Appended at the foot with docs/queue-index.md re-rendered in the same commit, so
the newest queue-touching commit leaves the index current in its own tree.
The record carries what cc2c6a5 measured: the nine cases (M0 21/21 clean, M1
TRACEBACK, M1-leg the gate red at rc 1, M2 RC_OTHER, M3 SILENT, M4 UNNAMED, M4b
the limitation of that class, M5 the 67f94cc shadowed write, CTL green), the
detail line that named a healthy tool and now names the faulting one, the one
TOOL_MISSING row in doc_command_check.py that was this tool's own recipe (64/64
now), and the gate at 6 legs / 6 pass / 0 fault. No Q-item opened or closed; the
open set still reads Q37, Q53, Q64.
A gate that has only ever been seen green is indistinguishable from a gate that
cannot go red, so the write axis was mutated one defect at a time in throwaway
worktrees (nine cases, wizard-outputs/volt/2026-10-21-write-axis-bites/
mutation_study.py). It goes red every time: TRACEBACK, RC_OTHER, SILENT,
UNNAMED, the 67f94cc shadowed write, and verify.py's own write-axis leg -- while
the clean control stays green 21/21.
The study found two things this commit fixes and one it only states.
FIXED 1 -- the detail line on a red write-axis leg named a healthy tool. Read at
7da4283 in the M1 worktree, whose only defect was doc_census_check.py, verify.py
printed `FAULT: append_only_audit.py OK 2 cannot write --json ...`: every table
row contains "cannot", and pick_detail() takes the FIRST reason-shaped line, so
the first healthy row won. write_probe.py now prints a `FAULT <tool> ...` block
above the table (one line per non-OK row, naming the tool, its class and its
detail), and verify.py carries "FAULT" in STRONG_HINTS so a SILENT fault -- whose
own detail has no other marker -- is still the line a reader sees. Cell c11
grades the block: selftest 10 -> 11 cells, 11/11 rc 0.
FIXED 2 -- doc_command_check.py's only red row at 7da4283 was this tool's own
reproduction recipe: `python3 <dir>/tools/write_probe.py --repo <dir>` graded
TOOL_MISSING, because the copied absolute path is not in the tree at HEAD. The
recipe now reads `cd <dir> && python3 tools/write_probe.py --repo <dir>`, which
is both what a reader actually types and a path the checker resolves.
STATED, NOT CHANGED -- UNNAMED grades the TEXT, not the guard's sentence. With
the explicit path dropped but `str(exc)` kept, the OSError string still carries
the path and the probe reads OK (measured: case M4b). The docstring now says so,
because a class that grades less than its name suggests is worse than a class
with a caveat.
Measured before this commit, at 7da4283: write_probe --repo . 21 probed, 21 ok,
0 fault(s), rc 0; write_probe --selftest 11/11 rc 0; tool_map --check docs/
TOOLS.md rc 0; doc_census_check --tools tools/write_probe.py --fail 0 STALE rc
0. Verification at this commit follows in the next commit with the queue record.
Measured at 67f94cc: 19 of the 20 tracked tools answered a --json target inside a nonexistent directory with an uncaught FileNotFoundError at rc 1. Only queue_append_audit.py already refused (rc 2). A traceback is fatal under this repo's contract, and rc 1 is the code that means a graded fault -- so a caller could not tell 'the grade is bad' from 'the artifact was never written'.
Landed: the grade first, its stdout report standing; the write wrapped, one stderr line naming the path, rc 2 (could not grade). gate_blame.py also moves its --json write ahead of the all-UNGRADABLE early return, so a write refusal is not shadowed by the cannot-grade return (an extra ']' and a mis-indented try in that hunk were fixed before commit; the module compiled and its selftest was 21/21).
tools/write_probe.py is the instrument: one probe per tracked tool, verdicts TRACEBACK / RC_OTHER / SILENT / UNNAMED / NO_REACH / OK, NO_PROBE fatal on the same rule as the read axis, and it probes itself. It is leg 6 of verify.py, and selftest_sweep.py now carries both a read probe and a malformed probe for it.
Verification at this commit follows in the next commit with docs/TOOLS.md and the queue record.
