Q45S12 (Helm lane): Run 40 -- the byte-stability cell corrected by its own artifacts. The control plane's 17:41Z tick returned one correction against this lane: recoveries/helm-pin-hash-convention.md:85 paired one run's bytes with another run's diff ("rc 0 / 195 / 0; the two raw stdouts are 17,027 B each and differ on exactly 4 lines"). VERIFIED AGAINST THE ARTIFACTS, not accepted from the reply: the only raw stdout pair on disk, out/R39-STABILITY-{1,2}.txt, is 17318 B each, BOTH rc 1 / 194 passed / 1 failed (stdout sha256 b93549cf1ef860bcc52fca11556a0c9abde0a86675136abd9d83bfcf6ca8344a / 0dd6922a53a52d207c5a29f8f51be0a841bbd40312590fe0b2c255d4317a2ca8, both equal to out/R39-STABILITY.json), differing on exactly 4 lines (1, 10, 209, 210), all per-run mkdtemp paths; normalised residual 0, normalised digest 49eb85e9a1461769a1ece37401a500590c8bc2a28208918c72937ad5119376ab. The 17027 B / rc 0 / 195 / 0 figures are the five gate_parity* legs of out/RUN39.json -- arm A gate_parity_render1 379cfc4e0317b758, render2 799e3e21836dc5a3, render2_repeat 88fbede428fb68b8, render3 f8df74cc627a1f19, arm B render1 fc26907c39e24619 -- every one 17027 B / rc 0 / 195 / 0 with distinct digests. No verdict, digest, row or count in sections 1-8 of the record moves; section 4 already stated the stability pair's rc 1 / 194 / 1 correctly. ERRATUM FORM per the lane's correction rule: the Run-39 commit message (28ca8e5) and the queue's Run-39 block carry the same sentence; a commit message cannot be edited and the queue is append-only, so both stand with the new section 9 as the correction. CLAIM CHECK RAN FIRST and reproduced 15 opening records / 12 closed / 3 open (Q37, the career-lane Q53, Mercury's Q53) -- none claimable by this lane, so no queue item was opened or closed; the Run-39 verification's own ask was the only executable unit left. All three appends are append-only (numstat 39/0 + 68/0 + 46/0 = 153 insertions, 0 deletions; anchors unique; pre-images asserted: record 12513 B / 2831a9c293e09afac0d0c70f6af064576f4e3ce53555747640aeee256d9ec4d3, check-in 66369 B / 28779a4130dbd3bec09f0f8dd00a9f5fed3e38c21268778cc0401e09603540e7, queue 1198687 B / ac7d32703b7760d9925a7f2b42b16b928bad5c952a660f2feb3bcdc1b822d07b; trailing newline both ways). Post-append: record 15109 B / b84391af977218c8, check-in 70102 B / 44ec91e0e507fdd1, queue 1201550 B / 17662169a9709e45. NOTHING DEPLOYED: no cp into /root/.helm/bin/, no --deploy, no write to the live document root; live state re-censused unchanged (page 9865 B / 427b7b54c69b18d2270288910fc810732463129f48ec4bdd7dbc75cdb22997ce4, snapshot 14039 B / aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d, held pin 120 B / 5b6d70716153c3f4bd82045d5d71edf88f793a240ce1275c3dfca5759d0ee297, five deployed bin digests ee0b36a82f23 / 5c67473d8928 / 7ed1bca8f9da / 12570786ba70 / 738699986778 unmoved, grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py = 0 so Q40 stands, /tmp/q31-g8-deploy-* 475, disk 40 G free of 154). No another-party file edited, decisions/ and inbox/ untouched, no secret printed. Merlin <merlin@agents.invalid>.

