queue + record: Q39 closed and verified from this host (18 gate invocations, delta 0; the incident's own artifact refused at rc 2 / stdout 0 B); Q37 claimed with the v1.3 census landed -- branch-head line, one line of output, measured against the stored 09:40:52Z baseline as the push v1.2 hid (c2a0dc3710); its cost and its open boundary named

WORK-QUEUE.md

@@ -5198,3 +5198,25 @@ Read from source and from the forge API, not from the PR's narrative.
   the file. The test is the digest, never the mtime — the same rule as the 22:45Z reading. For housekeeping on an
   80 MB-free box: `/root/.helm/data` holds only `held` + `snapshot.json` as it should, and the stale
   `/tmp/q31-g8-deploy-*` dirs total 2.6M across nine of them.
+
+---
+
+## Q39 closure — verified from this host by the pipe (2026-10-12, reply 22)
+
+**Status: DONE. Finished by `fad802c` (record + queue block + Run 5 check-in) and `4e87c8f` (landing evidence); verified by `replies/2026-10-12-to-merlin-22.md` with my own harness `/root/troupe-verify/q39/indep-negatives.py` → `INDEP-NEGATIVES.json`, `pair-run.log`.**
+
+- **Verified exact (Documented, my own re-measurements):** gate `9b09f328…` 1,412 lines / 77,704 B; Q38 gate `74aba348…` 1,141 / 64,454; `DIFF.txt` 408 lines / `b8adc912…` (my own `diff -u` of the two gates reproduces it except its header lines); collector `4e45021d…`; deployed bin `ee0b36a8…`/`7ed1bca8…`/`5c67473d…` unmoved — the same three digests my Q35 and Q38 records carry; live snapshot 14,039 B / `aa842b0f…` / mtime_ns `1791479579475780303`, delta 0 across **18** gate invocations; the three landing readbacks re-run by me, 200 and `cmp` identical (record 12,253 / `56e25f16…`, queue 587,985 / `3884ebf8…`, check-in pre-append 38,651 / `d16b8ef2…`); `decisions/2026-09-26.md` `40b7cc14a829…` and `inbox/seed-2026-09-26.json` `e4429147bc1b…` match his bytes and neither file changed in the push, so nothing in `decisions/` conflicts with the proposal.
+- **The five controls re-run by me, my own method** (side effects detected by `(size, mtime_ns)` change; none of his files deleted — his suite pre-deletes, mine does not): Q39 refuses all five, rc 2 / stdout 0 B / no fixture destination touched; Q38 admits `n1` (rc 0 **and the fixture's destination stamp moves** — the containment failure reproduced), `n2` (rc 1) and `n5` (rc 2), and its `n3` refusal still writes the decoy's real destination. The Q35 precondition survives the five repairs: the deployed collector under the fixed gate → rc 2 / stdout 0 B, refused before the scan is reached.
+- **The decisive check is the incident's own artifact, not a fixture:** `/tmp/hermes-probe/fake-comment38.py` (229 B, 07:17Z) under the fixed gate → rc 2, stdout 0 B / `e3b0c442…`, the refusal naming the absolute literal with the rewrite shown as a no-op, live delta 0. The shape that clobbered live at 07:17:44Z dies before any leg.
+- **Corrections logged, never deleted (full text in reply 22):** **C24** the five §5 log digests reproduce nowhere — the on-disk logs are `8411dc98…`/`ed931812…`/`2da8391f…`/`af4ec869…`/`95d774db…` (11,823 B each, 09:27Z); the *measurement* they are quoted for reproduces exactly on my own invocation, so the digests are **Unrecovered** while the property stands. **C25** `+309 / −38` counts the two diff header lines: `git diff --no-index --numstat` gives `308 37`, and `1,141 + 308 − 37 = 1,412` is exact. **C26** the production gate (`7ed1bca8…`, 609 lines) returns rc 0 / `119 passed, 0 failed` / `VERDICT: ALL GATES PASS` with empty stderr on **all five** fixtures, including the comment-only class Q35 and Q38 were built to refuse — the Q35 precondition never shipped either, so the exposure is wider than the Ask states. **C27** §2.4's "which is why the deployed collector is admitted" is about the **gated** collector `4e45021d…`; the deployed collector is refused earlier, at Q35. **C28** `green-run-1.err` is not part of the green set (it is the deployed-refusal transcript `2aaa36c1…`).
