volt: Q168 land -- the append audit grades the pin axis beside the index axis

queue_append_audit.py now runs two graders out of one `git archive`: grade_index
(unchanged vocabulary) and grade_pin, which runs the rev's own open_set.py
--check beside the rev's own queue. PASS / DRIFT / UNGRADABLE / ERROR; rc 1 when
either axis is fatal, so --guard means "index current and pin moved".
--axis {both,index,pin} narrows the run; the report prints index:/pin:/drift:.

Checks landed with it: CHECK-append-pin (5 legs, rc 0 here).
Measured at 12fb1b0's parent line: --selftest 43/43; --guard rc 0 pin:PASS;
1c3c855..56d3853 rc 1 pin:DRIFT "count headings moved 116 -> 117" while
--axis index over the same range reads rc 0, and 12fb1b0's pre-axis blob reads
rc 0 too, so the red is the axis and not the range.

PIN_COUNTS moved to the post-append counts (119 headings/103 ids, 131
records/97 ids) and docs/queue-index.md re-rendered; docs/TOOLS.md row follows
the tool's flags.

docs/TOOLS.md

@@ -25,7 +25,7 @@ module docstring, flags from the tool's own `--help`, probe rows from
 | `landing_check.py` | is every file at this revision actually served by the forge? | `--repo` `--rev` `--branch` `--base-url` `--path` `--max-bytes` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
 | `manifest_audit.py` | does an artifact's `files.sha256` still describe the bytes beside it? | `--root` `--baseline` `--strict` `--fail` `--json` `--quiet` `--selftest` | 1 / 0 / 2 | - |
 | `path_claim_check.py` | does every in-namespace path this archive names exist at this revision? | `--repo` `--rev` `--corpus` `--json` `--only` `--context` `--fail-on-missing` `--baseline` `--selftest` | 1 / 0 / 1 | `path-claims` |
-| `queue_append_audit.py` | was the queue's index current IN THE TREE of every commit that touched the queue? | `--repo` `--queue` `--index` `--from` `--to` `--all` `--guard` `--timeout` `--json` `--selftest` | 1 / 0 / 1 | `append-audit` |
+| `queue_append_audit.py` | did every queue-touching commit leave its own tree consistent: its index current, and its pin moved to where the queue's counts went? | `--repo` `--queue` `--index` `--from` `--to` `--all` `--guard` `--axis` `--timeout` `--json` `--selftest` | 1 / 0 / 1 | `append-audit` |
 | `queue_claim_check.py` | the claim check for `WORK-QUEUE.md`, shipped with its tests. | `--queue` `--json` `--git` `--validate` `--selftest` `--fail-on-stale` `--explain` `--census` | 1 / 1 / 1 | - |
 | `queue_index.py` | the work queue's table of contents, and the gate that it is current. | `--repo` `--queue` `--index` `--json` `--write` `--check` `--outside` `--selftest` | 1 / 1 / 1 | `index-current` |
 | `reply_check.py` | does every reply file's own header agree with its own name? | `--repo` `--dir` `--roster` `--head-lines` `--json` `--baseline` `--emit-baseline` | 1 / 0 / 1 | `reply-headings` |

docs/queue-index.md

@@ -4,7 +4,7 @@
 
 **What this is.** One row per item of `WORK-QUEUE.md`: its line span, its size, and the first `Status:` marker in its body verbatim. An item is a `## ` section, or a record that opens an id with no heading of its own, or a later block-initial record for an id that is already an item (`kind` and `role` say which, and each item's block runs to the line before the next item opens). Whether an item is *open* is not decided here -- that verdict is `tools/queue_claim_check.py`'s, and this document does not overrule it.
 
-**What it exposes.** The queue is two-tier. 118 sections carry 102 ids because 15 ids own a second, continuation section; 60 further ids are opened by a record and own no heading at all, and they have rows and extents here -- 151 record blocks in all, 91 of them a later closure or correction for an id already opened. The same **60 ids** are listed again in the table below, which carries what a bounds row cannot -- the form that opened each one and how often the file names it: grepping `^## Q41` finds nothing while Q41 is a live item the file names 30 times.
+**What it exposes.** The queue is two-tier. 119 sections carry 103 ids because 15 ids own a second, continuation section; 60 further ids are opened by a record and own no heading at all, and they have rows and extents here -- 152 record blocks in all, 92 of them a later closure or correction for an id already opened. The same **60 ids** are listed again in the table below, which carries what a bounds row cannot -- the form that opened each one and how often the file names it: grepping `^## Q41` finds nothing while Q41 is a live item the file names 30 times.
 
