tools (volt): queue_claim_check.py -- a duplicated label binds a closure by section, not by id

`Q53` labels two live items: the career-lane apply queue at `:7303` (seven
decisions held for Alexander) and Mercury's record at `:8530`. Mercury's `:9869`
DONE matched "Q53" and closed BOTH, so from `a82130e` (2026-10-16 12:29:32Z) the
census printed `open set: Q37:5278` while four standing blocks in the same file
assert `:7303` open. Bracketed by checkouts, each graded with its own tools:
`20a7501` 3 open / --validate 11/11 rc 0; `a82130e` 1 open / 10/11 rc 1.

Within a duplicated id a closure now binds to the last record of that id opened
at or before it, so a record owns its own section and no namesake can close it.
Unique ids unchanged; the row still prints COLLISION because the labelling
defect is the ledger's.

Selftest 16 -> 17 fixtures (new cell: ['Q40:CLOSED','Q41:OPEN','Q40:CLOSED']
pre-fix, the expected list post-fix; both measured). HAND_READ 11 -> 12
answers: :7303 OPEN added, :8530 corrected to CLOSED (its closure is real).
--validate rc 1 -> rc 0, 12/12.

Post-fix census: 15 opening records, 13 closed, 2 open, open set
Q37:5278 + Q53:7303; other 13 rows unmoved. doc_census_check on this tool: 19
claims, 0 STALE, 0 split, 0 leg failures. Queue block appended and
docs/queue-index.md re-rendered in this same commit.

WORK-QUEUE.md

@@ -10044,3 +10044,18 @@ Artifact: `/root/.hermes/wizard-outputs/volt/2026-10-18-index-stale/` (`REPORT.m
 - **Nothing operational.** No item opened or closed; open set unchanged (Q37 `:5278` pipe, career-lane Q53 `:7303` held for Alexander); no issue/PR/release/deploy surface; no another-party file edited (both files changed are this lane's own `tools/`); no secret printed. Artifact: `/root/.hermes/wizard-outputs/volt/2026-10-18-noprobe-fatal/`.
 
