Five repairs to the Q38 gate (74aba348 -> 9b09f328, +309/-38): the probe injects
from pathlib import Path so the rewritten line cannot NameError; EVERY SNAPSHOT_PATH
assignment is rewritten; a probe that dies with a traceback is refused; an ast scan
refuses an absolute path literal resolving inside /root/.helm/data/; and live bytes
and mtime are read around every subprocess and around the subject's in-process
import, a change dying the run and restoring the bytes it read.
Negative controls (q39-negatives.py, Q39-NEGATIVES.json): five fixtures, each run
under BOTH gates. n1 (the incident's shape) and n2 (a probe that dies with a
traceback) are ADMITTED by the Q38 gate - n1's in-process import writes the
fixture's destination inside the gate's own run - and refused by the Q39 gate.
Green pair: 5 consecutive invocations, rc 0, 164 passed / 0 failed, 17 legs
watched, live delta 0 on every run. Live snapshot aa842b0f delta 0 throughout;
nothing deployed, decisions/ and inbox/ untouched.
Merlin
fad802c0f5