+- **Adoption stays Alexander's; nothing was executed.** The pair is collector `4e45021d…` + gate `9b09f328…`. My recommendation, in the delivery: adopt the pair, and open the stronger form (the legs against a rewritten copy) as the Helm lane's next item rather than a precondition for adoption.
+- **Third-party write in this file, left standing, appended below.** `c2a0dc37` (control plane, 09:44:40Z) added its own Q39 block. Its receipt reproduces here to the byte (rc 2 / stdout 0 B / `e3b0c442…`), its digest finding is corroborated independently, and its "hold is superseded" is that lane's position on the evidence, not Alexander's decision — so the adoption ask is unchanged.
+
+## Q37 — claimed by this pipe; first increment landed (the v1.3 census)
+
+**Status: OPEN and claimed by the pipe (Merlin's §Next 2 read it correctly; it is this lane's tooling). Landed this tick:** the `branch-head` census line in `troupe_pipe_monitor.py` v1.3, sha256 `bb532da8c4f01b98eab4034ce74dc76b0e3939508bfd6cadd5d3d650020449f8`; v1.2 preserved at `/root/troupe-verify/q37/troupe_pipe_monitor.py.v1.2.bak` (`ce3950b5…`), reversible with one `cp`; record `recoveries/monitor-identity-census.md`.
+
+- **The item's question, answered by measurement:** identity cannot separate the two classes — a push that forces `timmy@stackchain.ai` matches this pipe in author, committer and `api-author-login`; and the pusher signal does not exist on this forge, because the repo activity feed's newest entry is `2026-10-07T14:06:40Z` and its newest `commit_repo` `2026-10-07T00:08:03Z` — no push since 10-07 is recorded, so it cannot see today's.
+- **What works instead — a census, not an attribution:** output that moves whenever the branch moves, whatever the author field says. v1.3 adds exactly one line, `branch-head <sha>` (the newest commit on the branch regardless of authorship). Measured: the v1.3 output differs from v1.2 **and** from the monitor's stored `09:40:52Z` baseline (`94b5561d…`) by exactly that one line, and that line is `c2a0dc371090` — a push v1.2 hid. Two live instances behind it: this pipe's own `08:32:01Z` queue-only push drew `no_change` at the `08:33:18Z` tick, and the control plane's `09:44:40Z` push left the output byte-identical while the branch head moved.
+- **Cost, named rather than hidden:** the line moves on the pipe's own commits too, so every push by this pipe now costs one follow-up run, in which the pipe reads its own commit, finds nothing from the counterparty and delivers nothing. Accepted deliberately: the alternative was more days of the `checkins/2026-10-09-merlin.md` silence (invisible under v1.2 since 10-09).
+- **Open at the boundary:** the line is a signal, not a ledger — a per-tick census remains the pipe's discipline rather than the runtime's, and the stronger repair (a push identity of its own for the counterparty) is an access decision, not a script. Q37 stays open there.

recoveries/monitor-identity-census.md

@@ -0,0 +1,81 @@
+# Q37 — the monitor's identity rule cannot see a push that carries this pipe's identity; the census that can
+
+**Timmy, 2026-10-12, this host. Scratch `/root/troupe-verify/q37/`. The only thing changed outside that tree
+is the pipe's own detector script, `/root/.hermes/scripts/troupe_pipe_monitor.py`, and the previous revision
+is preserved byte-for-byte. Nothing deployed, nothing published, `decisions/` and `inbox/` untouched.**
+
+Q36 closed one class by reading an own-attributed commit as counterparty content when it carries another
+wizard's check-in. Q37 is the residue: a push through this credential that carries **no** foreign check-in —
+a new `recoveries/` file, an edit to a listed path, a queue append — produced no listing change and no head
+move, so the monitor reported `no_change` and the agent never ran.
+
+## 1 The item's question, answered by measurement
+
+**Identity cannot separate the two classes.** The API's commit list gives `author`, `committer` and
+`api-author-login` (`timmy` for pushes through this credential; `null` when the git author's address maps to
+no user, e.g. `merlin@agents.invalid`). A push that forces `timmy@stackchain.ai` matches this pipe in all
+three.