 — Volt
+
+
+**Volt tick 2026-10-19 02:44Z — a duplicate id let one item's DONE close its namesake: the claim check's `open set:` dropped career-lane Q53 for 2.7 days, and binding within a duplicated label is now by section.** (Pure suffix append; clock read immediately before this edit; the file's true last line at `7fa6261` was `— Volt`, so nothing above this anchor was touched. The index is re-rendered in this same commit, and `--check` reads rc 0 at the commit this block lands in. Every queue line quoted below sits inside a code span on purpose: this block's first draft quoted a status line bare, and `queue_claim_check` read the quotation as a new opening record and opened a phantom item `Q63:10051` — caught by re-running the census after the append, and the draft was restored rather than committed.)
+
+- **The defect, at the line.** Two distinct items carry the label `Q53`. The career-lane apply queue opens at `:7303` and its status line, read verbatim, is `**Status: OPEN — queued and drafted; seven decisions and one rate figure are Alexander's.**` Mercury's record opens at `:8530` on a different subject (the state.db digests), and Mercury's closure sits at `:9869`: `**Q53 — DONE at f30a243 (Mercury's R5-a/R5-b, 2026-10-16) …**`. `tools/queue_claim_check.py` matched closures to records with `lead in ids` and nothing else, so `:9869` closed **both** records and its headline printed `open set: Q37:5278` — the item held for Alexander gone from the only command that says what is open. The per-row `COLLISION` note was printed beside it and the aggregate line resolved the collision anyway; the docstring's claim that the tool reports a collision *"rather than resolving"* was false in the one direction that matters.
+- **The window, bracketed by checkouts of each revision graded with its own tools.** `20a7501` (2026-10-16 12:28:37Z) → **3 open**, `open set: Q37:5278, Q53:7303, Q53:8530`, `--validate` **rc 0, 11/11**. `a82130e` (12:29:32Z, **55 s later**, the commit that recorded the closure) → **1 open**, `open set: Q37:5278`, `--validate` **rc 1, 10/11**. Every census between that commit and `7fa6261` printed the one-item set: **2.7 days**, from a commit whose own message reads `open set now Q37:5278 + career-lane Q53:7303`.
+- **Two instruments disagreed and nothing compared them.** Four standing control-plane blocks in this file (`:10006`, `:10017`, `:10031`, `:10044`) each assert the open set is Q37 `:5278` plus career-lane Q53 `:7303` held for Alexander, and all four postdate the commit that broke the tool. The prose was right and the instrument was wrong — the reverse of the usual direction, and the reason a one-line `open set:` is worth this much text.
+- **The one red the tool did print was consumed as evidence of something else, and the reading that did it is mine to name.** `--validate` was red from `a82130e` onward, and `replies/2026-10-17-to-volt-19.md:13` cites `queue_claim_check --validate → 1` as proof that graded faults still exit 1 — true, and it was the **stale hand-read answer for `:8530`** (that record closed legitimately) standing beside a silent error the oracle could not see, because it held no answer for `:7303` at all. An oracle that answers about one collided record and not the other grades the wrong half of the collision.
+- **The fix is one rule and one cell, not a special case.** Within a duplicated id, a closure now binds to the last record of that id opened at or before it, so a record owns its own section and no namesake can close it; unique ids are untouched. Selftest **16 → 17 fixtures** — the new cell reads `['Q40:CLOSED', 'Q41:OPEN', 'Q40:CLOSED']` against the unmodified tool and `['Q40:OPEN', 'Q41:OPEN', 'Q40:CLOSED']` after (**RED → GREEN measured on both sides**, not asserted). `HAND_READ` **11 → 12** answers: `:7303` **OPEN** added, `:8530` corrected to **CLOSED** (its closure is real; the answer was written before it arrived). `--validate` **rc 1 → rc 0, 12/12**.
+- **Measured at the commit this block lands in, after the tool edit and after this append.** Census: **15 opening records, 13 closed, 2 open**, `open set: Q37:5278, Q53:7303`; the other **13 rows are unmoved** — `:7303` is the only state that changed. `--selftest` **17/17, rc 0**; `doc_census_check --tools tools/queue_claim_check.py` **19 claims, 0 STALE, 0 INTERNAL SPLIT, 0 leg failures**; `verify.py` re-run at this commit, its three rows and rc recorded in the artifact's `post-verify.txt`.
+- **What it does not do.** It does not relabel the queue — the collision is the ledger's labelling defect and the row still prints `COLLISION`; it does not repair history (the 2.7-day window stays readable as it was); it does not adjudicate whether a closure is *earned*, only who it belongs to; and it changes no other record's verdict. Two records still need labels that differ — **Alexander's** call, not this lane's, and lane-naming remains the workaround the ledger already uses.
+- **Nothing operational.** No queue item opened or closed; open set after this block Q37 `:5278` (pipe) and career-lane Q53 `:7303` (held for Alexander); no issue, PR, release or deploy surface; no another-party file edited (the only file changed is this lane's own `tools/queue_claim_check.py`); no counterparty messaged; no secret printed. Artifact: `/root/.hermes/wizard-outputs/volt/2026-10-19-q53-collision/` (`REPORT.md`, `baseline-*`, `post-*`, `bracket.sh` + `bracket.txt`, `probe-collision-prefix.py`, `check.sh`).
+
+— Volt
+

docs/queue-index.md

@@ -4,7 +4,7 @@
 
 **What this is.** One row per `## ` section of `WORK-QUEUE.md`: its line span, its size, and the first `Status:` marker in its body verbatim. Whether an item is *open* is not decided here -- that verdict is `tools/queue_claim_check.py`'s, and this document does not overrule it.
 
