted. Membership is provisional until Cassian's first check-in
 identifies them.
 
+**SUPERSEDED IN PART — 2026-10-06 20:25Z, by the ruling quoted at the top of this section.** The two paragraphs
+below record the state of play *at the fourth tick, before Alexander ruled*. Their claim that nothing was executed
+became false the moment his ruling arrived and was executed; the now-false clauses are named in the seventh-tick
+correction at the foot of this section. Every character below is kept for the audit trail.
+
 Zeph reports Alexander approved onboarding three new wizards (his word, 2026-10-06) and that the onboarding kit
 `JOIN-THE-TROUPE.md` (`bb9d24d`, 17:39:58Z) was finalized from that approval. **The pipe holds no artifact of
 the approval**, so it is **Testimony only** and nothing is executed on it: no Gitea token issued, no `age`
@@ -1339,7 +1344,35 @@ two that do not hold as printed (`OLLAMA_USE_MLX=1` absent from Ollama's own MLX
 **Done means (only after he rules):** a decision line naming which member(s) he admits, then the credential
 handoff by the existing `access/` envelope pattern for that member alone. Nothing else — no launchd/cron
 harness, no standing cadence, until a member exists.
-**Blocked on:** Alexander. One line from him opens this item.
+**Blocked on:** nothing for the admission — that ruling arrived on 2026-10-06 and is executed above. **Open:**
+`cassian` holds a working token but **is not a collaborator** on this repo, so his first check-in cannot land
+directly. See the seventh-tick correction immediately below.
+
+**Correction, appended 2026-10-06 (seventh tick) — the admission landed credential-only, and two clauses in this
+section contradicted the status line at its top.**
+
+- **The section asserted both execution and non-execution.** Resolved in favour of execution, which is real:
+  Gitea user `cassian` (id 45) created 2026-10-06T20:22:36Z, active, non-admin; one PAT sealed to the age key at
+  `access/cassian-forge-token.age` (240 B ciphertext), committed `a5717ecf` 20:24:34Z, under the ruling quoted at
+  the top. The two clauses that said otherwise — *"nothing is executed on it: no Gitea token issued, no `age`
+  envelope sealed, no member admitted"* and *"**Blocked on:** Alexander. One line from him opens this item"* —
+  described the fourth tick, before the ruling, and are **void as of 20:25Z**.
+- **What was *not* executed, and it is exactly what issue #1 is about: the repo permission.** `cassian` is absent
+  from the collaborator list (only `zephyrus-sparkborn`, id 41). So `permissions.push=false` on the live API is the
+  correct reading, **not** a token-scope defect — `write:repository` governs what a user may do to repositories they
+  already reach; it does not confer reach. `STANDING-AGREEMENT.md` §6's *"this repo: direct commits to `main` are
+  fine"* is a member privilege and cannot be exercised without the grant.
+- **Open, gated on Alexander — new item, his one line:** add `cassian` as collaborator with **write** (finishing
+  the provisional admission), or hold the PR-only path. Fork → branch → push → PR works today on his existing
+  scope, and PRs into this repo are sanctioned; nothing has to wait for the grant.
+- **Identity remains provisional:** the age key arrived over a cron-channel note, not from a check-in of his own
+  hand. The first check-in that arrives by his hand is what closes that.
+- **Also owed, and not by him:** `JOIN-THE-TROUPE.md` names the credential handoff but **not** the collaborator
+  grant as an onboarding step. That omission is what produced this blocker. It is the counterparty's file, so the
+  ask travels on the pipe rather than as a direct edit.
+- **His Q5 draft figure does not reproduce from public data:** *"330 open issues, all class (b)"* against **314**
+  measured from this host across the nine public org repos (318 including the private `a2a-workshop`), excluding
+  pull requests, 2026-10-06 ~20:45Z. Testimony only until he publishes the query and the window.
 
 ---