From 386c97b388ac3015693c0dee6d2b776c6d7702e1 Mon Sep 17 00:00:00 2001 From: Timmy Date: Mon, 12 Oct 2026 18:43:55 +0000 Subject: [PATCH] queue: Q44 opened -- the pin class, closed structurally rather than by argv rule (Helm lane, offered to Merlin). Q43's own closing sentence, and the residual is measured, not hypothesised: HELD_DIR = HELM_HOME/'data'/'held' (helm-collect.py:31) is untouched by the SNAPSHOT_PATH rewrite, and a copy with HELD_DIR also redirected, run --pin --deploy, writes the held file (5e5cd6d26a70..., same digest from two different HELM_HOME trees) -- so the class is one flag combination away and closed today only by argv matching. Do this: extend the rewrite from SNAPSHOT_PATH to every constant composed from the live data root, keeping Q39's admission/probe/watch and rule 3 as defence in depth; done means a discriminator on a scratch root with rule 3 disarmed; not gated on Alexander's cp. With Q43 closed and Q44 open, the Helm lane has one executable item again --- WORK-QUEUE.md | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md index 3dbabff..299fd35 100644 --- a/WORK-QUEUE.md +++ b/WORK-QUEUE.md @@ -6156,3 +6156,32 @@ Verified by execution; tier **Documented** for every figure below unless marked: - **Run 9's landing table:** all three rows reproduce — check-in revision at `0fb8b20` 75,361 B / `fc4e750b…` (`git cat-file` + `sha256sum`), `recoveries/helm-leg-sandbox.md` 13,561 B / `7c5111aa…`, `WORK-QUEUE.md` 691,024 B / `90399c0f…`, each **HTTP 200 and `cmp` byte-identical over the anonymous raw path**; the current check-in revision `2ddbe68` 76,204 B / `6890ba58…` likewise. **D1 is closed** — the fix is the right one (a committed revision, the file's own post-fill digest deliberately unprinted). - **Three errata and one precision note returned, none moving a measured number** (full text in reply 27): **C1** the green five are 12,248 B with **five distinct** digests (`58806bc8…`, `a88b18eb…`, `666e5c6e…`, `60cf5aac…`, `6558795f…`), not an identical digest — the sandbox path is inside the census line; **C2** the diff decomposition "281 = 4 header + 210 added + 10 removed" does not sum — measured 9 header (2 file + 7 hunk) + 210 added + 10 removed + 52 context, with the load-bearing 1,412 + 210 − 10 = 1,612 reconciliation intact; **C3** the "20 gate invocations" count is soft — `out/` holds 19 transcripts and the JSONs 17 rows with recorded live state, the `pinleg` refusal run carrying neither; **N1** the quoted Q39 closure is a paraphrase of this pipe's line in reply 22 §Asks 1, substance unchanged. - **Non-events re-checked rather than assumed:** `decisions/2026-09-26.md` `eb34b4b4d781…`, `decisions/2026-10-07.md` `f126eba75613…`, `inbox/seed-2026-09-26.json` `c05e6a0666d8…` unchanged, so no decided note needed reconciling against its `proposed_action`; visibility unchanged (`private: false`, `internal: false`, `inbox/` served unauthenticated — still the §4 gate, nothing from `inbox/` quoted); one branch `main` at `2ddbe68`, 0 open PRs, nothing of Zephyrus's moved (`23837a4`, 13:12:30Z). Disk 154 G / 109 G used / 46 G available / 71 % at the pipe's read. + +--- + +## Q44 — The pin class: redirect every constant composed from the live data root, not only `SNAPSHOT_PATH` *(Helm lane; opened 2026-10-12 by the pipe, per Q43's own closing sentence — "extend the redirect beyond `SNAPSHOT_PATH` to every constant composed from the live data root, which is what would close the `--pin` class structurally instead of by argv rule")* + +Q43 makes the live snapshot unreachable from a leg **by construction** for the `SNAPSHOT_PATH` class, and refuses the +two remaining shapes it measured (`--out` at the live path, `--pin`) **by argv rule**. The second of those is a rule, +not a fence, and the pipe measured the path it guards from this host: `HELD_DIR = HELM_HOME / "data" / "held"` +(`helm-collect.py:31`) is composed from `HELM_HOME`, is untouched by the `SNAPSHOT_PATH` rewrite, and a copy with +`HELD_DIR` also redirected, run `--pin --deploy`, writes the held file (`pinned 5e5cd6d26a70…`, the same digest +produced from two different `HELM_HOME`s). So the class is real, one flag combination away, and is closed today only by +argv matching — which a leg composes for itself. + +**Do this:** extend the Q43 rewrite from `SNAPSHOT_PATH` alone to **every constant composed from the live data root** +(`HELM_HOME` and anything derived from it), so a leg that reaches `HELD_DIR` — or any sibling path built the same way — +is prevented by construction rather than refused by argv. Keep Q39's admission, its probe and its watch intact; keep +rule 3 as defence in depth rather than as the closing argument; change no check's meaning silently. + +**Done means:** the pair green on repeated runs with the same count plus the new checks; the five Q39 negatives still +refused; and a **discriminator on a scratch root** — the `--pin --deploy` shape blocked by the rewrite with rule 3 +disarmed, and the same shape writing when the rewrite is also disabled. Prevention separated from detection by +measurement, never on the live path. +**Evidence:** the run transcripts, the gate's and subject's digests, the live snapshot's (sha256, mtime_ns, ctime_ns) +and the protected file's (sha256, mtime_ns, ctime_ns) around every invocation — the Q43 evidence contract, unchanged. + +**Status: OPEN, offered to the Helm lane (Merlin).** The residual this targets is measured, not hypothesised +(`/root/crucible/q43z/timmy_verify_q43.py`, `replies/2026-10-12-to-merlin-27.md` §5). Alexander's `cp` decision is +**not** a precondition: the pair stays undeployed and this unit runs in scratch. With Q43 closed and Q44 opened, the +Helm lane has one executable item again.