timmy: Q67 -- forge's probe-refactor verifier passes a guard-less mutant (rc 0, no summary), four _find_first_diff mutants and a hardcoded equal:True; index re-rendered

WORK-QUEUE.md

@@ -11315,3 +11315,49 @@ mismatches; prefix function checked against its definition for all 254 binary pa
 - **The omissions still behave as the contract says.** Ledger row dropped → runner **rc 1**, `UNGRADED` named. Verifier edited and committed after rowing → runner **rc 1** `DRIFT`, rc-probe **rc 1** `STALE`. Untouched clone → `CHECK` **rc 0**. The census-row cell is the one above: the coverage number drops 110 → 109 and is now named rather than mislabelled.
 - **Open, and whose.** The two findings are forge's (`verify_probe_forge_refactor.py`); the census is still not a `tools/verify.py` leg (reply 93 §4, the operator's call); 24 `FAIL` rows remain per-lane findings. No item opened or closed; nothing here is a decision for Alexander.
 - **Evidence.** `wizard-work/volt/q65-2026-10-25-c7.md` (the record), `q65_c7_controls.py` (the 13-cell instrument), `q65-2026-10-25-c7-controls.txt` (12/12, pre-fix), `q65-2026-10-25-c7-after.txt` (13/13 + `CHECK` at the fix commit), `-c7-red.txt` (`CHECK` rc 1 at `6e8f577`) and `-c7-green.txt` (`CHECK` rc 0 at `eb34583`). One file of another lane is cited, none edited. Nothing from `inbox/` is quoted. Appended at the foot; `docs/queue-index.md` re-rendered in this commit.
+
+## Q67 — forge's probe-refactor verifier certifies a refactor that restores the defect it removes *(forge lane; opened 2026-10-25 by the pipe, per reply 20 to forge)*
+
+`wizard-work/forge/verify_probe_forge_refactor.py` (`6e8f577`) reports **9/9, rc 0** for
+`_probe_forge_refactored.py`, and the refactor it certifies is genuinely behaviour-preserving: I
+reproduced the rc, and reproduced byte-identical output more strictly than the check does (separate
+streams, stdout **790 B** sha256 `f4f8e17f…`, stderr **0 B**, both exit 0). The defect is what the
+suite cannot see. Eight mutants, each a one-string change to the refactored file in a throwaway copy:
+
+| # | mutation | harness |
+|---|---|---|
+| M1 | `_find_first_diff` body → `return None` | rc 0, 9/9 |
+| M2 | scan range `min(len,len)` → `max(0, min-1)` | rc 0, 9/9 |
+| M3 | `if diff is not None:` → `if False:` | rc 0, 9/9 |
+| M4 | `_find_first_diff(actual, expected)` → `(expected, actual)` | rc 0, 9/9 |
+| M5 | `print("equal:", actual == expected)` → `print("equal:", True)` | rc 0, 9/9 |
+| M6 | guard → `if __name__ == "__main__" and False:` | rc 1, killed |
+| **M7** | **guard deleted, `sys.exit(main())` left at module level** | **rc 0, six `OK:` lines, no summary** |
+| M8 | `head[:20]` → `head[:19]` (control) | rc 1, killed |
+
+- **M7 is the headline: the pre-refactor defect, certified green.** With the guard gone the module
+  calls `main()` at import; `check_import_side_effect_free` imports it, `sys.exit(0)` raises
+  `SystemExit(0)` inside the verifier, nothing catches it, and the verifier exits **rc 0** before checks
+  8–9 and before its summary. `check_main_guard` prints `OK: __main__ guard present` throughout,
+  because it is a substring test and the module docstring quotes the pattern (line 7).
+- **M1–M4 share one cause: the failure branch never runs.** The probe's text round-trips
+  (`equal: True`, 2,919 chars, 12 chunks), so `_find_first_diff` always returns `None` and the
+  `FIRST DIFF` path — the only new logic the refactor adds — executes zero times. Four direct
+  assertions kill all four; none exist.
+- **M5 is output-equivalence's own limit:** the harness grades the probe's text, so asserting the
+  equality instead of computing it is indistinguishable. Needs one planted-diff run requiring
+  `equal: False` and a named `FIRST DIFF at char`.
+- **The pin (volt's finding, Q65 cycle 7 at `eb34583`), reproduced from a `git archive` of `6e8f577`:**
+  replace the clone's `wizard-work/forge/chunker.py` with `raise SystemExit("SABOTAGED CHUNKER")` and
+  the verifier still reads **rc 0, 9/9**; rewrite the two `sys.path.insert` lines into the clone and
+  the same sabotage is **rc 1** with FAILs. The `PASS` certifies `/root/.hermes/wizard-outputs/forge/chunker.py`,
+  not the tree. Not a wrong claim about the chunker: 1,600 randomized in-tree round-trips, 0 mismatches.
+- **Inert branch, recorded by volt and confirmed here:** `:146..154`, a `for` whose body is `pass`.
+
+**Status: open and unclaimed.** Forge's lane by authorship; the remedy is four small edits
+(AST guard check; a raise-is-FAIL wrapper with the summary in `finally`; four `_find_first_diff`
+assertions; a planted-diff run) plus the vendored chunker. Done means those eight mutants and the
+sabotage cell are re-run and every one is killed.
+
+Evidence: `replies/2026-10-25-to-forge-20.md` (`967bc62`) §1–§5, harness inline in §5, re-runnable
+against `/tmp` copies. Nothing from `inbox/` is quoted. No other lane's file was edited.

docs/queue-index.md

@@ -4,7 +4,7 @@
 
 **What this is.** One row per `## ` section of `WORK-QUEUE.md`: its line span, its size, and the first `Status:` marker in its body verbatim. Whether an item is *open* is not decided here -- that verdict is `tools/queue_claim_check.py`'s, and this document does not overrule it.
 
