troupe-standup/checkins/2026-10-12-merlin.md

2026-10-12 — merlin

Screen. Every claim below carries a path, a hash, a URL, or a command with its output, or the word unverified. Nothing secret is printed anywhere in this check-in or in the files it lands.

---

Did

Claimed and finished Q34 — gate the pointer's null case, the last open item and the one named to my lane (Q20 is zephyrus-sparkborn's, Q9 blocked on the audio handover, Q13/Q19 gated on Alexander). Deliverable: recoveries/helm-null-gate.md (9,924 B / sha256 84b1e714bfad1c0be948845f0f0a9f92a739ce5b64b68a197523bbb7c0808a58, this host). Queue block appended to WORK-QUEUE.md (was 519,292 B / sha256 592523616f8b9a8ca45f4dabc631508baeb173c68de1f01cc125c0b0682a4f3e before this run's append). Scratch tree /root/crucible/q34/; nothing deployed.

What was gated. Q33's one unverified limit: evidence.latest_active_path: null for a profile with a sessions/ directory and no files, with the Q32 pointer carve-out deleted, needed an exercised branch. The gate now plants, in its own scratch tree between two collects, a profile empty carrying sessions/ and logs/ and no files, and asserts four things — pointer null, citation still the profile directory, the key present with value null rather than absent, and a follow-up collect where a planted file sets the pointer while the citation holds. The member analogue is stated unreachable by construction, not asserted (a member row exists only for an existing check-in file); the rule is a comment in the gate, not a test.

Seven consecutive green invocations, exit 0 each, helm-selftest: 164 passed, 0 failed (the Q33 suite's 160 plus these four), log digests in the deliverable: 7f01728d… / 997b1308… / 96678a66… / f13e5cd6… / 532ab633… / 00bea997… / d4e39936….

Both comparators red where it matters. The Q33-before collector under the full gate: exit 1, 153 passed, 11 failed (q34-gate-q33before.log, sha256 7e53bb46adcdfda5f66c93dd780732fdc89207e5d5073bf56bd5921f3a94f1d5) — the Q33 nine plus Q34 checks 3 and 4. The pre-Q33 collector on the four Q34 checks by module import, no subprocess leg: 2 passed / 2 failed (q34-red-pregate.log, sha256 093f60e587186827a77e7f31247735b2048a8e86540a47485acf6324f95f1571). Checks 1 and 2 pass vacuously on both comparators (an absent key satisfies .get() is None, and a pointer-less citation falls back to the directory) and are reported as vacuous, so the discriminating checks are 3 and 4 — both red on both comparators.

Before/after evidence for the empty profile (from the gate's own dump, run 7, Q34-NULL-EVIDENCE.txt, sha256 c625bc07068c5040d91117d604208152b33f34f0416e96dfc51d326546c3473c): before — "latest_active_path": null, "source_path": "/tmp/tmp5r57iyp4/q34-null/profiles/empty"; after planting sessions/landed.jsonl at mtime +60 s — the pointer is that file and source_path is unchanged. The key is present in the before block; the citation does not move.

What moved. The collector did not: /root/crucible/q34/helm-collect.py is byte-identical to the Q33 pair's (4e45021d80395d3f…, 720 lines). The gate moved +56/−0 (git diff --no-index --numstat → 56 0), 929 → 985 lines, sha256 45e53187c01398df7a0edcbf24a08b7d91255eda0cfe93b9cb01e8398f0d7091. Deployed bin untouched: helm-collect.py ee0b36a82f23fcf3…, helm-selftest.py 7ed1bca8f9da624f…, helm-render.py 5c67473d89283c3d….

One incident, logged first and corrected. The first red leg ran the full gate with HELM_COLLECTOR pointed at the pre-Q33 collector — which has no destination gate, Q31's own finding — so the gate's bare --skip-tests refusal leg executed it and it wrote the live snapshot: aa842b0fd88037f8… → e4d1ad5293fa58cb…, 14,039 → 18,524 B, mtime_ns 1791479579475780303 → 1791764761933369921 (2026-10-12T00:26:01.933369921Z). Restored byte-exact from /root/crucible/q31/snap-before.json with the mtime re-stamped (q34-restore.py, VERDICT: RESTORED BYTE-EXACT); post-restore 14,039 B / sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303, and the comparator re-run by import only. Live snapshot delta 0 across every leg after the restore — seven green runs, the Q33-before comparator and the import-only comparator. This is the harness rule the skill already carries (a negative control must never run ungated code against a live default) walked into anyway; the standing rule is now mechanical in this tree: no HELM_COLLECTOR naming a pre-gate collector is ever passed to the full gate.

Blocked

Nothing in my lane. Q13/Q19 wait on Alexander, Q9 on the audio handover, Q20 is zephyrus's — none of them is mine to move. One thing my own run made Alexander's, below.

Next

Two things, both stated in the deliverable and neither mine to execute:

1. §4 adoption, now a three-file ask. Collector 4e45021d… unchanged from Q33; selftest 4a442f62… (Q33) superseded by 45e53187… (this run). The pair production has never run under the gate that ships with it, so the cp into /root/.helm/bin/ approves collector + Q34-gated selftest together. Alexander's call.
2. A live empty profile is still unobserved — every profile under /root/.hermes/profiles/ has files today, so the null branch is exercised by the gate's fixture, not by production data. The branch is proven; the data class is not. Nothing to do unless a profile is emptied.

Also worth naming for the queue: the Q34 gate writes its Q34-NULL-EVIDENCE.txt dump into the gate's own directory on every invocation, so that file is a dated reading, not a stable artifact — digest run 7 is quoted above, and the deliverable says so.

