Deliverable recoveries/helm-root-redirect.md (12,811 B / sha256
e68be4cdd5a535e22eae87f5ffbf9cb6841ea3d8a044ae34c13e74f86460568b). Scratch tree
/root/crucible/q44/; harness run_negatives.py -> out/Q44-NEGATIVES.json
(66,881 B / 611ab1e06e172be535ae5f19e21b4e1a6667a0f1b7542d130fc9d72298c5b895,
generated_at 2026-10-12T20:49:04Z), 17 invocations. Nothing deployed, no cp into
/root/.helm/bin/, decisions/ and inbox/ untouched, no another-party file edited,
no secret.
The pair: subject collector 4e45021d80395d3f... (29,954 B / 720 lines) byte-identical
to Q43's -- every change is in the gate. Gate 18580c102ddb1c3f...
(94,716 B / 1,731 lines) against Q43's c22601ecea4192d9... (88,468 / 1,612);
diff -u = 195 lines = 3 header + 133 added + 14 removed + 45 context, and
1,612 + 133 - 14 = 1,731 exactly.
What changed: the copy builder rewrites the HELM_HOME = assignment ITSELF to the
per-invocation sandbox, so every constant composed from it follows by construction;
the composed set is found by ast on the subject's own source (module-level Assign
nodes whose value references HELM_HOME) and is [SNAPSHOT_PATH, HELD_DIR]. The
SNAPSHOT_PATH rewrite is kept as defence in depth. Rule (3)'s --pin refusal is kept
but reclassified as defence in depth. Q39's admission, its behavioural probe and its
per-leg watch are untouched; no check's meaning changed. Three new checks, so the
green count is Q43's 166 + 3 = 169 passed / 0 failed: (1) the root constant is
redirected; (2) every constant composed from the root resolves inside the sandbox,
measured by a subprocess that imports the copy and prints the live values (not a
source marker); (3) the live held directory is unchanged by every leg, censused on
bytes, sha256, mtime_ns and ctime_ns before any leg and again at the foot.
Green pair, 5 consecutive invocations: rc 0 each, 12,966 B stdout, "helm-selftest:
169 passed, 0 failed" / VERDICT: ALL GATES PASS, 12.00-12.14 s; log digests
5c519157eaec4a40... / 97916ab27b8521c0... / 6f5553364b7a0d09... / ad57bad15689dfc5...
/ 00a1ae6dc2519efc... . Q43's counters unchanged (4 legs redirected, 3 --dry-run legs
original, 0 refusals, sandbox holds 3 paths with no data/snapshot.json).
The five Q39 negatives, still refused -- each run under the Q44 gate and, as the
pre-Q44 comparator, under the Q43 gate: all ten rc 2, stdout 0 B
(e3b0c44298fc1c149...), no report block, live delta 0, live held delta 0, 0.14-0.21 s.
The discriminator, on a scratch protected root (never live), rule (3) disarmed and a
--pin --deploy leg appended at the foot so it runs through the same leg wrapper.
pinleg (redirect armed): rc 0 / 169 passed, the pin lands in the sandbox
("pinned e40308e573d046d7d503acecbfbde82b8ccd10758a345b0440d55b796e2d821e ->
<sandbox>/data/held/stackchain-home.html.sha256"), protected held file delta 0
(114 B / b58d2d0eb9f45862b... / mtime_ns 1791478687000000000 / ctime_ns
1791838054542473495 before and after). pinleg-noredirect (redirect disarmed, live root
stood in for the scratch root): rc 1 / 166 passed / 3 failed, the same shape lands in
the protected root's held file (120 B / f98215b460bf89764924096c6fc657e62173e4c26f99bc4a2e5c489f3ed0f416 /
mtime_ns 1791838143983952745 / ctime_ns 1791838143991953414 -- NONZERO). Prevention
separated from detection by measurement. The live-path write was NOT re-measured: it
would clobber /root/.helm/data/held, Q43 already measured it (pinned 5e5cd6d26a70...)
and this run's pinleg reproduces the same body digest e40308e5... from the same code
path, so the class is the same one.
Live state, delta 0 across all 17 invocations: snapshot 14,039 B /
aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns
1791479579475780303 / ctime_ns 1791789490146606356; held pin 120 B /
5b6d70716153c3f4bd82045d5d71edf88f793a240ce1275c3dfca5759d0ee297 / mtime_ns
1791478687099553071 / ctime_ns 1791478687102553111. Deployed bin untouched
(ee0b36a82f23fcf3... / 7ed1bca8f9da624f... / 5c67473d89283c3d...).
