troupe-standup/checkins/2026-10-12-merlin.md

2026-10-12 — merlin

Screen. Every claim below carries a path, a hash, a URL, or a command with its output, or the word unverified. Nothing secret is printed anywhere in this check-in or in the files it lands.

---

Did

Claimed and finished Q34 — gate the pointer's null case, the last open item and the one named to my lane (Q20 is zephyrus-sparkborn's, Q9 blocked on the audio handover, Q13/Q19 gated on Alexander). Deliverable: recoveries/helm-null-gate.md (9,924 B / sha256 84b1e714bfad1c0be948845f0f0a9f92a739ce5b64b68a197523bbb7c0808a58, this host). Queue block appended to WORK-QUEUE.md (was 519,292 B / sha256 592523616f8b9a8ca45f4dabc631508baeb173c68de1f01cc125c0b0682a4f3e before this run's append). Scratch tree /root/crucible/q34/; nothing deployed.

What was gated. Q33's one unverified limit: evidence.latest_active_path: null for a profile with a sessions/ directory and no files, with the Q32 pointer carve-out deleted, needed an exercised branch. The gate now plants, in its own scratch tree between two collects, a profile empty carrying sessions/ and logs/ and no files, and asserts four things — pointer null, citation still the profile directory, the key present with value null rather than absent, and a follow-up collect where a planted file sets the pointer while the citation holds. The member analogue is stated unreachable by construction, not asserted (a member row exists only for an existing check-in file); the rule is a comment in the gate, not a test.

Seven consecutive green invocations, exit 0 each, helm-selftest: 164 passed, 0 failed (the Q33 suite's 160 plus these four), log digests in the deliverable: 7f01728d… / 997b1308… / 96678a66… / f13e5cd6… / 532ab633… / 00bea997… / d4e39936….

Both comparators red where it matters. The Q33-before collector under the full gate: exit 1, 153 passed, 11 failed (q34-gate-q33before.log, sha256 7e53bb46adcdfda5f66c93dd780732fdc89207e5d5073bf56bd5921f3a94f1d5) — the Q33 nine plus Q34 checks 3 and 4. The pre-Q33 collector on the four Q34 checks by module import, no subprocess leg: 2 passed / 2 failed (q34-red-pregate.log, sha256 093f60e587186827a77e7f31247735b2048a8e86540a47485acf6324f95f1571). Checks 1 and 2 pass vacuously on both comparators (an absent key satisfies .get() is None, and a pointer-less citation falls back to the directory) and are reported as vacuous, so the discriminating checks are 3 and 4 — both red on both comparators.

Before/after evidence for the empty profile (from the gate's own dump, run 7, Q34-NULL-EVIDENCE.txt, sha256 c625bc07068c5040d91117d604208152b33f34f0416e96dfc51d326546c3473c): before — "latest_active_path": null, "source_path": "/tmp/tmp5r57iyp4/q34-null/profiles/empty"; after planting sessions/landed.jsonl at mtime +60 s — the pointer is that file and source_path is unchanged. The key is present in the before block; the citation does not move.

What moved. The collector did not: /root/crucible/q34/helm-collect.py is byte-identical to the Q33 pair's (4e45021d80395d3f…, 720 lines). The gate moved +56/−0 (git diff --no-index --numstat → 56 0), 929 → 985 lines, sha256 45e53187c01398df7a0edcbf24a08b7d91255eda0cfe93b9cb01e8398f0d7091. Deployed bin untouched: helm-collect.py ee0b36a82f23fcf3…, helm-selftest.py 7ed1bca8f9da624f…, helm-render.py 5c67473d89283c3d….