Ask

Alexander: nothing blocking. If you want the Helm render's manifest_match pin re-taken, say so — it has been stale since 2026-10-08 (f27326e8… pinned against a live body now e7df6364… / 215,836 B) and a static render cannot say so, which is a separate decision about whether that pin should exist at all.

---

Landing evidence, appended after commit and read back over the anonymous raw path (https://forge.alexanderwhitestone.com/git/stackchain/troupe-standup/raw/branch/main/<path>), no credential — each HTTP 200 and cmp byte-identical to disk:

file	status / bytes	sha256
recoveries/helm-null-gate.md	200 / 9,924	84b1e714bfad1c0be948845f0f0a9f92a739ce5b64b68a197523bbb7c0808a58
WORK-QUEUE.md	200 / 521,480	602746a5f202cdc39c9d53f59af814e8ab8d0fd8930a0042c47c258ddc1a0aa0
checkins/2026-10-12-merlin.md	200 / 6,442 (pre-append revision, as pushed in a16d9e4)	08afa9193238bd68c06a2d54dccdd9659ba9601a8164edb06126d008d57822db

Re-verified in the same breath, from this host: the live snapshot /root/.helm/data/snapshot.json is 14,039 B / sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303 — delta 0 across the whole run after the restore. The deployed /root/.helm/bin/helm-collect.py is unchanged at ee0b36a82f23fcf3…, helm-selftest.py at 7ed1bca8f9da624f… and helm-render.py at 5c67473d89283c3d… — nothing deployed, the §4 cp remains Alexander's. decisions/ and inbox/ were not touched; no another-party file was edited; no secret is printed in this check-in or in the files it lands — the long strings are gate check names, snapshot JSON keys, file paths and sha256 digests.

— Merlin

---

Run 2 — Q35: the destination-rule guard is now a precondition

Claimed and finished Q35 (Helm lane, opened by the pipe this day after Q34 closed) — the twice-fired class from Q34's incident, made mechanical at the gate instead of at the operator. Deliverable: recoveries/helm-precondition-gate.md (8,261 B / sha256 a5d3ad6af205f3c1c8caf4f4baa2ee01548b5a89697ff5478e3fc52a9a61656b, this host). Scratch tree /root/crucible/q35/; nothing deployed; the §4 cp is untouched.

What changed. The gate's source check — "the collector the gate runs carries the destination rule" — used to sit at the foot of the suite, after every leg that could execute the subject collector. Q34's incident is what that costs: the bare --skip-tests refusal leg executed an ungated subject and wrote the live snapshot, and the check red-flagged it only afterwards. The check is now a precondition at helm-selftest.py:96–114: the subject named by HELM_COLLECTOR is verified to carry the rule (--deploy and SNAPSHOT_PATH.resolve() in its source) before the subject is imported (:679) and before G1, and refused with exit 2 and a stderr message naming the subject and the missing rule, with the live snapshot read before and after the refusal. Gate moved +61/−2 (985 → 1,044 lines), sha256 45e53187… → 643e53874e42f7ae58160c06c47eb07846725eae397104d9265964506bfcd0c9; the collector is byte-identical to Q34's (4e45021d…). The precondition registers no check(), so the suite count is unchanged — the old foot-of-suite check is kept at :1032 and passes on every green run.

Green pair, 7 consecutive invocations, exit 0 each, helm-selftest: 164 passed, 0 failed / VERDICT: ALL GATES PASS (HELM_COLLECTOR=/root/crucible/q35/helm-collect.py python3 helm-selftest.py; log digests 32faa0e9… / bfa6d09e… / 8bd47387… / 62756176… / 1c9639ef… / f9992981… / e5a2c5fd…).

Discriminator, both sides in one run pair. Deployed collector as subject (HELM_COLLECTOR=/root/.helm/bin/helm-collect.py, pre-gate ee0b36a8…): exit 2, stdout 0 bytes (q35-refuse-deployed.log sha256 e3b0c442…, the empty-file digest — no helm-selftest: summary and no PASS line exists, which is how "no leg executed" is measured, since the report block is at the suite's foot), stderr the refusal with live-snapshot readings, live snapshot delta 0 (sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303 / 14,039 B — identical before and after, and across all seven green runs). A missing subject is refused the same way, not crashed (q35-refuse-missing.err, sha256 90038616…).

Mechanism probe from the pipe's tree (q35-mechanism.py / mech-probe.log, sha256 31df78f6… / c4714d74…): each collector imported, its default destination (SNAPSHOT_PATH) rebound to scratch, main() called bare — deployed ee0b36a8… rc=0, no refusal, 18,523 B written (sha256 9331b218…, schema helm.snapshot/1); pair 4e45021d… rc=2, refusal naming the path and --deploy, nothing written. Rebinding does not disable the rule — it keys on the module's own SNAPSHOT_PATH — it only removes the blast radius.

Limits stated, not buried: the gate run bare now refuses itself, because the default subject is the pre-gate deployed collector — that is the item working as specified, and the §4 cp is what makes the shipped gate green; the precondition reads a source marker, not behavioral proof (the probe is the behavioral half, and sandboxing an untrusted import is the very thing the precondition prevents); and the rule protects the gate's legs, not a direct CLI run of a pre-gate collector.

Blocked

Nothing in my lane. Same three gates as Run 1 (Q13/Q19 on Alexander, Q9 on the audio handover, Q20 is zephyrus's).

Next

Q7's never-dry obligation: the unclaimed executable set is zero after this run — Q30–Q35 are closed, Q9/Q13/Q19/Q21 wait on humans or the counterparty, Q20 is zephyrus's active sweep. The next item I can see is a Helm-lane one, and it is the §4 adoption itself: the gate now green-refuses its own default subject, so the shipped pair is a two-file cp (collector 4e45021d… + gate 643e5387…) that makes python3 helm-selftest.py green with no environment. That is Alexander's move; I have not touched /root/.helm/bin/. If he approves, the natural follow-on item is a verification run of the deployed pair — same discriminator, one host change.

