queue: Q48 verified by the pipe from this host (closure 0b0b591, landing evidence abe1f0b) -- pair, 122,186 B / 2,287 lines, the 163-not-143 component, the two Q48 checks, 171/0 with live delta 0 on my own instrument, and the three landing rows at 20623b6 re-read; plus the correction that Q48 section 6.2's causal attribution is unsupported (sections 7.3/7.4 and the witness docstring name the driver's --deploy copy-run) and my own invocation with the live root named moves nothing live

WORK-QUEUE.md

@@ -6809,3 +6809,14 @@ disclosed live-held incident caused, restored and recorded; the residual named a
   live-root-resolving subject), so a `cp` now lands Q48 with Q49 a known gap. Deployed bin unchanged,
   `HELM_COLLECTOR` reads **0**: none of Q31–Q48 is in production. Live snapshot `aa842b0f…` / 14,039 B and held pin
   `5b6d7071…` / 120 B unchanged; disk 46 GB.
+
+---
+
+**Q48 (Helm lane) — VERIFIED from this host by the pipe (2026-10-13, reply 33). Closure `0b0b591`; landing evidence `abe1f0b`; check-in/queue fill `20623b6`.** One substantive correction, below the receipts: the residual's causal attribution is unsupported, and the gate's own legs measured innocent of the live pin's movement.
+
+- **Pair and arithmetic — Documented.** Gate `a590170fa87d7e2a…` **122,186 B / 2,287 lines** (digest, `stat` and `wc -l` re-read here); Q47's `76f2292b…` **115,182 / 2,124**; collector `4e45021d…` **720 / 29,954** and **byte-identical across `q46`, `q47` and `q48`** by sha256. My own `diff -u` of the two gates is **186 lines and its 184 non-header lines are byte-identical to `out/DIFF-vs-q47.txt`** (8,300 B / `71c593e2…`), decomposing as **2 file + 3 hunk + 163 added + 0 removed + 18 context**, so **2 + 3 + 163 + 0 + 18 = 186** and **2,124 + 163 − 0 = 2,287** exactly. The record's **`143`** stands at `recoveries/helm-runtime-redirect.md:29`, `:31`, `:32` and once in the check-in's Run 14 row; the totals it prints are right, the component is not (logged here and in reply 33; his file, his call). The 169 → 171 step is measured: the diff adds exactly the **two** `check("Q48"…)` registrations and no other `check(` line.
+- **Green and the mechanism's firing — Documented, on the pipe's own instrument** (`/root/crucible/q48/timmy-verify-14/run.py`, results in `TIM-Y14.json`, raw captures beside it; a pre-armed guard copied both live objects and recorded sha + size + `mtime_ns` before the runs and compared after, restoring only if a backup digest matched the recorded value). Real collector, `Q48_ROOT` unset: **rc 0, `helm-selftest: 171 passed, 0 failed`, 13,514 B stdout, live delta 0, 0 sandboxes left**. With `HELM_COLLECTOR=collector-env.py` and `Q48_ROOT=/root/.helm`: the `Q48 NOTE` fires the redirect (`Q48_ROOT /root/.helm -> /root/crucible/q48/helm-legs-pqyt_oe_`), rc 1, `170 passed, 1 failed`, the failing check being the `Q43` live-identity one §7.4 predicts — and **live delta 0 on both objects, no restore taken, 0 sandboxes left**.
+- **The residual's cause — corrected.** §6.2 says *"the gate's legs … so a subject whose root is the live root writes the live held directory"*; §7.3 of the same document says the held pin is written **only under `--deploy`, which no leg passes**, §7.4 says **no subject leg runs the copy with `--deploy --pin`**, and the witness driver's own docstring has the **driver** running the copy `--deploy --pin --out <sandbox>` directly. My suite invocation with the live root named moved nothing. So the moving mechanism was, on the available evidence, the instrument's own `--deploy` copy-run; the §6.2 attribution is **Testimony only** until the v1 argv is named. The class itself is **not** withdrawn — the disarmed row measures it, and the residual stays named beside the `cp`, now with its scope depending on that answer.
+- **His record's smaller errata (logged, nothing rewritten):** §6's heading says the run wrote the live dir **"twice"** (`recoveries/helm-runtime-redirect.md:106`) while §6's body says **"three"** (`:108`) and the check-in says three; §6.1's `ctime_ns` (`1791871227057299704` = 06:00:27.057Z) is restore #1's reading, superseded by the value on disk now, **`1791873567284160583` = 06:39:27.284Z**, which is also `Q48-WITNESS.json`'s own `live_after`; and **no `legacy/q47` exists** (`ls /root/crucible/q48/legacy/` → `q39`, `q43`, `q44`, `q45`), so §7.6's locator is **Unrecovered** — the substance survives, the real Q47 gate carrying zero Q48 markers.
+- **Landing — verified on the pipe's own read, at the ref the record cites.** All three files at `20623b66fd6d66da8bb38d95ba3a136f606a02dc`: `recoveries/helm-runtime-redirect.md` **200 / 14,030 / `8da99a79…`**, `checkins/2026-10-13-merlin.md` **200 / 32,103 / `6c6eeded…`**, `WORK-QUEUE.md` **200 / 791,037 / `bba7bc80…`** — each byte-identical to `git cat-file -p 20623b6:<path>` and to the anonymous raw read at `main`. The five `q48-green-*.out` are 13,514 B each with five distinct digests; subjects `collector-env.py` `29,982 B` / `4739ced8…` and `collector-file.py` `29,966 B` / `a81f3b08…`; `grep -c 'q48-witness'` = **0** in the shipped gate, **3** in the witness copy.
+- **Standing:** deployed bin `helm-selftest.py` `7ed1bca8…` with `grep -c HELM_COLLECTOR` = **0** — none of Q31–Q48 is in production, so the §4 `cp` (collector `4e45021d…` + gate `a590170f…`) is the only path in. `private: false` / `internal: false`, one branch (`main`), **0 open PRs** — the `inbox/` visibility mismatch stands as Alexander's call. Live objects unchanged through my two invocations: snapshot `14,039 B` / `aa842b0f…`, held pin `120 B` / `5b6d7071…`.