# G12 — the deployed page's pin pill

*Helm lane, Run 33, 2026-10-15. Merlin. Scratch tree `/root/crucible/q62/`.
Nothing deployed: no `cp` into `/root/.helm/bin/`, no `--deploy`, no write to the live
document root. `decisions/` and `inbox/` untouched. No another-party file edited. No secret
printed.*

---

## 1. The gap, measured before anything was built

`/root/crucible/q62/probe_pill.py` (1,963 B / sha256
`0d124eaee1096b7358caa5e018eae394223bd24fefd962269d15b4eeb5583328`, 51 lines) → `out/PILL-PROBE.json`,
`generated_at 2026-10-15T01:12:21+00:00`.

The deployed page `/var/www/alexander-whitestone/helm/index.html` is **9,865 B / sha256
`427b7b54c69b18d270288910fc810732463129f48ec4bdd7dbc75cdb22997ce4` / mtime_ns
`1791709034017837233`**, and its manifest cell reads, verbatim:

```
<div class="kv">held copy <span style="color:#22c55e">match</span> (pinned vs live)</div>
<div class="kv dim">https://www.stackchainmagazine.net/</div>
```

with `as of ` occurring **0** times and `not re-checked since` **0** times. There is no
qualifier line at all.

G10 reads that file and checks the **qualifier**. G11 conditions the **pill** but only on
scratch renders under `/root/crucible/q59/`. `grep -n 'held copy'` over the shipped gate
`125754b270bf…` (161,122 B / 3,053 lines / 135 registrations) returns exactly three hits —
`:2841` G10's negative literal, `:2882` a comment, `:2893` G11's constant — and **none of
them is read off the deployed path**. So the pill half of the cell G11 exists to forbid is
unguarded on the one artifact the public reads.

## 2. First predicate: falsified by measurement before it shipped

The obvious rule is *a page presenting a pin pill must state the clock behind it*:
`("held copy" not in text) or ("as of " in text)`. It is **redundant**, and redundancy in a
gate is not a cosmetic flaw — it is a gate that cannot fire while its sibling is green, which
is theatre. `/root/crucible/q62/distinguishing_cell.py` (3,071 B / `c4b9b9dacd64dd61…`, 73
lines) proves it:

| body | G10 | G12 (first form) |
|---|---|---|
| today's deployed page (9,865 B) | False | False |
| real current-generation stale render (11,819 B / `951a8a76…`) | True | True |
| that render with the amber pill swapped to unqualified green (11,806 B / `3f48643d…`) | **True** | **True** |
| amber pill, no qualifier | False | False |
| qualifier, no pill | True | True |

G12-fail implies `"as of "` absent; G10-fail is `"not re-checked since" absent OR "as of "
absent`. So **every body the first predicate refused, G10 already refused** — and the swapped
body, a green "match" beside a five-day-old disclaimer, walked through both unreported. That
is the exact defect the control plane named on 2026-10-14, and the first predicate could not
see it. Logged rather than hidden; nothing was shipped in that form.

## 3. The distinguishing cell is a real artifact, not a string I built

`/root/crucible/q62/standin_from_production.py` (2,068 B / `5cbfff139f562a68…`, 52 lines):

- `/root/crucible/q59/helm-render-plain.py` is **byte-identical to the renderer in
  production** — both 21,766 B / sha256
  `5c67473d89283c3d4434928dc96d45ff48a41d8f443ecc3c98e9236be8b597f9`. So the unpatched
  renderer is not a scratch toy; it is `/root/.helm/bin/helm-render.py`.
- Rendering it at `--as-of 2026-10-14T16:00:00.000Z` emits **11,806 B / sha256
  `3f48643d8e7bac77020674198e6be78a35f27a0fec71b400d718b52b88ca4ad7`**, rc 0, carrying
  `as of ` ×1, `not re-checked since` ×1 and the **unqualified green pill** ×1.

The digest is the same one the string substitution produced. So the body that passes G10 and
fails G12 is an artifact **production would deploy**, not a construction of mine.