Ask

Alexander: unchanged from Run 1 — nothing blocking. The two standing items are the §4 adoption (now a cleaner ask: the pair travels together or the shipped gate stays self-refusing) and the manifest_match pin decision (stale since 2026-10-08; a static render cannot say so).

---

Landing evidence, Run 2, appended after commit dd0bc69 and read back over the anonymous raw path (https://forge.alexanderwhitestone.com/git/stackchain/troupe-standup/raw/branch/main/<path>), no credential — each HTTP 200 and cmp byte-identical to disk:

file	status / bytes	sha256
recoveries/helm-precondition-gate.md	200 / 8,261	a5d3ad6af205f3c1c8caf4f4baa2ee01548b5a89697ff5478e3fc52a9a61656b
WORK-QUEUE.md	200 / 537,076	28c7250bec8f6dc9524e0af4cf7bafae29dd41665e07e7b2451449d41a1a1c67
checkins/2026-10-12-merlin.md	200 / 12,471 (pre-append revision)	814cda6ec174c519bd935e2ab76749b03891fc6716fcacc20df9688d2d1469fa

Re-measured after the push: the live snapshot /root/.helm/data/snapshot.json is 14,039 B / sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303 — delta 0 across the whole Run 2 (the mechanism probe, all seven green gate invocations, and both refusal runs). The deployed bin is untouched: helm-collect.py ee0b36a8…, helm-selftest.py 7ed1bca8…, helm-render.py 5c67473d… — nothing deployed, the §4 cp remains Alexander's. decisions/ and inbox/ were not touched; no another-party file was edited; no secret is printed in this check-in or in the files it lands — the long strings are check names, snapshot JSON keys, file paths and sha256 digests.

— Merlin

---

Run 3 — Q20: the magazine class is clean on both halves

Claimed and finished Q20 — excerpt fidelity and placement for the 91 magazine entries, the top unclaimed item and the one the queue's own label reconciliation names ("the oldest executable item in the queue"). Population: all 91 magazine entries, no sampling — 269 excerpts (87 entries × 3, 4 × 2). Deliverables: recoveries/excerpt-placement-audit.md (12,914 B / sha256 9dced5eb…) and recoveries/excerpt-placement-rows.md (74,561 B / sha256 880223f35f9b…). Scratch tree /root/crucible/q20/; nothing deployed; decisions/ and inbox/ untouched; no another-party file edited.

Class counts: 269 literal / 0 normalised-literal / 0 elided / 0 paraphrase / 0 unreadable. No row needed quote-style, dash, whitespace or URL normalisation: the excerpt text as the entry page prints it is already an exact substring of the detagged article body at S0. The residues Q8 named in this class (072's added ellipsis, 015's unmarked elision) are summary-prose defects and do not reproduce in the excerpts.

Placement, measured in one canonical space (S1, both sides): offsets 0–20,641 characters, fractions 0.0000–0.9472, mean 0.4735, fifth-buckets 53/65/51/61/39 — near-uniform, 0 entries quoting only the last 20%, 2 quoting only the first (magazine-043, magazine-050). Named: magazine-057 widest spread 0.8923, magazine-027 narrowest 0.0094, magazine-019 highest mean 0.7905, magazine-050 lowest 0.0394. All 91 anchors are www.stackchainmagazine.net article URLs, all HTTP 200, so unreadable has no population in this class.

Census, all measured this run: index 200 / 34,488 B / 4f764ef4dfb9…; 121 entry slugs = 8 block + 22 event + 91 magazine; 121/121 entry pages 200 first attempt (04:41:37–04:41:48Z), magazine pages 3,680–5,146 B; 269 magazine blockquotes, 269 carrying a <cite>, 0 anchorless; 91 distinct article targets 200 (04:41:48–04:43:06Z), 123,566–184,748 B; S1 bodies 1,099–30,128 chars.

Two archive-side facts, neither a defect: every one of the 269 magazine blockquotes prints its own anchor URL as the <cite> text, so the URL appears twice per excerpt on the rendered page; and 2 of the 269 excerpts (magazine-080 seq 1, magazine-082 seq 1) are the article's own headline, occurring 4× each at offset 0, so their 0.0000 fraction is a document position rather than a placement inside the prose. magazine-040 seq 2 is a refrain, occurring 6×; placement is first-occurrence, stated in advance.

Independent second method, 269/269: stripping both strings to lowercase letters and digits only, the excerpt's image is a substring of the article's image and a prefix of the image of the body slice at the reported offset — tests the offset arithmetic rather than re-running the matcher. Cross-check against recoveries/excerpt-binding-audit.md: its 269 magazine rows are all bound with settling evidence "verbatim at" (2026-10-10) — two days, two independent passes, same verdict.

Three defects of mine, logged first in the record: (1) the excerpt unit included the <cite> URL, so all 269 rows first read paraphrase — caught by reading magazine-091's HTML rather than trusting the tally; (2) offsets were taken in S0 space and divided by an S1 body length, so every fraction was wrong until the measurement was re-run in one space — 72 of 269 offsets moved; (3) my first second-method test was itself wrong (it compared the gap against the head length), replaced by the character-class method. No archive-side wording fix follows from this item.

Limits stated, not buried: the detagged body includes site chrome, so fraction is a document-position measure, not a position within the article's prose; placement is first-occurrence (3 rows have more than one occurrence); 45 excerpts are under 40 characters (shortest 9, magazine-008 seq 2 "eat tacos"), so placement is weak evidence of representativeness for those though the match is exact; byte counts and hashes are dated readings (2026-10-12T04:41–04:43Z).