WORK-QUEUE.md

@@ -9808,3 +9808,49 @@ convention on one side."*
 - **The adoption payload, amended a third time.** Renderer **`117001e8…`** = `/root/crucible/q68/helm-render-r39.py`, 23,523 B / 522 lines → collector **`5a99364b…`** = `q68/helm-collect-r39.py`, 31,595 B / 750 lines + gate **`833d0827…`** (unchanged: 190,330 B / 3,619 lines / 145 registrations) → re-collect → re-render → deploy. **Order amendment that matters: do not run `--pin` before adopting** — with the pin/hash convention still split, a `--pin` first publishes a green pill the gate's own instrument cannot confirm (that arm measured 194/1 with G13 row 2 red). After Run 39 the wire digest `c34ae2c2…` is what the new pin hashes on both arms, so re-pinning and an honest red pill are now the two legal options. **Re-read the file list at adoption time: it has now moved six times.**
 - **Praetorian cannot execute a review even if asked.** His cron store (`/root/.hermes/profiles/praetorian/cron/jobs.json` and `executions.db`, read-only check) carries `blocked_config`, so a hostile-review request before any `cp` would fail silently — an exact-head review needs a working lane, not his.
 - **Production unchanged:** page **9,865 B / `427b7b54…`** (mtime frozen 2026-10-11T08:57:14Z), snapshot **14,039 B / `aa842b0f…`**, pin **120 B / `5b6d7071…`**, `HELM_COLLECTOR` **0** in all five deployed files, live body **200 / 217,163 B / `c34ae2c2…`** against the pin's `f27326e8…` → the published green `match` is false today. Nothing deployed, no item opened or closed, no another-party file edited, no secret printed.
+
+---
+
+**Q45S12 (Helm lane) -- Run 40: the byte-stability cell corrected by its own
+artifacts (Merlin, 2026-10-15 ~18:3x-18:4xZ).** Deliverable:
+`recoveries/helm-pin-hash-convention.md` section 9 (append-only). Scratch
+`/root/crucible/q68/`; nothing deployed, no `cp` into `/root/.helm/bin/`,
+`decisions/` and `inbox/` untouched, no another-party file edited, no secret
+printed. **No queue item opened or closed** -- the lane's claim check ran first
+and reproduced 15 opening records / 12 closed / **3 open** (Q37, the career-lane
+Q53, Mercury's Q53), none claimable here, so the unit taken was the one
+correction the control plane's 17:41Z tick returned against this lane.
+
+- **The return, verified against the artifacts rather than accepted.**
+  `recoveries/helm-pin-hash-convention.md:85` read *"rc 0 / 195 / 0; the two raw
+  stdouts are 17,027 B each and differ on exactly 4 lines"*. Measured: the
+  captured pair `out/R39-STABILITY-{1,2}.txt` is **17,318 B each, rc 1 /
+  194 passed / 1 failed** (sha256 `b93549cf1ef860bc...` / `0dd6922a53a52d20...`,
+  both equal to `out/R39-STABILITY.json`), differing on exactly **4 lines**
+  (1, 10, 209, 210), all per-run `mkdtemp` paths, normalised residual 0,
+  normalised digest `49eb85e9a1461769...`. The **17,027 B / rc 0 / 195 / 0**
+  figures are the five `gate_parity*` legs of `out/RUN39.json` -- arm A
+  `379cfc4e...`, `799e3e21...`, `88fbede4...`, `f8df74cc...`, arm B
+  `fc26907c...`, distinct digests across different legs and arms. The cell
+  paired one run's bytes with another run's diff; **no verdict, digest, row or
+  count in the record's sections 1-8 moves**, and section 4 already stated the
+  stability pair's rc 1 / 194 / 1 correctly.
+- **Erratum form, per the lane's correction rule:** the Run-39 commit message
+  (`28ca8e5`) and the Run-39 queue block above carry the same sentence; a commit
+  message cannot be edited and this queue is append-only, so both stand with
+  section 9 as the correction. Nothing above the append anchor was touched
+  (pre-image asserted 12,513 B / `2831a9c293e0...`, anchor unique, trailing
+  newline both ways).
+- **Live and deployed re-censused, unchanged:** page 9,865 B /
+  `427b7b54c69b18d2...`; snapshot 14,039 B / `aa842b0fd880...`; held pin 120 B /
+  `5b6d70716153c3f4...`; five deployed bin digests unmoved; `grep -c
+  HELM_COLLECTOR /root/.helm/bin/helm-selftest.py` = **0** -- Q40 stands;
+  `/tmp/q31-g8-deploy-*` **475**; disk 40 G free of 154.
+- **Standing, unchanged and still human-gated:** the section-4 adoption
+  sequence (adopt renderer `117001e8...` -> adopt collector `5a99364b...` +
+  gate `833d0827...` -> re-collect -> re-render -> deploy), the stale
+  `manifest_match` pin, Q13, Q9, Q19. **No new item** -- the queue is not thin
+  and the Helm executable set was empty at the start of this run by the claim
+  check above.
+
+--- Merlin (Run 40)

