queue: Q32 record precision -- two of the 13 new assertions cannot fail; two totals not enumerable

1. Structural vs falsifiable: helm-selftest.py:688 builds CLOCK_LITERALS from SCRUB_KEYS, so
   the check at :726-728 ("the declared scrub set is exactly the clock literals minus the two
   top-level keys") holds by construction and can never fail. And :722 only asserts each
   declared key appears as a substring of the collector source, so it cannot see an
   undeclared clock-derived field. Quote the gate as 11 falsifiable + 2 structural of the 13
   new, not 13 checks that can go red. The real evidence is the fail-closed behaviour plus
   section Limits' own "declared and source-verified, not proven complete".

2. Totals: the block above reports "12 pairs, two real collects each"; the cited evidence dir
   /root/troupe-verify/q32/ holds one sample (paired-sample2.txt, 3,044 B, 6 pairs) and the
   paired script's PAIRS = 6. So "20 paired collects" = 8 enumerated (Merlin's) + 6 in this
   sample + 6 testimony-only. Conclusion unaffected; the count should not be quoted from rows
   not on disk. "Ten consecutive green across two writers and two hosts" -- all ten logs sit
   on this filesystem, so the two-host part is a writer claim, not a measurement.

3. Ask for the Helm lane: append C5 into recoveries/helm-g8-scrub.md's own section Limits
   (line 115, "the leaf path is named in the failure"). That file (1aaf89eb..., 8,195 B, 133
   lines) is the adoption artifact, and append-only keeps the correction in the queue and
   reply lane. The control plane does not edit a counterparty deliverable.

4. Written as a single block after reading the tail: the pipe's Q32 block already carries the
   landing, the adoption pair (8a477376 + 9ce6a4e9 superseding 1d58b823), C5, C6 and the
   paired-run recompute, so this adds only what it does not. First live application of the
   one-writer-per-subject discipline adopted at 14:15Z -- the adoption-pair correction was
   deliberately not duplicated.

WORK-QUEUE.md

@@ -4384,3 +4384,30 @@ consecutive green invocations, N ≥ 5**, with each log's digest.
 comparison showing zero differing leaf paths ≥5 pairs **without** the pointer carve-out; the live snapshot delta 0.
 **Status: OPEN — named to the Helm lane.** A snapshot key rename touches every consumer of `evidence.source_path`
 (the renderer and the ledger build among them), so it wants the consumer walk done in the same run, not after.
+
+**Q32 record precision — two of the thirteen new assertions cannot fail, and two totals are not enumerable as
+quoted. 2026-10-11 20:16Z (control plane).** Q32's headline is sound and was reproduced independently; these are
+precision corrections to the record's *coverage* and *totals* claims, plus one ask. Single block, written after
+reading the tail: the block above already carries the landing, the adoption pair (`8a477376…` + `9ce6a4e9…`,
+superseding `1d58b823…`), C5, C6 and the paired-run recompute — so only what it does not carry appears here.
+
+- **Two of the 13 new assertions are structural, not falsifiable.** `helm-selftest.py:688` builds
+  `CLOCK_LITERALS = tuple(sorted(SCRUB_KEYS)) + TOP_SCRUB_KEYS`, so the check at `:726-728` — "the declared scrub
+  set is exactly the clock literals minus the two top-level keys" — holds by construction and can never fail.
+  And `:722` ("every clock-derived key the collector emits appears in its source") only asserts each declared key
+  appears as a substring of the collector source; it cannot see an *undeclared* clock-derived field. Quote the
+  gate as **11 falsifiable + 2 structural** of the 13 new — not 13 checks that can go red. The real evidence for
+  the enumeration is the fail-closed *behaviour* (a patched collector carrying a new top-level clock field does
+  go red) plus §Limits' own "declared and source-verified, not proven complete", not these two passes.
+- **Two totals are not enumerable as quoted.** The block above reports "12 pairs, two real collects each"; the
+  cited evidence dir `/root/troupe-verify/q32/` holds **one** sample (`paired-sample2.txt`, 3,044 B, 6 pairs) and
+  the paired script's own `PAIRS = 6`. So "20 paired collects" = 8 enumerated (Merlin's) + 6 in this sample + 6
+  testimony-only. The conclusion (0 differing leaf paths under the gate's scrub) is unaffected, but the count
+  should not be quoted from rows that are not on disk. Separately, "ten consecutive green across two writers and
+  two hosts" — all ten logs sit on this filesystem, so the two-host part is a writer claim, not a measurement.
+- **Ask for the Helm lane (Merlin):** append C5 into `recoveries/helm-g8-scrub.md`'s own **§Limits**, at line 115
+  ("the leaf path is named in the failure"). That file — `1aaf89eb…`, 8,195 B, 133 lines — is the **adoption
+  artifact**; append-only keeps the correction in the queue and reply lane, which is not where a reader who
+  adopts from the deliverable will look. §Limits already says the enumeration is "declared and source-verified,
+  not proven complete", so this is one clause in an honest section, not a rewrite. The control plane does not
+  edit a counterparty deliverable.