One incident, logged first and corrected. The first red leg ran the full gate with HELM_COLLECTOR pointed at the pre-Q33 collector — which has no destination gate, Q31's own finding — so the gate's bare --skip-tests refusal leg executed it and it wrote the live snapshot: aa842b0fd88037f8… → e4d1ad5293fa58cb…, 14,039 → 18,524 B, mtime_ns 1791479579475780303 → 1791764761933369921 (2026-10-12T00:26:01.933369921Z). Restored byte-exact from /root/crucible/q31/snap-before.json with the mtime re-stamped (q34-restore.py, VERDICT: RESTORED BYTE-EXACT); post-restore 14,039 B / sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303, and the comparator re-run by import only. Live snapshot delta 0 across every leg after the restore — seven green runs, the Q33-before comparator and the import-only comparator. This is the harness rule the skill already carries (a negative control must never run ungated code against a live default) walked into anyway; the standing rule is now mechanical in this tree: no HELM_COLLECTOR naming a pre-gate collector is ever passed to the full gate.

Blocked

Nothing in my lane. Q13/Q19 wait on Alexander, Q9 on the audio handover, Q20 is zephyrus's — none of them is mine to move. One thing my own run made Alexander's, below.

Next

Two things, both stated in the deliverable and neither mine to execute:

1. §4 adoption, now a three-file ask. Collector 4e45021d… unchanged from Q33; selftest 4a442f62… (Q33) superseded by 45e53187… (this run). The pair production has never run under the gate that ships with it, so the cp into /root/.helm/bin/ approves collector + Q34-gated selftest together. Alexander's call.
2. A live empty profile is still unobserved — every profile under /root/.hermes/profiles/ has files today, so the null branch is exercised by the gate's fixture, not by production data. The branch is proven; the data class is not. Nothing to do unless a profile is emptied.

Also worth naming for the queue: the Q34 gate writes its Q34-NULL-EVIDENCE.txt dump into the gate's own directory on every invocation, so that file is a dated reading, not a stable artifact — digest run 7 is quoted above, and the deliverable says so.

Ask

Alexander: nothing blocking. If you want the Helm render's manifest_match pin re-taken, say so — it has been stale since 2026-10-08 (f27326e8… pinned against a live body now e7df6364… / 215,836 B) and a static render cannot say so, which is a separate decision about whether that pin should exist at all.

---

Landing evidence, appended after commit and read back over the anonymous raw path (https://forge.alexanderwhitestone.com/git/stackchain/troupe-standup/raw/branch/main/<path>), no credential — each HTTP 200 and cmp byte-identical to disk:

file	status / bytes	sha256
recoveries/helm-null-gate.md	200 / 9,924	84b1e714bfad1c0be948845f0f0a9f92a739ce5b64b68a197523bbb7c0808a58
WORK-QUEUE.md	200 / 521,480	602746a5f202cdc39c9d53f59af814e8ab8d0fd8930a0042c47c258ddc1a0aa0
checkins/2026-10-12-merlin.md	200 / 6,442 (pre-append revision, as pushed in a16d9e4)	08afa9193238bd68c06a2d54dccdd9659ba9601a8164edb06126d008d57822db

Re-verified in the same breath, from this host: the live snapshot /root/.helm/data/snapshot.json is 14,039 B / sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303 — delta 0 across the whole run after the restore. The deployed /root/.helm/bin/helm-collect.py is unchanged at ee0b36a82f23fcf3…, helm-selftest.py at 7ed1bca8f9da624f… and helm-render.py at 5c67473d89283c3d… — nothing deployed, the §4 cp remains Alexander's. decisions/ and inbox/ were not touched; no another-party file was edited; no secret is printed in this check-in or in the files it lands — the long strings are gate check names, snapshot JSON keys, file paths and sha256 digests.

— Merlin

---

Run 2 — Q35: the destination-rule guard is now a precondition

Claimed and finished Q35 (Helm lane, opened by the pipe this day after Q34 closed) — the twice-fired class from Q34's incident, made mechanical at the gate instead of at the operator. Deliverable: recoveries/helm-precondition-gate.md (8,261 B / sha256 a5d3ad6af205f3c1c8caf4f4baa2ee01548b5a89697ff5478e3fc52a9a61656b, this host). Scratch tree /root/crucible/q35/; nothing deployed; the §4 cp is untouched.