checkins/2026-10-15-merlin.md

@@ -1066,3 +1066,71 @@ so none of Q31–Run 39 is in production; `/tmp/q31-g8-deploy-*` **475**;
 another-party file edited, no secret printed.
 
 — Merlin (Run 39, landing)
+
+---
+
+## Run 40 -- the byte-stability cell corrected (Helm lane), 2026-10-15 ~18:2x-18:4xZ
+
+Scratch `/root/crucible/q68/`; nothing deployed, no `cp` into `/root/.helm/bin/`,
+no write to the live document root, `decisions/` and `inbox/` untouched, no
+another-party file edited, no secret printed.
+
+### Did
+
+- **Claim check first, per the queue's own convention (`WORK-QUEUE.md:8020`):**
+  ran `python3 tools/queue_claim_check.py --census` (head `a21d1e3`, worktree
+  clean before and after, so the tool is read-only in fact) -> **15 opening
+  records, 12 closed, 3 open: Q37 (pipe), the career-lane Q53 (Alexander's),
+  Mercury's Q53** -- none claimable by this lane. The Helm executable set is
+  empty, measured here rather than inherited from earlier runs.
+- **Took the one standing unit this lane owed:** the control plane's 17:41Z
+  return against `recoveries/helm-pin-hash-convention.md:85`. Verified it
+  against the artifacts before appending: the captured byte-stability pair
+  (`/root/crucible/q68/out/R39-STABILITY-1.txt` / `-2.txt`) is **17,318 B each,
+  rc 1 / 194 passed / 1 failed** (stdout sha256 `b93549cf1ef860bc...` /
+  `0dd6922a53a52d20...`, equal to `out/R39-STABILITY.json`), differing on
+  exactly **4 lines** (1, 10, 209, 210), all per-run `mkdtemp` paths; normalised
+  residual 0, normalised digest `49eb85e9a1461769...`. The **17,027 B /
+  rc 0 / 195 / 0** figures are the five `gate_parity*` legs of
+  `out/RUN39.json` (arm A `379cfc4e...`, `799e3e21...`, `88fbede4...`,
+  `f8df74cc...`; arm B `fc26907c...`) -- a different run. The cell paired one
+  run's bytes with another run's diff.
+- **Appended section 9 to the record** (append-only): pre-image asserted
+  **12,513 B / sha256 `2831a9c293e09afac0d0c70f6af064576f4e3ce53555747640aeee256d9ec4d3`**,
+  anchor unique, trailing newline asserted before and after; post-append
+  **15,109 B / sha256 `b84391af977218c8...`**.
+- **Erratum carried, not edited:** the Run-39 commit message (`28ca8e5`) and the
+  queue's Run-39 block carry the same mispaired sentence; a commit message
+  cannot be edited and the queue block is append-only, so both stand with
+  section 9 as the correction.
+- **Nothing deployed, and live state re-censused unchanged:** deployed page
+  9,865 B / `427b7b54c69b18d2...`; snapshot 14,039 B / `aa842b0fd880...`; held
+  pin 120 B / `5b6d70716153c3f4...`; the five deployed bin digests unmoved
+  (`ee0b36a82f23...`, `5c67473d8928...`, `7ed1bca8f9da...`, `12570786ba70...`,
+  `738699986778...`); `grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py`
+  = **0** (Q40 stands, so none of Q31-Run 39 is in production);
+  `/tmp/q31-g8-deploy-*` **475**; `df -h /` -> 40 G available of 154 G (75 %).
+
+### Blocked
+
+- The section-4 adoption `cp` remains Alexander's, unchanged and **not
+  re-raised**: four files in one order -- adopt renderer `117001e8...` (23,523
+  B), adopt collector `5a99364b...` (31,595 B) + gate `833d0827...` (190,330 B
+  / 3,619 lines / 145 registrations) -> re-collect -> re-render -> deploy.
+- Q9 (checksum handover), Q13 (publication call) and Q19 (wizard onboarding)
+  stay human-gated; Q37 and Mercury's Q53 belong to other lanes. No new
+  blocker was opened by this run.
+
+### Next
+
+- Nothing executable in the Helm lane until the adoption decision lands; the
+  queue's three open items belong to other lanes or to Alexander, so **no new
+  item is proposed** -- the queue is not thin, measured above rather than
+  asserted.
+
+### Ask
+
+- The one standing decision this lane needs from you, carried once: the
+  section-4 adoption sequence above. Whether to re-pin at all (a green pill
+  accepting today's live body as the drift reference) or ship the honest red
+  drift page is a policy choice, not a technical one.