-**What it exposes.** The queue is two-tier. 49 sections carry 45 ids because 4 ids own a second, continuation section. A further **9 ids have no heading at all** and are opened as records nested inside another item's section -- so grepping `^## Q41` finds nothing while Q41 is a live item the file names 26 times. Those are listed in their own table below.
+**What it exposes.** The queue is two-tier. 49 sections carry 45 ids because 4 ids own a second, continuation section. A further **9 ids have no heading at all** and are opened as records nested inside another item's section -- so grepping `^## Q41` finds nothing while Q41 is a live item the file names 28 times. Those are listed in their own table below.
 
 | # | id | lines | bytes | role | title | first `Status:` |
 |---|---|---|---|---|---|---|
@@ -56,7 +56,7 @@
 | 46 | Q44 | 6162-6705 | 88496 | opening | The pin class: redirect every constant composed from the live data root, not only `SNAPSHOT_PATH` *(Helm lane; opened 2026-10-12 by the pipe, per Q43's own closing sentence — "extend the redirect … | DONE 2026-10-12 — `recoveries/helm-root-redirect.md` (Merlin, Helm lane); the closure block is at the foot |
 | 47 | Q48 | 6706-6825 | 15123 | opening | The runtime-resolution redirect: close the class Q45's literals cannot see | DONE 2026-10-13 — `recoveries/helm-runtime-redirect.md` (Merlin, Helm lane), scratch tree |
 | 48 | Q49 | 6826-7593 | 92050 | opening | The runtime-resolved root's live write path: name it, reproduce it, then close it | open and unclaimed. Opened by the pipe 2026-10-13 |
-| 49 | Q45 | 7594-10046 | 369081 | opening | §9 follow-on — the home-directory channel *(Helm lane; Merlin)* | -- |
+| 49 | Q45 | 7594-10061 | 374595 | opening | §9 follow-on — the home-directory channel *(Helm lane; Merlin)* | -- |
 
 ## Ids with no `## ` heading
 
@@ -64,15 +64,15 @@ Opened as records inside another section. `line` is the record's own opening lin
 
 | id | record line | first mention | refs | inside section | shape | form |
 |---|---|---|---|---|---|---|
-| Q41 | 5597 | 5597 | 26 | Q37 | BULLET+BOLD | BOLD-LEAD |
+| Q41 | 5597 | 5597 | 28 | Q37 | BULLET+BOLD | BOLD-LEAD |
 | Q42 | 5803 | 5673 | 62 | Q37 | BULLET+BOLD | BOLD-LEAD |
 | Q46 | 6419 | 6412 | 62 | Q44 | BULLET+BOLD | BOLD-LEAD |
 | Q47 | 6542 | 6485 | 45 | Q44 | BULLET+BOLD | BOLD-LEAD |
 | Q50 | 6990 | 6990 | 46 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q51 | 7106 | 7106 | 37 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q52 | 7167 | 7167 | 90 | Q49 | BULLET+BOLD | BOLD-LEAD |
-| Q53 | 7292 | 7246 | 112 | Q49 | BULLET+BOLD | BOLD-LEAD |
-| Q63 | 9918 | 9909 | 16 | Q45 | BULLET+BOLD | BOLD-LEAD |
+| Q53 | 7292 | 7246 | 121 | Q49 | BULLET+BOLD | BOLD-LEAD |
+| Q63 | 9918 | 9909 | 17 | Q45 | BULLET+BOLD | BOLD-LEAD |
 
 **Not in this document.** Ids the prose corpus names that the queue has never mentioned (`checkins/`, `replies/`, `recoveries/`, `audits/`, `docs/`, the top-level documents; `tools/` excluded). That set moves with the prose, not with the queue, so embedding it here would make `--check` go RED for a reason that has nothing to do with the queue being current. It is reported on demand: `python3 tools/queue_index.py --outside`.
 
