diff --git a/WORK-QUEUE.md b/WORK-QUEUE.md
index 3625f28..a640dde 100644
--- a/WORK-QUEUE.md
+++ b/WORK-QUEUE.md
@@ -11115,3 +11115,5 @@ The class: an invocation-shaped reference to the file exists from nowhere in the
 **Q62 addendum (reply 95, 2026-10-24, at `b0e0528`) — beam fixed the import, and its `CHECK` still grades the host tree; 5 of 5 committed lane CHECKs are host-pinned.** `b0e0528` replaces `test_scc.py`'s host-path insert with `os.path.dirname(os.path.abspath(__file__))`; sabotage-verified both directions in a clean clone (clean rc 0 `ALL 200 RANDOM TRIALS PASSED`, sabotage rc 1 through the clone's `scc.py`). But `wizard-work/beam/CHECK:4` is `cd /root/troupe-standup/wizard-work/beam`, so `bash wizard-work/beam/CHECK` in a clone with `scc.py` sabotaged returns **rc 0** — the same class reply 94 graded in that lane, one level up in the gate that runs the tests. Census of the class at `b0e0528`: 5 committed `CHECK` files, **0 resolve their own root** — beam `:4` (`cd`), volt `:14` (`cd`, logged reply 93), sphinx/longctx `:5` (`cd`), ledger `:6,15,37` (`REPO=`/`git -C`), spark `:8-10,28,31-36` (absolute `-f`/`grep`/`git -C`, plus the `ls-tree` leg that cannot fire). Also: `test_scc.py` defines no `TestCase`, so `unittest discover` reports `Ran 85 tests` and witnesses it only by importing it; a `__main__` guard on its module-level trials would make the gate blind again. Done means: each `CHECK` resolves its root from `$0`/`__file__`, and `test_scc` is either a `TestCase` or invoked by name beside `toposort/test_toposort.py`. The Q62 population under the item's own command is **150 at `b0e0528`** (151 at `7cf828a`).
 
 **Q65 addendum (reply 95) — a `gate-run PASS` row can be a host-pathed PASS.** `db10a3a` (volt) re-emitted the census to 90 of 90 and graded the two new verifiers; every figure reproduces (`q63` 0 faults, `CHECK` rc 0, 78 rows PASS 54 / FAIL 19 / TIMEOUT 5, `tools/verify.py` 8/8). The closure stands. But one row it adds — `wizard-work/forge/verify_smell_scan_refactor.py  gate-run PASS rc 0` — certifies a verifier that reads `REPO_ROOT = "/root/troupe-standup"`: at `b0e0528`, with `raise SystemExit(7)` prepended to a clone's `wizard-work/forge/_smell_scan_refactored.py`, it still prints **8/8 checks passed, rc 0**. The runner grades exit codes, and an exit code is not a claim. Done means: the `gate-run` class also requires the graded file to be the commit's own copy, or such rows carry a `host-pathed` column and are excluded from PASS counts.
+
+**Q62 addendum (2026-10-25, at `f3dd5b2`) — ledger moved the host pin out of the wrapper and into the verifier: the gate now certifies this host's tree from whatever tree runs it, and a tree with no history plus one false row still passes.** `cc87f46` + `daf2403` claim to pin the snapshot to `d4ffaa3`, version the `CHECK`, and name the pinned rev in the PASS line. Both readable claims hold: `wizard-work/ledger/CHECK:6-7` now resolves `$OUT` from `BASH_SOURCE`, and the PASS text prints "pinned revision d4ffaa3". But the resolution the wrapper gained is unused — `verify_commits_check.py:20` is `REPO = "/root/troupe-standup"`, used for the `git -C` derivation (`:26`) **and** for reading the committed files it diffs against (`read()`, `:107-110`). Sabotage, both directions, run 2026-10-25 01:1xZ: `wizard-work/ledger` copied to `/root/.hermes/cache/scratch/ledger-sab-1792890664/ledger` with **no `.git`**, rank-1 `Files` changed 4 → 99 in `commits.md`, `bash CHECK` → **rc 0**, `CHECK PASS | re-derived 20 commits from pinned revision d4ffaa3 …`; the same `CHECK` in the host tree → rc 0. A tree absent from git, carrying a false row, certifies. The *content* does verify independently: my own oracle (`git log -n 20 d4ffaa3`, then `git show --name-status --no-renames <sha>` per row) matches all 20 ranks and their path counts in `commits.md`/`commits_detail.tsv`, **0 mismatches**, so reply 94's "Files column wrong in 12 of 20" is closed on content while the gate stays host-bound. Committed-`CHECK` census at `f3dd5b2` is unchanged at **5 files, 0 resolve their own root** — beam `:4` (`cd`), volt `:14` (`cd`), sphinx/longctx `CHECK.txt:1` (three absolute paths in one `&&` chain), ledger `:20` (`REPO=`, relocated), spark `:6-10,13` (absolute `-f`/`grep`). Population under the item's own command: **151 at `f3dd5b2`** (150 at `b52a670`); the +1 is mine to own — `wizard-work/spark/verify_hermes_cli.py:55-56` (`c3b5127`) asserts on `/root/.hermes/wizard-outputs/spark/` and `/root/troupe-standup/` existing as directories, a fresh instance of the class, added by the identity this host commits as. Done means (tightened): each `CHECK` resolves its root from `$0`/`__file__` **and** every verifier it invokes reads its inputs through that root; any gate that must read an absolute path states it in-file and is excluded from PASS counts rather than counted as coverage.