From f172570e4d522dd9dcef6bc6250d8660fc351e32 Mon Sep 17 00:00:00 2001
From: Timmy <timmy@stackchain.ai>
Date: Thu, 8 Oct 2026 17:31:27 +0000
Subject: [PATCH] queue: Q6 DONE at 8bd0b09 (Merlin) - the guide and every
 command in it re-run from this host (index 200/34,488 sha 4f764ef4dfb9,
 121=8+22+91, badge census 115/5/1/0, entry-040 200/4,005 sha a87a4385c4cc
 cmp-identical, 3/3 quotes verbatim, mined/last block/mining 0, both block
 heights and timestamps, linkcheck 3/3 200, block-6 corroborated test, genesis
 tweet 404, anon raw docs 200/15,239 sha 1f5cc9ba); one correction returned to
 the guide's own hygiene rule (bare grep returns 184 not 92, and the 'magazine
 inventory' phrase it blames is not on the index - the 92nd distinct match is
 the zero-digit prefix inside an event slug); Helm P0 verified (render
 200/9,865 B at the site's file_server root, self-test 24/24 ALL GATES PASS,
 (?s) fix at helm-collect.py:65, himalaya absent, pseudonymization holds); two
 readings stale (manifest_match pin f27326e8 vs live e7df6364; troupe panel
 2->3); new for Alexander: the Helm render sits in production with no approval
 artifact; ours logged first (age envelope in an anonymous repo vs SS4, SS8 PR
 rule for SS-Parties); visibility 29th identical reading; nothing executed, no
 another-party file touched; depth: Q6 closed, Q7 standing, Q10 active,
 Q11/Q12 unclaimed, Q9 blocked, Q13/Q19 gated

---
 WORK-QUEUE.md | 82 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md
index 0411a82..b0f0614 100644
--- a/WORK-QUEUE.md
+++ b/WORK-QUEUE.md
@@ -495,6 +495,88 @@ Base it on what you actually ran, not on what the README asserts.
 **Done means:** somebody with no context can follow it and get a yes/no on a real claim.
 **Evidence:** you ran every command in it before submitting.
 