@@ -154,7 +154,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q41",
    "line": 5597,
-   "refs": 26,
+   "refs": 28,
    "section": "Q37",
    "shape": "BULLET+BOLD"
   },
@@ -217,7 +217,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q53",
    "line": 7292,
-   "refs": 112,
+   "refs": 121,
    "section": "Q49",
    "shape": "BULLET+BOLD"
   },
@@ -226,7 +226,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q63",
    "line": 9918,
-   "refs": 16,
+   "refs": 17,
    "section": "Q45",
    "shape": "BULLET+BOLD"
   }
@@ -236,9 +236,9 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "end_line": 8,
   "line": 1
  },
- "queue_bytes": 1261342,
- "queue_lines": 10046,
- "queue_sha256": "45acaff1d91dbd771bf68cba90ab96f402dfd35ec4f03f1ce82bdde7129c4fa2",
+ "queue_bytes": 1266856,
+ "queue_lines": 10061,
+ "queue_sha256": "b6c9c2d5478bb511dc44cc1ab939ce62b18fd8f6513bae943a46204d01588462",
  "sections": [
   {
    "bytes": 3139,
@@ -817,11 +817,11 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "The runtime-resolved root's live write path: name it, reproduce it, then close it"
   },
   {
-   "bytes": 369081,
-   "end_line": 10046,
+   "bytes": 374595,
+   "end_line": 10061,
    "id": "Q45",
    "line": 7594,
-   "lines": 2453,
+   "lines": 2468,
    "role": "opening",
    "role_detail": "",
    "status": null,

tools/queue_claim_check.py

@@ -94,7 +94,12 @@ KNOWN BLIND SPOTS (measured, not hand-waved)
 --------------------------------------------
 - Item ids are labels, not keys: this file's own record carries a collision
   (career-lane apply queue `:7292` also reads `Q53`; the queue's own reply 62
-  notes it), which the tool reports as `COLLISION` rather than resolving.
+  notes it). Binding is by **section**: within a duplicated id, a closure binds
+  to the last record of that id opened at or before the closure, so neither
+  namesake can close the other. Until 2026-10-19 the tool took the id alone as
+  sufficient, graded `:7303` CLOSED on Mercury's `:9869`, and printed
+  `open set: Q37:5278` while the ledger's own blocks asserted `:7303` open; the
+  row still reads `COLLISION` because the labelling defect is the ledger's.
 - The state is only as good as the closure line's anchoring. Inherited
   anchoring can attach a closure to the enclosing item; a hand-validated set
   (`--validate`) is included so a wrong answer is visible.
@@ -106,7 +111,7 @@ USAGE
     python3 tools/queue_claim_check.py --queue PATH --json OUT.json
     python3 tools/queue_claim_check.py --validate           # + the hand-read answers
     python3 tools/queue_claim_check.py --git                # resolve closure revisions
-    python3 tools/queue_claim_check.py --selftest           # 16 fixtures, exit 0/1
+    python3 tools/queue_claim_check.py --selftest           # 17 fixtures, exit 0/1
     python3 tools/queue_claim_check.py --census             # both closure units + the axis table
 
 Exit codes: 0 clean · 1 self-test failure · 2 stale opening line (--fail-on-stale)
@@ -157,12 +162,16 @@ CLOSURE_WINDOW = 120
 STALE_LITERAL = re.compile(r'Status:\s*\**\s*open and unclaimed', re.I)
 SHA7 = re.compile(r'`([0-9a-f]{7,63})[0-9a-f\u2026]*`')
 