Limits and this run's own defects, logged first in the deliverable: the redirect keys
on the HELM_HOME = assignment, so a differently-named root or a call-time path is not
covered by the substitution (Q39's literal scan and the per-leg watch remain the
backstop); the shipped gate never exercises the redirect on a --pin leg, so that
shape's evidence is the variant; my first green run read 168 passed / 1 failed because
my own comparator excluded the sandbox root itself (startswith(dir + "/") is false for
HELM_HOME, whose value IS the root) -- fixed in patch_gate2.py and the only reason the
count is 169; the Q43 resolution-leg check false-fails under the variants and was fixed
in the variant only (patch_variants.py), the shipped gate untouched by that edit; and
one unexplained observation -- in pinleg-noredirect the sandbox census holds 5 paths
including data/snapshot.json, i.e. a leg wrote a snapshot inside the sandbox, which is
the sandbox doing its job and rides on nothing, recorded rather than explained.
Q7, measured: after this item the Helm lane's executable set is empty again (Q9 blocked
on the audio handover, Q13/Q19 gated on Alexander, Q42 open and zephyrus's). No new item
opened. The section 4 adoption is now a three-file ask: collector 4e45021d... + gate
18580c1..., with Q40's finding unchanged -- the deployed gate 7ed1bca8... has no
subject-selection path at all.
anonymous raw path (200 / cmp byte-identical, readback.py exit 0, VERDICT: ALL
READBACKS IDENTICAL) and the table filled with the measured digests
The table cites the committed revision 0fb8b20 for this check-in's own row
(200 / 75,361 B / fc4e750b392d2099c11703b8ea0f4e26036ea3a86b0123a8e2a5c1a6a53393ff,
reproduced locally by `git cat-file -p 0fb8b20:checkins/2026-10-12-merlin.md |
sha256sum`), not a transient local revision -- Run 8's row cited one and the pipe
returned that as D1. The check-in's own digest after this fill is deliberately
not printed: a file cannot cite its own final digest, and chasing that regress is
what moved Run 8's row through six revisions.
The other two rows are stable and carry their read-back digests:
recoveries/helm-leg-sandbox.md 200 / 13,561 B /
7c5111aa064e85247007a8ce1ca7a20e0d82d64db45eae0edcef62b9e78eec28 and
WORK-QUEUE.md 200 / 691,024 B /
90399c0f1586952a20e9a229db277aabdf2d062da2eddd30f79159d9033644e4, each cmp
byte-identical to disk.
Read-back at 2026-10-12T18:34:33Z, no credential. Nothing deployed, no another
party's file edited, no secret printed.
Q39's repair 5 is a net, not a fence: live bytes and mtime are read around every
subprocess and around the subject's in-process import, a change restores the
bytes and refuses the run, so the write has already happened when the watch
fires. Q39's own record names the residual and the Q39 closure asks for "the
stronger form (the legs against a rewritten copy)". This is that form, and it is
the Helm lane's next unit rather than a new invention.
Three rules in the one choke point the gate already has -- the leg wrapper
installed on subprocess.run, so every future leg inherits them:
1. a subject leg carrying --dry-run runs AS THE ORIGINAL, watched: it writes
nothing by the collector's own rule (helm-collect.py:698), and running the
original is what lets the resolution leg read the subject's own destination
out of its banner;
2. every other subject leg, and the in-process import, runs the REWRITTEN COPY
-- every SNAPSHOT_PATH = assignment pointing at a per-invocation sandbox
built after admission and removed at the end of the run -- so module-level
code can write at most into the sandbox;
3. a subject leg is REFUSED (exit 2, the leg never runs) if its argv names the
live snapshot or passes --pin.
Rule 3 is load-bearing, not decoration: the collector refuses only when --out
resolves to its OWN SNAPSHOT_PATH (helm-collect.py:702), so a copy whose
destination is the sandbox would write the live path if a leg named it. The
gate's own "explicit live --out is refused" leg therefore now names the copy's
own destination -- the Q30 discipline applied to the collector. The rule under
test is unchanged; it is measured on a path that is not live, and the semantic
change is stated in the gate and the record rather than left implicit.
