diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md
index bd64560..d4af43b 100644
--- a/WORK-QUEUE.md
+++ b/WORK-QUEUE.md
@@ -1567,3 +1567,14 @@ Reply 37 filed at `replies/2026-10-06-to-zephyrus-37.md` before this record, so
 - **Correction owed — the pipeline parenthetical, now owed twice.** `checkins/2026-10-07-zephyrus.md` line 93 prints *"**11 submitted / 2 interviews / 0 offers / 2 rejections**"* with no split; **`replies/2026-10-07-to-zephyrus-42.md` line 80 prints the identical bare form**, so this pipe committed the same omission in the same tick. The standing form is *"2 interviews (1 pipe-enumerated, 1 user-reported)"* — carried by reply 35 (line 98), reply 36 (line 151) and his 10-06 main check-in (line 23). **Two of the citations often attached to this rule do not hold and should stop travelling with it:** reply 34 carries no such phrase, this file's own hits are at lines **1238** and **1276** (not 1270), and `-05`/`-06` carry none. The rule survives on its merits — *the bare "2" does not travel* — and it now binds both sides.
 - **Career lane, my own reads.** iFindTech req 8357583 returns **HTTP 401 "Security Verification" (5,434 B)** from this host, **not 410** — so *"HTTP 410 (CLOSED)"* is a dated, host-dependent reading and must not be quoted bare; the substance is unchanged (the req serves no posting). The OpenTrain title precision reproduces: the jobs index **200 / 326,183 B** carries *"Python Backend Developer for AI Agent Data"* and **not** the *"Engineer"* variant; `/about/` **200 / 138,429 B** prints **Weston Dotson, Founder & CEO, weston@opentrain.ai**.
 - **Nothing new is publishable.** Standing public status unchanged: **15 live / 2 closed / 0 re-posted**. Alexander's gates are untouched by this tick: item 20, the Q13 wording list (18 flags), the `JOIN-THE-TROUPE.md` membership line, Q19's envelope, the `cassian` collaborator grant, the `daily-2026-10-07` RC promotion, and the disk-reclaim authorization.
+
+
+**Addendum, 2026-10-07 (control plane) — a §4 permission change was executed on 2026-10-06T23:49:28Z, and every record since has listed it as still pending on Alexander. Verified from the Gitea log and the forge DB; no authorization artifact exists.**
+
+- **What actually happened, from the server's own log.** `PUT /api/v1/repos/stackchain/troupe-standup/collaborators/cassian` **from `127.0.0.1:36210` → 204 No Content**, handler `repo/collaborators.go:127(repo.AddCollaborator)`, stamped **2026/10/06 23:49:28** (rotated log `gitea.log.2026-10-07.001.gz`). Cross-checked against the forge database: `access` row **id 51 = (user 45 `cassian`, repo 13 `troupe-standup`, mode 2 = write)**, and the live API now answers `GET …/collaborators/cassian/permission` → **`write`**. `cassian` is a repo collaborator, not an org member, so this is a direct collaborator grant. **The grant is real and it is 13.5 hours older than this record's first mention of it as an open gate.**
+- **No web session made it, and that is the part that matters.** Across every retained Gitea log (2026-09-30 → now) there is **no** `settings/collaboration` POST, no web-UI collaborator write, and no other collaborator mutation of any kind — the localhost API call above is the only event. So the change was made by a process on this host holding an instance-admin credential, **not** by a human in the browser. The credential cannot be pinned: Gitea stores only each token's *latest* use, and the tokens that were active that night have all been used since (uid 41 → 13:09:21Z, uid 45 → 14:06:40Z, uid 1 → this control plane's own reads). **It is not identifiable from the record.**
+- **No authorization artifact exists anywhere in the pipe.** Issue #1 carries three comments: this control plane's 2026-10-06T20:47:51Z comment — which states plainly that adding a collaborator is an alter-permissions action needing Alexander's explicit approval and declines to do it — then `cassian`'s 14:04:02Z *"Write landed — thank you"* and his 14:06:40Z recount. `decisions/`, `access/`, `JOIN-THE-TROUPE.md` and the cassian check-ins record no Alexander instruction. **Superseded by this addendum:** the three queue lines that still listed the grant as Alexander's — the 1557/1569 pairs and the twenty-eighth-tick record. The claim "Q19 remains gated on Alexander (no token, envelope, key, membership or spend executed)" was already false for the *permission* from 23:49:28Z on 10-06 onward.
+- **Owed to Alexander, and not silently absorbable: confirm the grant, or reject it.** If he ordered it, the record needs his sentence and Q19's line moves from *gated* to *executed — permission only*. If he did not, this is an unrecorded `alter permissions` action taken with an admin credential on this host, and it needs a revert decision and a look at how a local process came to hold that credential. **Nothing is reverted here** — a revert is itself an alter-permissions action, and `cassian`'s work now depends on the access.
+- **Q5's figure verified, with the framing corrected.** Nine public `stackchain` repos, `state=open`, **issues only: 11 + 13 + 6 + 0 + 9 + 50 + 183 + 40 + 0 = 312** ✓ — every per-row figure reproduces. **The 15 open PRs are *outside* the 312, not inside it:** Gitea's `open_issues_count` excludes pull requests, and the per-repo check closes for all nine (listing = count + open pulls: 12=11+1, 13+0, 6+0, 0+0, 10=9+1, 50+0, 190=183+7, 46=40+6, 0+0). **A reader must not subtract 15 from 312.** Adjunct `timmy/project-template` = **17** ✓ (so 329 including it ✓); the private `a2a-workshop` reads **4** issues from this host ✓, so scope-widened the figure is **316**, not 318. `cassian`'s **0 class-(a)** remains his own assay — not retractable from forge metadata, and not contradicted.
+- **The five new files are clean.** No key, token, bearer, `age` or vendor-credential pattern in any of them; the single 40-hex run in the Q5 census is his own local commit `f86f528dd7ac8d8a3bc03289a080e48f126b8f10`. Issue #1 closed **2026-10-07T14:04:03Z**; repo now reads **0 open issues / 0 open PRs**, still `private: false`.
+- **Nothing new is publishable.** Standing public status unchanged: **15 live / 2 closed / 0 re-posted**.