-**What it exposes.** The queue is two-tier. 57 sections carry 53 ids because 4 ids own a second, continuation section. A further **10 ids have no heading at all** and are opened as records nested inside another item's section -- so grepping `^## Q41` finds nothing while Q41 is a live item the file names 28 times. Those are listed in their own table below.
+**What it exposes.** The queue is two-tier. 58 sections carry 54 ids because 4 ids own a second, continuation section. A further **10 ids have no heading at all** and are opened as records nested inside another item's section -- so grepping `^## Q41` finds nothing while Q41 is a live item the file names 28 times. Those are listed in their own table below.
 
 | # | id | lines | bytes | role | title | first `Status:` |
 |---|---|---|---|---|---|---|
@@ -64,7 +64,8 @@
 | 54 | Q61 | 10890-10945 | 9624 | opening | beam's `topo_sort` drops generator dependencies, and its gate imports a copy outside the repo *(beam lane; opened 2026-10-24 by the pipe, per reply 88 to zephyrus)* | open and unclaimed. |
 | 55 | Q62 | 10946-10993 | 3717 | opening | 147 committed gates read `/root/.hermes/wizard-outputs`; two of them cannot pass from a clone *(no lane owns it; opened 2026-10-24 by the pipe, per reply 89 to zephyrus)* | open and unclaimed. |
 | 56 | Q63 | 10994-11284 | 99944 | opening | Six committed verifiers print PASS while asserting nothing, and eight are run by no gate *(no lane; opened 2026-10-24 by the pipe, per reply 90 to zephyrus)* | open and unclaimed. |
-| 57 | Q66 | 11285-11317 | 5881 | opening | beam's `search_count` advertises overlapping occurrences and no test would notice if it stopped *(beam lane; opened 2026-10-25 by the pipe, per reply 27 to beam)* | open and unclaimed. |
+| 57 | Q66 | 11285-11318 | 5882 | opening | beam's `search_count` advertises overlapping occurrences and no test would notice if it stopped *(beam lane; opened 2026-10-25 by the pipe, per reply 27 to beam)* | open and unclaimed. |
+| 58 | Q67 | 11319-11363 | 3516 | opening | forge's probe-refactor verifier certifies a refactor that restores the defect it removes *(forge lane; opened 2026-10-25 by the pipe, per reply 20 to forge)* | open and unclaimed. |
 
 ## Ids with no `## ` heading
 
@@ -81,7 +82,7 @@ Opened as records inside another section. `line` is the record's own opening lin
 | Q52 | 7167 | 7167 | 90 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q53 | 7292 | 7246 | 165 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q64 | 10308 | 10308 | 28 | Q45 | BULLET+BOLD | BOLD-LEAD |
-| Q65 | 11055 | 11047 | 39 | Q63 | BULLET+BOLD | BOLD-LEAD |
+| Q65 | 11055 | 11047 | 40 | Q63 | BULLET+BOLD | BOLD-LEAD |
 
 **Not in this document.** Ids the prose corpus names that the queue has never mentioned (`checkins/`, `replies/`, `recoveries/`, `audits/`, `docs/`, the top-level documents; `tools/` excluded). That set moves with the prose, not with the queue, so embedding it here would make `--check` go RED for a reason that has nothing to do with the queue being current. It is reported on demand: `python3 tools/queue_index.py --outside`.
 
@@ -163,7 +164,8 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "Q61",
   "Q62",
   "Q63",
-  "Q66"
+  "Q66",
+  "Q67"
  ],
  "nested": [
   {
@@ -252,7 +254,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q65",
    "line": 11055,
-   "refs": 39,
+   "refs": 40,
    "section": "Q63",
    "shape": "BULLET+BOLD"
   }
@@ -262,9 +264,9 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "end_line": 8,
   "line": 1
  },
- "queue_bytes": 1615512,
+ "queue_bytes": 1619029,
- "queue_lines": 11317,
+ "queue_lines": 11363,
- "queue_sha256": "3d3c43438dac9738b658b354f6f1aacbd9c716c60a5c24f6aa31ce1f285bb301",
+ "queue_sha256": "950fbcccbc2ede7143e56500c178e50fbcc90385a1af067d91ff0e028a743ee0",
  "sections": [
   {
    "bytes": 3139,
@@ -939,16 +941,28 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "Six committed verifiers print PASS while asserting nothing, and eight are run by no gate *(no lane; opened 2026-10-24 by the pipe, per reply 90 to zephyrus)*"
   },
   {
-   "bytes": 5881,
+   "bytes": 5882,
-   "end_line": 11317,
+   "end_line": 11318,
    "id": "Q66",
    "line": 11285,
-   "lines": 33,
+   "lines": 34,
    "role": "opening",
    "role_detail": "",
    "status": "open and unclaimed.",
    "status_line": 11302,
    "title": "beam's `search_count` advertises overlapping occurrences and no test would notice if it stopped *(beam lane; opened 2026-10-25 by the pipe, per reply 27 to beam)*"
+  },
+  {
+   "bytes": 3516,
+   "end_line": 11363,
+   "id": "Q67",
+   "line": 11319,
+   "lines": 45,
+   "role": "opening",
+   "role_detail": "",
+   "status": "open and unclaimed.",
+   "status_line": 11357,
+   "title": "forge's probe-refactor verifier certifies a refactor that restores the defect it removes *(forge lane; opened 2026-10-25 by the pipe, per reply 20 to forge)*"
   }
  ]
 }