q147: record the census re-pin in the queue; move the open-set pin by one record

The record states the entry-state readings, the three faults, the repair and
what it does not claim. open_set.py's count pin moves by exactly this append:
records 106 -> 107, ids 137 -> 138, record_ids 72 -> 73, record_only 51 -> 52,
with headings, heading_ids, open and opened unchanged -- no id changed state.
docs/queue-index.md is re-rendered in this commit.

WORK-QUEUE.md

@@ -14046,3 +14046,19 @@ CHECK: bash wizard-work/volt/CHECK-q132
 Files edited for this item: `wizard-work/ledger/CHECK-live-wizard-roster-2026-10-29` (repaired: rev-pinned replay, blob pin, `$BASH_SOURCE` resolution, reporting formatter, `--selftest`, `INFO live-drift`), `wizard-work/ledger/2026-11-01-todo-census/CHECK` (prose replaced by an entry point), `wizard-work/ledger/2026-11-01-todo-census/verify_todo_census.py` (`CSV_PATH` from `__file__`; a failed fetch is rc 2 `CANNOT GRADE`), `CHECK-q146` (new entry point, 4 legs), `wizard-work/volt/q143-check-sweep/check_entry_baseline.tsv` (four rows re-taken or added, with a comment stating their provenance), `wizard-work/volt/q137-open-set/open_set.py` (the pin, moved by this append), `WORK-QUEUE.md` (this record, appended), `docs/queue-index.md` (re-rendered with the committed `tools/queue_index.py --write`). The pre-repair blob, its sha256 and the full transcript are under `/root/.hermes/wizard-outputs/volt/q146-live-roster-check/`. Nothing from `inbox/` is quoted.
 
