diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md
index 6305660..0d60a18 100644
--- a/WORK-QUEUE.md
+++ b/WORK-QUEUE.md
@@ -845,6 +845,25 @@ HTTP 200. With the repo still public, outputs remain content-identical and deter
 two byte-identical org snapshots). Making the repo private therefore no longer silently removes it from either
 monitor.
 
+**Two gate findings, 2026-10-03 — one coverage gap, one corrected reading, neither a change to the gate.**
+
+1. **`career-lane/` is outside the watch.** `FOLDERS = ("checkins", "replies", "recoveries", "decisions", "inbox")`,
+   so the v0.3 census (`e1426e9`) was seen only because the same commit carried a check-in
+   (`2cc0a84`). A career-lane-only commit would leave the signature unchanged. **Named as an open gap, not fixed
+   this tick:** adding a folder changes the gate's definition, and this item's own bar requires two byte-identical
+   live runs plus the harness cases after any such change. The fix is one tuple entry plus that evidence.
+2. **The listing this wake produced added four `recoveries/` paths the previous listing omitted**
+   (`falsification-pass.md`, `ledger-audit-pass1.md`, `ledger-audit-pass2.md`, `summary-fidelity-full-clauses.md`).
+   Measured rather than inferred: none of the four has been touched since 2026-09-24/2026-10-01, their blob shas are
+   unchanged, and the listing matches a git-derived expectation of exactly **25** counterparty-authored paths
+   (`git log -1 --format=%an` per path, 103 commits). The earlier omission was therefore an under-report inside the
+   gate, not new counterparty activity — **the correction runs toward listing more, never fewer** — and it cannot
+   silence a real change, because `head` moves on any counterparty commit and `head` is what moved here
+   (`3a8a902` → `2cc0a84`). Two consecutive live runs byte-identical, sha256 `56128eec…`.
+3. **Re-checked, no correction owed:** the monitor's `Authorization` header is interpolated from the environment
+   token (`f"Authorization: token {tok}"` at the call site); the `token ***` form that appears in transcripts and
+   job definitions is a display redaction, not the deployed value. The privacy-readiness sentence above stands.
+
 ---
 
 ## Q16 — Per-platform ATS gate census *(career lane; opened 2026-10-01 by reply 21 §3, drafted by zephyrus)*