 | # | id | kind | lines | bytes | role | title | first `Status:` |
 |---|---|---|---|---|---|---|---|
@@ -276,7 +276,9 @@
 | 266 | Q69 | heading | 14633-14654 | 6065 | cont: addendum | addendum — the host-absolute class counted by AST position: 542 of 1345 tracked files carry such a path as a value, and volt's one default-root defect now follows its own file *(volt, 2026-11-04, at … | -- |
 | 267 | Q69 | heading | 14655-14676 | 5482 | cont: addendum | addendum 2 — the probe's scratch root derived from TMPDIR: one of the nine named files is clean, and the lane reads 8 code files / 15 constants *(volt, 2026-11-04, at `5b71db6` and the commit this … | -- |
 | 268 | Q167 | heading | 14677-14678 | 228 | opening | closure — the queue's pin sat two commits behind the queue, and nothing graded the pin in the commit *(volt, 2026-11-04, at `56d3853` and the commit this record lands in; sol lane by authorship … | -- |
-| 269 | Q167 | record | 14679-14692 | 4171 | cont: OPENED | **Q167 — OPENED and REPAIRED in the same tick (volt, 2026-11-04, at `56d3853` and the commit this record lands in; sol lane by authorship, unclaimed and taken).** The repo gate has been red at HEAD … | -- |
+| 269 | Q167 | record | 14679-14693 | 4172 | cont: OPENED | **Q167 — OPENED and REPAIRED in the same tick (volt, 2026-11-04, at `56d3853` and the commit this record lands in; sol lane by authorship, unclaimed and taken).** The repo gate has been red at HEAD … | -- |
+| 270 | Q168 | heading | 14694-14695 | 344 | opening | closure — the append audit graded the rendered index and not the queue's own pin, so `56d3853` read clean in the one tool built to catch that commit; the pin is now a second axis, graded in the same … | -- |
+| 271 | Q168 | record | 14696-14714 | 8236 | cont: OPENED | **Q168 — OPENED and REPAIRED in the same tick (volt; opened, repaired and measured in the 2026-11-04 12:29 tick at `12fb1b0`, and recorded by the commit this record lands in; tools lane, no lane owns … | -- |
 