The first live run of c56e3be graded /var/www/leathermint against HEAD and got
one DIFFERS: index.html served 26,064 B / b5136bb947dd vs tree 25,697 B /
42b2f374f5d3. That is a true row and an unhelpful one -- the serve root IS the
work tree, so an uncommitted edit reaches the host before any revision holds
it, and "the deploy fell behind" and "another lane is mid-edit" send a reader to
two different places. (It was the second: argus's commit 4f69d46 landed the
26,064 B file at 19:29:41Z, three seconds after that run at 19:29:38Z; the re-run
now reads 23/23 OK.)
Every row now carries a worktree field of "modified" or "clean", computed from
`git diff --name-only <rev>` plus `git ls-files -o --exclude-standard`, and the
summary counts the modified rows and says what they mean. The verdict stays
DIFFERS -- an uncommitted file is still not the revision, and a claim that the
host is running revision X is still false while it serves X+edit -- but the row
no longer makes the reader re-measure which of the two it is.
Three cells added (23 -> 25): an uncommitted edit is named on its own row, the
summary states the count, and a clean tree gets no such note. selftest 25/25
rc 0.
The leathermint lane re-proves the same served-bytes fact by hand every tick --
reply 45 lists six paths, my 18:25Z block lists six more, each with sizes typed
out. `landing_check.py` grades the FORGE, whose raw path is a convention
(`<base>/branch/<branch>/<path>`); a static host has none, so its own question
went ungraded: are the bytes on the host the bytes this revision says?
New instrument `tools/served_drift_check.py` -- one row per tracked file at
--rev, graded against GET `<base>/<path>`; verdicts OK / DIFFERS / MISSING /
HTTP_ERROR / UNREACHABLE / READ_FAILED / SKIPPED_LARGE, the same vocabulary as
landing_check so no reader has to learn a third table. DIFFERS carries both
lengths and both digests (the direction of the staleness is the useful part);
UNREACHABLE is kept apart from MISSING so an outage cannot read as a clean
negative; rc 2 when it cannot grade at all (not a git work tree, no --base-url,
a scheme it cannot read, a revision that tracks nothing).
Self-proving: `--selftest` is 22 cells over a fixture git repo and a real
http.server on 127.0.0.1:0 -- mirror-is-OK, stale-copy-is-DIFFERS with both
digests, 404-is-MISSING, 500-is-HTTP_ERROR, refused-port-is-UNREACHABLE,
HEAD-vs-HEAD~1 grades a different blob, --prefix/--exclude/--max-bytes, the
three rc-2 preconditions, and a --json round trip. One defect found in my own
first draft by running it: `return 1 if bad else 0` on a list made every
green selftest exit 1; the cell count was 22/22 with rc 1 until it was
`bad[0]`.
Live measurement, this host, this commit's parent: 23 of 23 tracked files of
/var/www/leathermint OK against https://leathermint.alexanderwhitestone.com,
0 drift, rc 0 -- the first machine-checkable form of what the leathermint
blocks assert in prose.
Both sweep axes get their row (read-refusal: --root {nope}; malformed:
not-a-repo -> rc 2 naming "not a git work tree"), which is what keeps the new
tool from being silently ungraded; docs/TOOLS.md re-rendered in the next
commit, since tool_map reads the tree at HEAD.
723a852 ("forge: census_row_delta DRY -- eliminate redundant moves() call")
added a 77-line verification doc and no change to tools/census_row_delta.py:
report() still returned d and main() still recomputed moves() with the same
arguments. The doc's "Status: DONE -- verified equivalent" stood over a
worktree diff no reader of this archive could see. This commit lands the
two-line change itself.
WHAT CHANGED: report() computes mv once, for its own printing, and returns
(d, mv); main() unpacks that instead of calling moves(before, after, d,
KEYS[name]) a second time. moves() is pure, so the second call was duplicate
work, never a second opinion. Nothing else moved: no argument, output line,
exit code or JSON field changed.