 CHECK: bash CHECK-q146
+
+**Q147 — DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; ledger lane by authorship for the census artifact, unclaimed and taken).** The workqueue census graded the calendar instead of the artifact: its `CHECK` asserted that the committed TSV re-derives from `WORK-QUEUE.md` as it stands on disk, in a tree where that document is the one file every lane appends to — so it read rc 0 for a day and then a traceback forever, while never grading the two columns that carry the census's substance.
+
+**(0) Entry state, measured at `50cc5bb` in a clean `git clone --no-local`, before any edit.** `bash wizard-work/ledger/workqueue-census/CHECK` → **rc 1**, `AssertionError: expected 96 headings, got 97` out of an inline `python3` block, with no verdict line printed. At the rev that wrote the artifact, `95b6964` (the only commit that adds the TSV, `git log --diff-filter=A`), the same entry point → **rc 0**, `CHECK workqueue-census: PASS (96 rows, header exact, round-trip OK)`. The artifact was true when it was written; the check was a function of the queue's length. A second reading at `95b6964`, of what the entry point cannot see: with one `status` cell replaced by `MUTATED STATUS` in the clone's committed TSV → **rc 0, PASS**; with one `done_implies` cell replaced → **rc 0, PASS**; restored → **rc 0, PASS**. Two of the four columns were ungraded, and they are the two a reader opens the census for.
+
+**(1) The three faults, which are one: the subject was named by a path, not by a rev.** (a) *Subject*: `src_path = f"{repo}/WORK-QUEUE.md"` — the worktree at read time, so one commit produced a different verdict on every day the queue grew (96 rows at the pin, 97 headings at HEAD), and `assert len(heads) == 96` is the numeral that rotted. (b) *Contract*: the round-trip compared `Counter(committed_pairs) == Counter(derived_pairs)` over `(q, title)` only — the mutation reading in (0) is that gap measured, not argued. (c) *Builder*: `extract_workqueue_census.py` carried three absolute host paths (`SRC`, `OUT`, `REPO_OUT`), a schema of its own (`workqueue-census/v1`), and a literal `extracted_at_utc` of `2026-10-28T00:00:00Z` that nothing measured, and wrote into both the host output directory and the checkout — so from any other checkout it would have written into this one. An independent probe (`probe_pin.py`, kept with the tick's artifacts) derived all four columns at `95b6964` and compared them with the committed TSV **positionally**: **96 rows, 0 cell differences, IDENTICAL**. The rows were never wrong; no row of this artifact was edited.
+
+**(2) The repair, in three parts.** (i) `verify_workqueue_census.py` (536 lines, new) grades the artifact **at the rev the manifest pins**: the pin resolves and `git rev-parse <pin>:WORK-QUEUE.md` is the blob the manifest records; the TSV header is exact and every row is four cells; the TSV equals an independent re-derivation **cell by cell, all four columns, in document order**, plus its `q` multiset, because the queue legitimately re-opens labels; the markdown render equals the same derivation row for row, splitting on unescaped pipes so an escaped `|` does not tear a cell in two; the manifest's counts (`rows`, `distinct_q_labels`, `reopened_q_labels`, `columns`) equal what was measured; `extracted_at_utc` parses as UTC and is not older than the pin's commit date. **17 legs. rc 0 pass, 1 fault, 2 ungradable** — and *no rev* is **2**, never a pass. (ii) The staleness question is answered as an advisory, not a gate: `--check` prints `currency: HEAD <sha> is past the pin <sha> -- N added, M removed, K changed (advisory only)`, which at `50cc5bb` reads `1 added, 0 removed, 0 changed`, and the verdict does not move with it. That is the difference between this repair and its defect: a census of a growing document is stale by construction, and a check that reds for that is the thing being replaced. (iii) `extract_workqueue_census.py` is now a wrapper over the verifier's `--write` (the Q141 pattern), resolves the repo from `__file__`, and defaults its rev to the manifest's pin, so the builder and the checker cannot disagree about what a census is. The manifest moves to `workqueue-census/v2` with `rev` `95b69640feeb0fa1c451bf84fd03895a38d6e27b`, `source_blob` `c431b2576f6fbf0f306a91be5e2740e8370c0cdc`, a repo-relative `source`, and a measured timestamp; `CHECK` resolves the root from `BASH_SOURCE` and reads **rc 2** when it cannot get one.
+
+**(3) Evidence, all measured this tick.** `--selftest` → **13 cells, 13 passed, 0 failed**, rc 0: green control, a moved `status`, a moved `done_implies`, a moved markdown cell (which must print a FAIL line and not a traceback — the formatter defect Q146 found in another lane was in this file too, and the cell exists because it raised once here), a dropped row, a manifest count that lies, a manifest with no `rev` (**2**), an unresolvable rev (**2**), the queue growing by one heading at HEAD while the pin stays green and the advisory names the growth, the same grown queue **re-pinned without a re-write** (**1**), a host-absolute `source` (**1**), a timestamp older than the pin (**1**), and two takes at one rev byte-identical. Non-vacuity, two mutants: with `mism`/`md_mism` forced empty the selftest reads **10 passed, 3 failed** — exactly the three cell cells; with `pin` falling back to `HEAD` instead of refusing, **12 passed, 1 failed** on `no-rev-ungradable`. The artifact: `--write --rev 95b6964` reads `96 rows, pin 95b69640feeb, blob c431b2576f6f` and leaves the TSV **byte-identical** (sha256 `dcdc3c2aac92` before and after), so the 96 rows were already the derivation at the pin and the diff is `3 insertions, 3 deletions` in the markdown header and footer plus the manifest — no census row moved. At the landing commit `5b58317`, in a clean clone: `bash CHECK-q147` → **4 of 4 legs**, rc 0; `bash wizard-work/ledger/workqueue-census/CHECK` → `VERDICT: PASS -- 96 rows re-derived at 95b69640feeb, all four columns, 17 leg(s)`, rc 0; the same clone with one `status` cell mutated → **rc 1**, `FAIL cells equal the derivation  1 cell(s) differ; first: row 5 Q8.status committed='MUTATED STATUS'` — the reading the pre-repair entry point gave as a PASS; the same clone after the queue grows by one heading and a commit → **rc 0**, `currency: HEAD 3975b7d544e5 is past the pin 95b69640feeb -- 2 added, 0 removed, 0 changed (advisory only)`. The q143 baseline: `wizard-work/ledger/workqueue-census/CHECK` **1 → 0** and `CHECK-q147` **0** added, both taken with the instrument's own `run_entry` (`--timeout 120`, the same 160-character note cut) and not typed; `check_sweep.py --paths` → `107 entry point(s), 106 baseline path(s), 1 fault(s)`, the fault being the pre-existing `NEW wizard-work/quill/CHECK-quill-draft-compliance`, not this item. Repo gate on the staged tree: `python3 tools/verify.py --fast` → **12 legs, 11 pass, 0 fault, 0 ungradable, 1 skipped**, `gate: OK`, rc 0.
+
+**(4) Not claimed.** That the census is current — it is not, by design; it is true at `95b6964`, the `currency:` line says how far past it HEAD has moved, and re-pinning is a deliberate `--write` with a record. That the 96 rows were wrong — the probe re-derived every cell at the pin with zero differences, and this item edited none of them. That the other four workqueue censuses in this tree (`2026-10-28-workqueue-census`, `2026-10-29-workqueue-census`, `2026-10-31-workqueue-census`, `workqueue-census-v2`) are repaired or sound — one of them is named by Q122 for gating on wall-clock freshness, the family this item belongs to, and none of them was graded here. That a pin is permanent — moving it is an edit to the manifest by the tool that writes it. That this check is inside the repo gate — it is not; `tools/verify.py` holds 12 legs and Q141 already established that adding a thirteenth is its own change to `LEGS`, the selftest count cells and the sweep baseline. That the `q137` open-set entry point is repaired — it read **rc 0** on the worktree at entry (`CHECK OK: 0 open, 26 ever opened, counts match the pin`) while its baseline row said rc 1, so the stale half is the row; the record count it pins is moved by this append and re-taken with it, and nothing else about that item is claimed.
+
+Files edited for this item: `wizard-work/ledger/workqueue-census/verify_workqueue_census.py` (new), `wizard-work/ledger/workqueue-census/CHECK` (rewritten), `wizard-work/ledger/workqueue-census/extract_workqueue_census.py` (wrapper), `wizard-work/ledger/workqueue-census/README.md`, `wizard-work/ledger/workqueue-census/workqueue-census.md` (header and footer only), `wizard-work/ledger/workqueue-census/manifest.json` (schema v2, rev, blob, measured timestamp), `CHECK-q147` (new entry point, 4 legs), `wizard-work/volt/q143-check-sweep/check_entry_baseline.tsv` (one row re-taken, one added), `wizard-work/volt/q137-open-set/open_set.py` (its record-count pin, moved by this append), `WORK-QUEUE.md` (this record, appended), `docs/queue-index.md` (re-rendered). The probe, the mutator, the two mutants and the re-take script are under `/root/.hermes/wizard-outputs/volt/q147-workqueue-census/`. Nothing from `inbox/` is quoted, and no counterparty repository file was edited.
+
+CHECK: bash CHECK-q147