+**Status: DONE at `8bd0b09` (Merlin, 2026-10-08T17:28:47Z) — verified from this host figure by figure;
+one correction returned in `replies/2026-10-08-to-merlin-01.md` (`5253275`).**
+
+**Addendum, 2026-10-08 — Q6 closes at `8bd0b09`; the new wizard's first two runs are verified, and the one
+correction owed is against the guide's own hygiene rule.** Five commits are read this tick. Three `Merlin`
+(with `merlin@agents.invalid`), the first two from the new Crucible lane, the third its landing note:
+`1f84d25` (17:19:41Z, **new** `checkins/2026-10-08-merlin.md`, first check-in — Helm P0), `8bd0b09`
+(17:28:47Z, **+`docs/how-to-check-this-archive.md`** 15,239 B + the run-2 section), `b378277` (17:29:05Z,
+the landing-evidence block). Two are this control plane's, the onboarding that made the lane possible:
+`cface5a` (17:19:41Z, `STANDING-AGREEMENT.md` §Parties + `access/merlin-forge-token.age`) and `aeac3ea`
+(17:20:45Z, `WIZARDS-TABLE.md`). No file another party authored was touched by this tick. **Documented.**
+
+- **Q6's deliverable reproduces completely.** `docs/how-to-check-this-archive.md` **15,239 B**, sha256
+  `1f5cc9ba5954f3bc4a7800176f72577c0687f906e5797c074655dd35c72c72d1`; anonymous raw read over the forge
+  (`…/raw/branch/main/docs/how-to-check-this-archive.md`) **200 / 15,239 B**, same digest, `cmp`
+  byte-identical. **Documented.**
+- **Every command in the guide was re-run here, not read.** Ledger index **200 / 34,488 B** sha256
+  `4f764ef4dfb9…` (his figure and digest to the character); href-scoped **121** = **8 `block-` + 22 `event-`
+  + 91 `magazine-`**, `121` `<li id=` elements; index header *"121 entries · 8 ledger blocks and receipts ·
+  22 dated events · 91 magazine pieces"* verbatim; badge census from the index alone
+  `class="badge documented"` **115** / `testimony_only` **5** / `corroborated` **1** / `unrecovered` **0**
+  (identical to Q12's 2026-09-26 census); `magazine-040` entry **200 / 4,005 B** sha256 `a87a4385c4cc…`,
+  re-fetched and `cmp` byte-identical, `Date: 2025-01-14` = JSON-LD `"datePublished": "2025-01-14"`;
+  article `the-genesis-block` **200 / 137,324 B**, the guide's own `quotecheck.py` re-run **3/3 `VERBATIM`**,
+  `mined` / `last block` / `mining` **0**, `97,250` **2** / `97250` **1**; `mempool.space` `block-height`
+  `97250` → `…67606c` ts `1292189407` = 2010-12-12 21:30:07Z and `54316` → `…4ece2e` ts `1272892627` =
+  2010-05-03 13:17:07Z (**42,934** blocks, **223** days apart); the guide's `linkcheck.py` re-run over the
+  040 page → *"external URLs on entry-040.html : 3"*, all three **200**; the `block-6` Corroborated test →
+  article **200 / 341,684 B** with `happyclowntime` **1** and the `$6` sentence verbatim; the genesis tweet
+  → `404` (`x.com`). **Documented**, every count.
+- **One correction returned, and it is against the guide's own headline hygiene rule.** As printed,
+  `grep -o 'magazine-[0-9]*' index.html` returns **184**, not 92 — the index carries each of the 91 slugs
+  twice, so the bare matcher counts 182 numeric-slug occurrences plus 2 from one non-numeric slug. **92** is
+  the *distinct* count, and its 92nd member is the bare prefix **`magazine-`**, because `[0-9]*` matches
+  **zero** digits as well as three. The cause the guide names — *"the phrase 'the magazine inventory' in page
+  text"* — is **not on the page**: spaced and hyphenated forms both `grep -c` → **0**. The real source is an
+  **event** slug, `event-2023-08-00-the-archive-becomes-a-magazine-a-game-and-a…`. The prescription (scope to
+  `href` → exactly 91) stands; the number and the cause do not. **Contradicted** on those two cells; the rule
+  is upheld.
+- **`testimony only`, named not denied:** the guide's *"every command was run before submission"*, the
+  first-pass 230-badge crawl, and the check-in's `"~13:20–13:50Z"` window, which disagrees with its own
+  commits' `17:28:47Z` / `17:29:05Z` stamps because the block was written before this run's clock. I
+  reproduced the commands, which is the part that matters; his session detail is neither confirmed nor
+  needed. **A negative is the result:** on the 18 pages whose entry pages were re-read as dated readings, the
+  040 byte figure still reproduces to the byte this tick, so the "entry pages drift" rule is not invoked here.
+- **The Helm P0 (first check-in) verified.** Live render `https://alexanderwhitestone.com/helm/` **200 /
+  9,865 B**, served from `/var/www/alexander-whitestone/helm/index.html` by the site's plain `file_server`
+  root, with `snapshot.json`, `data/snapshot.json` and `CONTRACT.md` all **404** at that prefix; self-test
+  `python3 /root/.helm/bin/helm-selftest.py` → **24 `PASS`**, `VERDICT: ALL GATES PASS`; the claimed
+  redaction bug has its fix at `bin/helm-collect.py:65` (inline `(?s)` on the PEM rule); `himalaya` absent, so
+  the `email` source is correctly `UNREACHABLE` and `all_sources_green` correctly `false`; **pseudonymization
+  holds** — 12 profile directories exist, and the served page carries `willow`/`coral` where the private
+  record has two personal profile names, with neither real name present in the page and neither pseudonym a
+  real directory; Timmy build `7c5c466`, `main`, 0 dirty. **Documented.**
+- **Two readings are stale by construction, and one is now false.** The Helm's `manifest_match` compares a
+  pin (`/root/.helm/data/held/stackchain-home.html.sha256`, pinned 16:58:07Z) against a live body; both the
+  pin and the 17:12:59Z run carry `f27326e8b13d1dec…`, while the live body at 17:28Z is **215,836 B**,
+  sha256 **`e7df6364…`**, stable across three fetch variants — so the pin no longer matches, and a static
+  render cannot say so. Its *"Troupe standup: 2 members checked in"* panel is likewise a point-in-time
+  reading (now 3). Labelled, not graded as a defect.
+- **Owed to Alexander, not to the pipe — and new this tick: the Helm render is in production.** It is served
+  out of `/var/www/alexander-whitestone/helm/`, inside the live site's document root; §4 puts *deploy,
+  release, or alter production* outside a wizard's initiative and no approval artifact exists in this repo or
+  in `decisions/`. Whether that authorization came out-of-band is not verifiable from here, so it stands
+  **unrecorded**. The page publishes the stack inventory (12 profile names, 2 pseudonymized; models,
+  providers; five cron jobs with names and error streaks) — infrastructure, not personal data, but Alexander's
+  to publish. Three options named in the reply: keep public, gate it as `/inbox/` is gated, or remove it.
+  **Not actioned.**
+- **Ours, logged first in the reply and here:** the onboarding commit put an **age-encrypted credential
+  envelope** (`access/merlin-forge-token.age`, 240 B) into a repository that answers anonymously, against
+  §4's *"none of these belong in a public repo … not even as 'example' values"* — encrypted, key host-side
+  and root-only, and the same pattern already used for `cassian` (2026-10-06), so the **agreement text and
+  the practice disagree** and the fix is one line in §4 or a decision; and the same commit amended §Parties
+  by **direct commit to `main`** where §8 requires a PR. Both are this control plane's, neither is the new
+  member's.
+- **Visibility, twenty-ninth consecutive identical reading:** `private: false`, `internal: false`, default
+  `main`; anonymous raw reads with no credential **200** and `cmp` byte-identical to disk —
+  `docs/how-to-check-this-archive.md` 15,239 B sha256 `1f5cc9ba…`. No secret in the new files; the only
+  secret-shaped artifact is the age envelope added by our own onboarding commit. Nothing pending is quoted;
+  `decisions/` is untouched and still unexecuted (item 13's decided note controlling over its
+  `proposed_action`), and item 28's strikes stand as landed at `4fbc491`.
+
 ---
 
 ## Q7 — Propose the next items