queue: Q34 verified and closed from this host with the finishing SHAs (a16d9e4 deliverable + record, ac98bfb landing append) — every digest re-derived, my own gate runs from an independent tree (pair exit 0 / 164-0; Q33-before collector exit 1 / 153-11 with Q34 checks 3 and 4 red; deployed collector 2/2 by import with my own fixture; live snapshot delta 0 after every leg), and one measurement the §4 ask needs: the shipped gate cannot see the pair at all (7ed1bca8, 609 lines, 119-0 against his collector, the same verdict it gives the deployed one), so the cp carries the gate with the collector or carries no covering gate. Incident graded: the class Corroborated by mechanism (reproduced non-destructively with the destination default patched to scratch — deployed collector writes its default 18,537 B with no refusal, the pair refuses rc=2 and writes nothing, live default delta 0), the occurrence Testimony only / Unrecovered (the restore overwrote the clobbered bytes; no 18,524 B file and no artifact containing e4d1ad5 survives). Three corrections logged not deleted (C10 the live-body figure does not reproduce — live 217,162 wire / 217,149 normalised 5e5cd6d2, unchanged since 2026-10-11T08:58Z and already at CONTRACT.md:131-134, while the served page still prints f27326e8 and the green "match" pill; C11 "three-file ask" over-counts the cp targets — two approved, the third name superseded — plus my own queue line's "not located" being wrong, the phrase is at checkins/2026-10-12-merlin.md:77; C12 precision: run-to-run log variance is temp paths too). Limits graded (20/20 profiles carry files; the schema clause left as Testimony only). Q35 opened for the Helm lane — the gate must refuse a subject collector that carries no destination rule, before any leg that can execute it: the one guard that closes the twice-fired class, mechanical at the gate instead of at the operator; the §4 cp is out of scope and stays Alexander's. Verify logs and scripts: /root/troupe-verify/q34/.

WORK-QUEUE.md

@@ -4596,3 +4596,85 @@ at 13:44Z and 14:16Z is not what the file reads now, and neither "the restore la
 stand as a statement about the file as it stands: an mtime is mutable, these are **dated readings, not properties**.
 This supersedes my earlier correction; the doc's `§7:241` sentence remains the odd one out, but as a reading of some
 other moment, not as a proven error. No further correction is owed unless the file is re-stamped again.
+
+**Status: VERIFIED AND CLOSED from the pipe, 2026-10-12 00:39–00:55Z — `a16d9e4` (deliverable + record + check-in,
+3 files, +274/−2) and `ac98bfb` (landing append, +17/−1).** Re-read from this host against the artifacts at those
+SHAs, not against the check-in's own summary. **Every digest re-derived (Documented):** deliverable
+`84b1e714…` / 9,924 B; check-in pre-append 6,442 B / `08afa919…`; queue 519,292 B / `59252361…` → 521,480 B /
+`602746a5…`; collector `4e45021d…` 29,954 / 720 and `cmp` byte-identical to `/root/crucible/q31/helm-collect.py`;
+gate `45e53187…` 55,874 / **985**, `git diff --no-index --numstat` against the Q33 gate `4a442f62…` (52,077 / 929)
+→ **56 0**; comparators `8a477376…` / 705 (carries the destination refusal at `:688`) and `ee0b36a8…` / 687
+(byte-identical to the deployed collector); all seven gate-log digests to the hex digit (`7f01728d… 997b1308…
+96678a66… f13e5cd6… 532ab633… 00bea997… d4e39936…`, 11,169 B each, `164 passed, 0 failed` and
+`VERDICT: ALL GATES PASS` in every one); `q34-gate-q33before.log` `7e53bb46…` 153/11; `q34-red-pregate.log`
+`093f60e5…` 2/2; `Q34-NULL-EVIDENCE.txt` run-7 `c625bc07…`; live snapshot `aa842b0f…` / 14,039 B / mtime_ns
+`1791479579475780303`; deployed bin untouched (`ee0b36a8…` 27,907 / `7ed1bca8…` 33,647 / `5c67473d…` 21,766); live
+Helm page `427b7b54…` 9,865 B, last written `2026-10-11 08:57:14.017837233Z`, unmoved. **The gate discriminates,
+measured here in an independent tree (`/root/troupe-verify/q34/`):** the pair runs **exit 0, 164 passed, 0 failed**;
+the Q33-before collector under the same gate runs **exit 1, 153 passed, 11 failed** — the Q33 nine (eight named
+`G8 Q33:` checks + the declared-key source check) plus **Q34 checks 3 and 4**; the deployed collector on the four
+Q34 checks by import with the pipe's own fixture is **2 passed / 2 failed**; live snapshot **delta 0 after every
+leg**. Checks are verbatim at `helm-selftest.py:897 / :900 / :903 / :906`, section at `:866`, the member analogue a
+comment at `:870-875` and true by construction in the source read (`collect_troupe()` builds member rows only from
+existing `*.md` files, `:482-494`, and returns `unreachable` when there are none, `:512-513`). **One measurement the
+§4 ask needs and neither side had: the shipped gate cannot see the pair at all** — `/root/.helm/bin/helm-selftest.py`
+(`7ed1bca8…`, 609 lines) against the Q34 collector returns **exit 0, 119 passed, 0 failed**, the same verdict it
+returns against the deployed collector, so a green shipped gate is no evidence about the pair and the `cp` carries
+the gate with the collector or carries no covering gate at all. **The incident, graded:** the write's *class* is
+**Corroborated by mechanism** — reproduced non-destructively (collector imported, its own `SNAPSHOT_PATH` rebound to
+a scratch path, `main(["--skip-tests"])`): the deployed collector writes its default with **no refusal** (`rc=0`,
+18,537 B — the same shape as the recorded 18,524 B, the difference being live data), the pair refuses (`rc=2`,
+`refusing to write the live snapshot … without --deploy`) and writes nothing, live default delta 0 across the probe.
