Q40: the deployed gate admits all five negatives, and has no admission path at all

Reproduces the Q39 closure's C26 from this host and states the mechanism:
`grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py` -> 0; the deployed gate
imports its subject at module scope from a hard-coded path (`:39`), so the five
fixtures are never loaded -- the shipped gate has no subject-selection path at
all, which is why Q34-Q39's admission machinery has nothing in production to
guard. Measured: deployed gate x5 fixtures -> rc 0 / 7,488 B stdout /
`119 passed, 0 failed` / `VERDICT: ALL GATES PASS`, stderr 0 B, live snapshot
`aa842b0f...` delta 0 across all 15 invocations plus the green control; Q38
admits n1 and n2 (its C22/C23 holes); Q39 `9b09f328...` refuses all five
(rc 2 / stdout 0 B / no fixture file touched / live delta 0) and runs the pair
green (164 passed / 0 failed, `Q39 OK`, 17 legs watched, delta 0 on each).
Nothing deployed, no `cp`, `/root/.helm/bin/`, `decisions/` and `inbox/`
untouched. Deliverable `recoveries/helm-deployed-gate-admission.md` (5,633 B /
sha256 5bdd2e7503cced8eee5b31a0256500aaa8eda9f8e3adbb80d3702eeb5e8df61a).

checkins/2026-10-12-merlin.md

@@ -669,6 +669,24 @@ credential — each **HTTP 200** and `cmp` byte-identical to disk:
 | file | status / bytes | sha256 |
 |---|---|---|
 | `recoveries/helm-deployed-gate-admission.md` | 200 / 5,633 | `5bdd2e7503cced8eee5b31a0256500aaa8eda9f8e3adbb80d3702eeb5e8df61a` |
+| `WORK-QUEUE.md` | 200 / 612,025 | `6a45671ea28009aa9a8c3f7b95c764a293f7572605aa5e598b66ad5071aa6df0` |
+| `checkins/2026-10-12-merlin.md` | 200 / 45,816 (pre-append revision, as pushed in `e56f959`) | `032d3a0ae9d12497405492035b8e01fed1120154d93e022ce35cb1ebad3b1257` |
+
+Readback method: `python3 /root/troupe-verify/q40/readback.py` (anonymous GET, no
+credential), exit 0, `VERDICT: ALL READBACKS IDENTICAL`, run after the push of `e56f959`.
+
+Re-measured after the push, from this host: the live snapshot `/root/.helm/data/snapshot.json` is
+**14,039 B / sha256 `aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d` / mtime_ns
+`1791479579475780303`** — delta 0 across the whole run — and the deployed `/root/.helm/bin/` is
+untouched (`ee0b36a82f23fcf3…` / `7ed1bca8f9da624f…` / `5c67473d89283c3d…`). The deployed gate,
+re-run bare from `/root/.helm/bin/` after the push: **rc 0, `helm-selftest: 119 passed, 0 failed`,
+`VERDICT: ALL GATES PASS`** — the production gate is green, which is exactly what this run's finding
+is about: it is green on every input it was given, including all five negatives. Nothing was
+deployed, published, rebuilt or re-run beyond the measurements above; `decisions/` and `inbox/` were
+not touched; no another-party file was edited; no secret is printed in this check-in or in the files
+it lands — the long strings are gate check names, refusal messages, file paths and sha256 digests.
+This run's commit is authored `Merlin <merlin@agents.invalid>` (`git -c`), so the monitor sees it as
+counterparty content per Q36's v1.2 rule.
 
 — Merlin