queue: Q30 needs a destination gate too; the 08:57:14 production write explained

1. helm-render.py:47 sets OUT_DEFAULT = /var/www/alexander-whitestone/helm/index.html. The CLI entry
   point is dead (the __main__ guard at :90-91 sits above def build_page at :232, which main() calls at
   :78), so the only working path is calling main() from an import driver - and main() with no --out
   writes the live page. That is the accident Merlin documents and restored byte-exact (9,865 B /
   427b7b54c69b18d2). Q30 must therefore assert the DESTINATION, not only the emitted bytes: a render
   that would write OUT_DEFAULT should refuse unless an explicit --out/deploy flag (and, for the live
   path, Alexander's section 4 approval) is present. Otherwise Q30 closes with a working
   "python3 helm-render.py" that deploys production by default.

2. The served file's mtime/ctime are 2026-10-11 08:57:14.017837233Z at 9,865 B - Merlin's restore, not a
   new deploy; content unchanged at 427b7b54c69b18d2. The queue's "stayed at 427b7b54 throughout" is
   true of content and should be read with that one write in mind; the check-in carries the account.

3. Independent re-confirmation, 09:18-09:21Z: live /helm/ 200 / 9,865 B / 427b7b54c69b18d2; 5 FRESH, 0
   STALE; newest clock 2026-10-08T17:12:59.475Z; age 2d16h8m6s against limits 1d/15m/1h/6h/2d -> not
   fresh under any of the five. Nothing will refresh it: grep -ci helm in the cron store = 0 and no
   profile store holds a Helm job. The dead entry point was read from source, not executed - running it
   would be a production write if the ordering were ever fixed.

WORK-QUEUE.md

@@ -3759,3 +3759,29 @@ member**, Merlin first as the Helm's author and the author of the gate set.
 - **Standing rule, restated for the fourth time because it keeps producing misreads:** an item's currency lives
   in the queue's **DONE** lines, the verification ticks and `WIZARDS-TABLE.md` — never in a section's first
   Status line. Prefer searching for `Status: DONE` over reading a section's head.
+
+**Control-plane addendum, 2026-10-11 09:21Z — Q30 needs a *destination* gate as well as a byte gate; and the 08:57:14 write on production, explained.**
+
+- **The renderer's default output IS production, so the fix that makes the CLI work will also re-arm the
+  accident.** `helm-render.py:47` — `OUT_DEFAULT = Path("/var/www/alexander-whitestone/helm/index.html")`. The
+  reason the accident happened is now clear from both sides: the CLI entry point is dead (the `__main__` guard
+  at `:90-91` sits above `def build_page` at `:232`, which `main()` calls at `:78`), so the only path that
+  *works* is calling `main()` from an import driver — and `main()` with no `--out` writes the default, which is
+  the live page. Merlin's check-in §"Three defects of mine" documents that overwrite and its byte-exact restore
+  (`9,865 B / 427b7b54c69b18d2…`); §4 named correctly. **Q30 must therefore assert the destination, not only
+  the emitted bytes:** a render that would write `OUT_DEFAULT` should refuse unless an explicit
+  `--out`/deploy flag (and, for the live path, Alexander's §4 approval) is present. Otherwise Q30 closes with a
+  working `python3 helm-render.py` that deploys production by default the first time anyone runs it without
+  arguments.
+- **The 08:57:14Z write, for the record.** The served file's `mtime`/`ctime` are `2026-10-11 08:57:14.017837233Z`
+  at 9,865 B — that is Merlin's **restore**, not a new deploy: content is unchanged at `427b7b54c69b18d2…`. The
+  queue's *"stayed at `427b7b54…` throughout"* is true of the content and should be read with that one write in
+  mind; the check-in carries the full account.
+- **Independent re-confirmation from this host (09:18–09:21Z), so the numbers in the brief are not just its
+  own.** Live `/helm/` = 200 / **9,865 B** / `427b7b54c69b18d2…`; **5 × `FRESH`, 0 × `STALE`**, the only badge
+  word on the page is `FRESH`, pill *"5 green · 1 red"*, newest clock on the page `2026-10-08T17:12:59.475Z`.
+  Age at 09:21:05Z = **2d 16h 8m 6s**, against limits 1d / 15m / 1h / 6h / 2d → **not fresh under any of the
+  five**, so the served page publishes five false freshness claims and one false held-copy *match*, and nothing
+  will ever refresh it: `grep -ci helm /root/.hermes/cron/jobs.json` = **0**, and no profile cron store holds a
+  Helm job. The dead entry point above was **read from source, not executed** — running it would be a
+  production write if the ordering were ever fixed, so the source read is the safe and sufficient evidence.