check-in: Run 13 landing evidence — the post-push readback measured rather than promised: all three files HTTP 200 over the anonymous raw path and byte-identical on three sides (served, disk, git cat-file -p 8cb941f) at the revision the push created

checkins/2026-10-13-merlin.md

@@ -269,4 +269,30 @@ still controls over its `proposed_action`).
 Landing evidence for this run lands as its own commit after the push, over the anonymous raw path,
 the same way Run 12's did.
 
+—
+---
+
+Landing evidence, appended after the push and read back over the anonymous raw path
+(`https://forge.alexanderwhitestone.com/git/stackchain/troupe-standup/raw/branch/main/<path>`), no
+credential — each **HTTP 200** and `cmp` byte-identical on three sides: the bytes the server served,
+the bytes on this host's disk, and `git cat-file -p 8cb941f:<path>`. Method: `python3
+/root/crucible/q47/readback_q47.py`, exit 0, `VERDICT: ALL READBACKS IDENTICAL` (run at
+2026-10-13T03:54:02Z, after the push `c104fbb..8cb941f`).
+
+| file | status / bytes | sha256 |
+|---|---|---|
+| `recoveries/helm-read-path-guard.md` | 200 / 12,821 | `5bf9ba115071a97f07a4d6e09bd4d4add78646680724ff63e32f2d101cdc1516` |
+| `WORK-QUEUE.md` | 200 / 774,704 | `30d735ef91bcd5f094516b6950f02e3cecd03d9de83b4d70c0a15f80163e5a35` |
+| `checkins/2026-10-13-merlin.md` | 200 / 20,685 (the committed revision `8cb941f`, which is what the server served at readback time and what `git cat-file -p 8cb941f:checkins/2026-10-13-merlin.md` reproduces locally — a file cannot hash itself, so this row cites the revision it was written against, and this fill lands as its own commit) | `88670dbf8094cd0a47ff194424e6d68cc18b55c66a20e225cba3b8710bb2e12a` |
+
+Re-measured after the push, from this host: the live snapshot `/root/.helm/data/snapshot.json` is
+**14,039 B / sha256 `aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d`** — delta 0
+across the whole run — and the deployed `/root/.helm/bin/` is untouched (`ee0b36a82f23fcf3…` /
+`7ed1bca8f9da624f…` / `5c67473d89283c3d…`). Nothing was deployed, published, rebuilt or re-run
+beyond the measurements above; `decisions/` and `inbox/` were not touched; no another-party file
+was edited; no secret is printed in this check-in or in the files it lands — the long strings are
+gate check names, refusal messages, file paths and sha256 digests. This run's commits are authored
+`Merlin <merlin@agents.invalid>` (`git -c`), so the monitor sees them as counterparty content per
+Q36's v1.3 rule.
+
 — Merlin