VERIFIED ON REAL CENSUS PAIRS, NOT A FIXTURE. HEAD's copy and this copy were
run side by side over four real census pairs already in the record --
2026-10-20-wrapped (131 -> 133 rows), split-2026-10-17 (111 -> 96),
horse-2026-10-17 (111 -> 95), vocab-gate (112 -> 112) -- across all nine CLI
shapes (--keys --verbose, --keys, and each of the seven --key values with and
without --verbose), plus the three read-error paths (missing file, non-census
JSON, non-JSON) and --selftest: 40 cells, 40 passed, 0 failed. Compared per
cell: rc, stderr, stdout, and the --json payload's sha256. Stdout was
byte-identical after normalising the one line that echoes the --json output
path, which is an input and not a computation. Read-error paths return rc 2
on both sides ("cannot read census ..."), and the selftest is 33/33 on both.
THE DUPLICATION IS ACTUALLY GONE, MEASURED. Instrumenting moves() with a
counter on the real split-2026-10-17 pair: --keys 14 -> 7 calls, --key
canonical 2 -> 1. Matches the doc's claim on a live path rather than on its
synthetic pair.
ONE CORRECTION TO 723a852's FRAMING, measured. Its evidence section calls the
duplicate "a real cost" and says removing it "removed real work"; on this
pair moves() costs 0.15 ms for the canonical key and 0.65 ms for all seven,
against a ~185 ms process, and end-to-end timing cannot see the difference
(median 185.2 ms unpatched vs 197.3 ms patched over 9 runs, both inside a
154-235 ms spread). The change is landed as a cleanliness fix -- one
computation, returned to its only other consumer -- not as a speedup, and the
doc's "DONE" now describes something the archive actually contains.
Gate: tools/verify.py -- the checkin leg's 2 faults (2026-10-19-zephyrus.md,
2026-10-19-zephyrus-sovereignty.md) are present at every rev in this window,
before and after this commit; every other leg is green.
The UNITS section states 11 figures for revision abe08a9 and every one of them
is true there (verified against `git show abe08a9:WORK-QUEUE.md`). Nothing
compared them to the queue the tool prints: at 03c1465 four of the eleven had
moved (BQ 85->86, BQ-only 64->65, symmetric difference 116->117, lead axis
46->47) while every command exited 0 and doc_census_check reported 0 STALE,
because the moved figures land in its AMBIGUOUS bucket.
--census now re-reads the prose (doc_figures), measures the same 11 figures on
the queue it just read (computed_figures), and prints a docstring-pin block
naming each figure that moved. Exit code unchanged: a queue that grows is not a
fault. Measured both ways -- live queue names four moves, the pinned revision's
own queue reads "moved: none".
Cells 20 -> 24 (4 doc-pin). Mutant returning [] from doc_drift: 22/24, rc 1,
naming doc pin 2 and 4. Landed: 24/24, rc 0. The tool's plain report is
byte-identical before and after (diff rc 0). Gate 5/5, sweep 15/15, doc-census
0 STALE, ruff clean.
- c46d7dd's replies/2026-10-19-to-zephyrus-interview.md carries no number by
construction; reply_check graded NAME_MALFORMED and verify.py's
reply-headings leg went FAULT (1 file(s) carry a class the baseline does not
tolerate) at 196 files / 1 new fault / 1 known, rc 1.
- 2f32c23 adds INTERVIEW_RE (YYYY-MM-DD-to-<recipient>-interview.md) as
INTERVIEW_UNNUMBERED, ADVISORY: numbering rules skip it, date/heading/
addressee still graded, a misspelled slug is still NAME_MALFORMED.
- 41 -> 49 selftest cells; mutation red 45/49 rc 1 on four interview cells;
--baseline now 196 / 0 new / 1 known rc 0; bare rc 1 faults 1 advisories 20.
- verify.py 5/5 rc 0, landing 385/385 rc 0, raw sha256 f1d8b81202c71f7e.
- No item opened or closed; open set unchanged (Q37:5278, Q53:7303).
Timmy's c46d7dd filed replies/2026-10-19-to-zephyrus-interview.md, whose name
carries no number by construction. reply_check graded NAME_MALFORMED and, under
--baseline, a new fault: verify.py's reply-headings leg went FAULT (1 file(s)
carry a class the baseline does not tolerate), so the repo's one-command gate
was red at HEAD.
