queue (volt): TICK 2026-10-18 17:23Z -- the re-render rule now has a tooth (queue_append_audit.py)

The 15:15Z block adopted "append and re-render in the same commit" as a rule
and left enforcement to hand probes; that loop produced three wrong-slice
counts in one week. tools/queue_append_audit.py (8a450a3) grades each
queue-touching commit in its own tree. Measured at 8a450a3: default range 9
commits -- 6 PASS, 3 STALE (f2c3067, ece5228, 067afdf), 0 UNGRADABLE -- with
328 earlier queue-touching commits counted and not listed; --all lists all 337
(328 UNGRADABLE); --guard reads 1 PASS at c034175, rc 0. Reply 24's corrected
set reproduces from the commits by a second route, with its two rc-2 commits
(12b4497, 0bdb9d4) landing in UNGRADABLE as it said. The tool's fixture also
found and fixed a --write IndexError in queue_index.py (zero-byte document, rc
1) for any queue with no nested records; the real render did not move.

This commit is the append + the re-render, and --check reads rc 0 at it.

WORK-QUEUE.md

@@ -9992,3 +9992,17 @@ Artifact: `/root/.hermes/wizard-outputs/volt/2026-10-18-index-stale/` (`REPORT.m
 - **Instrument lesson, recorded because it nearly produced a false green twice in one tick.** A `--check` run in a working tree at HEAD says **nothing** about a cited revision: my first probe loop reported rc 0 "at `067afdf`" while actually grading HEAD's tree, contradicting the checkout scan on the same commit. Any claim of the form "the gate was red at X" must come from a checkout of X, never from `git show <rev>` plus a working-tree run.
 - **What stands from the 15:15Z block, unamended:** the red window is real and mine (`067afdf` 12:33:59Z → `de3dcdc` 15:11:09Z, 2h37m, from this lane's append plus the earlier `f2c3067` prose quoting); the rule (queue append + `--write` in one commit, `--check` rc 0 at the landing commit) is now exercised twice; the repair verifies; and `docs/queue-index.md` is green at the pushed HEAD.
 - **Nothing operational.** No item opened or closed; open set unchanged (Q37 `:5278`, career-lane Q53 `:7303`); no issue, PR, release or deploy surface; no another-party file edited; no secret printed. Vincent's route remains dead and Praetorian's jobs remain `blocked_config`.
+
+
+**Volt tick 2026-10-18 17:23Z — the re-render rule gets a tooth: `tools/queue_append_audit.py` grades every queue-touching commit IN ITS OWN TREE, and it reproduces the corrected stale set exactly.** (Pure suffix append; clock read immediately before this edit; the file's true last line at `8a450a3` was the `Nothing operational` bullet above, so nothing above this anchor was touched. The index is re-rendered in this same commit, per the rule the 15:15Z block adopted, and `--check` reads rc 0 at the commit this block lands in.)
+
+- **The gap, in this lane's own words from 15:15Z, left open as "Alexander's policy call".** `docs/queue-index.md` pins `WORK-QUEUE.md` by sha256, so an append that skips the re-render is STALE by construction; nothing obliged a commit to re-render, and two appends in two days left the gate red (the second for 2h37m). The missing piece was never a decision — it was an instrument: every count produced so far came from a hand-run probe loop, and that loop produced **three wrong slices in one week**, the 15:16Z correction naming the mechanism (a `--check` in a working tree at HEAD grades HEAD, not the revision it is cited for).
+- **What `tools/queue_append_audit.py` measures, and what it refuses to measure.** For each commit that touches the queue it extracts exactly the queue, the index document and `tools/queue_index.py` **from that commit** with `git archive`, then runs that tree's own gate inside a scratch directory. Verdicts are `PASS` (rc 0), `STALE` (rc 1 **with** the tool's `STALE:` line), `UNGRADABLE` (the gate did not exist at that rev, or the tool refused with rc 2) and `ERROR` (rc 1 without a `STALE:` line is a crash wearing the verdict code, not a fault). The separation is the point: an ungradable commit is counted and printed, never folded into the stale bucket — that fold is precisely the defect corrected at 15:16Z. House exit contract: **0** clean, **1** a graded fault, **2** could not grade.
+- **Measured at `8a450a3`, this host.** `--repo .` (default range, which begins at the commit that introduced the index): **9 commits, 6 PASS, 3 STALE, 0 UNGRADABLE**, `graded: 9 of 9`, rc 1, stale set `f2c3067 ece5228 067afdf`; the **328** earlier queue-touching commits are counted on a printed line and not listed. `--all` lists them: **337 rows, 6 PASS, 3 STALE, 328 UNGRADABLE**. `--guard` (newest queue-touching commit only) reads **1 PASS** at `c034175`, **rc 0** — which is the one-line tooth a tick's `check.sh` can call.
+- **Reply 24's corrected set reproduces from the commits, not from its prose.** The three stale revisions are the same three, and Timmy's two rc-2 commits (`12b4497`, `0bdb9d4`) — plus `a82130e` — come out **UNGRADABLE** under `--all`, not stale, because they predate the index: the tool reaches the 15:16Z correction (5 rc 0 / 3 rc 1 / 2 rc 2) by a second, independent route, and adds its own later commit (`c034175`, PASS) that did not exist when that count was taken.
+- **A real defect fell out of the tool's own fixture, in the tool it audits.** `queue_index.py:build_doc` indexed `payload["nested"][0]` unconditionally, so `--write` died with `IndexError` — leaving a **zero-byte** document and **rc 1**, the code that means "graded a fault" — on any queue whose ids all carry headings. Found by the fixture, not by reading. Fixed in a new `nested_prose()`; the non-empty branch reproduces the previous sentence byte for byte, so the real document did not move: `--check` **rc 0** and `--selftest` **54/54** before and after, and the fix is 23 lines added / 7 removed.
+- **Gates at `8a450a3`, all measured.** `queue_append_audit --selftest` **25 cells, 25 passed** (and it advertises that count on its own usage line); `selftest_sweep` **13 tools, 13 OK, 0 fatal**, read-refusal **18 probes, 18 ok**, malformed-input **16 probes, 16 ok** — the new reader was added to **both** axes rather than left as the `NO_PROBE` advisory the sweep printed for it pre-commit; `doc_census_check --tools tools/queue_append_audit.py --no-run` grades **0 claims** (no oracle in that mode) and exits 0.
+- **What this does not do.** It does not enforce anything by itself: it reports, and wiring `queue_append_audit.py --guard` into a tick's `check.sh` is the same policy call as before — but it is now a one-line call, not a build. It also does not adjudicate closure (that is `queue_claim_check.py`'s verdict) and does not repair a stale commit; the three historical reds stay red, correctly, because history is not rewritten.
+- **Nothing operational.** No queue item opened or closed; open set unchanged (Q37 `:5278` pipe, career-lane Q53 `:7303` held for Alexander); no issue, PR, release or deploy surface; no another-party file edited (this lane's own `tools/queue_index.py` and `tools/selftest_sweep.py` were edited, both carrying this lane's author); no counterparty messaged; no secret printed. Artifact: `/root/.hermes/wizard-outputs/volt/2026-10-18-queue-append-audit/`.
+
+— Volt

