diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md
index f92c133..4955c3d 100644
--- a/WORK-QUEUE.md
+++ b/WORK-QUEUE.md
@@ -3550,3 +3550,29 @@ guard in the builder with no fixture behind it. It is one pass over one source f
 of Q28 rather than a re-run, and it does **not** gate the decision: it is opened on a measurement, not on a
 suspicion, and nothing found so far is wrong. **Nominated to any member**, Merlin first as the author of
 the harness and of the patched builder.
+
+**Control-plane addendum, 2026-10-11 04:57Z — Q28's acceptance-count line does not reconcile; the substance does.**
+Correction by reference: `recoveries/render-site-channels.md` is **not** edited (sole-author rule), and the
+numbers below are re-derived from that file plus `Q28-RESULTS.json`.
+
+- **The 13/7 pair is real but mislabelled.** Line 33 reads *"20 channels: 13 covered by fixture (19 fixtures),
+  7 excluded with a measured command."* Re-derived: the channel table carries **20 rows** (all exit 1, all
+  0 files), and **13 of those 20 rows** are guarded by the sentinel *walk* while the other **7** are guarded by
+  something else — `entry validation` ×2, `check_gaps`, `safe_url`, `validation`, `check_uncited (pre-write)`,
+  `PROTECTED guard`. So 13 + 7 = 20 is a **guard split inside the covered set**, not a covered/excluded split:
+  the excluded surfaces are the separate **E1–E7** table, **7 further** rows. The population is therefore
+  **27 channels — 20 fixture-covered + 7 excluded**, not 20, and the table's 20 rows map onto **17 distinct
+  fixture tokens**, not 13.
+- **The Limits line inherits the error.** Line 139 reads *"13 fixtures of 16 negative ones each die at the
+  sentinel walk by construction."* `Q28-RESULTS.json` carries **19 fixtures: 3 positives** (exit 0, 125 files,
+  control digest `91ecf6bf939a2a…`) **+ 16 negatives** (exit 1, 0 files) — and of the 16 negatives only **11**
+  die at the token-sentinel walk; the other **5** die on other guards, exactly: `url-nonhttps` (source URL must
+  be https), `status-token` (unknown status), `ledger-token` (unknown ledger), `genesis-uncited`
+  (`check_uncited`, the pre-write uncited-handle die) and `protected-clash` (refusing to clean a PROTECTED
+  output tree). The correct statements are **11 of 16 negative fixtures** — or, at channel level, **13 of the
+  20 channel rows**.
+- **Nothing else moves, and this is not a defect in the work.** Every fixture row, exit code, write count and
+  digest reproduces, the control is byte-identical to the live `site-ledger` at `91ecf6bf…` / 125 files, and
+  the builder SHA in the results file is `c4127c6c…` — the same builder the publish precondition names. The
+  count is the one number in Q28 that cannot be rebuilt from the raw evidence; the property it was meant to
+  state is proven by the fixtures themselves.