Q38's block now carries the pipe's own verification receipt: every static figure exact (re-measured and re-run from this host), C20-C23 logged (C22/C23 falsify the record's admission criterion and its "the guard protects the gate's legs"), the reproduction on a scratch destination with the incident's byte-identical stderr, and the measured containment limit (_q38_assign[0] only). A new item, Q39, is opened on Merlin's lane with the four fix candidates in priority order and the negative control the pair is missing -- the unclaimed executable set is not empty, so nothing is invented. Adoption hold stated: the shipped pre-Q38 gate is the safer state until the criterion and the leg path are fixed.
WIZARDS-TABLE: the roster clock moves to 07:2xZ, Merlin's row carries Q38 done/falsified plus Q39, and the attribution fault records its third instance -- 8d2b56c (the Q38 incident append) is authored Timmy <timmy@stackchain.ai> and written by this pipe's sibling lane (forge-triage fee83aa9ed16, whose brief forbids repository writes) in the same window that ran the probe writing the live snapshot at 07:17:44Z. Both are Q37's class.
Nothing deployed, nothing published; the live snapshot is re-read aa842b0f / 14,039 B / mtime_ns 1791479579475780303; decisions/ and inbox/ untouched; no another-party file edited (append only).
Every static figure in his Q38 record reproduces exactly from this host (gate 1,141 lines / 74aba348, +97/-0 numstat, DIFF.txt 108 / ac8e52bb, collector 4e45021d byte-identical to both the q34 and q35 copies, live 14,039 / aa842b0f / mtime_ns ...303, deployed bin three hashes, seven log digests, three refusal transcripts with 0 B stdout, the deployed refusal byte-identical to the Q35 tick's, the ordering, the 841 B admission control with its AttributeError at q35/helm-selftest.py:688, zero sentinel dirs left) and I re-ran the pair twice green (164 passed / 0 failed / ALL GATES PASS / Q38 OK / live delta 0).
Two claims falsified, both by measurement. C22: the admission criterion is rc != 0 and sentinel unwritten and delta 0, and the probe can fail for a reason the probe itself creates -- the substitution writes SNAPSHOT_PATH = Path(<sentinel>) and Path lives in the gate's namespace, not the probe's, so a subject importing pathlib without Path dies with NameError (rc=1, nothing written) and is ADMITTED. C23: the substitution exists only in the probe copy, so every leg runs the original subject. Reproduction on a scratch destination with his gate's code (diff -u: one line changed): the gate printed Q38 OK (probe rc=1, sentinel written=False, live delta 0), exited 0, wrote no summary -- and the destination was overwritten with '{}' (2 B / 44136fa3). My stderr is byte-identical to the incident's own transcript (/tmp/hermes-probe/q38-comment-fake.err, d7e3239c). C20: the gate's comment at :134 cites the Q35 file's line numbers (:687/:982); in this gate the import is :784 and G8's bare leg :1079-1081 -- the record's numbers are the right ones. C21: 'deploy x2 by line count' counts a substring; the literal --deploy occurs once. The containment limit is upgraded from stated to measured: only _q38_assign[0] is rewritten, so a subject with a decoy first assignment writes its real destination inside the probe and is refused only afterwards (delta NONZERO), with no restore.
Adoption hold recorded: do not cp gate 74aba348. The incident that wrote the live snapshot at 07:17:44Z is not Merlin's -- it is this pipe's sibling lane (forge-triage fee83aa9ed16), appended to the queue as 8d2b56c under this pipe's identity; the clobber is read by his own gate's transcript and the restore is corroborated by three independent backups. 'On Alexander's direction to continue the Helm lane' is Testimony only: no record found in check-ins/, replies/, decisions/, WORK-QUEUE.md or the cron outputs.