## 4. The corrected predicate, and why the two gates are complements

> An unqualified green pin pill must never appear beside a staleness disclaimer.
> `not (unqualified_green_pill and "not re-checked since" in text)`

- **G10 owns the missing clock.** Today's page: green pill, no as-of, no disclaimer. G10
  refuses it; G12 correctly **passes** it.
- **G12 owns the incoherent pair.** Green pill *and* a disclaimer saying the reading was
  never re-checked. G10 **passes** it — both of its strings are present — and G12 refuses it.

The mechanism is structural, not stylistic: the pill's colour and label come from the
**frozen** `manifest_match` field (`helm-render.py:323`, `:326`) while the qualifier beside it
is computed at render time (`:343`–`:346`). The two can disagree, and nothing read the pair
together on the artifact the public reads.

## 5. The gate

Built by `/root/crucible/q62/build_g12.py` (3,600 B / `3af733da5b73773a…`, 84 lines) from the
shipped gate `125754b270bf…` plus `patch_g12.py` (10,930 B / `12ca3ecbb29d6409…`, 203 lines),
inserted at the single `# ---- report` anchor (asserted count 1).

| artifact | bytes | lines | registrations | sha256 |
|---|---|---|---|---|
| `helm-selftest-q62.py` (shipped) | 171,979 | 3,256 | **138** | `4b18329c7437bec4c5c05be86ddd8376a7396eda9c97739410b1ab5952e4d270` |
| `helm-selftest-q62-twin.py` | 171,982 | 3,256 | 138 | `0fc58aabfb8d9345ff80be1e4a24bbfca7f64518b938349ff1297d06504e2be5` |
| q59 gate (base) | 161,122 | 3,053 | 135 | `125754b270bf6b0f55911f407fa9c36c6161b45a71e646fa36a70db096d7de93` |

138 = 135 + 3. The twin differs on **exactly one line** (asserted, not claimed): line 3073,
`_g12_deployed` repointed from the live path to
`/root/crucible/q62/out/g12-standin-deployed.html` (11,806 B / `3f48643d…`, the production
renderer's own stale output).

Three checks, in this gate's house style:

1. **the deployed artifact** — the pill the public reads must not claim a green match beside
   its own staleness disclaimer. Green today, because G10 owns that page's defect; the
   detail string says so rather than implying the gate found nothing.
2. **the discriminator** — the production renderer's stale output violates the rule *while
   G10 passes it*, and the patched renderer's stale (`951a8a76…`, 11,819 B, amber pill) and
   fresh outputs both satisfy it. So the rule refuses the incoherent pair and not green.
3. **read-only** — bytes + sha256 + mtime_ns identical around all four legs.

## 6. The run

`/root/crucible/q62/run_gate_q62.py` (5,192 B / `e58a56d453c5de66…`, 127 lines) → `out/R33-GATE.json`
(6,453 B / `1a1744774ce3652f…`), `generated_at 2026-10-15T01:20:11+00:00`,
`HELM_COLLECTOR=/root/crucible/q48/helm-collect.py` throughout.

| leg | rc | verdict | stdout | G12 rows |
|---|---|---|---|---|
| shipped-1 | 1 | `187 passed, 1 failed` | 16,212 B | 3 PASS |
| shipped-2 | 1 | `187 passed, 1 failed` | 16,212 B | 3 PASS |
| twin | 1 | `186 passed, 2 failed` | 16,583 B | 2 PASS, 1 FAIL |

**The prediction, stated before the run and met exactly:** shipped 187/1 with the sole
failure G10's deployed-page row; twin 186/2 adding G12 row 1. The twin's G12 row is red
against a body that is a real production artifact, so the shipped gate's green row is a
property of the deployed file and not of the predicate.

- The twin's remaining failure is G10's row, unchanged — `deployed=… exists=True bytes=9865
  sha256=427b7b54…`, i.e. the same defect, now seen by two gates from two directions.
- **Byte-stability:** `g12_lines_identical_across_shipped_runs: true`;
  `stdout_bytes_identical: true`; `stdout_sha_identical: false` with the cause measured —
  `mkdtemp` suffixes. `stdout_identical_after_sandbox_normalisation: true`,
  `residual_differing_lines_after_normalisation: 0`, normalised stdout sha256
  **`7a080e1616fb20e3e9685d67cb121b9a8af35614a7edba7b649aeca62e2612d0`**.
- `live_moved: {}` on all three legs; `sandboxes_after: []` shallow and recursive on all three.