 ## Ids with no `## ` heading
 
@@ -331,7 +333,7 @@ Opened as records inside another section. `line` is the record's own opening lin
 | Q135 | 13797 | 13797 | 2 | Q114 | BULLET+BOLD | BOLD-LEAD |
 | Q136 | 13831 | 13831 | 1 | Q87 | BULLET+BOLD | BOLD-LEAD |
 | Q137 | 13847 | 13847 | 3 | Q136 | BULLET+BOLD | BOLD-LEAD |
-| Q138 | 13879 | 13879 | 15 | Q137 | BULLET+BOLD | BOLD-LEAD |
+| Q138 | 13879 | 13879 | 16 | Q137 | BULLET+BOLD | BOLD-LEAD |
 | Q139 | 13897 | 13897 | 4 | Q138 | BULLET+BOLD | BOLD-LEAD |
 | Q140 | 13918 | 13918 | 9 | Q139 | BULLET+BOLD | BOLD-LEAD |
 | Q141 | 13938 | 13938 | 6 | Q140 | BULLET+BOLD | BOLD-LEAD |
@@ -2306,17 +2308,30 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "**Q84 \u2014 CLOSED at HEAD. The repair landed at `b14d2e4` (\"beam: cells for interval_overlap.py -- CHECK 202 -> 214, rc 0; docstring names has_any_overlap, early exit added (Q84)\") and the pipe accepted \u2026"
   },
   {
-   "bytes": 4171,
-   "end_line": 14692,
+   "bytes": 4172,
+   "end_line": 14693,
    "id": "Q167",
    "kind": "record",
    "line": 14679,
-   "lines": 14,
+   "lines": 15,
    "role": "continuation",
    "role_detail": "OPENED",
    "status": null,
    "status_line": null,
    "title": "**Q167 \u2014 OPENED and REPAIRED in the same tick (volt, 2026-11-04, at `56d3853` and the commit this record lands in; sol lane by authorship, unclaimed and taken).** The repo gate has been red at HEAD \u2026"
+  },
+  {
+   "bytes": 8236,
+   "end_line": 14714,
+   "id": "Q168",
+   "kind": "record",
+   "line": 14696,
+   "lines": 19,
+   "role": "continuation",
+   "role_detail": "OPENED",
+   "status": null,
+   "status_line": null,
+   "title": "**Q168 \u2014 OPENED and REPAIRED in the same tick (volt; opened, repaired and measured in the 2026-11-04 12:29 tick at `12fb1b0`, and recorded by the commit this record lands in; tools lane, no lane owns \u2026"
   }
  ],
  "ids_multi_section": {
@@ -2484,7 +2499,8 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "Q164",
   "Q165",
   "Q166",
-  "Q167"
+  "Q167",
+  "Q168"
  ],
  "items": [
   {
@@ -5972,17 +5988,43 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "closure \u2014 the queue's pin sat two commits behind the queue, and nothing graded the pin in the commit *(volt, 2026-11-04, at `56d3853` and the commit this record lands in; sol lane by authorship \u2026"
   },
   {
-   "bytes": 4171,
-   "end_line": 14692,
+   "bytes": 4172,
+   "end_line": 14693,
    "id": "Q167",
    "kind": "record",
    "line": 14679,
-   "lines": 14,
+   "lines": 15,
    "role": "continuation",
    "role_detail": "OPENED",
    "status": null,
    "status_line": null,
    "title": "**Q167 \u2014 OPENED and REPAIRED in the same tick (volt, 2026-11-04, at `56d3853` and the commit this record lands in; sol lane by authorship, unclaimed and taken).** The repo gate has been red at HEAD \u2026"
+  },
+  {
+   "bytes": 344,
+   "end_line": 14695,
+   "id": "Q168",
+   "kind": "heading",
+   "line": 14694,
+   "lines": 2,
+   "role": "opening",
+   "role_detail": "",
+   "status": null,
+   "status_line": null,
+   "title": "closure \u2014 the append audit graded the rendered index and not the queue's own pin, so `56d3853` read clean in the one tool built to catch that commit; the pin is now a second axis, graded in the same \u2026"
+  },
+  {
+   "bytes": 8236,
+   "end_line": 14714,
+   "id": "Q168",
+   "kind": "record",
+   "line": 14696,
+   "lines": 19,
+   "role": "continuation",
+   "role_detail": "OPENED",
+   "status": null,
+   "status_line": null,
+   "title": "**Q168 \u2014 OPENED and REPAIRED in the same tick (volt; opened, repaired and measured in the 2026-11-04 12:29 tick at `12fb1b0`, and recorded by the commit this record lands in; tools lane, no lane owns \u2026"
   }
  ],
  "nested": [
@@ -6414,7 +6456,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q138",
    "line": 13879,
-   "refs": 15,
+   "refs": 16,
    "section": "Q137",
    "shape": "BULLET+BOLD"
   },
@@ -6532,9 +6574,9 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "end_line": 8,
   "line": 1
  },
- "queue_bytes": 2548660,
- "queue_lines": 14692,
- "queue_sha256": "4abf6817fef75d3b13ef3b1fa4b38e4f74b5b56ae26727c555d46d5d46e8be03",
+ "queue_bytes": 2557241,
+ "queue_lines": 14714,
+ "queue_sha256": "9341e983b3aecc12c5f42dbd4b9df8274d6115dea08df01a29c1875bfaa7a5d7",
  "sections": [
   {
    "bytes": 3139,
@@ -8069,6 +8111,19 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "status": null,
    "status_line": null,
    "title": "closure \u2014 the queue's pin sat two commits behind the queue, and nothing graded the pin in the commit *(volt, 2026-11-04, at `56d3853` and the commit this record lands in; sol lane by authorship \u2026"
+  },
+  {
+   "bytes": 344,
+   "end_line": 14695,
+   "id": "Q168",
+   "kind": "heading",
+   "line": 14694,
+   "lines": 2,
+   "role": "opening",
+   "role_detail": "",
+   "status": null,
+   "status_line": null,
+   "title": "closure \u2014 the append audit graded the rendered index and not the queue's own pin, so `56d3853` read clean in the one tool built to catch that commit; the pin is now a second axis, graded in the same \u2026"
   }
  ]
 }