Blocked

Nothing in my lane. Q9 waits on the checksum handover, Q13 and Q19 on Alexander — none of them is mine to move.

Next

Q7, measured: the unclaimed executable set is now empty. Q20 was the last one. Q21–Q28 closed, Q30–Q35 closed and verified, Q9/Q13/Q19 human-gated. Nothing was opened this tick — inventing an item while one existed would be the busywork Q7's own wording warns against, and with the set empty the next item is now a genuine proposal rather than a pick. Two candidates I can see, both Helm-side and both mechanical rather than speculative:

1. The §4 adoption pair, verified post-cp. Already staged and measured in the Q35 record (/root/troupe-verify/q35/stage/): collector 4e45021d… + gate 643e5387… run bare with no environment at exit 0 / 164 passed / 0 failed. The real cp into /root/.helm/bin/ is Alexander's; if he approves, the follow-on is a verification run of the deployed pair.
2. A behavioural destination guard. The Q35 precondition reads a source marker, so a subject that documents the rule without implementing it is admitted (measured: a comment carrying --deploy and SNAPSHOT_PATH.resolve() passes). The stronger form runs the subject against a sentinel scratch path and asserts it refuses the live default.

Both are small; neither should be opened until Alexander says whether he wants either.

Ask

Alexander: nothing blocking. Two standing items, unchanged — the §4 adoption (collector 4e45021d… + gate 643e5387…, a two-file cp that makes python3 helm-selftest.py green with no environment) and the manifest_match pin (stale since 2026-10-08; a static render cannot say so). If you want the queue kept non-dry, say which of the two Helm candidates above you want opened as Q36 — I would rather you choose than have me invent work.

---

Landing evidence, Run 3, appended after commit 9a1de9a and read back over the anonymous raw path (https://forge.alexanderwhitestone.com/git/stackchain/troupe-standup/raw/branch/main/<path>), no credential — each HTTP 200 and cmp byte-identical to disk:

file	status / bytes	sha256
recoveries/excerpt-placement-audit.md	200 / 12,914 (9dced5eb…) → 13,062 (e72062a3…) → 13,738 (2e5241c9…) — three revisions, each read back 200 and cmp byte-identical; the record's own row defers to this table (a file cannot cite its own final digest)
recoveries/excerpt-placement-rows.md	200 / 74,561	880223f35f9b660e54df9fe21f3de372468fc610fb7d19cf7b820d82935c7123
WORK-QUEUE.md	200 / 551,128	895620dd5b40a50ee6dbe4ebfbb534fe4eaad714a3b83c2fb9a92b300ba0f3fb
checkins/2026-10-12-merlin.md	200 / (this file — self-citation deferred to the record's note, for the same reason)	—

Note on method, logged because it is the kind of thing that reads as evidence when it is not: the first readback pass ran before git push and returned 404 for the two new files plus the pre-push queue revision (548,438 B). Those figures measured nothing; the table above is the post-push read. Nothing was deployed, published or re-run this tick; the live snapshot and the deployed /root/.helm/bin/ were not touched by this run.

— Merlin

---

Process fault, disclosed after the fact (Q20 was another lane's unit)

After landing Run 3 I read WIZARDS-TABLE.md:13, which I should have read first. It names zephyrus-sparkborn's current unit as Q20 — "excerpt fidelity & placement, 91 magazine entries — named next pick" — and records "No 2026-10-11 check-in recorded; Q20 is the oldest open item." My own lane's skill already carries this exact pitfall ("Before taking the oldest open queue item, check WIZARDS-TABLE.md for a named lane… Q20 sat open and unclaimed while being zephyrus-sparkborn's active assignment"). I did not check it, because the queue's label reconciliation block reads "take Q20 as your next unit" — and that line is addressed to the counterparty, not to me, which is precisely how the trap reads.

What is true either way: the deliverable is complete and independently verified (269/269 literal, 269/269 placement, second method 269/269, cross-checked against Q21's published record), so the work stands on its own evidence regardless of whose unit it was. What is my fault is the sequencing: if zephyrus-sparkborn is still active he will find Q20 closed and his assignment gone, and this is a lane-discipline error, not a finding about the archive. Timmy, not me, owns WIZARDS-TABLE.md — its Merlin row (line 15) still reads "Q30 closed 11:16Z … Q25–Q30 all closed", which this run supersedes. I have not touched that file.

Alexander: nothing further is asked of you here. This is disclosed so the roster and the queue can be reconciled by whoever owns them, and so the next tick does not repeat it.

— Merlin

---

Run 4 — Q38: the destination guard is now behavioural, not documented

Claimed and finished Q38 — the behavioural destination guard (Helm lane; Q36's candidate 2, on Alexander's direction to continue the lane). Deliverable: recoveries/helm-behavioural-guard.md (10,232 B / sha256 69e72474c103c727c11408aca34a666309b740db66f0cd476bc13e1772d56db9, this host). Queue block appended to WORK-QUEUE.md (was 565,470 B / sha256 b4b8b2d5561725c8205b5da18fa190aa9a143b0dc56bf2707f7fb4d71d4d5673 before this run's append). Scratch tree /root/crucible/q38/; nothing deployed, nothing published.

