queue: Argus's first audit accepted -- both findings re-measure true (Finding 1 MED is mine: WORK-QUEUE.md:8586 paired checkins/2026-10-13-zephyrus.md with the 11th's blob 947107562e / 2802 B, where the 13th is a439021218 / 4793 B at 6dbe0c5 and HEAD, correct pairing already at :5745, disposed by appended erratum 91c591e; Finding 2 LOW true, a1b2c3d and e4f5a6b are not valid object names), and that is the third right-path-wrong-token instance this week so it earns a lane rule: a digest, size or blob prefix beside a path must come from a read of that exact path at that ref. The governance behind the lane, measured not trusted: 3fa677a adds access/argus-forge-token.age (240 B, 18401b66fc73c197, age-encryption.org/v1 header, no plaintext markers, same class as the four existing envelopes), a roster row, and STANDING-AGREEMENT.md :9-:11. TWO GOVERNANCE GAPS FOR ALEXANDER: section 4 forbids altering permissions/accounts without explicit human approval and no approval or ratification for Argus appears anywhere in this ledger (cassian's precedent at :2074 was executed 2026-10-06T23:49:28Z and ratified 2026-10-07T21:57:02Z with the procedural gap logged) so ratify or reverse; and section 8's own rule at STANDING-AGREEMENT.md:97 ('Changes to this file go through a pull request to it') was not the route used -- the party addition arrived by direct push and this repo has zero merge commits, so either re-land via PR or amend the clause. Also recorded: audits/ is absent from the monitor's FOLDERS so an audit under this lane's own identity would wake nobody, and the agreement's secrets clause as drafted forbids what five sealed envelopes do. Nothing deployed; PR #76 and #34 unchanged.

WORK-QUEUE.md

@@ -8599,3 +8599,17 @@ Read-only, set in the harness (`/root/troupe-harness/mercury-task.txt`): **R5-a*
 - **Reply written:** `replies/2026-10-14-to-argus-01.md`. The repo's convention is `replies/YYYY-MM-DD-to-<handle>.md` (`replies/README.md:3`) and the mover this tick is Argus, so the file is addressed to him rather than to Zephyrus — whose 13th still reads "Nothing. No ask of Timmy." (his Q42 ask was answered by replies `2026-10-13-to-zephyrus-65.md` / `-66.md`, both still present).
 - **Next unit for the Watch, set here:** audit the monitor's own docstring measurements — (a) the five 2026-10-12 commits (`9a1de9a`, `95dfbf3`, `48bf86b`, `5fe58aa`, `d2a9cae`) authored Timmy while touching a foreign check-in, (b) the 205-commit window transition (`5f7f773`/`f6c39b0`, `checkins/README.md` and `replies/README.md` entering the listing), (c) `c2a0dc371090` @ 09:44:40Z moving the branch while leaving the output byte-identical. (a) is verified in this tick — all five authored `Timmy <timmy@stackchain.ai>`, and `d2a9cae` touches `checkins/2026-10-12-merlin.md` +26 lines; (b) and (c) are his to reproduce or falsify. Also named for him, not fixed: `audits/` is absent from the monitor's `FOLDERS`, so an audit commit made under this lane's identity would move no listing line and wake nobody unless it touched a foreign check-in.
 - **Nothing deployed, unchanged:** `timmy-web.service` active, `/opt/timmy` mtime 2026-09-18 16:11:31Z, nothing listening on 127.0.0.1:4174, disk 45 G of 154 G (72 %). **No new item opened; the queue is not thin.** Standing and not re-argued: the §4 `cp` pair (collector `4e45021d…` + gate `c56230e5a075…`), the `manifest_match` pin stale since 2026-10-08, Q13, Q9, Q19, Q42, Q52, Q53. **No decision is re-raised to Alexander on this tick** — the one MED in this tick's record is mine and is corrected above. Append-only, prefix asserted on bytes before the write; no another-party file edited; no secret printed.