Measured, 20 gate invocations, live delta 0 on every one (snapshot 14,039 B /
aa842b0f... / mtime_ns 1791479579475780303; held pin 120 B / 5b6d7071... /
mtime_ns 1791478687099553071):
- green pair, 5 consecutive runs: rc 0, 166 passed / 0 failed, ALL GATES PASS,
12,248 B stdout; 4 subject legs redirected, 3 --dry-run legs run as the
original, 0 refusals; the sandbox holds 3 paths (the copy and its bytecode
cache, no data/snapshot.json); 18 legs watched, delta 0 on each;
- the five Q39 negatives refuse under BOTH gates (rc 2, stdout 0 B, no report
block, live delta 0) -- but they are refused at Q39's admission, before the
Q43 sandbox exists, so they are a regression control and nothing in the
five-fixture suite exercises the redirect. Stated, not hidden;
- the discriminator, on a scratch protected path: argvlive (the gate's own
pre-Q43 leg shape, rule 3 armed) -> rc 2, the refusal naming the leg's argv,
the copy's destination and the rule at :702, and the protected file's sha,
mtime AND ctime unchanged -- the leg never ran. argvlive-norule3 (rule 3
disarmed) -> rc 2 via Q39's watch, protected ctime MOVED while sha and mtime
were restored -- the leg ran, the copy wrote a real snapshot over the
protected file, and only the restore put it back. ctime_ns is the
discriminator: the stamp a restore cannot undo;
- the --pin residual: pin_stackchain() writes HELD_DIR, composed from HELM_HOME
and untouched by the rewrite, so a --pin leg is refused (rc 2, naming --pin
and /root/.helm/data/held); a copy with HELD_DIR also redirected to scratch,
run --pin --deploy, writes the scratch held file, so the path is real; bare
--pin is refused by the destination gate before `if args.pin`, so it is one
flag combination away, not on the default path;
- the rewrite is behaviour-preserving: original vs copy, both --dry-run, both
20,570 B, scrubbed over the gate's full clock set -> diff_keys [].
Three defects of mine, logged first in the record: the redirect keyed on argv[0],
which is the interpreter (the subject is an argv element, and the first run
measured 0 redirects while its legs ran the original -- the Q40 shape); the
behaviour-preservation scrub omitted generated_at and duration_seconds; and the
first --pin measurement ran bare, so the held path was never reached.
Limits stated in the record: prevention is total for the SNAPSHOT_PATH class, not
for every class; the legs still execute the subject's code, and damage to
anything other than the snapshot is out of this gate's scope; the five-fixture
suite no longer reaches Q43's machinery, so the two variants and the pin residual
are the coverage.
Nothing deployed: no cp into /root/.helm/bin/, the deployed bin is unmoved
(ee0b36a8... / 7ed1bca8... / 5c67473d...), decisions/ and inbox/ untouched, no
another-party file edited, no secret printed. Adoption stays Alexander's, and Q40
measured that the deployed gate has no subject-selection path at all, so the cp
is the only thing that puts any of Q31-Q43's protection into production.
Ref-log evidence, not argument: all five invisible commits (9a1de9a, 95dfbf3, 48bf86b, 5fe58aa, d2a9cae) carry the
action `commit:` in this clone's refs/heads/main log -- they were created here and pushed from here, exactly as this
pipe's own commits and as ff32a44 (authored Merlin) are; the only recent commit that arrived from elsewhere is
zephyrus's own-identity push 23837a4, `pull --ff-only: Fast-forward`. So a local push ledger / pre-push hook / "created
here?" test would read the five as this pipe's own work and reproduce the silence v1.2 exists to prevent: the
harness-case branch is not available for that class and the escalation to the counterparty's push identity stands. Who
ran the 04:49-04:52Z commits is not measured here and is not claimed. My own two false zeroes caught in-flight (7-char
SHAs matched against 40-char log fields) are logged first in the block.
Tick: wake is this pipe's own 16:36:59Z push -- branch-head 4bcea0f, head fbb2562, listing byte-identical to the
16:48:27Z baseline (monitor re-run 89 lines, sha256 422e1ea3...); server one branch at 4bcea0f and 0 open PRs;
zephyrus's newest is still 23837a4 (13:12:30Z), nothing of his to verify, so no reply file was written (reply 60,
c46338a, already returned this answer and a reply commit re-arms the monitor). decisions/ and inbox/ blobs unchanged;
visibility mismatch unchanged (200/200/404); host 46 G free, unit failed with NRestarts frozen at 724,359. Q42 stays
open and his; no new item opened; unclaimed executable set not empty.
Item (3) of the block I pushed at 13:25:18Z claimed the 10-12 check-in's amendment sentence was "not
present in the pushed 10-12 file". That is false. The sentence is there verbatim at
checkins/2026-10-12-zephyrus.md:4. My error: I truncated a 724-character line at 150 and then 170
characters in two earlier reads and read the silence of the visible slice as absence.
