volt: q155 — workqueue census graded against its pin, not the live queue

wizard-work/ledger/2026-11-02-workqueue-census/README.md

@@ -1,32 +1,59 @@
 # workqueue-census — 2026-11-02
 
-Typed census of every numbered work-queue (Q) item in `WORK-QUEUE.md` (the
-committed source, sha256 `cea6cd3c…06eb`, 14,265 lines).
+Typed census of every numbered work-queue (Q) item in `WORK-QUEUE.md`.
+
+The census is a **snapshot**, and it says which one: `extract_manifest.json` pins
+the queue revision and blob the rows were read from —
+
+    source_rev       0ec1c643fa5cfcb996266423013de2b553eb0c95
+    source_blob_sha  a7f716593b91c0db930d8ed7e78eb23a2d0f0d51   (WORK-QUEUE.md)
+    source_sha256    ceb6cd3c7e0f1fbfe55045b5fd2765f076f7adae50f23b26f243e6e5028906eb
+    source_lines     14265
+    rows             88
+
+(The README this replaces stated the source sha256 as `cea6cd3c…06eb`; the blob
+pinned above hashes to `ceb6cd3c…06eb`. One hex character, in prose the gate did
+not read — which is why the digest is now a graded leg rather than a caption.)
 
 ## Artifact
 
-`workqueue-census.tsv` — tab-separated, header `Q | Title | Status | Target`.
-One row per Q item, sourced verbatim from the live `WORK-QUEUE.md`.
+`workqueue-census.tsv` — tab-separated, header `Q | Title | Status | Target`,
+one row per Q heading at the pinned revision. `Q` and `Title` are graded against
+an independent re-derivation; `Status` and `Target` are transcribed from the
+item's body and are **not** certified by this gate.
 
-## Rules (documented for the CHECK)
+## Rules
 
 * A Q item is a line matching `^## Q<n> — <title>`.
 * Trailing `*(notes)*` on the title is stripped.
-* `Status` is the `**Status: ...` line in the item's body; `Target` is the first
-  backticked `recoveries|docs|checkins` file in the body.
+* `Status` is the first `**Status: ...` line in the item's body; `Target` is the
+  first backticked `recoveries|docs|checkins` file in the body.
 * Duplicates (a Q opened twice, or re-opened) are emitted as separate rows,
   exactly as they appear in the source.
 
 ## Reproduce / verify
 
 ```bash
-python3 extract_workqueue_census.py   # regenerate the TSV + manifest
-python3 CHECK                            # independent re-derivation; exit 0 iff green
+bash CHECK                                 # grade the artifact against its pin
+python3 extract_workqueue_census.py        # regenerate TSV + manifest at HEAD
+python3 extract_workqueue_census.py --help # usage; a bad flag is rc 2
 ```
 
-The CHECK re-derives the expected rows from `WORK-QUEUE.md` with plain
-string operations (does not import the extractor) and diffs them against the
-committed TSV. Exit code is the verdict: `0` = correct, nonzero = wrong.
+`CHECK` is a bash entry point over `grade_census.py` (the same shape as the two
+check-in censuses that Q151 repaired): every caller in this tree invokes an entry
+point with `bash`, and before this wrapper `bash CHECK` read rc 2 on shell syntax
+errors without grading a cell. The grader is a separate program from the
+extractor and does not import it.
+
+`probe_census.sh` runs a 13-cell battery in a detached worktree, so the gate's
+red readings are measured rather than asserted: a moved `Title` cell, a moved `Q`
+cell, a corrupted digest, a pin whose revision does not hold that blob, an absent
+pinned object, an absent TSV, an absent grader, a queue append the pin absorbs
+(ADVISORY), the extractor refusing a dirty source, `--allow-dirty` writing an
+unpinned manifest that the gate then refuses to grade, and a restore.
+
+Exit codes: `0` green, `1` a fault, `2` could not grade (no pin, no artifact, no
+grader). A `2` is never a pass.
 
 ## Column contract
 
@@ -35,3 +62,17 @@ committed TSV. Exit code is the verdict: `0` = correct, nonzero = wrong.
 * `Status` — the `**Status: ...` line, verbatim (may carry a trailing `**`).
 * `Target` — first backticked file in the body, or empty when the item names
   none.
+
+## What the pin does and does not buy
+
+The queue is append-only, so a gate that re-derived from the live file reddened
+on the next tick's own append — it graded the world, not the artifact (measured:
+one appended heading turned the pre-repair `python3 CHECK` from rc 0 into rc 1
+with three failing legs). Grading the pinned blob removes that time bomb: a
+later append is reported as `ADVISORY source-moved` and changes no verdict.
+
+The pin does not make the census current. Re-pinning is a deliberate
+`python3 extract_workqueue_census.py` at a committed revision plus a commit; the
+extractor refuses to pin a dirty `WORK-QUEUE.md` unless `--allow-dirty` is
+passed, and that path records `source_blob_sha: null` — which the gate reads as
+ungradable, not as green.