## 7. A defect of mine, logged first

`run_gate_q62.py`'s normaliser first matched `(helm-legs-|/tmp/tmp)` only, but this host's
TMPDIR is `/root/.hermes/profiles/merlin/cache/scratch`, so the two `mkdtemp` suffixes the
gate prints live under that prefix and were invisible to the pattern. It reported
`stdout_identical_after_sandbox_normalisation: false` with `residual 2` — a true figure with
no characterisation behind it, which is this lane's own logged class.
`/root/crucible/q62/residual_lines.py` (1,627 B / `17b8408dd57b0ace…`) printed the two lines:
`tmp1prcmj7c` vs `tmph8sr6_e0` and `q31-g8-deploy-ltgw0sri` vs `q31-g8-deploy-_j2jdsam`.
`residual_lines_fixed.py` (2,188 B / `62ddacff0b63f762…`) shows the old pattern leaves 2 and
the corrected one leaves 0. The runner was then patched and re-run, and §6's figures are the
corrected ones. **No G12 row and no verdict depended on the defect** — the G12 rows were
byte-identical across both shipped runs under either pattern.

## 8. Live state, delta 0

`/root/crucible/q62/measure_final.py` (2,702 B / `47d475ed7172c469…`, 74 lines) → `out/R33-FINAL.json`
(48,975 B / `7b3801eb20385144…`), `generated_at 2026-10-15T01:20:25+00:00`. Unchanged on
bytes + sha256 + mtime_ns across every leg of this run:

| object | bytes | sha256 | mtime_ns |
|---|---|---|---|
| deployed page | 9,865 | `427b7b54c69b18d270288910fc810732463129f48ec4bdd7dbc75cdb22997ce4` | `1791709034017837233` |
| snapshot | 14,039 | `aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d` | `1791479579475780303` |
| held pin | 120 | `5b6d70716153c3f4bd82045d5d71edf88f793a240ce1275c3dfca5759d0ee297` | `1791478687099553071` |

- Deployed `/root/.helm/bin/` untouched: `helm-collect.py` 27,907 B / `ee0b36a82f23fcf3…`;
  `helm-render.py` 21,766 B / `5c67473d89283c3d…`; `helm-selftest.py` 33,647 B /
  `7ed1bca8f9da624f…`; `helm-validate.py` 3,556 B / `12570786ba703787…`; `summarize.py` 1,463 B /
  `7386999867789694…`; `__pycache__/` holds four `.pyc` files an adoption must not copy in.
- `grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py` = **0** — Q40 stands, so nothing of
  Q31–Q62 is in production.
- Sandboxes: 0 shallow, 0 recursive, 0 `helm-g12-*`.
- Repo: `main` at `07fdaf9c8cbaff8cc01f3dc6dc065eecb0070f16`, worktree clean,
  `git ls-remote origin main` identical; **102** merlin-authored commits before this run's push.
- Disk 41 G avail of 154 (74 % used).

## 9. Limits

- The gate reads the deployed artifact but cannot make it current; the remedy is
  **re-render and deploy**, an operator's call under §4. G12 detects, it does not repair.
- G12's predicate is about the *pair*, not about whether the pin actually matches. That is
  the collector's `manifest_match` job at collection time, and it is frozen by design.
- No fuzzer: the enumerated render set only (patched stale, patched fresh, production stale).
- The payload's `raw <` / `&` handling is Q29's territory and not revisited here.
- No X page fetched this run.

## 10. Testimony only

None. Every figure in this record came from a command in this run, and each artifact carries
its own digest above.

## 11. Standing, unchanged and still human-gated

The §4 adoption `cp` — now collector `4e45021d80395d3f…` + gate `4b18329c7437bec4…` (this
run's, superseding `125754b270bf…`) — the stale `manifest_match` pin, the G10 re-render,
Q13's publication call, Q9's checksum handover, Q19's onboarding. **No new item opened:** the
Helm executable set was empty at the start of the run by both this lane's and the pipe's
measurement, so the unit taken was the one defect the lane had measured and labelled but
never fixed.