The fix is a third name form, not a rename and not a baseline exemption:
replies/README.md's numbered contract is about replies, and an interview is not
one. INTERVIEW_RE accepts YYYY-MM-DD-to-<recipient>-interview.md; the row is
ADVISORY (INTERVIEW_UNNUMBERED), the numbering rules skip it, and its date, its
heading and its addressee are still graded as a numbered reply's are. A
misspelled slug stays NAME_MALFORMED.
41 -> 49 selftest cells: the form is advisory and only that, exits 0, adds no
number to any series, still fails HEADER_RECIPIENT on a wrong addressee and
BAD_DATE on 2026-02-30, and a near-miss slug still exits 1. Docstring census
updated with the cells (Five more are reported; four of the five reach the
advisories count).
--repo . --baseline tools/reply_baseline.tsv: 196 file(s), 0 new fault(s), 1
known-faulting, rc 0. Bare run rc 1 with faults: 1, advisories: 20 (194 + 6).
The control plane measured them at 16:52Z: the docstring said 'Five classes
are graded' over a seven-row enumeration and 'Three more are counted and
printed' over four, while FAULTS holds 7 and ADVISORIES holds 4. Prose is not
executed and doc_census_check.py reads only '<digits> <unit>', so a spelled
count has no reader at all.
Fix: Seven classes are graded; Four more are reported and printed, with the
HOLE/ line split stated (three of the four reach 'advisories: N').
Instrument: doc_counts() parses the two spelled counts; four selftest cells
grade them against len(FAULTS)/len(ADVISORIES), assert every graded class is
named in the docstring, and pin the pre-fix words on a fixture. RED measured on
the same file with only the words reverted: 39/41, 2 failed ('says 5; FAULTS
holds 7', 'says 3; ADVISORIES holds 4'), rc 1. GREEN: 41/41 rc 0.
Live archive unchanged: 194 files, 1 known-faulting under the baseline, 0 new;
bare run still rc 1 with the one fault printed. verify.py 5/5 rc 0 (sweep 15
tools, 15 OK). doc_census_check --fail: 0 STALE, rc 0. ruff F,E9 clean.
f59a592 left the exact defect class this repo keeps finding in documents: the
docstring and the run said 50 cells while `--selftest`'s argparse help still
said 42, and nothing failed. Two changes:
- the help string no longer carries a count ("the run prints its cell count"),
so it cannot drift again;
- DOC_CELLS parses the docstring's `fixture corpus, N cells` claim and cell 27
grades it against the count that actually ran. Measured RED: a copy whose
docstring claims 50 while the run has 51 prints
`selftest: 51 cells, 50 passed, 1 failed` / `FAIL 27 ... got: 50 want: 51`,
rc 1.
Selftest 50 -> 51 cells, 51/51, rc 0.
The repo test was `os.path.isdir(<repo>/.git)`, which is wrong in both
directions. A LINKED worktree's `.git` is a 47-byte FILE (`gitdir: ...`), so
`git worktree add --detach <path>` produced a checkout the gate refused with
rc 2 "not a git repository" -- measured at cf5101f: the committed blob rc 2,
the fixed blob rc 0 with four legs PASS in the same tree, and 5 of 5 legs PASS
with --fast off (selftest-sweep: 15 tools, 15 OK, 0 fatal). An empty directory
named `.git` was the same test's false positive: it passed while git refused
the path.
`resolve_repo()` asks `git -C <repo> rev-parse --show-toplevel`: it succeeds in
every work tree (main, linked, submodule) and fails in a bare repo or a bare
`.git` directory. `--repo` stays the ROOT -- a subdirectory is rc 2 naming the
root it would have graded, because widening it silently would grade a tree
nobody named. Legs, rcs and --queue/--index semantics are untouched.
Selftest: _fixture() now `git init`s a real work tree (it used to create an
empty `.git/`, a repository only to the test being replaced) and takes
commit=True where a cell needs a HEAD to branch from. New cells 23/23b/23c
(a linked worktree is graded, and the row names the worktree -- RED on the old
blob), 24/24b (subdirectory refused, root named), 25/25b (empty .git refused),
26 (bare repo refused). 42 -> 50 cells, 50/50, rc 0.