+The *occurrence* (`e4d1ad5…` / 18,524 B at 00:26:01.933369921Z) is **Testimony only / Unrecovered** here — the
+restore overwrote the clobbered bytes, no artifact of 18,524 B and no file containing `e4d1ad5…` survives under
+`/root`, and `q34-gate-old-collector.log` (`35b800b1…`) records the argparse error, not the write. **Three
+corrections logged, not deleted.** (C10) The live-body figure in the check-in's Ask does not reproduce: measured
+00:42–00:52Z over three fetches and the collector's own path, `https://www.stackchainmagazine.net/` is **217,162 B
+wire / `9a5ee1328d4a3fed…`** and **217,149 B CRLF→LF-normalised / `5e5cd6d26a700423…`**, identical under `curl` and
+`urllib`, unchanged since the 2026-10-11T08:58Z reading already recorded at `/root/.helm/CONTRACT.md:131-134`; no
+fetch variant yields `e7df6364…` or 215,836 B. The pin is stale — the conclusion holds — but the drift is not new,
+and the figure belongs as the normalised digest with the wire digest beside it
+(`helm-collect.py:343-356`). The finding that needs no new digest: the page served now still prints
+`live body sha256 f27326e8…` and the green "match" pill (`index.html:110`). (C11) "a three-file ask" over-counts
+what the `cp` approves while under-describing it: **two targets** are approved (collector `4e45021d…` + gate
+`45e53187…`), and the third name in the same sentence — the Q33 gate `4a442f62…` — is the one the deliverable
+itself calls **superseded**; locators `checkins/2026-10-12-merlin.md:77` and
+`recoveries/helm-null-gate.md:131-133`. Corrections of the pipe's own, filed first: the queue line at `:4562`
+claiming the phrase was "not located" is **wrong** (found on the first grep), and the near-miss correction against
+his queue landing figure was the pipe's own control plane writing inside the verification window (`7067f0b`
+00:40:06Z, `52f5e34` 00:41:01Z) — fetched SHA-pinned at the revision he cites, `raw/commit/ac98bfb53ce2…/
+WORK-QUEUE.md` is HTTP 200 / 521,480 B / `602746a5…`, exactly as he wrote. (C12, precision) The run-to-run log
+variance is the **temp-directory names** as well as clocks and durations (`/tmp/q31-g8-deploy-lo7gkl01/…` vs
+`…psac4i9r/…`), measured by diffing runs 1 and 2. **Limits graded:** a live empty profile is unobserved — confirmed
+here, 20/20 profile directories carry files under `sessions/`, `logs/`, `cron/output/` (minimum 1, `home`); Q34
+checks 1–2 are structural on both comparators as he states; the schema clause (`$defs.evidence` has no
+`additionalProperties: false`) is left as **Testimony only** from Q33 — not re-opened this tick. **Monitor-side
+note, the pipe's:** the head moved three times inside the window (`ac98bfb` → `7067f0b` → `52f5e34`), all
+Timmy-authored, so the control plane's queue writes cannot wake this pipe's change detection — the mirror of the
+reply-15 note. Verify logs and scripts: `/root/troupe-verify/q34/` (pipe's own area; the Crucible tree holds only
+Helm-lane artifacts). Nothing of another party's was overwritten; no secrets.
+
+---
+
+## Q35 — The gate must refuse a subject collector that carries no destination rule *(Helm lane; opened 2026-10-12 by the pipe, per Q7's never-dry obligation — Q34 verified and closed at `ac98bfb`)*
+
+The twice-fired class, made mechanical at the gate instead of at the operator. Two live-snapshot writes this day —
+`2026-10-11T13:28Z` (Q31) and `2026-10-12T00:26:01.933369921Z` (Q34) — came from the same shape: a
+negative-control leg of a gate running a collector that carries **no destination gate of its own**, so the leg's
+bare `--skip-tests` call executed it and it wrote its default destination. The rule is in the skill and is
+mechanical only inside the Helm lane's tree; the Q34 gate *has* the source check
+(`the collector the gate runs carries the destination rule`) but evaluates it **after** the legs that can execute
+the collector, which is why it red-flagged the subject instead of refusing to run it. The pipe's own probe is the
+measuring instrument: with the destination default rebound to a scratch path, the deployed collector (`ee0b36a8…`)
+writes it with `rc=0` and no refusal (18,537 B), while the pair's collector (`4e45021d…`) refuses with `rc=2` and
+writes nothing.
+
+**Done means:** the destination-rule guard is a **precondition** — a collector that lacks the refusal is refused by
+the gate *before* any leg capable of executing it runs, with a non-zero exit and a message naming the subject and
+the missing rule, and with the live snapshot delta 0 measured across that refusal; the pair is unchanged green
+(N ≥ 5 consecutive invocations, `164 passed, 0 failed` each, log digests); the discriminator is demonstrated on
+both sides in one run pair (deployed collector as subject → refused, no leg executed; pair as subject → unchanged).
+**Evidence:** the check name and its code path, the two red/green logs with digests, the pre/post live-snapshot
+readings (sha256 and mtime_ns), and the mechanism probe repeated from the pipe's tree. **Out of scope:** the §4
+`cp` into `/root/.helm/bin/` — the shipped gate travelling with the collector is still Alexander's, and this item
+does not move it.