diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md
index 3c5e9a5..3086031 100644
--- a/WORK-QUEUE.md
+++ b/WORK-QUEUE.md
@@ -3759,3 +3759,29 @@ member**, Merlin first as the Helm's author and the author of the gate set.
 - **Standing rule, restated for the fourth time because it keeps producing misreads:** an item's currency lives
   in the queue's **DONE** lines, the verification ticks and `WIZARDS-TABLE.md` — never in a section's first
   Status line. Prefer searching for `Status: DONE` over reading a section's head.
+
+**Control-plane addendum, 2026-10-11 09:21Z — Q30 needs a *destination* gate as well as a byte gate; and the 08:57:14 write on production, explained.**
+
+- **The renderer's default output IS production, so the fix that makes the CLI work will also re-arm the
+  accident.** `helm-render.py:47` — `OUT_DEFAULT = Path("/var/www/alexander-whitestone/helm/index.html")`. The
+  reason the accident happened is now clear from both sides: the CLI entry point is dead (the `__main__` guard
+  at `:90-91` sits above `def build_page` at `:232`, which `main()` calls at `:78`), so the only path that
+  *works* is calling `main()` from an import driver — and `main()` with no `--out` writes the default, which is
+  the live page. Merlin's check-in §"Three defects of mine" documents that overwrite and its byte-exact restore
+  (`9,865 B / 427b7b54c69b18d2…`); §4 named correctly. **Q30 must therefore assert the destination, not only
+  the emitted bytes:** a render that would write `OUT_DEFAULT` should refuse unless an explicit
+  `--out`/deploy flag (and, for the live path, Alexander's §4 approval) is present. Otherwise Q30 closes with a
+  working `python3 helm-render.py` that deploys production by default the first time anyone runs it without
+  arguments.
+- **The 08:57:14Z write, for the record.** The served file's `mtime`/`ctime` are `2026-10-11 08:57:14.017837233Z`
+  at 9,865 B — that is Merlin's **restore**, not a new deploy: content is unchanged at `427b7b54c69b18d2…`. The
+  queue's *"stayed at `427b7b54…` throughout"* is true of the content and should be read with that one write in
+  mind; the check-in carries the full account.
+- **Independent re-confirmation from this host (09:18–09:21Z), so the numbers in the brief are not just its
+  own.** Live `/helm/` = 200 / **9,865 B** / `427b7b54c69b18d2…`; **5 × `FRESH`, 0 × `STALE`**, the only badge
+  word on the page is `FRESH`, pill *"5 green · 1 red"*, newest clock on the page `2026-10-08T17:12:59.475Z`.
+  Age at 09:21:05Z = **2d 16h 8m 6s**, against limits 1d / 15m / 1h / 6h / 2d → **not fresh under any of the
+  five**, so the served page publishes five false freshness claims and one false held-copy *match*, and nothing
+  will ever refresh it: `grep -ci helm /root/.hermes/cron/jobs.json` = **0**, and no profile cron store holds a
+  Helm job. The dead entry point above was **read from source, not executed** — running it would be a
+  production write if the ordering were ever fixed, so the source read is the safe and sufficient evidence.