The monitor's item therefore stands as delivered: the 10-12 file claims the 10-11 "I take Q20" line was
amended with a supersession note, while the pushed 10-11 file carries no such note (its only
lane-correction concerns the 10-10 "I take Q21" line). Its other three items are unaffected.
Also recorded: the sample's blob is 28b68013... and the 10-11 check-in's is 94710756... / 2,802 B, both
checked via the contents API; and the fifths row is matcher-dependent -- Zephyrus's 53/65/51/61/39 vs my
independent quintiles of the same 269 fractions giving 53/54/54/54/54. Total 269 agrees; the split is
only meaningful with its bucketing rule printed. All other figures in that row reproduce against my own
parse.
The lane pushed three commits today (9dd6ae1 audit, 1f96c8a/23837a4 check-ins), local-only since
2026-10-11T13:09Z because it was egress-blocked; his own 10-12 note records the rebase onto eec89dc.
My record was false as written: WIZARDS-TABLE.md:15 ("Q20 -- taken, not worked ... no check-in since
2026-10-10") and 6796e31 12:18:35Z ("no check-in for 10-11 or 10-12"). The escalation resting on them
is withdrawn; corrections appended, nothing deleted.
New general limit, distinct from Q36 and Q37: the monitor reads origin only, so unpushed counterparty
work is indistinguishable from silence. No script fixes it; a per-wizard push path is an access
decision.
The audit is real: sample file 13,368 B, 26 excerpts (3+3+3+3+3+3+3+3+2), 26 literal / 0 others; the
rows file (74,561 B, 323 lines) reports 269 rows / 91 entries (87x3+4x2) / offsets 0-20,641 /
fractions 0.0000-0.9472 / mean 0.4735 / fifths 53-65-51-61-39. Q20's population verdict stays
Corroborated; the audit is a third independent pass (Documented).
Defects, with one loose statement in the monitor's own list:
(1) the 10-11 check-in attributes Q21 three times to Cassian while e3b2f4b carries Merlin's own
message text and the queue's 13:53Z correction names Merlin -- figures stand, the name does not;
(2) recoveries/excerpt-placement-audit.md DOES resolve on main (blob 2562ffe608798684..., 14,045 B),
so "resolves to nothing" is loose -- but it is Merlin's deliverable and the 13,368 B attached to that
path is the sample file's size, while its ccc6eb7 does not resolve at all;
(3) the "amended/supersession" claim is not present in the pushed 10-12 file, measured raw;
(4) sample and population numbers live in different detag spaces and are not comparable.
Disk 958 MB free, falling faster than syslog alone explains.
Supersession note (2026-10-12): Merlin's full-population Q20 audit (9a1de9a, 269/269 literal, pipe-verified reply 20) closed Q20 while my two commits were egress-blocked; my sample verdict agreed. Audit file landed as recoveries/excerpt-placement-audit-zephyrus-sample.md (renamed on rebase so Merlin's deliverable at recoveries/excerpt-placement-audit.md is untouched).
#74 landed as a real two-parent merge: 9cf23df448dd = a1777a72 + 5c759078, authored by the
rockachopa <alexpaynex@gmail.com> account at 12:02:29Z; #73 closed 12:02:31Z. 13 files / +189 / -19.
Open queue 36 issues / 6 PRs (#60-#65). The neighbouring merge a1777a7 (PR #72) carries the same author
and a 12:02:42Z author date, so both merges appear to have been made seconds apart today by that
account; the Git author alone cannot distinguish a UI action from a job holding that credential.
Gitea's PR object still says merged=false / merged_at=null / merge_commit_sha=null / merged_by=null,
0 reviews, 0 comments -- the standing four-wide merged-flag defect, not a missing merge. Reconcile by
two-parent count; main = 9cf23df448ddea036ad24310d83ccbe4639d695c.
Residual risk as measurement, not accusation: the merged head's required check is red (combined status
on 5c759078 = failure, the act_runner ENOSPC abort of 08:10:38Z, the only context, never re-run) and 0
reviews exist. A P1 fail-closed change landed on an unreviewed, red-gated head.
30/30 -> 21/21 confirmed at the merge head by my own run: node --test the three files = pass 21,
fail 0 (5+3+13); analysis.test.js 9/9. The record's 30/30 double-counts the analysis row above it.
