troupe-standup/recoveries/helm-pill-both-directions.md

The pin pill in both directions — G13 row 1's demonstrated catch, and the false red no row could see

Run 35, Helm lane. Merlin, 2026-10-15T06:00–07:2xZ. Scratch /root/crucible/q64/. Deliverable: this record. Gate helm-selftest-q64.py (182,752 B / 3,464 lines / 142 registrations / sha256 6a887f42754a8d96a2e28e7f24df072a75c0820776a25a650bf414274ada990d), built from Run 34's shipped gate 94f9b3625e5791a7… (180,772 B / 3,432 lines / 141 registrations) at four asserted anchors: +1,980 B / +32 lines / +1 registration. Four twins and one control, each one to four asserted lines different. Subject collector 4e45021d80395d3f… / 29,954 B throughout.

Nothing was deployed: no cp into /root/.helm/bin/, no --deploy, no write to the live document root, no write anywhere under /root/.helm. Live state measured before and after every leg: delta 0 (bytes + sha256 + mtime_ns on all three objects). No another-party file edited; no secret printed; decisions/ and inbox/ untouched.

---

1. Why this unit

Run 34 closed G13 with one limit stated and left open in its own record: "Row 1 is green on all six cells today, so it has never fired. It is a real check (it compares three published objects), not a demonstrated catch." This run discharges that limit — and in discharging it finds the second one: the pill's truth was being checked in one direction only.

Two questions, both answerable with objects already on this host:

1. Is there a real state that makes row 1 fire? If not, row 1 is dead code and the record must say so.
2. Row 2 confirms a green pill against a fresh fetch. What confirms a red one? Nothing. A page whose pill says drift while the live body equals the held pin passes every row the lane has.

---

2. Ground truth, measured this run

python3 /root/crucible/q64/probe_r35.py, exit 0, and python3 /root/crucible/q64/make_cells_r35.py → R35-CELLS.json:

object	reading
live body (https://www.stackchainmagazine.net/, the snapshot's own URL)	HTTP 200 / 217,163 B / sha256 c34ae2c245117ca73ba5720b2c22b6fab689840070ff68cda7bffe3e723986d4
held pin /root/.helm/data/held/stackchain-home.html.sha256	120 B / f27326e8b13d1dec9eb158fe40e5091f79dcaf73b47312c4e7d3958ba1d95d18 stackchain-home.html pinned 2026-10-08T16:58:07.100Z / file sha256 5b6d70716153c3f4…
pin_matches_live_now	false — the live body differs from the held pin
snapshot stackchain_site.manifest_match / live_body_sha256 / evidence.observed_at	true / f27326e8b13d1dec… (the pin, not the body) / 2026-10-08T17:12:59.458Z — six days and change stale
deployed page /var/www/alexander-whitestone/helm/index.html	9,865 B / 427b7b54c69b18d2…, carries live body sha256 <span class="mono">f27326e8b13d1dec… and held copy <span style="color:#22c55e">match</span> (pinned vs live), as of ×0, not re-checked since ×0

Two consequences, stated because the record must not read around them:

• The page's line "live body sha256 f27326e8b13d1dec…" is a present-tense claim of a six-day-old frozen value. The live body is c34ae2c2…. This is the same defect class as the pill, one line below it, and it is covered by nothing — G10 owns the missing qualifier, G12 the pill's pairing, G13 the pill's truth. The hash line is read by no gate.
• manifest_match: true with live_body_sha256 equal to the pin is internally consistent only at the instant of collect. It is a frozen claim, and every gate that reads it reads a 2026-10-08 reading.

---

3. The cells

Three subjects (make_cells_r35.py → cells/, all readings at the run's clock 2026-10-15T06:07:22.000Z):

cell	built by	bytes / sha256	pill	published hash	vs held pin r1/r2/r3	vs fresh pin r1/r2/r3
deployed page (production, read-only copy)	the document root	9,865 / 427b7b54c69b18d2…	green match	f27326e8b13d1dec	PASS / FAIL / PASS	FAIL / PASS / PASS
r35-match-fresh.html	scratch renderer copy (SNAPSHOT repointed, Q45's class) on a scratch snapshot whose manifest_match is true and whose live_body_sha256 and evidence.observed_at are the real live body's hash and this run's clock	11,742 / 7e2a4cb677555ec8…	green match	c34ae2c245117ca7	FAIL / FAIL / PASS	PASS / PASS / PASS
r35-falsered-fresh.html	same renderer, manifest_match false, hash and clock real	11,742 / 0e0e20b52b73b341…	red drift	c34ae2c245117ca7	PASS / PASS / PASS	PASS / PASS / FAIL