recoveries/helm-pin-hash-convention.md

@@ -188,3 +188,42 @@ meaning and both digests remain in every snapshot.
   fetch path (e.g. a proxy that normalises newlines) would reintroduce a
   split; the gate's G13 rows are the detector for exactly that, and they now
   pass only when both sides agree.
+
+## 9. Correction, Run 40 -- the byte-stability cell paired one run's bytes with
+another run's diff
+
+**Returned by the control plane at 2026-10-15T17:41Z:** the arm-A table's cell
+`gate repeat (byte-stability)` read *"rc 0 / 195 / 0; the two raw stdouts are
+17,027 B each and differ on exactly 4 lines"*. The byte count and the rc/tally
+belong to one run; the 4-line diff belongs to another. Re-measured from the
+artifacts on 2026-10-15 ~18:3xZ, not accepted from the reply:
+
+* **The only raw stdout pair on disk is `out/R39-STABILITY-{1,2}.txt`:
+  17,318 B each, both rc 1 / 194 passed / 1 failed** -- the section 4
+  incidental-catch re-run after the drift probe, not the acceptance repeat.
+  Per-run stdout sha256 `b93549cf1ef860bc...` and `0dd6922a53a52d20...`, both
+  equal to the values `out/R39-STABILITY.json` records for those two runs; the
+  diff is exactly **4 lines** (1, 10, 209, 210), all per-run `mkdtemp` paths
+  (`/tmp/tmp*`, `/tmp/q31-g8-deploy-*`, `sbA/helm-legs-*`); normalised
+  **residual 0**, normalised digest `49eb85e9a1461769...` -- every field re-read
+  from the artifact and the two captures this run.
+* **The 17,027 B / rc 0 / 195 / 0 figures are the five `gate_parity*` legs of
+  `out/RUN39.json`** -- arm A `gate_parity_render1` (`379cfc4e...`),
+  `gate_parity_render2` (`799e3e21...`), `gate_parity_render2_repeat`
+  (`88fbede4...`), `gate_parity_render3` (`f8df74cc...`), and arm B's
+  `gate_parity_render1` (`fc26907c...`): every one 17,027 B / rc 0 / 195 / 0
+  with **distinct** digests. Four arm-A legs cover three distinct gate states
+  plus render #2's own repeat, and the fifth is arm B's control leg. Their raw
+  stdouts were **not** the pair that was diffed; the one same-configuration
+  repeat on record (arm A `render2` vs `render2_repeat`, `799e3e21...` vs
+  `88fbede4...`) was not captured to disk, so the 4-line diff cannot be
+  attributed to it from any artifact that exists.
+* **No verdict, digest, row or count in sections 1-8 moves.** The 4-line count,
+  the residual 0 and the normalised digest are correct measurements of the
+  17,318 B pair; only the byte count and the rc/tally beside them belonged to
+  another run. Section 4 already states the stability pair's rc 1 / 194 / 1
+  correctly -- the arm-A table cell is the sole mispairing.
+* **Erratum form, per this lane's correction rule:** the Run-39 commit message
+  (`28ca8e5`) and the queue's Run-39 block carry the same sentence. A commit
+  message cannot be edited, and the queue is append-only, so both stand and are
+  corrected by this section. Nothing above this append was touched.