No queue item opened or closed; no another-party file edited.
Queue block 12:16Z: fenced record = quoted material (3 cells, 17 -> 20
fixtures), unclosed fence fails OPEN; live report byte-identical except the one
printed line (ACS 73 / BQ 86, open set unchanged, 12/12 hand-read). Pre-rebase
SHAs 5ed9da9/e98a34b/92f8934/14f26e1/f45ae01 mapped to a114ead/fdc4a21/3d58197/
d95820c/0de9cf2, objects preserved on tag pre-rebase-2026-10-19 (2071a7c).
Comment only; no behaviour change. The pre-fix census of the first fence cell is
['Q60:CLOSED', 'Q99:CLOSED'] -- the quoted item lands in the census as a closed
record -- not the ['Q60:CLOSED','Q99:OPEN','Q99:CLOSED'] the comment first
asserted. Measured by importing the pre-fix module and running its census on the
fixture strings; the third cell is identical on both sides by design and pins the
FENCE_UNCLOSED diagnostic instead.
The queue's other three text parsers already refuse to read structure out of a
fence (queue_index.py:207/:266, checkin_check.py:251, citation_resolve_check.py
after efe7ec6). This scanner had no fence state: a 19-line fixture quoting a
fenced `**Q99 - OPEN**` and a fenced `**Status: OPEN**` printed two OPEN
records no writer ever opened (before/fixture-fenced.txt).
An unclosed fence fails OPEN, not closed: nothing is masked, every line is
graded, FENCE_UNCLOSED names the line. Masking to EOF would hide the newest
records, the ones a claim check exists to surface.
Live queue at HEAD: the one fence (:3757-:3763) is a quoted traceback with no
record in it, and the full report is byte-identical before and after except the
one printed line -- 73 ACS, 86 BQ, open set Q37:5278 + Q53:7303, 12/12 hand-read.
The 09:49Z leg ran checkin_check --since <newest day>, on the reasoning that the
newest day is the only day a new fault can appear. Measured false on a clone of
e98a34b: one added checkins/2026-10-02-volt-b.md (BAD_NAME) is invisible to that
floor -- verify --fast rc 0 'checkin_check: 1 files, 0 with a fault', while the
whole-archive run on the same tree is rc 1 with 74 files / 36 faults.
tools/checkin_baseline.tsv (35 data rows, sha256 0f599c5e...) is the faults the
archive already carried; checkin_check --baseline splits each row's classes into
known/new, only a new class makes rc 1, per class not per path; --emit-baseline
prints it to stdout (no new write path); an unreadable ledger is rc 2; stale
entries are advisory. Refreshed leg: same clone, same file -> rc 1 naming exactly
that file; live tree -> 73 files, 0 new, 35 known, rc 0.
Cells: checkin_check 29 -> 35 (35/35), verify 35 -> 37 (37/37), sweep 19/19 +
17/17 rc 0, ruff F,E9 clean. One docstring count removed after
doc_census_check graded it STALE -- the ledger is now the artifact that carries it.
Queue block appends at the foot (offset 10080 -> 10094 lines, 1271673 ->
1276470 B): the measured hole (three-leg gate rc 0 on a clone whose
checkin_check --fail is rc 1), the leg's unit and cost (124-153 ms, cheapest,
first), why one day (35 historical faults, 2026-09-24..2026-10-07), the
pick_detail tiering fix found by the first real run, and what it does not do.
Index re-rendered in this same commit: queue_index --check rc 0 (49 sections,
45 ids, 4 continuations, 9 nested, 10094 lines / 1276470 B); Q53 refs 122 -> 123
is this block's own mention. No item opened or closed; open set unchanged
Q37:5278, Q53:7303.
Measured hole: on a clone of 3890c12 carrying checkins/2026-10-19-volt-02.md,
checkin_check.py --since 2026-10-19 --fail returned rc 1 (BAD_NAME 1, DUPLICATE
group 1) while verify.py --fast returned rc 0, 'gate: OK -- 2 of 2 graded leg(s)
passed'. Three legs grade the queue, its append discipline and the tools'
selftests; none graded the one artifact every lane writes every tick.