Neither constructed cell is drift theatre: the hash is the live body's own digest measured minutes earlier, and the observation clock is the run's. The match cell is the state a correct re-collect produces; the falsered cell is the state a page reaches when the pill says drift while the held pin is the live body.

Finding 1 — row 1 has a real state, and it is the middle of the lane's own adoption sequence. helm-collect.py:647–662 (pin_stackchain) writes the held pin from the live body's hash and exits without rendering. So the sequence re-pin → (page not yet re-rendered) is reachable by running the collector's own --pin, and in that state the deployed page publishes f27326e8… while the held pin is c34ae2c2…. Measured on the first table's last two columns: row 1 FAIL, row 2 PASS. The catch is demonstrated, and it is not hypothetical — the lane's own §4 order is renderer → collector → re-collect → re-render → deploy, and between the re-collect (which can re-pin) and the re-render, the gate's offline row is the only thing that sees the discrepancy.

Finding 2 — the hole between the two rows. Row 2's predicate passes whenever the green pill is absent, so a page claiming drift is unverifiable by construction. The falsered cell against the fresh pin: row 1 PASS, row 2 PASS — and with the shipped gate as the subject, control-g returns rc 0, 191 passed, 0 failed, ALL GATES PASS. A false drift claim sails through the gate that exists to check the pill's truth.

---

4. The fix, and why it is not a fourth instrument

G13 gains row 3: a red pill is confirmed by a fresh fetch too — the body it claims to have drifted from must still differ from the live one. Predicate (_g13_red not in text) or (_g13_matches is False); when the fetch cannot be made _g13_matches is None, the row is red, and the reason is named in its own evidence line (measured, §6).

The three rows are transitively closed for the pill's class, which is the argument that no fourth row is owed: row 1 is page-published hash vs pin, rows 2 and 3 are pin vs live (green and red directions), and together they cover page-published vs live without ever fetching inside row 1. Row 2 subsumes G12 on the stale cell (Run 34's finding, unchanged); row 3 subsumes nothing and is subsumed by nothing.

---

5. The matrix

python3 /root/crucible/q64/run_matrix_r35.py → out/R35-GATE.json (20,078 B). Prediction stated in build_r35.py before the run; measured:

config	predicted	measured	verdict
shipped (q64)	rc 1, 190/2	rc 1, 190 passed, 2 failed (G10 deployed-page row, G13 row 2 live)	met exactly
shipped again	byte-identical stdout	identical after normalisation, residual 0	met
twinE — only _g13_pin repointed at the live body's own hash	rc 1, 189/3	rc 1, 190 passed, 2 failed — G10, and G13's failing row MOVED from row 2 to row 1 (row 2 flips to PASS)	the catch demonstrated; my count was wrong, §8
twinF — three page subjects at the match cell + fresh pin	rc 0, 192/0	rc 0, 192 passed, 0 failed, ALL GATES PASS	met exactly — the honest remediated end state, and the second configuration this gate has ever been able to pass (twinC was the first, on the drift cell)
twinG — falsered cell + fresh pin	rc 1, 191/1, row 3 only	rc 1, 191 passed, 1 failed — row 3 only, its evidence line reading unqualified_red_pill=True live_sha256=c34ae2c245117ca7 held_pin_digest=c34ae2c245117ca7 pin_matches_live_now=True	met exactly
twinH — same cell against the held pin (a true drift claim)	rc 0, 192/0	rc 0, 192 passed, 0 failed, ALL GATES PASS	met exactly — row 3 does not over-refuse an honest drift
control-g — the shipped q63 gate under twinG's exact repoints	rc 0, 191/0	rc 0, 191 passed, 0 failed, ALL GATES PASS	met exactly — the hole, measured: the false-red page passes the gate as it stands

The twinG / control-g pair isolates row 3 and nothing else: same three page subjects, same pin, the only difference the row's existence. Asserted in the runner (pair_isolates_row3: true).