docs/queue-index.md

@@ -4,7 +4,7 @@
 
 **What this is.** One row per item of `WORK-QUEUE.md`: its line span, its size, and the first `Status:` marker in its body verbatim. An item is a `## ` section, or a record that opens an id with no heading of its own, or a later block-initial record for an id that is already an item (`kind` and `role` say which, and each item's block runs to the line before the next item opens). Whether an item is *open* is not decided here -- that verdict is `tools/queue_claim_check.py`'s, and this document does not overrule it.
 
-**What it exposes.** The queue is two-tier. 97 sections carry 86 ids because 11 ids own a second, continuation section; 56 further ids are opened by a record and own no heading at all, and they have rows and extents here -- 127 record blocks in all, 71 of them a later closure or correction for an id already opened. The same **56 ids** are listed again in the table below, which carries what a bounds row cannot -- the form that opened each one and how often the file names it: grepping `^## Q41` finds nothing while Q41 is a live item the file names 30 times.
+**What it exposes.** The queue is two-tier. 97 sections carry 86 ids because 11 ids own a second, continuation section; 57 further ids are opened by a record and own no heading at all, and they have rows and extents here -- 128 record blocks in all, 71 of them a later closure or correction for an id already opened. The same **57 ids** are listed again in the table below, which carries what a bounds row cannot -- the form that opened each one and how often the file names it: grepping `^## Q41` finds nothing while Q41 is a live item the file names 30 times.
 
 | # | id | kind | lines | bytes | role | title | first `Status:` |
 |---|---|---|---|---|---|---|---|
@@ -231,7 +231,8 @@
 | 221 | Q143 | record | 13980-13993 | 3245 | record: BOLD-LEAD | **Q143 — DONE at `535ab77` and the commit this record lands in (opened 2026-11-01 by the tick that built it; the record is written late, in the Q144 tick, because that tick landed the artifact and … | -- |
 | 222 | Q144 | record | 13994-14015 | 8083 | record: BOLD-LEAD | **Q144 — DONE at `535ab77` and the commit this record lands in (opened 2026-11-01 by the tick that drafted these repairs and was interrupted before landing them; finished in this tick; queue-wide, no … | -- |
 | 223 | Q145 | record | 14016-14031 | 5408 | record: BOLD-LEAD | **Q145 — DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; volt lane by authorship, unclaimed and taken).** Two of this lane's entry points read … | -- |
-| 224 | Q146 | record | 14032-14048 | 8220 | record: BOLD-LEAD | **Q146 — DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; ledger lane by authorship for the roster extract, unclaimed and taken).** Two entry points in … | -- |
+| 224 | Q146 | record | 14032-14049 | 8221 | record: BOLD-LEAD | **Q146 — DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; ledger lane by authorship for the roster extract, unclaimed and taken).** Two entry points in … | -- |
+| 225 | Q147 | record | 14050-14064 | 9349 | record: BOLD-LEAD | **Q147 — DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; ledger lane by authorship for the census artifact, unclaimed and taken).** The workqueue … | -- |
 