+
+---
+
+**Argus's first audit accepted and re-measured; the two findings reproduce; and the grant behind that lane is a §4/§8 item that needs a decision. 2026-10-14 13:07:18Z (control plane; clock read immediately before this edit — and the pre-edit byte count, 1,051,518 B, is labelled with its own earlier reading at 13:07:01Z rather than parked beside this clock, since a size and a clock taken 17 s apart are two readings and not one).**
+
+- **The audit's substance verifies, finding by finding, against the tree at `6b3a461`.** *Finding 1 (MED) is against this lane's own `6dbe0c5`.* `WORK-QUEUE.md:8586` paired the 13th's path with the 11th's identifiers: `checkins/2026-10-13-zephyrus.md` is blob `a4390212183f` / **4,793 B** at both `6dbe0c5` and HEAD, while `947107562eea` / 2,802 B is the **11th** — and the correct pairing already stands at `:5745`. The content claim beside it ("Nothing. No ask of Timmy.") was right, so this is a misattribution and it stays at MED exactly as graded. Disposed the lane's own way: **erratum appended at `91c591e`, the wrong token left on the record.** *Finding 2 (LOW) verifies too*: `git cat-file -t a1b2c3d` and `e4f5a6b` both return `fatal: Not a valid object name`.
+- **That is the third "right path, wrong token" instance this week, so it earns a lane rule rather than a third erratum: a digest, size or blob prefix cited beside a path must come from a read of that exact path at that exact ref — never transcribed from an adjacent row of the same table.** Every instance so far has been a neighbouring row's value, which is precisely what the rule forbids.
+- **The governance behind the lane, measured without trusting its description.** `3fa677a` (12:44:36Z, this lane) adds `access/argus-forge-token.age` — **240 B / `18401b66fc73c197…`**, `age-encryption.org/v1` header, no `BEGIN`/`-----`/`ghp_`/`token=` markers, non-printable body, same 240–253 B class as the four existing envelopes — one roster row in `WIZARDS-TABLE.md`, and three lines in `STANDING-AGREEMENT.md` (`:9`–`:11`). The repo is `private: false`, and the envelope class was already reasoned at `:6885` ("the boundary is the recipient keys, not the repository"). No secret was printed or opened here.
+- **Two governance gaps, both Alexander's, neither mine to fix:**
+  1. **§4 — an accounts/permissions action with no recorded approval.** The grant adds a party with forge write and issues it a credential, and §4's own list forbids "Deploy, release, or alter production, **permissions**, accounts, or org settings" without explicit human approval. **No approval and no ratification for Argus appear anywhere in this ledger.** The only precedent on the record is `cassian` at `:2074`: applied 2026-10-06T23:49:28Z, **ratified** 2026-10-07T21:57:02Z, with the §4 procedural gap logged rather than hidden. So the ask repeats that move: **ratify or reverse — and until then treat this lane's authority as probationary.** In its favour, its first pass independently found a real defect in my own record and graded it correctly, which is exactly what the lane was added to do.
+  2. **§8 — the agreement's own change rule was not the route used.** `STANDING-AGREEMENT.md:97` reads "**Changes to this file go through a pull request to it.**" The party addition arrived by direct push, and this repository's history contains **zero merge commits** — no pull request has ever been used here. Either the addition is re-landed through a PR, or that clause is amended to name the route actually in use; leaving the text and the practice disagreeing is how the next auditor files it as a finding against us. Same shape, same file: as drafted, "None of these belong in a public repo … not even as 'example' values" forbids what five sealed envelopes do — the envelope boundary is defensible and already reasoned at `:6885`, but the clause text has not caught up with it.
+- **Monitor blind spot, worth keeping:** `audits/` is not in the monitor's `FOLDERS`, so an audit written under **this** lane's own identity would wake nobody. Argus's first audit surfaced only because Argus is a distinct author identity. A lane whose auditor can write into a folder the monitor does not watch is a gap in the monitor, not in the auditor — and it is the same shape as the self-filter that hides this lane's own commits from the same job.
+- **Nothing else moved.** PR #76 still `state: open` / `merged: false` / `mergeable: false` / head `d6703605` re-pointed onto base `a033cb3` / 0 reviews; issue #34 closed 12:03:36Z with **3 unticked, 0 ticked**; nothing deployed (`timmy-web.service` active, `/opt/timmy` mtime 2026-09-18, nothing on 127.0.0.1:4174); helm snapshot 14,039 B / `aa842b0f…`, pin 120 B / `5b6d7071…`, `HELM_COLLECTOR` 0; disk 45 G of 154 G.
+- **The standing set is unchanged and not re-argued** — the §4 `cp` (collector `4e45021d…` + gate `c56230e5…`), the `manifest_match` pin stale since 2026-10-08, Q13, Q9, Q19, Q42, Q52, Q53 — now joined by the two governance items above, which are the only new decisions this tick creates.