Offline behaviour, measured not read. twinG with both proxies pointed at a dead port (offline_row3_r35.py, out/R35-OFFLINE.txt): rc 1, 191/1, sole failure row 3, fetch_error=URLError(ConnectionRefusedError(111,…)), pin_matches_live_now=None. A red pill that cannot be checked is refused, the same trade row 2 takes knowingly, and it will read as noise on a disconnected host — stated, not hidden.

---

6. Live state, delta 0 across all seven legs

Bytes + sha256 + mtime_ns, censused before every leg and after the last (out/R35-GATE.json, live_delta_empty_all_legs: true, per-object unchanged ×3):

• deployed page 9,865 B / 427b7b54c69b18d2…
• snapshot 14,039 B / aa842b0fd88037f8…
• held pin 120 B / 5b6d70716153c3f4…

Deployed /root/.helm/bin/ untouched (five digests re-read) and grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py = 0, so Q40 stands and nothing of Q31–Q63 is in production. Sandboxes 0/0/0 before and after. Disk 41 G free of 154.

---

7. Adoption — four files, one order, unchanged in kind

adopt renderer 306d4bee… (22,731 B) → adopt collector 4e45021d… (29,954 B) + gate 6a887f42… (182,752 B) → re-collect → re-render → deploy.

The gate supersedes 94f9b362… (Run 34's) and everything before it. The acceptance criterion is unchanged and now demonstrated twice: the sequence is done when the gate reaches twinF's shape, rc 0 / 192 passed / 0 failed / ALL GATES PASS. The re-collect is load-bearing twice over — G13's live row stays red until a collect recomputes manifest_match against the live body, and Finding 1 shows the re-pin inside a collect can leave the page and the pin disagreeing until the re-render lands.

Standing, unchanged and still human-gated: that cp; the stale manifest_match pin (measured false, three times now, on three instruments); the Q13 publication call; Q9's checksum handover; Q19's onboarding. No queue item opened.

---

8. Defects of mine, logged first

1. My own prediction for twinE was wrong and internally contradictory. It read "189 passed, 3 failed (G10, G13 row 1; row 2 flips PASS)" — two named failures is 190/2, not 189/3. The measured result is 190/2 with the failing G13 row moved from row 2 to row 1, which is what the sentence's second half says and its first half does not. No finding depends on the count; the row-level prediction (row 1 fires, row 2 passes) was met exactly.
2. The first cell set rendered the STALE cell, not the remediated one. The scratch snapshots kept the live snapshot's evidence.observed_at of 2026-10-08, so a cell rendered at today's clock carried a six-day age and the renderer appended not re-checked since — twinF came back 191/1 red on G12, and I nearly recorded the remediated state as unpassable. The cause is the renderer's own rule (helm-render-plain.py:329), the same rule Run 34's G10 fix was built around; the fix was to stamp the observation clock with the run's clock, because that is what a re-collect does. The cells are 11,742 B now against 11,806 B in the first set.
3. The matrix runner's first run died on its own artifact. pair_isolates built a set and json.dumps refused it, so out/R35-GATE.json did not exist until the second run. The figures above are from the run that wrote the artifact; the first run's stdout agreed with it cell for cell, which is why the second run was a re-run and not a re-measurement.
4. run_matrix_r35.py's docstring still carries the original twinE prediction (189/3). Left as written, because a prediction edited after the run is not a prediction.

Limits, stated as the item's first limits:

• Row 3 needs the network, like row 2. Offline it is red with the reason named — the conservative direction, and noise on a disconnected host.
• The three rows detect and cannot repair. The remedy is still re-collect → re-render → deploy, an operator's call under §4.
• The pill's substance is still the collector's frozen field. These rows make a false pill visible; they do not make the field fresh.
• The page's "live body sha256" line — a present-tense label on a frozen value — is now covered transitively through the pin, but nothing checks the label itself. A renderer-side wording fix ("last checked body sha256, as of …") would retire the class at the source; it is a live-page change and therefore Alexander's, alongside Q13's.

— Merlin (Run 35), Helm lane