-# Hand-read ground truth: eleven answers read off the queue by hand before any
+# Hand-read ground truth: twelve answers read off the queue by hand before any
 # instrument runs (queue-hygiene-census.md §2). Two independent lanes now.
 HAND_READ = {
+    # Read by hand off WORK-QUEUE.md at `7fa6261` (2026-10-19).  :8530 was 'OPEN'
+    # here until this revision; it closed legitimately at :9869 on 2026-10-16 and
+    # the hand-read answer had gone stale, which is what `--validate` exists to
+    # show.  :7303 is the collided sibling and is OPEN in its own words.
     2264: 'CLOSED', 2684: 'CLOSED', 2898: 'CLOSED', 6348: 'CLOSED',
     6419: 'CLOSED', 6542: 'CLOSED', 6847: 'CLOSED', 6990: 'CLOSED',
-    7106: 'CLOSED', 7167: 'CLOSED', 8530: 'OPEN',
+    7106: 'CLOSED', 7167: 'CLOSED', 7303: 'OPEN', 8530: 'CLOSED',
 }
 
 
@@ -384,6 +393,35 @@ def census(text):
     for r in records:
         r['collision'] = bool(r['item'] and len(seen.get(r['item'], [])) > 1)
 
+    # A duplicate label cannot bind a closure by id alone.  Until 2026-10-19 this
+    # file took `lead in ids` as sufficient and let EVERY record carrying the
+    # label inherit the same closure -- so one item's DONE closed its namesake.
+    # On the live queue that graded the career-lane apply queue (:7303, held for
+    # Alexander) CLOSED on Mercury's :9869 and dropped it from `open set:`, while
+    # four standing ledger blocks assert it open.  A record owns its own section,
+    # so a closure binds to the last record of that id opened at or before it --
+    # never to a sibling that ended before the closure was written.
+    groups = {}
+    for r in records:
+        if r['item'] is not None:
+            groups.setdefault(r['item'], []).append(r)
+    for item, recs in groups.items():
+        if len(recs) < 2:
+            continue
+        recs.sort(key=lambda r: r['line'])
+        qid = int(item[1:])
+        for i, r in enumerate(recs):
+            lo = r['line']
+            hi = recs[i + 1]['line'] if i + 1 < len(recs) else None
+            owned = [(c[0], c[2]) for c in closures
+                     if qid in c[1] and c[0] >= lo and (hi is None or c[0] < hi)]
+            r['closure_line'] = owned[0][0] if owned else None
+            r['closure_lines_after'] = [c[0] for c in owned]
+            r['closure_text'] = owned[0][1].strip() if owned else None
+            r['state'] = 'CLOSED' if owned else 'OPEN'
+            r['stale'] = (bool(STALE_LITERAL.search(strip_code(lines[lo - 1])))
+                          and r['state'] == 'CLOSED')
+
     raw_literal = len(re.findall(r'Status:\s*\**\s*open and unclaimed', text, re.I))
     return {
         'lines': len(lines),
@@ -466,6 +504,18 @@ FIXTURES = [
      '  enumerable as stated**, so the record is corrected in place rather than restated.\n\n'
      '**Status: DONE — closed by the pipe.**\n',
      ['Q30:CLOSED']),
+
+    # The live defect this cell was written for (2026-10-19): the career-lane
+    # apply queue (:7303) and Mercury's record (:8530) both read `Q53`, so
+    # Mercury's `:9869` DONE closed both and the tool printed `open set: Q37:5278`
+    # against four ledger blocks asserting :7303 open.  Pre-fix this cell reads
+    # ['Q40:CLOSED', 'Q41:OPEN', 'Q40:CLOSED'].
+    ("collision: a duplicate label does not let one record's closure close the other",
+     '## Q40 — first use of the label\n\n**Status: OPEN — held for Alexander.**\n\n'
+     '## Q41 — an unrelated section between them\n\n**Q41 — OPEN (lane).**\n\n'
+     '## Q40 — second use of the same label\n\n**Status: OPEN — queued.**\n\n'
+     '**Q40 — DONE at 4010b96.**\n',
+     ['Q40:OPEN', 'Q41:OPEN', 'Q40:CLOSED']),
 ]
 
 UNIT_FIXTURES = [