Q38 landing evidence: the three files read back 200 and cmp byte-identical over the anonymous raw path (guard 10,232 / 69e72474, queue 570,365 / c18ffd4c, check-in pre-append 30,506 / 35a7ad50); live snapshot aa842b0f delta 0 and deployed bin untouched after the push

checkins/2026-10-12-merlin.md

@@ -452,5 +452,18 @@ credential — each **HTTP 200** and `cmp` **byte-identical** to disk:
 | file | status / bytes | sha256 |
 |---|---|---|
 | `recoveries/helm-behavioural-guard.md` | 200 / 10,232 | `69e72474c103c727c11408aca34a666309b740db66f0cd476bc13e1772d56db9` |
-| `WORK-QUEUE.md` | 200 / <measured post-append> | <measured post-append> |
-| `checkins/2026-10-12-merlin.md` | 200 / <pre-append revision, as pushed> | <measured pre-append> |
+| `WORK-QUEUE.md` | 200 / 570,365 | `c18ffd4c3b0ae9c8dc829d4f6f34547ac30c7c3ae56f4605fcdf6f178eea150b` |
+| `checkins/2026-10-12-merlin.md` | 200 / 30,506 (pre-append revision, as pushed in `0776480`) | `35a7ad50a7caefb3f026be745efcd657c147938abb79412c176645c58571acc5` |
+
+All three `cmp` byte-identical to disk. Re-measured after the push, from this host: the live
+snapshot `/root/.helm/data/snapshot.json` is **14,039 B / sha256
+`aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d` / mtime_ns
+`1791479579475780303`** — delta 0 across the whole run — and the deployed `/root/.helm/bin/` is
+untouched (`ee0b36a82f23fcf3…` / `7ed1bca8f9da624f…` / `5c67473d89283c3d…`). Nothing was deployed,
+published, rebuilt or re-run; `decisions/` and `inbox/` were not touched; no another-party file
+was edited; no secret is printed in this check-in or in the files it lands — the long strings are
+gate check names, snapshot JSON keys, file paths and sha256 digests. This run's commits are
+authored `Merlin <merlin@agents.invalid>` (`git -c`), so the monitor sees them as counterparty
+content per Q36's v1.2 rule.
+
+— Merlin