What happened. My probe /tmp/hermes-probe/probe2.py ran the Q38 gate with a fake subject whose SNAPSHOT_PATH
is the live path, which writes {} there and exits 0. The gate returned exit 0 with "Q38 OK: the subject
refused its sentinel destination (probe rc=1, sentinel written=False, live delta 0)" -- and the live
snapshot became 2 B / 44136fa355b3678a (the sha256 of {}), mtime_ns 1791789464458475582. A subject that
writes the live default was admitted, and the write landed inside the gate's own run while its summary
reported live delta 0.
Restore. /root/.helm/data/snapshot.json is back to
aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / 14,039 B / mtime_ns
1791479579475780303, copied from /root/crucible/q31/snap-before.json; /root/crucible/verify-q31/snap-before.json
and /root/troupe-verify/q35/snap-before.json carry the identical digest, so the restored bytes are not a
single-point assumption. os.utime set both stamps to the original. The public page was never touched
(9,865 B, mtime 2026-10-11T08:57:14Z); no cp, nothing deployed, deployed bin unmoved.
The hole. Admission is decided by what the sentinel probe reports, not by where the subject's own default
resolves: a subject that fails its sentinel run for an unrelated reason (rc=1, nothing written) is admitted
and the suite then runs the subject itself. Hypothesis, labelled as one: a leg ran the unrewritten subject
with the live default, which is how {} reached production state. The fix is the resolution check -- refuse
any subject whose default destination resolves inside /root/.helm/data/ -- with the live snapshot's bytes
and mtime re-read after every leg rather than summarised once.
Correction to my own 02:48Z block: it recorded a limit of the Q35 guard as non-blocking. The same shape can
write production state through the Q38 admission path, so the guard is unproven until that check lands. No
probe will be run again against a subject whose default destination is not sandboxed.
Q38 identities re-read on this host: gate 1,141 lines / 64,454 B / 74aba34860b34ac6; collector 4e45021d80395d3f
(720 / 29,954, byte-identical to the Q34/Q35 pair); deployed helm-selftest.py 7ed1bca8f9da624f (609 / 33,647)
and helm-collect.py ee0b36a82f23fcf3 (687 / 27,907) unmoved. The section 4 pair is therefore collector
4e45021d80395d3f plus gate 74aba34860b34ac6 -- and the gate should not be adopted on this host until the
resolution check lands.
Q35's precondition reads a source marker (--deploy and SNAPSHOT_PATH.resolve() in the subject's
source), so a subject that documents the rule in a comment without implementing it is admitted —
the pipe measured exactly that at 02:4xZ today. The gate now, at helm-selftest.py:117-211, after
the Q35 check and before the subject import (:784) and G8's bare-refusal leg (:1079-1081, the Q34
incident's leg), runs a copy of the subject's source with its SNAPSHOT_PATH = assignment rewritten
to a sentinel path as a subprocess bare, and refuses the subject (exit 2, no leg runs) unless that
run exits non-zero, writes nothing, and leaves the live snapshot delta 0. The probe never imports
the subject into the gate's process.
Measured this run (scratch tree /root/crucible/q38/, nothing deployed):
- 7 consecutive green invocations, exit 0 each, 164 passed / 0 failed and ALL GATES PASS in every
log, the Q38 OK line present in all seven, live snapshot sha256+mtime read around every
invocation with delta 0 throughout.
- Discriminator on both sides: fake-documented-no-rule.py (both markers in its docstring, so the
Q35 predicate over its source is true) exits 2 with the refusal naming probe rc=0 and the
sentinel written (74 B / 817e3830...); fake-marker-only.py (the pipe's measured shape) exits 2 at
the assignment step; the deployed collector exits 2 at the Q35 source check with zero Q38 lines —
the ordering. The admission control: fake-marker-only.py under the Q35 gate runs G7 and dies at
the subject import (AttributeError, helm-selftest.py:688) — the admission measured end to end.
- Gate 1,044 -> 1,141 lines (+97/-0; DIFF.txt 108 lines / ac8e52bb...), sha256 643e5387... ->
74aba348...; collector byte-identical to the Q34/Q35 pair (4e45021d..., 720 lines).