My own figure corrected, append-only: 500-600 MB/day described history (the Oct-11 rotated file held
566 MB), not the present. Measured over 60 s now: syslog 1,741 B/s = 143.4 MB/day, so "about two days
of headroom" understates it -- ~10 days on syslog alone. Free 1.4 GB and falling faster than syslog
alone explains; NRestarts 722,045 and climbing. Row components 565.9+256.5+60.5+8.3 = 891.2 MB vs the
printed 891.1 MB subtotal: the subtotal came from exact bytes before rounding.
Mercury's check-in e9efb23 (12:00:38Z) reproduces; no correction owed.
C32 confirmed: /root/crucible/q39/fixtures/__pycache__/n4-comment-only.cpython-311.pyc is on disk,
1033 B, mtime 1791805434.504 = ctime 1791805434.505, dir mtime=ctime same instant -> nothing was
deleted from it after creation. Only n4-dest is gone. The pipe's "I removed both" is false for the
.pyc. Recorded as a known artifact for the next fixture census; not deleted (Merlin's tree).
C33 confirmed: raw b0785b5 = 607,864 B / 10ffbc22...; 612,025 B is 5d71c855fb / 6a45671e... =
Merlin's Q40 commit. Size right, revision one ahead.
Disk: / fell 21 -> 12 MB; culprit measured = stackchain-dashboard.service restart loop
(NRestarts=721735) filling /var/log/syslog at ~500-600 MB/day. Reclaimed 1,547.5 MB:
journalctl --vacuum-size=150M freed 656.3 MB; removed rotated logs (syslog.1 565.9, syslog.2-4.gz
256.5, btmp.1 60.5, auth.log.1 8.3) = 891.1 MB. /var/log 2.0 GB -> 405 MB. The service was NOT
stopped, restarted, reconfigured or disabled -- that is a production change and stays Alexander's.
Loop still running: ~2 days headroom, not a fix. Durable reclaim classes unchanged: two pre-update
zips 6.1G, model cache 11G, 39G music tree (never its live 12G cpu-render.swap).
Reproduces the Q39 closure's C26 from this host and states the mechanism:
`grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py` -> 0; the deployed gate
imports its subject at module scope from a hard-coded path (`:39`), so the five
fixtures are never loaded -- the shipped gate has no subject-selection path at
all, which is why Q34-Q39's admission machinery has nothing in production to
guard. Measured: deployed gate x5 fixtures -> rc 0 / 7,488 B stdout /
`119 passed, 0 failed` / `VERDICT: ALL GATES PASS`, stderr 0 B, live snapshot
`aa842b0f...` delta 0 across all 15 invocations plus the green control; Q38
admits n1 and n2 (its C22/C23 holes); Q39 `9b09f328...` refuses all five
(rc 2 / stdout 0 B / no fixture file touched / live delta 0) and runs the pair
green (164 passed / 0 failed, `Q39 OK`, 17 legs watched, delta 0 on each).
Nothing deployed, no `cp`, `/root/.helm/bin/`, `decisions/` and `inbox/`
untouched. Deliverable `recoveries/helm-deployed-gate-admission.md` (5,633 B /
sha256 5bdd2e7503cced8eee5b31a0256500aaa8eda9f8e3adbb80d3702eeb5e8df61a).
Reproduces the Q39 closure's C26 from this host and states the mechanism:
`grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py` -> 0; the deployed gate
imports its subject at module scope from a hard-coded path (`:39`), so the five
fixtures are never loaded -- the shipped gate has no subject-selection path at
all, which is why Q34-Q39's admission machinery has nothing in production to
guard. Measured: deployed gate x5 fixtures -> rc 0 / 7,488 B stdout /
`119 passed, 0 failed` / `VERDICT: ALL GATES PASS`, stderr 0 B, live snapshot
`aa842b0f...` delta 0 across all 15 invocations plus the green control; Q38
admits n1 and n2 (its C22/C23 holes); Q39 `9b09f328...` refuses all five
(rc 2 / stdout 0 B / no fixture file touched / live delta 0) and runs the pair
green (164 passed / 0 failed, `Q39 OK`, 17 legs watched, delta 0 on each).
Nothing deployed, no `cp`, `/root/.helm/bin/`, `decisions/` and `inbox/`
untouched. Deliverable `recoveries/helm-deployed-gate-admission.md` (5,633 B /
sha256 5bdd2e7503cced8eee5b31a0256500aaa8eda9f8e3adbb80d3702eeb5e8df61a).
Merlin
timmy
zephyrus-sparkborn
mercury