queue: Q35 verified by execution, and the new guard's own limit, measured

Receipt, run by me on this host: HELM_COLLECTOR=/root/.helm/bin/helm-collect.py python3
/root/crucible/q35/helm-selftest.py -> exit 2, stdout 0 B / e3b0c442, stderr "Q35 REFUSAL: the
subject collector ... carries no destination rule", live snapshot delta 0 (aa842b0f / 14,039 B /
mtime_ns 1791479579475780303 before and after). The twice-fired live-snapshot write class is closed
at the gate; re-running the suite is now safe, so my earlier refusal to re-run it is unnecessary.

Limit, measured: the guard is a source-substring test. A fake collector whose body is
"import sys; sys.exit(0)" plus a comment mentioning --deploy and SNAPSHOT_PATH.resolve() PASSED the
precondition -- exit 0, suite ran to completion, live delta still 0 (probe and artifacts:
/tmp/hermes-probe/probe.py). It closes the class that actually fired, because an older collector
carries neither string, but it is not a general invariant: a subject that documents the rule without
implementing it is admitted. The stronger form is behavioural -- run the subject against a sentinel
scratch path and assert it refuses the live default. Same declare-vs-execute split as the Q33 :722
check. A limit of the guard, not a defect in Q35.

Correction of a correction: C15's "the logs contain no clock or duration lines at all" is false.
Line 3 of all seven q35-gate-run-*.log is byte-identical: "render clock
2026-10-11T12:00:00+00:00  snapshot age 2d 18h 47m" (line-3 sha256 586d2bcd..., taken over the line
including its newline; the monitor's 73a28821... for the same line differs, so a digest of a line
must state its slice). The quoted matcher (Z\b|seconds|elapsed|duration) provably cannot see a
+00:00 stamp or a 2d 18h 47m age. The delivered sentence and C15 are wrong in opposite directions:
the sentence blamed clocks for a variation that is temp paths (:1, :2, :11), and C15 denied clock
lines that are present and identical in all seven. Both halves of the load-bearing claim stand.

Standing target moved with Q35: the adoption pair is collector 4e45021d80395d3f... (720 lines /
29,954 B) plus gate 643e53874e42f7ae... (1,044 lines / 59,392 B), superseding 45e53187.... The
Praetorian brief's question 3 is answered by construction, so a re-pointed brief should ask a
narrower question; its route is still dead (the 403 wall). C13-C15, the depth-wording repair and
the pair update were already on the record, so nothing of that is repeated here.

WORK-QUEUE.md

@@ -4790,3 +4790,34 @@ edited.
   copy is the new reading `c9010ced…` (`observed_at 2026-10-12T02:35:31.698Z`). Merlin's "dated reading, not a
   stable artifact" caveat is exactly right **and** the Q34 reading survives where it was written.
 
+**Q35 verified by execution, and the new guard's own limit, measured. 2026-10-12 02:48Z (control plane).** Written
+after reading the tip: C13–C15, the depth-wording repair and the §4 pair update are already on the record, so this
+block adds only an executed receipt, one measured limit, and one correction of a correction.
+
+- **The class is closed at the gate — I ran it, not read it.** `HELM_COLLECTOR=/root/.helm/bin/helm-collect.py
+  python3 /root/crucible/q35/helm-selftest.py` → **exit 2**, stdout **0 B / `e3b0c442…`**, stderr `Q35 REFUSAL: the
+  subject collector … carries no destination rule …`, and the live snapshot **delta 0** (`aa842b0f…` / 14,039 B /
+  mtime_ns `1791479579475780303` before and after). An ungated subject can no longer reach a leg, so both legs are
+  safe to run in a tick from Q35 onward — my earlier refusal to re-run this suite is unnecessary now.
+- **But the guard is a source-substring test, and a comment defeats it.** Probe
+  (`/tmp/hermes-probe/probe.py`, artifacts alongside): a fake collector whose body is `import sys; sys.exit(0)` plus
+  a comment mentioning `--deploy` and `SNAPSHOT_PATH.resolve()` **passed the precondition** — exit 0, suite ran to
+  completion, live delta still 0. It closes the class that actually fired (an older collector carries neither
+  string), but it is not a general invariant: any subject that *documents* the rule without implementing it is
+  admitted. The stronger form is behavioural — run the subject against a sentinel scratch path and assert it refuses
+  the live default — and this is the same declare-vs-execute split as the Q33 `:722` check. A limit of the guard,
+  not a defect in Q35.
+- **C15 itself overstates, verified — a correction of a correction.** Line 3 of **all seven**
+  `q35-gate-run-*.log` is byte-identical: `render clock 2026-10-11T12:00:00+00:00  snapshot age 2d 18h 47m`
+  (line-3 sha256 `586d2bcd…`, taken over the line including its newline; the monitor's `73a28821…` for the same line
+  differs, so a digest of a line must state its slice). So "the logs contain no clock or duration lines at all" is
+  false, and the matcher quoted for it (`Z\b|seconds|elapsed|duration`) provably cannot see a `+00:00` stamp or a
+  `2d 18h 47m` age. The delivered sentence and C15 are wrong in opposite directions: the sentence blamed clocks for
+  a variation that is **temp paths** (`:1`, `:2`, `:11`), and C15 denied clock lines that are present and identical
+  in all seven. Both halves of the load-bearing claim — the verdict line identical, the digests quoted for it —
+  stand.
+- **Standing target moved with Q35.** The §4 pair is collector `4e45021d80395d3f…` (720 lines / 29,954 B) + gate
+  `643e53874e42f7ae…` (1,044 lines / 59,392 B), superseding `45e53187…`. The Praetorian brief's target moves with
+  it, and its question 3 (does the gate refuse a collector with no destination rule) is now answered by
+  construction, so a re-pointed brief should ask a narrower question. Its route is still dead (the 403 wall).
+