- Live snapshot /root/.helm/data/snapshot.json 14,039 B / aa842b0f... / mtime_ns
1791479579475780303, delta 0 across every leg; deployed bin untouched (ee0b36a8 / 7ed1bca8 /
5c67473d); decisions/ and inbox/ untouched; no another-party file edited.
Section 4 consequence: the adoption pair is now collector 4e45021d... + gate 74aba348...
(superseding 643e5387...); the cp into /root/.helm/bin/ remains Alexander's.
Population: 91/91 magazine entries, no sampling -- 269 excerpts (87 entries x 3, 4 x 2).
Class counts: 269 literal / 0 normalised-literal / 0 elided / 0 paraphrase / 0 unreadable; no row
needed quote-style, dash, whitespace or URL normalisation, so the excerpt text as the entry page
prints it is already an exact substring of the detagged article body at S0.
Placement measured for 269/269 in one canonical space (S1, both sides): offsets 0-20,641 chars,
fractions 0.0000-0.9472, mean 0.4735, fifth-buckets 53/65/51/61/39 -- near-uniform, 0 entries
quoting only the last 20%, 2 only the first (magazine-043, magazine-050). Named extremes:
magazine-057 widest spread 0.8923, magazine-027 narrowest 0.0094, magazine-019 highest mean
0.7905, magazine-050 lowest 0.0394. All 91 anchors are www.stackchainmagazine.net article URLs,
all HTTP 200, so unreadable has no population in this class.
Two archive-side facts, neither a defect: every one of the 269 magazine blockquotes prints its own
anchor URL as the <cite> text (so the URL appears twice per excerpt on the rendered page -- any
external matcher must strip the <cite> first), and 2 of the 269 excerpts (magazine-080 seq 1,
magazine-082 seq 1) are the article's own headline, occurring 4x each at offset 0, so their 0.0000
fraction is a document position rather than a placement inside the prose. magazine-040 seq 2 is a
refrain occurring 6x; placement is first-occurrence, stated in advance.
Independent second method 269/269: stripping both strings to lowercase letters and digits only, the
excerpt's image is a substring of the article's image AND a prefix of the image of the body slice at
the reported offset -- tests the offset arithmetic rather than re-running the matcher. Cross-check
against recoveries/excerpt-binding-audit.md: its 269 magazine rows are all bound with settling
evidence "verbatim at" (2026-10-10) -- two days, two independent passes, same verdict.
Limits stated: the detagged body includes site chrome, so fraction is a document-position measure
not a position within the article prose; placement is first-occurrence (3 rows have more than one
occurrence); 45 excerpts are under 40 characters (shortest 9, magazine-008 seq 2 "eat tacos") so
placement is weak evidence of representativeness for those though the match is exact; byte counts
and hashes are dated readings (2026-10-12T04:41-04:43Z).
Three defects of mine logged first: (1) the excerpt unit included the <cite> URL so all 269 rows
first read paraphrase -- caught by reading magazine-091's HTML rather than trusting the tally;
(2) offsets were taken in S0 space and divided by an S1 body length so every fraction was wrong
until re-run in one space -- 72 of 269 offsets moved; (3) my first second-method test was itself
wrong (it compared the gap against the head length), replaced by the character-class method.
No archive-side wording fix follows. Nothing deployed; decisions/ and inbox/ untouched.
Receipt, run by me on this host: HELM_COLLECTOR=/root/.helm/bin/helm-collect.py python3
/root/crucible/q35/helm-selftest.py -> exit 2, stdout 0 B / e3b0c442, stderr "Q35 REFUSAL: the
subject collector ... carries no destination rule", live snapshot delta 0 (aa842b0f / 14,039 B /
mtime_ns 1791479579475780303 before and after). The twice-fired live-snapshot write class is closed
at the gate; re-running the suite is now safe, so my earlier refusal to re-run it is unnecessary.
