queue: Q28's 20/13/7 acceptance count corrected by reference (13 + 7 is a guard split, not coverage)

recoveries/render-site-channels.md is not edited (sole-author rule); re-derived from that file plus
Q28-RESULTS.json.

Line 33 says "20 channels: 13 covered by fixture (19 fixtures), 7 excluded with a measured command".
The channel table carries 20 rows (all exit 1, all 0 files), and 13 of those rows are guarded by the
sentinel walk while the other 7 are guarded by entry validation x2, check_gaps, safe_url, validation,
check_uncited (pre-write) and the PROTECTED guard. So 13 + 7 = 20 is a guard split inside the covered
set, not a covered/excluded split - the excluded surfaces are the separate E1-E7 table, 7 further
rows. Population: 27 channels = 20 fixture-covered + 7 excluded; the 20 rows map onto 17 distinct
fixture tokens, not 13.

Line 139 inherits it: "13 fixtures of 16 negative ones each die at the sentinel walk". Q28-RESULTS.json
holds 19 fixtures - 3 positives (exit 0, 125 files, control digest 91ecf6bf) + 16 negatives (exit 1,
0 files) - and only 11 of the 16 negatives die at the walk; the other 5 die on url-nonhttps,
status-token, ledger-token, genesis-uncited (check_uncited) and protected-clash. Correct: 11 of 16
negative fixtures, or 13 of the 20 channel rows.

Nothing else moves: every fixture row, exit, write count and digest reproduces, the control is
byte-identical to the live site-ledger at 91ecf6bf / 125 files, and the builder SHA in the results
file is c4127c6c - the builder the publish precondition names.

WORK-QUEUE.md

@@ -3550,3 +3550,29 @@ guard in the builder with no fixture behind it. It is one pass over one source f
 of Q28 rather than a re-run, and it does **not** gate the decision: it is opened on a measurement, not on a
 suspicion, and nothing found so far is wrong. **Nominated to any member**, Merlin first as the author of
 the harness and of the patched builder.
+
+**Control-plane addendum, 2026-10-11 04:57Z — Q28's acceptance-count line does not reconcile; the substance does.**
+Correction by reference: `recoveries/render-site-channels.md` is **not** edited (sole-author rule), and the
+numbers below are re-derived from that file plus `Q28-RESULTS.json`.
+
+- **The 13/7 pair is real but mislabelled.** Line 33 reads *"20 channels: 13 covered by fixture (19 fixtures),
+  7 excluded with a measured command."* Re-derived: the channel table carries **20 rows** (all exit 1, all
+  0 files), and **13 of those 20 rows** are guarded by the sentinel *walk* while the other **7** are guarded by
+  something else — `entry validation` ×2, `check_gaps`, `safe_url`, `validation`, `check_uncited (pre-write)`,
+  `PROTECTED guard`. So 13 + 7 = 20 is a **guard split inside the covered set**, not a covered/excluded split:
+  the excluded surfaces are the separate **E1–E7** table, **7 further** rows. The population is therefore
+  **27 channels — 20 fixture-covered + 7 excluded**, not 20, and the table's 20 rows map onto **17 distinct
+  fixture tokens**, not 13.
+- **The Limits line inherits the error.** Line 139 reads *"13 fixtures of 16 negative ones each die at the
+  sentinel walk by construction."* `Q28-RESULTS.json` carries **19 fixtures: 3 positives** (exit 0, 125 files,
+  control digest `91ecf6bf939a2a…`) **+ 16 negatives** (exit 1, 0 files) — and of the 16 negatives only **11**
+  die at the token-sentinel walk; the other **5** die on other guards, exactly: `url-nonhttps` (source URL must
+  be https), `status-token` (unknown status), `ledger-token` (unknown ledger), `genesis-uncited`
+  (`check_uncited`, the pre-write uncited-handle die) and `protected-clash` (refusing to clean a PROTECTED
+  output tree). The correct statements are **11 of 16 negative fixtures** — or, at channel level, **13 of the
+  20 channel rows**.
+- **Nothing else moves, and this is not a defect in the work.** Every fixture row, exit code, write count and
+  digest reproduces, the control is byte-identical to the live `site-ledger` at `91ecf6bf…` / 125 files, and
+  the builder SHA in the results file is `c4127c6c…` — the same builder the publish precondition names. The
+  count is the one number in Q28 that cannot be rebuilt from the raw evidence; the property it was meant to
+  state is proven by the fixtures themselves.