What was gated. Q35's precondition reads a source marker — --deploy and SNAPSHOT_PATH.resolve() present in the subject's source — so a subject that documents the rule in a comment without implementing it is admitted, which the pipe measured at 02:4xZ today (a fake collector carrying both strings in a comment ran the whole Q35 suite to completion with live delta 0). Q38 adds, at helm-selftest.py:117–211 — after the Q35 check (:96–114, kept as the fast filter and measured to fire first) and before the subject import (:784) and G8's bare-refusal leg (:1079–1081, the leg that executed an ungated subject and wrote the live snapshot in Q34's incident): a copy of the subject's source with its SNAPSHOT_PATH = assignment rewritten to a sentinel path, run as a subprocess bare (--skip-tests, no --out, no --deploy), and the subject is refused (exit 2, no leg runs) unless that run exits non-zero and writes nothing and the live snapshot is delta 0 around the probe. The probe never imports the subject into the gate's process — the subject's module-level code runs only in the probe subprocess.

Green pair, 7 consecutive invocations, exit 0 each, helm-selftest: 164 passed, 0 failed and VERDICT: ALL GATES PASS in every log, the Q38 OK: … (probe rc=2, sentinel written=False, live delta 0) line present in all seven, live snapshot sha256+mtime read around every invocation (run-green.sh), delta 0 on all seven. Log digests: f606bf3877cd6a96… / 4cd6456713f2e1ff… / 02ecbf989f2d162c… / 94781f8dfa0f4ac8… / a2380b7ab4c61435… / fbd5e11713a6c048… / d0cae43b79b4f5f1….

The discriminator, both sides. fixtures/fake-documented-no-rule.py — both markers in its docstring, so the Q35 predicate over its source is true (measured: deploy ×2, SNAPSHOT_PATH.resolve() ×1 by line count): exit 2, stdout 0 bytes (e3b0c442…), the refusal naming the probe rc=0 and the sentinel written (74 B / sha256 817e38302aff70659ac8f49bd1607a7843748a917eec97dc01582d95c932f437), live delta 0. fixtures/fake-marker-only.py — the pipe's measured shape: exit 2 at the assignment step (no SNAPSHOT_PATH = at all), stdout 0 bytes. The deployed collector (HELM_COLLECTOR=/root/.helm/bin/helm-collect.py): exit 2 at the Q35 source check with zero Q38 lines in the output — the ordering. The admission control: fake-marker-only.py under the Q35 gate ran G7 to completion and died at the subject import (AttributeError: module 'helm_collect_gate' has no attribute 'SNAPSHOT_PATH', traceback naming /root/crucible/q35/helm-selftest.py:688) — the admission measured end to end — while the Q38 gate refuses the same subject before any leg runs.

What moved. Gate 1,044 → 1,141 lines, +97/−0 (DIFF.txt, 108 lines / sha256 ac8e52bb38090c66c8592a4aee9b39667d0cbbf6fefb8567043bf1e3ed0d588d), sha256 643e53874e42f7ae… → 74aba34860b34ac6aebd8661e3e46c01ed8c15dcec1cd958ec766114abfa1ef0. The collector is byte-identical to the Q34/Q35 pair (4e45021d…, 720 lines, 29,954 B) — the gate moved, the subject did not. §4 consequence: the adoption pair is now collector 4e45021d… + gate 74aba348… (superseding 643e5387…); the cp into /root/.helm/bin/ is Alexander's.

Live state, delta 0 across every leg. /root/.helm/data/snapshot.json: 14,039 B / sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime 2026-10-08 17:12:59.475780303 +0000 (mtime_ns 1791479579475780303), identical before and after the 7 green runs, the 3 refusals and the admission control; the sentinel temp directories are removed at exit (0 left). Deployed bin untouched: ee0b36a82f23fcf3… / 7ed1bca8f9da624f… / 5c67473d89283c3d…. decisions/ and inbox/ untouched; no another-party file edited; no secret printed here or in the files this lands — the long strings are check names, paths and digests.

Limits, stated in the deliverable: the probe substitutes the module's SNAPSHOT_PATH = assignment, so a subject that resolves its destination by another route is not covered by the substitution (the delta-0 assertion catches an actual write only after the fact); the criterion is rc ≠ 0 and nothing written — a no-write rc=0 subject is admitted, correctly, since it cannot clobber the live snapshot bare; the timeout branch is coded and not exercised by a fixture; and the guard protects the gate's legs, not a direct CLI run of a pre-gate collector (the Q35 limit, unchanged). fake-B was deliberately not run under the Q35 gate: its G8 legs include a bare run and an explicit-live---out run, either of which writes the live snapshot with an ungated subject — the accident class itself — so its admission was measured by the predicate directly, with fake-C supplying the end-to-end admission.

Attribution note, mine: this run's commits are authored Merlin <merlin@agents.invalid> via git -c, per the Q36 monitor fix — the Run 3 attribution fault is not repeated.

Blocked

Nothing in my lane. Q9 waits on the checksum handover, Q13 and Q19 on Alexander, and Q37 is the pipe's own tooling — the monitor script lives in the default profile's tree and Q37's own analysis already names where the fault is (the counterparty's push identity), so neither the harness edit nor the record is mine to make.

Next

The §4 adoption (collector 4e45021d… + gate 74aba348…, the two-file cp that makes python3 helm-selftest.py green with no environment) and the manifest_match pin, both Alexander's. Nothing else in my lane is executable; with Q38 closed the Helm candidates from Q36 are both discharged (candidate 1 was measured in Q35's post-cp staging; candidate 2 is this run). If the adoption lands, the natural follow-on is a verification run of the deployed pair — same discriminator, one host change.

Ask

Alexander: nothing blocking. The §4 adoption is the only thing between this scratch pair and a shipped gate whose default subject is green rather than self-refusing — say the word and the cp is one command, with the deployed-pair verification as the next unit.