docs/queue-index.md

@@ -56,7 +56,7 @@
 | 46 | Q44 | 6162-6705 | 88496 | opening | The pin class: redirect every constant composed from the live data root, not only `SNAPSHOT_PATH` *(Helm lane; opened 2026-10-12 by the pipe, per Q43's own closing sentence — "extend the redirect … | DONE 2026-10-12 — `recoveries/helm-root-redirect.md` (Merlin, Helm lane); the closure block is at the foot |
 | 47 | Q48 | 6706-6825 | 15123 | opening | The runtime-resolution redirect: close the class Q45's literals cannot see | DONE 2026-10-13 — `recoveries/helm-runtime-redirect.md` (Merlin, Helm lane), scratch tree |
 | 48 | Q49 | 6826-7593 | 92050 | opening | The runtime-resolved root's live write path: name it, reproduce it, then close it | open and unclaimed. Opened by the pipe 2026-10-13 |
-| 49 | Q45 | 7594-9994 | 350722 | opening | §9 follow-on — the home-directory channel *(Helm lane; Merlin)* | -- |
+| 49 | Q45 | 7594-10008 | 355716 | opening | §9 follow-on — the home-directory channel *(Helm lane; Merlin)* | -- |
 
 ## Ids with no `## ` heading
 
@@ -71,7 +71,7 @@ Opened as records inside another section. `line` is the record's own opening lin
 | Q50 | 6990 | 6990 | 46 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q51 | 7106 | 7106 | 37 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q52 | 7167 | 7167 | 90 | Q49 | BULLET+BOLD | BOLD-LEAD |
-| Q53 | 7292 | 7246 | 108 | Q49 | BULLET+BOLD | BOLD-LEAD |
+| Q53 | 7292 | 7246 | 109 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q63 | 9918 | 9909 | 16 | Q45 | BULLET+BOLD | BOLD-LEAD |
 
 **Not in this document.** Ids the prose corpus names that the queue has never mentioned (`checkins/`, `replies/`, `recoveries/`, `audits/`, `docs/`, the top-level documents; `tools/` excluded). That set moves with the prose, not with the queue, so embedding it here would make `--check` go RED for a reason that has nothing to do with the queue being current. It is reported on demand: `python3 tools/queue_index.py --outside`.
@@ -217,7 +217,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q53",
    "line": 7292,
-   "refs": 108,
+   "refs": 109,
    "section": "Q49",
    "shape": "BULLET+BOLD"
   },
@@ -236,9 +236,9 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "end_line": 8,
   "line": 1
  },
- "queue_bytes": 1242983,
- "queue_lines": 9994,
- "queue_sha256": "4149f60ab86c3e4b8a95fdf4a67518897f735cccf85498857cf419a7ef497df2",
+ "queue_bytes": 1247977,
+ "queue_lines": 10008,
+ "queue_sha256": "a84a3f7381e9fcc182a7eaaebc0e514d6b63be551dd08776c4ac00ea653620c6",
  "sections": [
   {
    "bytes": 3139,
@@ -817,11 +817,11 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "The runtime-resolved root's live write path: name it, reproduce it, then close it"
   },
   {
-   "bytes": 350722,
-   "end_line": 9994,
+   "bytes": 355716,
+   "end_line": 10008,
    "id": "Q45",
    "line": 7594,
-   "lines": 2401,
+   "lines": 2415,
    "role": "opening",
    "role_detail": "",
    "status": null,