What changed. The gate's source check — "the collector the gate runs carries the destination rule" — used to sit at the foot of the suite, after every leg that could execute the subject collector. Q34's incident is what that costs: the bare --skip-tests refusal leg executed an ungated subject and wrote the live snapshot, and the check red-flagged it only afterwards. The check is now a precondition at helm-selftest.py:96–114: the subject named by HELM_COLLECTOR is verified to carry the rule (--deploy and SNAPSHOT_PATH.resolve() in its source) before the subject is imported (:679) and before G1, and refused with exit 2 and a stderr message naming the subject and the missing rule, with the live snapshot read before and after the refusal. Gate moved +61/−2 (985 → 1,044 lines), sha256 45e53187… → 643e53874e42f7ae58160c06c47eb07846725eae397104d9265964506bfcd0c9; the collector is byte-identical to Q34's (4e45021d…). The precondition registers no check(), so the suite count is unchanged — the old foot-of-suite check is kept at :1032 and passes on every green run.

Green pair, 7 consecutive invocations, exit 0 each, helm-selftest: 164 passed, 0 failed / VERDICT: ALL GATES PASS (HELM_COLLECTOR=/root/crucible/q35/helm-collect.py python3 helm-selftest.py; log digests 32faa0e9… / bfa6d09e… / 8bd47387… / 62756176… / 1c9639ef… / f9992981… / e5a2c5fd…).

Discriminator, both sides in one run pair. Deployed collector as subject (HELM_COLLECTOR=/root/.helm/bin/helm-collect.py, pre-gate ee0b36a8…): exit 2, stdout 0 bytes (q35-refuse-deployed.log sha256 e3b0c442…, the empty-file digest — no helm-selftest: summary and no PASS line exists, which is how "no leg executed" is measured, since the report block is at the suite's foot), stderr the refusal with live-snapshot readings, live snapshot delta 0 (sha256 aa842b0fd88037f83115b4a54d617f27666f4de06ef84f9a64c8fd0a5f04656d / mtime_ns 1791479579475780303 / 14,039 B — identical before and after, and across all seven green runs). A missing subject is refused the same way, not crashed (q35-refuse-missing.err, sha256 90038616…).

Mechanism probe from the pipe's tree (q35-mechanism.py / mech-probe.log, sha256 31df78f6… / c4714d74…): each collector imported, its default destination (SNAPSHOT_PATH) rebound to scratch, main() called bare — deployed ee0b36a8… rc=0, no refusal, 18,523 B written (sha256 9331b218…, schema helm.snapshot/1); pair 4e45021d… rc=2, refusal naming the path and --deploy, nothing written. Rebinding does not disable the rule — it keys on the module's own SNAPSHOT_PATH — it only removes the blast radius.

Limits stated, not buried: the gate run bare now refuses itself, because the default subject is the pre-gate deployed collector — that is the item working as specified, and the §4 cp is what makes the shipped gate green; the precondition reads a source marker, not behavioral proof (the probe is the behavioral half, and sandboxing an untrusted import is the very thing the precondition prevents); and the rule protects the gate's legs, not a direct CLI run of a pre-gate collector.

Blocked

Nothing in my lane. Same three gates as Run 1 (Q13/Q19 on Alexander, Q9 on the audio handover, Q20 is zephyrus's).

Next

Q7's never-dry obligation: the unclaimed executable set is zero after this run — Q30–Q35 are closed, Q9/Q13/Q19/Q21 wait on humans or the counterparty, Q20 is zephyrus's active sweep. The next item I can see is a Helm-lane one, and it is the §4 adoption itself: the gate now green-refuses its own default subject, so the shipped pair is a two-file cp (collector 4e45021d… + gate 643e5387…) that makes python3 helm-selftest.py green with no environment. That is Alexander's move; I have not touched /root/.helm/bin/. If he approves, the natural follow-on item is a verification run of the deployed pair — same discriminator, one host change.

Ask

Alexander: unchanged from Run 1 — nothing blocking. The two standing items are the §4 adoption (now a cleaner ask: the pair travels together or the shipped gate stays self-refusing) and the manifest_match pin decision (stale since 2026-10-08; a static render cannot say so).