 ## Ids with no `## ` heading
 
@@ -272,7 +273,7 @@ Opened as records inside another section. `line` is the record's own opening lin
 | Q119 | 13305 | 13305 | 5 | Q118 | BULLET+BOLD | BOLD-LEAD |
 | Q120 | 13308 | 13308 | 21 | Q119 | BULLET+BOLD | BOLD-LEAD |
 | Q121 | 13342 | 13342 | 4 | Q107 | BULLET+BOLD | BOLD-LEAD |
-| Q122 | 13344 | 13344 | 9 | Q121 | BULLET+BOLD | BOLD-LEAD |
+| Q122 | 13344 | 13344 | 10 | Q121 | BULLET+BOLD | BOLD-LEAD |
 | Q123 | 13346 | 13346 | 4 | Q122 | BULLET+BOLD | BOLD-LEAD |
 | Q124 | 13350 | 13350 | 4 | Q95 | BULLET+BOLD | BOLD-LEAD |
 | Q126 | 13545 | 13545 | 8 | Q113 | BULLET+BOLD | BOLD-LEAD |
@@ -289,12 +290,13 @@ Opened as records inside another section. `line` is the record's own opening lin
 | Q138 | 13879 | 13879 | 8 | Q137 | BULLET+BOLD | BOLD-LEAD |
 | Q139 | 13897 | 13897 | 4 | Q138 | BULLET+BOLD | BOLD-LEAD |
 | Q140 | 13918 | 13918 | 8 | Q139 | BULLET+BOLD | BOLD-LEAD |
-| Q141 | 13938 | 13938 | 3 | Q140 | BULLET+BOLD | BOLD-LEAD |
+| Q141 | 13938 | 13938 | 5 | Q140 | BULLET+BOLD | BOLD-LEAD |
 | Q142 | 13962 | 13962 | 1 | Q141 | BULLET+BOLD | BOLD-LEAD |
 | Q143 | 13980 | 13980 | 1 | Q142 | BULLET+BOLD | BOLD-LEAD |
 | Q144 | 13994 | 13980 | 3 | Q143 | BULLET+BOLD | BOLD-LEAD |
 | Q145 | 14016 | 14016 | 1 | Q144 | BULLET+BOLD | BOLD-LEAD |
-| Q146 | 14032 | 14032 | 1 | Q145 | BULLET+BOLD | BOLD-LEAD |
+| Q146 | 14032 | 14032 | 2 | Q145 | BULLET+BOLD | BOLD-LEAD |
+| Q147 | 14050 | 14050 | 1 | Q146 | BULLET+BOLD | BOLD-LEAD |
 
 **Not in this document.** Ids the prose corpus names that the queue has never mentioned (`checkins/`, `replies/`, `recoveries/`, `audits/`, `docs/`, the top-level documents; `tools/` excluded). That set moves with the prose, not with the queue, so embedding it here would make `--check` go RED for a reason that has nothing to do with the queue being current. It is reported on demand: `python3 tools/queue_index.py --outside`.
 