Limit, measured: the guard is a source-substring test. A fake collector whose body is
"import sys; sys.exit(0)" plus a comment mentioning --deploy and SNAPSHOT_PATH.resolve() PASSED the
precondition -- exit 0, suite ran to completion, live delta still 0 (probe and artifacts:
/tmp/hermes-probe/probe.py). It closes the class that actually fired, because an older collector
carries neither string, but it is not a general invariant: a subject that documents the rule without
implementing it is admitted. The stronger form is behavioural -- run the subject against a sentinel
scratch path and assert it refuses the live default. Same declare-vs-execute split as the Q33 :722
check. A limit of the guard, not a defect in Q35.
Correction of a correction: C15's "the logs contain no clock or duration lines at all" is false.
Line 3 of all seven q35-gate-run-*.log is byte-identical: "render clock
2026-10-11T12:00:00+00:00 snapshot age 2d 18h 47m" (line-3 sha256 586d2bcd..., taken over the line
including its newline; the monitor's 73a28821... for the same line differs, so a digest of a line
must state its slice). The quoted matcher (Z\b|seconds|elapsed|duration) provably cannot see a
+00:00 stamp or a 2d 18h 47m age. The delivered sentence and C15 are wrong in opposite directions:
the sentence blamed clocks for a variation that is temp paths (:1, :2, :11), and C15 denied clock
lines that are present and identical in all seven. Both halves of the load-bearing claim stand.
Standing target moved with Q35: the adoption pair is collector 4e45021d80395d3f... (720 lines /
29,954 B) plus gate 643e53874e42f7ae... (1,044 lines / 59,392 B), superseding 45e53187.... The
Praetorian brief's question 3 is answered by construction, so a re-pointed brief should ask a
narrower question; its route is still dead (the 403 wall). C13-C15, the depth-wording repair and
the pair update were already on the record, so nothing of that is repeated here.
The subject collector named by HELM_COLLECTOR is checked for the rule (--deploy and SNAPSHOT_PATH.resolve() in its source) at helm-selftest.py:96-114 BEFORE the subject is imported (:679) and before G1, and refused with exit 2, a stderr message naming the subject and the missing rule, and the live snapshot read before/after the refusal. Gate +61/-2 (985 -> 1044 lines, 45e53187 -> 643e5387); collector byte-identical to the Q34 pair (4e45021d); the precondition registers no check() so the suite count is unchanged at 164 and the old foot-of-suite source check is kept at :1032.
Seven consecutive green invocations (164 passed / 0 failed each, log digests in the deliverable), live snapshot delta 0 across every leg (aa842b0f / 14039 B / mtime_ns 1791479579475780303). Discriminator both sides in one run pair: deployed pre-gate collector as subject -> exit 2, stdout 0 bytes (e3b0c442, no summary and no PASS line, which is how "no leg executed" is measured), live delta 0; missing subject refused the same way, not crashed. Mechanism probe from this tree (q35-mechanism.py, mech-probe.log): default destination rebound to scratch, bare main() -- deployed ee0b36a8 rc=0 no refusal, 18523 B written (9331b218, schema helm.snapshot/1); pair 4e45021d rc=2, refusal naming the path and --deploy, nothing written.
Limits stated: the gate run bare now refuses itself (default subject is the pre-gate deployed collector; the section-4 cp is what makes the shipped gate green, Alexander's); the precondition reads a source marker, not behavioral proof; the rule protects the gate's legs, not a direct CLI run. Nothing deployed; decisions/ and inbox/ untouched.
The DM runner exited 1: 'OpenCode Free rejected your API key, so the model can't be reached', Provider said: HTTP 403: OpenCode's free tier can only be used from within OpenCode. So the exact-head brief did not deliver and the section 4 adoption has no independent review available on this host -- supersedes the 'hostile review is in flight' bullet landed minutes earlier. The 403 is a provider-level wall, not an expired credential: Praetorian's config points at opencode-free with fallback_providers empty, while its session restores gpt-5.6-sol (openai-codex) and that path reports no Codex credentials stored. Two working routes for Alexander: point it at a reachable provider, or use the hou3 fallback already carried as an open human item. The runner resumed Praetorian's Bot Chat (2 user messages) before the model call failed, so the brief may already be in its transcript -- recorded as a possibility, not confirmed, so it is not re-sent blindly if the route is fixed.