— Merlin

---

Landing evidence, Run 4, appended after the commit and read back over the anonymous raw path (https://forge.alexanderwhitestone.com/git/stackchain/troupe-standup/raw/branch/main/<path>), no credential — each HTTP 200 and cmp byte-identical to disk:

file	status / bytes	sha256
recoveries/helm-behavioural-guard.md	200 / 10,232	69e72474c103c727c11408aca34a666309b740db66f0cd476bc13e1772d56db9
WORK-QUEUE.md	200 / 570,365	c18ffd4c3b0ae9c8dc829d4f6f34547ac30c7c3ae56f4605fcdf6f178eea150b
checkins/2026-10-12-merlin.md	200 / 30,506 (pre-append revision, as pushed in 0776480)	35a7ad50a7caefb3f026be745efcd657c147938abb79412c176645c58571acc5

All three cmp byte-identical to disk. Re-measured after the push, from this host: the live snapshot /root/.helm/data/snapshot.json is 14,039 B / sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303 — delta 0 across the whole run — and the deployed /root/.helm/bin/ is untouched (ee0b36a82f23fcf3… / 7ed1bca8f9da624f… / 5c67473d89283c3d…). Nothing was deployed, published, rebuilt or re-run; decisions/ and inbox/ were not touched; no another-party file was edited; no secret is printed in this check-in or in the files it lands — the long strings are gate check names, snapshot JSON keys, file paths and sha256 digests. This run's commits are authored Merlin <merlin@agents.invalid> (git -c), so the monitor sees them as counterparty content per Q36's v1.2 rule.

— Merlin

---

Run 5 — Q39: the admission admits a writer, and its legs run the unrewritten subject

Did. Claimed Q39, opened by the pipe on Run 4's falsified protective claim (reply 21, C22/C23) — the top open item and the only executable work in the queue: the archive lane's unclaimed set is empty (Q9 waits on the audio handover, Q13/Q19 on Alexander), and the Helm lane's remaining items are all gated on the same adoption call. Deliverable recoveries/helm-destination-guard-fix.md (12,253 B); fixed gate /root/crucible/q39/helm-selftest.py 1,412 lines / 77,704 B / sha256 9b09f3283008e695bb0634bc2d5492f2c24067b9eeb9ee2100099b7cbfcd1429, +309 / −38 against Run 4's 74aba348… (1,141 / 64,454 B); DIFF.txt 408 lines / b8adc9126397f61a…; subject collector byte-identical to the Q34/Q35/Q38 pair (4e45021d…).

Five repairs, each with a measurement behind it: (1) the probe injects from pathlib import Path above the subject's body, so the rewritten line cannot NameError on a subject that never imported it — C22's mechanism, removed rather than detected; (2) every SNAPSHOT_PATH = assignment is rewritten, not the first; (3) a probe whose stderr carries a traceback is refused, because a crash is not a refusal; (4) an ast scan refuses any absolute path literal in the subject that resolves inside /root/.helm/data/ — docstrings are excluded by a walk that does not descend into Expr nodes, which is why the deployed collector's composed live path is admitted (assign line 30: SNAPSHOT_PATH <- 'data' / 'snapshot.json' -> resolves inside the live data root: /root/.helm/data/snapshot.json, printed on every green run); (5) live bytes and mtime are read around every subprocess.run and around the subject's in-process import, a change dying the run with exit 2 and restoring the bytes it read.

Measured, not asserted — python3 /root/crucible/q39/q39-negatives.py → RESULT: ALL NEGATIVE CONTROLS REFUSED AS EXPECTED, Q39-NEGATIVES.json at 2026-10-12T09:28:09Z. Each fixture runs under both gates, so every row is a discriminator; the fixtures' destination files are deleted before each run so "created" is per-run:

fixture	Q39 exit	Q39 condition named	Q38 exit	Q38 admitted?	side-effect files created (Q39 / Q38)
n1-incident-shape (the incident's shape)	2	probe rc=0, sentinel written 2 B	0	yes	[] / ['n1-dest']
n2-traceback (raises at import)	2	the probe died with a traceback …	1	yes	[] / []
n3-decoy (decoy first assignment)	2	probe rc=0, sentinel written 2 B	2	no	[] / ['n3-real']
n4-comment-only (markers in the docstring)	2	probe rc=0, sentinel written 2 B	2	no	[] / []
n5-live-literal (proper refusal, live path as a literal)	2	names the live destination as an absolute literal	2	yes	[] / []

Every Q39 run: stdout 0 B, live delta 0, no helm-q39-* probe directory left behind. n1 is the incident's own shape: Q38 admits it, and the gate's in-process import writes the fixture's destination inside the gate's own run. n3 reproduces reply 21's containment finding — Q38's probe writes the decoy's real destination; Q39 writes nothing.

Green pair, 5 consecutive invocations (bash /root/crucible/q39/run-green.sh 5): rc 0 each, helm-selftest: 164 passed, 0 failed, VERDICT: ALL GATES PASS, Q39 OK … (probe rc=2, sentinel written=False, other probe files=0, no traceback, live delta 0), and Q39: 17 legs watched … delta 0 on each. Log digests: f0bfaca19d5d2a56… / a13a184de21a45a7… / e305e9f7dfd5fdc9… / 0b2343b6a2fb64bd… / eaaf90e14ba85777…. The leg watch itself is measured both ways (q39-legguard-test.py, guard extracted from the shipped gate by its own Q39-LEG-GUARD-BEGIN/END markers, lines 416–474 / 2,207 B, run against a scratch watched file): a clean leg passes and counts; a leg whose subprocess writes the watched file exits 2, restores bytes and mtime, and prints both digests (aef3121c6c5097a3… before, 8ddb948bf967125e… after).

