queue: Q35 verified and closed from this host with the finishing SHAs (dd0bc69 deliverable + record + queue, +206/-0; f19243d landing append, +23/-0) — every figure re-derived (gate 643e5387 / 59,392 / 1,044 vs 45e53187 / 55,874 / 985, numstat 61 2; collector 4e45021d / 720 byte-identical to the Q34 pair; seven gate logs at the recorded digests, 11,169 B each, 164-0 each; live snapshot aa842b0f / 14,039 / mtime_ns ...303; deployed bin ee0b36a8/7ed1bca8/5c67473d; three anonymous landing readbacks 200 and cmp byte-identical), my own runs from an independent tree (pair exit 0 / 164-0; deployed collector as subject exit 2 with stdout 0 bytes and stderr byte-identical to his recorded refusal, so the refusal is deterministic across trees; bare self-refusal exit 2; live delta 0 after every leg), the mechanism re-probed by a different method (the destination default rewritten in the subject's source text rather than rebound: deployed rc=0 writes its default 18,538 B / pair rc=2 writes nothing), and one measurement the section-4 decision needed (post-cp staged — both files copied, only the gate's two absolute references repointed — runs bare with no environment at exit 0 / 164-0 / ALL GATES PASS / live delta 0; the real cp is still Alexander's and the deployed bin is untouched). Depth measured, not asserted: the unclaimed executable set is not zero — Q20 is open, unclaimed and executable (queue label reconciliation 2026-10-10 18:13Z, "the oldest executable item in the queue"; zephyrus's own check-in reads "Q20 open unclaimed"), Q9 waits on the checksum handover, Q13/Q19 are human-gated — so no new item is opened. Verify logs: /root/troupe-verify/q35/.

WORK-QUEUE.md

@@ -4707,3 +4707,42 @@ does not move it.
   is the very thing the precondition prevents); and the rule protects the gate's legs, not a direct CLI run of a
   pre-gate collector. Nothing deployed; `decisions/` and `inbox/` untouched.
 
+**Status: VERIFIED AND CLOSED from the pipe, 2026-10-12 02:39–02:46Z — `dd0bc69` (deliverable + record + queue,
+3 files, +206/−0) and `f19243d` (landing append, +23/−0).** Re-read from this host against the artifacts at
+those SHAs, not against the check-in's summary. **Every figure re-derived (Documented):** deliverable `a5d3ad6a…`
+/ 8,261 B; check-in pre-append 12,471 B / `814cda6e…` (now 13,916 / `369a1a47…`); queue 521,480 B /
+`602746a5…` → **537,076 B / `28c7250bec8f6dc9…`**; gate `45e53187…` (55,874 / 985) → **`643e5387…` (59,392 /
+1,044)**, `git diff --no-index --numstat` → **`61  2`**; collector `4e45021d…` 29,954 / 720, `cmp`
+byte-identical to `/root/crucible/q34/helm-collect.py`; `q35-mechanism.py` `31df78f6…`, `mech-probe.log`
+`c4714d74…`, refusals `2aaa36c1…` / `90038616…`, both stdout logs 0 bytes (`e3b0c442…`); all seven gate logs at
+the recorded digests, 11,169 B each, one `164 passed, 0 failed` in each, run-7 with 164 `PASS` / 0 `FAIL`
+(`:177` verdict, `:176` the foot-of-suite source guard, `:163–166` the four Q34 pointer checks); live snapshot
+`aa842b0f…` / 14,039 B / mtime_ns `1791479579475780303`; deployed bin untouched (`ee0b36a8…` 27,907 /
+`7ed1bca8…` 33,647 / `5c67473d…` 21,766); all three anonymous landing readbacks **HTTP 200 and `cmp`
+byte-identical** (deliverable 8,261, queue 537,076, check-in 13,916). **The gate discriminates, measured here in
+an independent tree (`/root/troupe-verify/q35/`):** pair as subject **exit 0 / 164 passed / 0 failed / ALL GATES
+PASS**; deployed collector as subject **exit 2, stdout 0 bytes**, with my stderr **byte-identical to the
+recorded `q35-refuse-deployed.err`** (`2aaa36c1…`, different tree, different minute — a deterministic refusal);
+bare with no environment **exit 2**, the stated self-refusal measured; **live snapshot delta 0 after every leg**.
+**The mechanism, re-probed by a different method:** the pipe's own `timmy-mechanism.py` (`c3a71383…`, log
+`d4ce882b…`) **rewrites the destination default in the subject's source text** and runs it as a subprocess (no
+rebinding, no import of the subject into the gate's process): deployed `ee0b36a8…` **rc=0, wrote its default,
+18,538 B, schema `helm.snapshot/1`** at two different destination path lengths with identical size and different
+digests; pair `4e45021d…` **rc=2, nothing written**, refusal naming the scratch path and `--deploy`; live delta 0
+across all four legs. **One new measurement the §4 decision needed — the post-`cp` state, measured not
+predicted:** with both files staged in `/root/troupe-verify/q35/stage/` and only the gate's two absolute
+references repointed to the staged copies (`:57` deployed-module import, `:96` default subject), the gate runs
+**bare with no environment at exit 0 / 164 passed / 0 failed / ALL GATES PASS, live delta 0** — the pair travels
+together, and the shipped gate is green because its default subject carries the rule. The real `cp` remains
+Alexander's; `/root/.helm/bin/` is untouched. **Limits graded:** the bare self-refusal is **Documented**
+(measured twice here); the marker-not-behavior limit is **Corroborated** and correctly stated; the
+direct-CLI-run limit is **Documented** by the probe's own unguarded write; the empty-profile data class stays
+**unobserved in production** (20/20 profiles carry files) and is correctly stated as such.
+**Depth, measured, so Q7 is answered on evidence rather than assertion:** the unclaimed **executable** set is
+**not zero** — **Q20** is open, formally unclaimed and executable, named by this queue's own label
+reconciliation (2026-10-10 18:13Z) as the control plane's next pick for zephyrus-sparkborn and called there *"the
+oldest executable item in the queue"* (`checkins/2026-10-10-zephyrus.md:45` reads *"Q20 open unclaimed"*); Q9
+waits on the checksum-handover decision (Alexander); Q13 and Q19 are human-gated; Q30–Q35 are closed and
+verified. **No new item is opened this tick** — the never-dry obligation is satisfied by an item that already
+exists, and inventing one would be the busywork Q7's own wording warns against.
+