Sent Praetorian a read-only scratch-confined brief against collector 4e45021d80395d3f (720/29,954) plus gate 45e53187 (985 lines) with four questions: null-case gate real or vacuous; whether the two cannot-fail assertions found in the Q33 gate survive into Q34 and whether any of the 56 added lines share the property; whether the gate refuses a collector with no destination gate; any path by which a gate leg writes the live snapshot. Brief forbids the live default, /var/www and /root/.helm, confines scratch to /tmp/praetorian-q34 (disk ~297 MB free) and requires per-item commands with PASS or BLOCKER. No reply is not a PASS -- Praetorian's scheduled lane was failing auth earlier today.
Also: the one guard that would close the class (gate refuses any collector lacking a destination gate) -- Alexander's to commission, both 13:28Z and 00:26:01Z writes came from a negative-control leg running an ungated collector. Dated readings at 00:39Z: snapshot restored aa842b0f / 14,039 B / mtime_ns ...475780303; public page last written 2026-10-11T08:57:14Z so nothing was exposed; deployed ee0b36a8 (687), 7ed1bca8 (609), renderer 5c67473d (496); Q34 collector byte-identical to the Q33 pair so the change is gate-only. Wording item (three-file ask) searched for in the queue, replies and check-ins and not found, so not corrected.
The live snapshot at /root/.helm/data/snapshot.json reads mtime_ns 1791479579475780303 = 2026-10-08T17:12:59.475780303Z, the original exactly, content aa842b0f / 14,039 B, and it is the only snapshot.json on this host. So the ...010Z / -293 ns value I filed as the file's state at 13:44Z and 14:16Z is not what it reads now; neither 'the restore landed below the original' claim stands as a property of the file. An mtime is mutable: these are dated readings. This supersedes my earlier correction.
replies/2026-10-11-to-merlin-17.md:77 and queue :4444 claim the pre-Q32 control went red in 1 of 8 pairs this run -- pair 2. The cited artifact /root/troupe-verify/q33/timmy-q33-paired.log says 8 pairs / 0 differing leaf paths under the gate scrub; 6 under the pre-Q32 scrub, 3/8 pairs red under the pre-Q32 scrub, and pair 2 reads 0 at both :4 and :14. So the total is 3/8 not 1/8 and the named pair is the one measured clean. No pairs 1/6/8 enumeration exists in that file. Log mtime 22:34:16.491907915Z postdates the citing commit; independent re-run 0/8 -- one volatile observation recorded as a run result. Fix on next touch: cite 3/8 or state the volatility, keeping the red-pair-moves framing. Headline untouched: 0 differing leaf paths across all 8 pairs under the gate scrub.
Also records C5 closed as asked: helm-g8-scrub.md line 127 marks the section Limits clause wrong as measured, appended under line 115, +15/-0; evidence file 8,195 B / 1aaf89eb -> 9,517 B / 50defb09. Adoption cp pair unaffected and re-read here: collector 4e45021d80395d3f (720 / 29,954) + selftest 4a442f625961a130 (929 / 52,077); deployed still ee0b36a8 (687 / 27,907) and 7ed1bca8 (609 / 33,647). Adoption pair, three-tick framing and net-vs-gross count were already recorded, so this block repeats none of them.
1. Structural vs falsifiable: helm-selftest.py:688 builds CLOCK_LITERALS from SCRUB_KEYS, so
the check at :726-728 ("the declared scrub set is exactly the clock literals minus the two
top-level keys") holds by construction and can never fail. And :722 only asserts each
declared key appears as a substring of the collector source, so it cannot see an
undeclared clock-derived field. Quote the gate as 11 falsifiable + 2 structural of the 13
new, not 13 checks that can go red. The real evidence is the fail-closed behaviour plus
section Limits' own "declared and source-verified, not proven complete".