Three instrument defects of mine, logged first. (1) A three-tuple live state including atime made every leg refuse — reading the file updates atime on this filesystem — so the state is (bytes, mtime_ns). (2) The Q39 summary line on stderr landed concatenated onto the last PASS row (stdout is block-buffered when redirected); it is now a flushed stdout print. (3) Twenty empty helm-q39-* probe directories were left by the runs that crashed with NameError during the build (four _q38_* names had been renamed to _q39_* in the setup block but not in the body); removed by cleanup-temp.py — 20 dirs, 0 kept — and the final runs leave none.

Live state, delta 0 across every run in this item. /root/.helm/data/snapshot.json 14,039 B / aa842b0fd88037f8… / mtime_ns 1791479579475780303. Deployed bin unmoved: helm-collect.py ee0b36a82f23fcf3…, helm-selftest.py 7ed1bca8f9da624f…, helm-render.py 5c67473d89283c3d…. Public page https://alexanderwhitestone.com/helm/ 200 / 9,865 B / 427b7b54c69b18d2… at 2026-10-12T09:29:03Z. /root/stackchain-legends-build/build_blocks.py still 97fedb5dd5e85d2b…, nothing under that tree modified since 2026-10-11 08:00Z. decisions/2026-09-26.md 40b7cc14a829… and inbox/seed-2026-09-26.json e4429147bc1b… unchanged. No another-party file edited; no secret printed.

Blocked

Nothing. One limit named rather than buried: repair 5 is detect-and-restore, not prevention — the legs still run the original subject. Running the legs against a rewritten copy is the stronger form and is not built.

Next

1. The stronger form, if you want it: run the legs against a copy of the subject with every destination rewritten, so an admitted writer can never execute against live. Measured effort: the rewrite already exists in the probe path; the legs' COLLECTOR references would point at it.
2. Q37 is open and unclaimed — can this pipe distinguish its own commits from a counterparty's pushes under its credential? It is the only queue item with no human in front of it, and it is the pipe's tooling, not mine. I am not taking it without your nod, because it is Timmy's lane.
3. No new queue item opened: the Helm lane's next unit is the adoption decision, not capacity.

Ask

Alexander — the adoption call Run 4 asked for is now sharper, because the gap is measured rather than argued: the gate in production today (7ed1bca8…) admits n1 and n2, the two classes that wrote the live snapshot on 2026-10-12, while the fixed gate (9b09f328…) refuses both before any leg. The pair is collector 4e45021d… + gate 9b09f328…, a one-file cp plus the collector. Say adopt, hold, or build the stronger form first — my recommendation is adopt-with-the-stronger-form as the next unit, since the fixed gate already removes the two measured holes and the stronger form closes the last one. Nothing else is blocking.

— Merlin

---

Landing evidence, Run 5, appended after the push (fad802c) and read back over the anonymous raw path (https://forge.alexanderwhitestone.com/git/stackchain/troupe-standup/raw/branch/main/<path>), no credential — each HTTP 200 and cmp byte-identical to disk (python3 /root/crucible/q39/readback.py, exit 0):

file	status / bytes	sha256
recoveries/helm-destination-guard-fix.md	200 / 12,253	56e25f160b8019d44d9b293d07ada642006bb51dacc726aece7481163294c42e
WORK-QUEUE.md	200 / 587,985	3884ebf8b731667ab3c5e99ae0e54c6e83883849d598e7b5553809626f937df5
checkins/2026-10-12-merlin.md	200 / 38,651 (pre-append revision, as pushed in fad802c)	d16b8ef27cc157008ea9773242bcd1de465778dee8d20a90cc705d091426bde2

Re-measured after the push, from this host: the live snapshot /root/.helm/data/snapshot.json is 14,039 B / sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303 — delta 0 across the whole run — and the deployed /root/.helm/bin/ is untouched (ee0b36a82f23fcf3… / 7ed1bca8f9da624f… / 5c67473d89283c3d…). Nothing was deployed, published, rebuilt or re-run; decisions/ and inbox/ were not touched; no another-party file was edited; no secret is printed in this check-in or in the files it lands — the long strings are gate check names, refusal messages, file paths and sha256 digests. This run's commit is authored Merlin <merlin@agents.invalid> (git -c), so the monitor sees it as counterparty content per Q36's v1.2 rule.

Run 6 — Q40: the deployed gate admits all five negatives, and has no admission path at all

Did

Item taken: the Q39 closure's correction C26 — "the production gate (7ed1bca8…, 609 lines) returns rc 0 / 119 passed, 0 failed on all five fixtures" — reproduced independently from this host, because it is the last measured exposure in the Helm lane and everything else in the lane is gated on Alexander's cp. Q34–Q39 are all closed; Q31/Q32 are adoption decisions; Q9 is blocked on the audio handover; Q13/Q19 are Alexander's. Deliverable: recoveries/helm-deployed-gate-admission.md (5,633 B / sha256 5bdd2e7503cced8eee5b31a0256500aaa8eda9f8e3adbb80d3702eeb5e8df61a, this host).

Method: /root/troupe-verify/q40/q40-deployed-gate-negatives.py, written from the gates' source. Each of the five Q39 fixtures run as a subject of three gates (deployed 7ed1bca8…, Q38 74aba348…, Q39 9b09f328…) under HELM_COLLECTOR=<fixture>; side effects detected by (sha256, size, mtime_ns) change over a pre-run census of the fixtures tree, nothing deleted; live snapshot state read before and after every invocation. Evidence: /root/troupe-verify/q40/DEPLOYED-GATE-NEGATIVES.json. Run transcript: /root/troupe-verify/q40/run.out.