+
+**The pusher signal that would separate them does not exist on this forge.** The repo activity feed
+(`/repos/stackchain/troupe-standup/activities/feeds`) does carry `commit_repo` events whose `act_user` is the
+pushing account (`rockachopa`, `zephyrus-sparkborn`) and whose `content` names the pushed SHA1s — but its
+newest entry is **2026-10-07T14:06:40Z** and its newest `commit_repo` **2026-10-07T00:08:03Z** (50 entries
+returned, the cap, oldest 2026-10-05T13:21:07Z). No push since 2026-10-07 is recorded. The feed cannot see
+any of today's.
+
+## 2 What landed: format v1.3, one line
+
+`troupe_pipe_monitor.py` **v1.3** — sha256 `bb532da8c4f01b98eab4034ce74dc76b0e3939508bfd6cadd5d3d650020449f8`.
+The change is +11 docstring lines and exactly **one** output line:
+
+```
+branch-head c2a0dc371090
+head 4e87c8fee59d
+```
+
+`head` is unchanged (the newest *counterparty* commit, invariant across this pipe's own pushes — which is
+precisely why the class can hide behind it). `branch-head` is the newest commit on the branch **whatever its
+authorship**, taken from the first entry of the API's newest-first commit list.
+
+- **Measured:** the v1.3 output differs from v1.2 by exactly that line, and from the monitor's stored
+  `09:40:52Z` baseline (sha256 `94b5561d202e208bc7000e6a0d58929bbf906c68a37402d4acac67aae72888ac`, the
+  output file `/root/.hermes/cron/output/78647f267d37/monitor_last_output.txt`, 3,840 B / 82 lines) by
+  exactly that line. The one line is a push v1.2 hid.
+- **Reversible:** v1.2 is preserved at `/root/troupe-verify/q37/troupe_pipe_monitor.py.v1.2.bak`
+  (`ce3950b5…`); one `cp` restores it. Outputs before and after are kept as `monitor-v1.2.out` /
+  `monitor-v1.3.out` for the comparison.
+
+## 3 Two live instances, not a synthetic case
+
+- **This pipe's own push:** `f57c0e7` (queue-only, authored `Timmy <timmy@stackchain.ai>`, 2026-10-12
+  **08:32:01Z**) → the tick at **08:33:18Z** reports `no_change (agent run suppressed)`
+  (`/root/.hermes/cron/output/78647f267d37/2026-10-12_08-33-18.md`).
+- **A sibling lane's push:** `c2a0dc37` (queue-only, same identity, **09:44:40Z**) → the monitor's output is
+  byte-identical to its `09:40:52Z` baseline while the real branch head moved from `4e87c8f` to `c2a0dc37`.
+  This push was not delivered to the pipe; this census is how it was found, during the run that began
+  09:41Z.
+
+## 4 Cost, stated
+
+`branch-head` moves on the pipe's own commits too, so every push by this pipe now costs one follow-up run:
+the tick after the push reads its own commit, finds nothing from the counterparty, and delivers nothing.
+That is the price of the class being invisible. The silence it replaces cost four days:
+`checkins/2026-10-09-merlin.md` was invisible under v1.2 from `da957486` (2026-10-09).
+
+## 5 Limits and what stays open
+
+- The line is a **signal, not a ledger.** It says the branch moved, not who moved it. Attributing a push to
+  a party still rests on the author field, which the class defeats by construction.
+- A per-tick census is the pipe's discipline, not the runtime's: the monitor's no-change gate suppresses the
+  agent, so a detector that only runs inside the agent cannot by itself break a silence.
+- The stronger repair — a push identity of its own for the counterparty — is an **access decision**, not a
+  script, and is Alexander's. Q37 stays open at that boundary.
+- This record was written the same tick the change landed; the follow-up run that the self-wake costs has
+  not happened yet, so the self-wake is stated as a consequence of the design, not as an observation.
+
+## 6 Evidence
+
+`/root/troupe-verify/q37/`: `probe.py` (identity fields, feed, branch), `feed.py` (feed census),
+`monitor-v1.2.out` / `monitor-v1.3.out` (before/after), `troupe_pipe_monitor.py.v1.2.bak` (the preserved
+revision). The monitor's own stored outputs are under `/root/.hermes/cron/output/78647f267d37/`. The queue
+block and reply 22 carry the same figures.