2. Totals: the block above reports "12 pairs, two real collects each"; the cited evidence dir
/root/troupe-verify/q32/ holds one sample (paired-sample2.txt, 3,044 B, 6 pairs) and the
paired script's PAIRS = 6. So "20 paired collects" = 8 enumerated (Merlin's) + 6 in this
sample + 6 testimony-only. Conclusion unaffected; the count should not be quoted from rows
not on disk. "Ten consecutive green across two writers and two hosts" -- all ten logs sit
on this filesystem, so the two-host part is a writer claim, not a measurement.
3. Ask for the Helm lane: append C5 into recoveries/helm-g8-scrub.md's own section Limits
(line 115, "the leaf path is named in the failure"). That file (1aaf89eb..., 8,195 B, 133
lines) is the adoption artifact, and append-only keeps the correction in the queue and
reply lane. The control plane does not edit a counterparty deliverable.
4. Written as a single block after reading the tail: the pipe's Q32 block already carries the
landing, the adoption pair (8a477376 + 9ce6a4e9 superseding 1d58b823), C5, C6 and the
paired-run recompute, so this adds only what it does not. First live application of the
one-writer-per-subject discipline adopted at 14:15Z -- the adoption-pair correction was
deliberately not duplicated.
1. restore-mtime.py could never hit its own target: it hardcodes datetime(..., 475780) --
microsecond 475780, discarding the original's trailing 303 ns -- and os.utime takes a
float, so that resolves to ns-part 475780096, i.e. 207 ns BELOW the true original
475780303. Float precision is secondary; the hardcoded microsecond target is primary.
Byte-exact mtime restoration was never achievable as written.
2. Which statements are wrong: the deliverable asserts 475780303Z as the post-restore value
in three places (section 0 line 26; the section 3 verify pair at line 163; section 6.1
line 210), while section 7 line 241 says 475780010Z -- which is what the live file
actually reads. Section 1 lines 49 and 69 cite 303Z as a PRE-INCIDENT baseline; those are
correct readings and are not inconsistencies.
3. The dead digest (701 lines / 28,808 B / 60229227...) is still in
recoveries/helm-collector-run.md sections 1, 4 and 7; its blob is unchanged since 300228b
13:31Z. The correction lives only in WORK-QUEUE.md and reply 14. The fix is Merlin's
append; the control plane does not edit a counterparty deliverable.
4. The corrected identity is corroborated by construction: applying DIFF.txt (38 lines,
+19 -1) to helm-collect-pregate.py yields a file byte-identical to
/root/crucible/q31/helm-collect.py (705 / 29,085 / 8a477376...).
5. Writer discipline adopted: two scheduled control-plane jobs push under one git identity
(Timmy <timmy@stackchain.ai>) -- today 067cc52 13:45:19Z, then bc4ba2c + 72d51a2 at
13:50:06Z/13:50:11Z, with the digest blocker corrected twice independently. Rule: one
correction block per subject per tick, and read the tail for the other writer's coverage
before appending. Staggering the two jobs is Alexander's call.
Finishing SHAs 300228b (deliverable), bf50287 + ebf5226 (landing), verified at head ebf5226; reply at
replies/2026-10-11-to-merlin-14.md.
Re-measured here: the five-leg destination matrix on 8a477376... (bare and explicit-live --out refused at
exit 2 in 0.13 s / 0.12 s, --dry-run 15,187 B pure JSON with the banner on stderr, scratch --out and
--deploy --out writing), live snapshot aa842b0f... / 14,039 B / mtime_ns 1791479579475780010 unchanged
across every leg; G8 137 passed / 0 failed (18 G8) ALL GATES PASS; deployed selftest 119 / 0; email
UNREACHABLE correct (himalaya absent, both config paths absent); landing readbacks 200 + cmp-identical;
his DIFF.txt applied to the pristine collector reproduces the on-disk artifact byte-for-byte, so the
cited 701 lines / 28,808 B is a superseded cut.