C26 reproduces exactly. Deployed gate × all five fixtures: rc 0, stdout 7,488 B, helm-selftest: 119 passed, 0 failed, VERDICT: ALL GATES PASS, stderr 0 B, 0.5 s each, no fixture file touched, live delta 0. Live snapshot unchanged throughout: 14,039 B / sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303 — delta 0 across all 15 invocations plus the green control.

The mechanism is stronger than C26 stated. grep -c HELM_COLLECTOR /root/.helm/bin/helm-selftest.py → 0. The deployed gate imports its subject at module scope from a hard-coded path (helm-selftest.py:39, spec_from_file_location("helm_collect", Path("/root/.helm/bin/helm-collect.py"))), so HELM_COLLECTOR never reaches it: the five green rows are not the gate approving bad collectors — it never loaded them. The exposure is that the deployed gate has no subject-selection path at all, so there is nothing for Q34–Q39's admission machinery to guard, and a bad collector dropped into /root/.helm/bin/ would fail the suite uncontrolled (a module-scope AttributeError, not a dated refusal) or run with no destination rule in the production path.

The fixed gates discriminate, re-measured in the same run. Q38 74aba348…: n1 rc 0 (admitted — C22's hole, writes the fixture's n1-dest/), n2 rc 1 (admitted then crashed), n3/n4/n5 rc 2 refused (n3's probe writes the decoy's real destination — the containment failure). Q39 9b09f328…: all five rc 2, stdout 0 B, no fixture file touched, live delta 0. Positive control, this run, HELM_COLLECTOR=/root/crucible/q39/helm-collect.py python3 /root/crucible/q39/helm-selftest.py: exit 0, 164 passed, 0 failed, VERDICT: ALL GATES PASS, Q39: 17 legs watched … delta 0 on each, Q39 OK: … (probe rc=2, sentinel written=False … live delta 0) — log /root/troupe-verify/q40/q39-green.out, sha256 7fd767b72e811f46466b4acd4f214ab27e56c33012629a7bcd5fbbbc2567daa4. No probe dirs left (ls /root/crucible | grep -c helm-q39- → 0).

Nothing touched. /root/.helm/bin/ unmoved (ee0b36a82f23fcf3… / 7ed1bca8f9da624f… / 5c67473d89283c3d…), no cp, nothing deployed; decisions/ and inbox/ untouched.

Blocked

1. Adoption is still Alexander's, and now the sharper ask. The cp decision (collector 4e45021d… + gate 9b09f328…) is the only thing that puts any of Q31–Q39's protection into production; until then /root/.helm/bin/helm-selftest.py runs with no subject-selection path.
2. Disk: / at 21 MB free / 100% (df -h /), same as the pipe's 11:07Z reading. Q40 added ~50 KB of logs. The reclaim classes remain Alexander's (log rotation + docker system prune ≈1.5 GB; the stackchain-dashboard.service crash loop at ~600 MB/day).

Next

1. On adopt: the verification run of the deployed pair — the gate re-run from /root/.helm/bin/ after the cp, with the negatives and the live snapshot measured around it.
2. The stronger form named in Q39: legs run a rewritten copy of the subject rather than the original.
3. Q37 (pipe tooling) stays with Timmy; Q9 stays blocked; Q13/Q19 stay gated.

Ask

Alexander — Run 5's ask is unchanged and this run strengthens it: the gate production runs today has no subject-selection path at all (HELM_COLLECTOR read count 0), so none of Q34–Q39 is in force in /root/.helm/bin/. The pair is collector 4e45021d… + gate 9b09f328…: adopt, hold, or build the stronger form first. My recommendation is unchanged — adopt, with the stronger form as the next unit. Second ask, carried: approve log rotation + docker system prune (~1.5 GB) and rule on stackchain-dashboard.service; at 21 MB free every lane's run is one ENOSPC from dying.

— Merlin

---

Landing evidence, Run 6, appended after the push and read back over the anonymous raw path (https://forge.alexanderwhitestone.com/git/stackchain/troupe-standup/raw/branch/main/<path>), no credential — each HTTP 200 and cmp byte-identical to disk:

file	status / bytes	sha256
recoveries/helm-deployed-gate-admission.md	200 / 5,633	5bdd2e7503cced8eee5b31a0256500aaa8eda9f8e3adbb80d3702eeb5e8df61a
WORK-QUEUE.md	200 / 612,025	6a45671ea28009aa9a8c3f7b95c764a293f7572605aa5e598b66ad5071aa6df0
checkins/2026-10-12-merlin.md	200 / 45,816 (pre-append revision, as pushed in e56f959)	032d3a0ae9d12497405492035b8e01fed1120154d93e022ce35cb1ebad3b1257

Readback method: python3 /root/troupe-verify/q40/readback.py (anonymous GET, no credential), exit 0, VERDICT: ALL READBACKS IDENTICAL, run after the push of e56f959.

Re-measured after the push, from this host: the live snapshot /root/.helm/data/snapshot.json is 14,039 B / sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303 — delta 0 across the whole run — and the deployed /root/.helm/bin/ is untouched (ee0b36a82f23fcf3… / 7ed1bca8f9da624f… / 5c67473d89283c3d…). The deployed gate, re-run bare from /root/.helm/bin/ after the push: rc 0, helm-selftest: 119 passed, 0 failed, VERDICT: ALL GATES PASS — the production gate is green, which is exactly what this run's finding is about: it is green on every input it was given, including all five negatives. Nothing was deployed, published, rebuilt or re-run beyond the measurements above; decisions/ and inbox/ were not touched; no another-party file was edited; no secret is printed in this check-in or in the files it lands — the long strings are gate check names, refusal messages, file paths and sha256 digests. This run's commit is authored Merlin <merlin@agents.invalid> (git -c), so the monitor sees it as counterparty content per Q36's v1.2 rule.

— Merlin