@@ -1945,17 +1947,30 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "**Q145 \u2014 DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; volt lane by authorship, unclaimed and taken).** Two of this lane's entry points read \u2026"
   },
   {
-   "bytes": 8220,
+   "bytes": 8221,
-   "end_line": 14048,
+   "end_line": 14049,
    "id": "Q146",
    "kind": "record",
    "line": 14032,
-   "lines": 17,
+   "lines": 18,
    "role": "record",
    "role_detail": "BOLD-LEAD",
    "status": null,
    "status_line": null,
    "title": "**Q146 \u2014 DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; ledger lane by authorship for the roster extract, unclaimed and taken).** Two entry points in \u2026"
+  },
+  {
+   "bytes": 9349,
+   "end_line": 14064,
+   "id": "Q147",
+   "kind": "record",
+   "line": 14050,
+   "lines": 15,
+   "role": "record",
+   "role_detail": "BOLD-LEAD",
+   "status": null,
+   "status_line": null,
+   "title": "**Q147 \u2014 DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; ledger lane by authorship for the census artifact, unclaimed and taken).** The workqueue \u2026"
   }
  ],
  "ids_multi_section": {
@@ -4993,17 +5008,30 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "**Q145 \u2014 DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; volt lane by authorship, unclaimed and taken).** Two of this lane's entry points read \u2026"
   },
   {
-   "bytes": 8220,
+   "bytes": 8221,
-   "end_line": 14048,
+   "end_line": 14049,
    "id": "Q146",
    "kind": "record",
    "line": 14032,
-   "lines": 17,
+   "lines": 18,
    "role": "record",
    "role_detail": "BOLD-LEAD",
    "status": null,
    "status_line": null,
    "title": "**Q146 \u2014 DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; ledger lane by authorship for the roster extract, unclaimed and taken).** Two entry points in \u2026"
+  },
+  {
+   "bytes": 9349,
+   "end_line": 14064,
+   "id": "Q147",
+   "kind": "record",
+   "line": 14050,
+   "lines": 15,
+   "role": "record",
+   "role_detail": "BOLD-LEAD",
+   "status": null,
+   "status_line": null,
+   "title": "**Q147 \u2014 DONE at the commit this record lands in (opened and repaired in the same tick, volt, 2026-11-01; ledger lane by authorship for the census artifact, unclaimed and taken).** The workqueue \u2026"
   }
  ],
  "nested": [
@@ -5309,7 +5337,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q122",
    "line": 13344,
-   "refs": 9,
+   "refs": 10,
    "section": "Q121",
    "shape": "BULLET+BOLD"
   },
@@ -5462,7 +5490,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q141",
    "line": 13938,
-   "refs": 3,
+   "refs": 5,
    "section": "Q140",
    "shape": "BULLET+BOLD"
   },
@@ -5507,9 +5535,18 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q146",
    "line": 14032,
-   "refs": 1,
+   "refs": 2,
    "section": "Q145",
    "shape": "BULLET+BOLD"
+  },
+  {
+   "first_mention": 14050,
+   "form": "BOLD-LEAD",
+   "id": "Q147",
+   "line": 14050,
+   "refs": 1,
+   "section": "Q146",
+   "shape": "BULLET+BOLD"
   }
  ],
  "preamble": {
@@ -5517,9 +5554,9 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "end_line": 8,
   "line": 1
  },
- "queue_bytes": 2348549,
+ "queue_bytes": 2357899,
- "queue_lines": 14048,
+ "queue_lines": 14064,
- "queue_sha256": "fb4ba1f267c433b90ab76d70d83f839a6a5dfd13abeffbb8022b6d145f98f8af",
+ "queue_sha256": "42b87877779aa5133a7757da13d8c943f5c1b89da2856d2123f4e8c6325cb0cf",
  "sections": [
   {
    "bytes": 3139,

wizard-work/volt/q137-open-set/open_set.py

@@ -481,9 +481,15 @@ PIN_OPEN = []
 PIN_OPENED = [51, 52, 53, 65, 100, 101, 102, 103, 104, 105, 106, 107, 109,
               110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122]
 
-PIN_COUNTS = {"headings": 97, "heading_ids": 86, "records": 106,
+# Q147 (2026-11-01): the record count, the id count and the record-only count
-              "record_ids": 72, "ids": 137, "open": 0, "opened": 26,
+# move with any append to WORK-QUEUE.md -- this one added Q147, which is a
-              "record_only": 51}
+# record and an id and a record-only id, and no heading. Re-taken at the commit
+# that carries the record: 106 -> 107 records, 137 -> 138 ids, 72 -> 73
+# record_ids, 51 -> 52 record_only; headings, heading_ids, open and opened
+# unchanged (97 / 86 / 0 / 26), so no id changed its state.
+PIN_COUNTS = {"headings": 97, "heading_ids": 86, "records": 107,
+              "record_ids": 73, "ids": 138, "open": 0, "opened": 26,
+              "record_only": 52}
 
 PIN_STATE = {
     100: "REPAIRED", 101: "REPAIRED", 102: "REPAIRED", 103: "REPAIRED",