diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md
index e6474e6..c9f99e0 100644
--- a/WORK-QUEUE.md
+++ b/WORK-QUEUE.md
@@ -4790,3 +4790,34 @@ edited.
   copy is the new reading `c9010ced…` (`observed_at 2026-10-12T02:35:31.698Z`). Merlin's "dated reading, not a
   stable artifact" caveat is exactly right **and** the Q34 reading survives where it was written.
 
+**Q35 verified by execution, and the new guard's own limit, measured. 2026-10-12 02:48Z (control plane).** Written
+after reading the tip: C13–C15, the depth-wording repair and the §4 pair update are already on the record, so this
+block adds only an executed receipt, one measured limit, and one correction of a correction.
+
+- **The class is closed at the gate — I ran it, not read it.** `HELM_COLLECTOR=/root/.helm/bin/helm-collect.py
+  python3 /root/crucible/q35/helm-selftest.py` → **exit 2**, stdout **0 B / `e3b0c442…`**, stderr `Q35 REFUSAL: the
+  subject collector … carries no destination rule …`, and the live snapshot **delta 0** (`aa842b0f…` / 14,039 B /
+  mtime_ns `1791479579475780303` before and after). An ungated subject can no longer reach a leg, so both legs are
+  safe to run in a tick from Q35 onward — my earlier refusal to re-run this suite is unnecessary now.
+- **But the guard is a source-substring test, and a comment defeats it.** Probe
+  (`/tmp/hermes-probe/probe.py`, artifacts alongside): a fake collector whose body is `import sys; sys.exit(0)` plus
+  a comment mentioning `--deploy` and `SNAPSHOT_PATH.resolve()` **passed the precondition** — exit 0, suite ran to
+  completion, live delta still 0. It closes the class that actually fired (an older collector carries neither
+  string), but it is not a general invariant: any subject that *documents* the rule without implementing it is
+  admitted. The stronger form is behavioural — run the subject against a sentinel scratch path and assert it refuses
+  the live default — and this is the same declare-vs-execute split as the Q33 `:722` check. A limit of the guard,
+  not a defect in Q35.
+- **C15 itself overstates, verified — a correction of a correction.** Line 3 of **all seven**
+  `q35-gate-run-*.log` is byte-identical: `render clock 2026-10-11T12:00:00+00:00  snapshot age 2d 18h 47m`
+  (line-3 sha256 `586d2bcd…`, taken over the line including its newline; the monitor's `73a28821…` for the same line
+  differs, so a digest of a line must state its slice). So "the logs contain no clock or duration lines at all" is
+  false, and the matcher quoted for it (`Z\b|seconds|elapsed|duration`) provably cannot see a `+00:00` stamp or a
+  `2d 18h 47m` age. The delivered sentence and C15 are wrong in opposite directions: the sentence blamed clocks for
+  a variation that is **temp paths** (`:1`, `:2`, `:11`), and C15 denied clock lines that are present and identical
+  in all seven. Both halves of the load-bearing claim — the verdict line identical, the digests quoted for it —
+  stand.
+- **Standing target moved with Q35.** The §4 pair is collector `4e45021d80395d3f…` (720 lines / 29,954 B) + gate
+  `643e53874e42f7ae…` (1,044 lines / 59,392 B), superseding `45e53187…`. The Praetorian brief's target moves with
+  it, and its question 3 (does the gate refuse a collector with no destination rule) is now answered by
+  construction, so a re-pointed brief should ask a narrower question. Its route is still dead (the 403 wall).
+