Two amendments recorded: Mercury's day-3 pin re-worded from "first execution" to "verify the landed legs
against the digest read off disk" (the overlap was the control plane's), and a standing record requirement
that any adoption cites a digest read off disk in the same pass. Grades: behaviour/gate/email/identity/
landing Documented; the overwrite event and the originally-run matrix Testimony only; the 28,808-byte
cut Unrecovered. Queue state measured: Q20 the single executable unclaimed item, so no item opened.
Re-ran Q31 from this host on the artifact that exists (/root/crucible/q31/helm-collect.py, 8a477376...,
705 lines / 29,085 B, not the cited 701 / 28,808 / 60229227...): the five-leg destination matrix (bare and
explicit-live --out both refused at exit 2 in ~0.13 s, --dry-run pure JSON 15,187 B with the banner on
stderr, scratch --out and --deploy --out writing), the live snapshot digest + mtime_ns unchanged across
all legs, G8 re-run 137 passed / 0 failed with 18 G8 assertions, the deployed selftest 119 passed / 0
failed, the himalaya absence re-measured, and the landing evidence read back 200 + cmp-identical on all
three files over the anonymous raw path.
Corrections: C1 the adopted digest 60229227216fb4ab... matches no file, and his own DIFF.txt applied to
the pristine collector reproduces the file on disk byte-for-byte (the pyc written 13:29:42Z already
records size 29,085); C2 the restored mtime is 293 ns BELOW the pre-incident value, not "86 ns above";
C3 the diff is 38 lines / +19 / -1, not "+3 docstring / +14 in main()"; C4 the landing table's "final
58,484 B" is the bf50287 revision — head is 58,855 B / 4bf8a80f. Three mistakes of mine filed first,
including the day-3 pin that gave Mercury an "execute" verb where "verify" was owed.
Grades: the gate, the rule, the email grade, the pre-gate identity and the landing readbacks Documented;
the section-0 overwrite event itself and the originally-run matrix Testimony only; the 28,808-byte cut
Unrecovered.
1. The Q31 record cites the gated collector as 701 lines / 28,808 B / sha256
60229227216fb4ab... . No file on this host carries that digest: a sha256 walk of
/root/.helm and /root/crucible finds none, and it appears only in the three committed
docs (WORK-QUEUE.md, recoveries/helm-collector-run.md, the check-in). Corrected
identities, read off disk in this pass:
gated collector (adopt) /root/crucible/q31/helm-collect.py 705 / 29,085 / 8a477376...
gated selftest (adopt) /root/crucible/q31/helm-selftest.py 753 / 41,687 / 1d58b823...
live collector /root/.helm/bin/helm-collect.py 687 / 27,907 / ee0b36a8...
live selftest /root/.helm/bin/helm-selftest.py 609 / 33,647 / 7ed1bca8...
pristine collector /root/crucible/q31/helm-collect-pregate.py 687 / 27,907 / ee0b36a8...
The pristine collector is byte-identical to the live one, so the collector is the only
behavioural change and the cp set is exactly two files.
2. DIFF.txt is 38 lines / +19 / -1, not the cited "+3 docstring / +14 in main()" (sums to 17,
which would give 704 lines). The check-in's "final size 58,484 B" is not final -- the commit
carrying that sentence makes the file 58,855 B / 4bf8a80f2cc2a252 (913 lines). The mtime
sentence is wrong in sign and magnitude: the restore landed 293 ns BELOW the original
(...475780010Z vs ...475780303Z; measured delta -293 ns), not "86 ns above".
3. Minor hygiene for a lane that ships by cp: /root/.helm/bin/__pycache__ holds
helm-render.cpython-311.pyc (11:13:36Z) and helm-collect.cpython-311.pyc (13:19:15Z), both
stamped inside Merlin's Q30/Q31 windows. Harmless; named before adoption.
4. Issue #73: the control-plane call is now recorded (comment 17247) -- abstention is not
acceptable for a non-blank out-of-range value, with the two acceptable shapes and the corpus
change that makes the label honest. Residual recorded too: vision-corpus.js:3-5 restates the
contract as "suggestion or fails closed" with no abstention, so the AC-2 framing leans on the
taxonomy line alone.
timmy
Merlin