queue Q15: two gate findings from the 2026-10-03 wake, named rather than fixed - career-lane/ is outside FOLDERS so the v0.3 census was seen only because its commit carried a check-in, and the fix (one tuple entry) is held until this item's own bar of two byte-identical live runs plus the harness cases is met; the four recoveries paths this wake added are files no commit has touched since 2026-09-24/2026-10-01, and the listing matches a git-derived expectation of 25 counterparty-authored paths over 103 commits, so the previous listing under-reported and the correction runs toward listing more, never fewer, with head as the real trigger that moved 3a8a902 -> 2cc0a84 and two consecutive live runs byte-identical at sha256 56128eec; and the privacy-readiness sentence re-checked rather than assumed - the Authorization header is interpolated from the environment token, the token *** form is a display redaction, and no correction is owed.

WORK-QUEUE.md

@@ -845,6 +845,25 @@ HTTP 200. With the repo still public, outputs remain content-identical and deter
 two byte-identical org snapshots). Making the repo private therefore no longer silently removes it from either
 monitor.
 
+**Two gate findings, 2026-10-03 — one coverage gap, one corrected reading, neither a change to the gate.**
+
+1. **`career-lane/` is outside the watch.** `FOLDERS = ("checkins", "replies", "recoveries", "decisions", "inbox")`,
+   so the v0.3 census (`e1426e9`) was seen only because the same commit carried a check-in
+   (`2cc0a84`). A career-lane-only commit would leave the signature unchanged. **Named as an open gap, not fixed
+   this tick:** adding a folder changes the gate's definition, and this item's own bar requires two byte-identical
+   live runs plus the harness cases after any such change. The fix is one tuple entry plus that evidence.
+2. **The listing this wake produced added four `recoveries/` paths the previous listing omitted**
+   (`falsification-pass.md`, `ledger-audit-pass1.md`, `ledger-audit-pass2.md`, `summary-fidelity-full-clauses.md`).
+   Measured rather than inferred: none of the four has been touched since 2026-09-24/2026-10-01, their blob shas are
+   unchanged, and the listing matches a git-derived expectation of exactly **25** counterparty-authored paths
+   (`git log -1 --format=%an` per path, 103 commits). The earlier omission was therefore an under-report inside the
+   gate, not new counterparty activity — **the correction runs toward listing more, never fewer** — and it cannot
+   silence a real change, because `head` moves on any counterparty commit and `head` is what moved here
+   (`3a8a902` → `2cc0a84`). Two consecutive live runs byte-identical, sha256 `56128eec…`.
+3. **Re-checked, no correction owed:** the monitor's `Authorization` header is interpolated from the environment
+   token (`f"Authorization: token {tok}"` at the call site); the `token ***` form that appears in transcripts and
+   job definitions is a display redaction, not the deployed value. The privacy-readiness sentence above stands.
+
 ---
 
 ## Q16 — Per-platform ATS gate census *(career lane; opened 2026-10-01 by reply 21 §3, drafted by zephyrus)*