The leg grades the newest day present in checkins/ (read from the archive, not a
clock and not a constant) because whole-archive grading is rc 1 with 35 faults
permanently -- 2026-09-24 through 2026-10-07, before the rule they break was
written. checkin_check --fail at 3890c12: 73 files, 35 with a fault, rc 1.
--checkin-day DATE sets the --since floor explicitly. No checkins/ dir or an
empty archive is UNGRADABLE (rc 2), never a pass and never a fault.
pick_detail() gains STRONG>WEAK>SKIP tiering: the first real run put
'FAULT rc=1 SKIP README.md (the directory's own README: not a check-in)' on the
row, because the weak hint 'not a ' matched the README note before the tool's
own FAIL line. Silent-class defect, fixed here with cells 18/18b.
Evidence: verify --selftest 26 -> 35 cells, 35 passed, rc 0 (cells 14-18b new:
fault->rc1, no-dir->rc2, newest-day --since, --checkin-day, the two detail-line
cases). ruff -F,E9 tools/ All checks passed. Live gate: 4 legs, 4 pass, rc 0.
Same clone after the change: 4 legs, 2 pass, 1 fault, rc 1, detail
'FAIL: 2 file(s) violate the check-in contract'. doc_census_check --tools
tools/verify.py: 6 claims, 0 STALE, 0 INTERNAL SPLIT, rc 0.
Artifact: /root/.hermes/wizard-outputs/volt/2026-10-19-checkin-leg/
ruff check --select F,E9 tools/ -> 3 errors at 960b852:
checkin_check.py:421 F541 f-string with no placeholder
checkin_check.py:556 F841 jd assigned, never read (dead residue of an unwritten
malformed-JSON refusal cell)
queue_append_audit.py:73 F401 re imported, never used (no 're.' in the file)
Fix: 3 lines removed, 1 line changed, nothing added (numstat 1/2 + 0/1).
Behaviour claim measured, not asserted: all 14 tools' --selftest stdout+stderr
captured before and after (28 files) plus checkin_check.py --dir checkins and
queue_append_audit.py --guard --to HEAD (2 files) -- 30 artifacts, 0 differ after
normalising only checkin_check's mkdtemp suffix. 14 tools / 429 cells / 429 pass
on both sides; verify.py 3/3 PASS rc 0.
Not enforced by the gate: verify.py has no static-check leg, so this property is
observed here only. Adding ruff to the gate would make it a hard dependency
(host without ruff -> UNGRADABLE -> rc 2), so no leg and no new tool.
The block was headed 'THE CENSUS AT HEAD' while pinning rev babdadc, and its
figures were the pre-fence build's. Both are now false against the block's own
pin: at babdadc the fence-aware build prints BARE 1606 / AS_SELF 715 /
UNRESOLVED 466 / mentions 6613, where the docstring claimed 1612 / 716 / 471 /
6961. doc_census_check --tools tools/citation_resolve_check.py --fail graded
3 STALE rc 1 before (reply 32), 0 STALE rc 0 now. The old values are described
in prose without digits next to a unit word, so the history does not re-enter
the claim set.
Corrects one decimal in 4fc1622's block. Measured a82130e 2026-10-16T12:29:32Z
-> 4fc1622 2026-10-19T02:38:28Z. The finding is unchanged; only the rounding
was wrong. Index re-rendered in this commit.
`Q53` labels two live items: the career-lane apply queue at `:7303` (seven
decisions held for Alexander) and Mercury's record at `:8530`. Mercury's `:9869`
DONE matched "Q53" and closed BOTH, so from `a82130e` (2026-10-16 12:29:32Z) the
census printed `open set: Q37:5278` while four standing blocks in the same file
assert `:7303` open. Bracketed by checkouts, each graded with its own tools:
`20a7501` 3 open / --validate 11/11 rc 0; `a82130e` 1 open / 10/11 rc 1.
Within a duplicated id a closure now binds to the last record of that id opened
at or before it, so a record owns its own section and no namesake can close it.
Unique ids unchanged; the row still prints COLLISION because the labelling
defect is the ledger's.
Selftest 16 -> 17 fixtures (new cell: ['Q40:CLOSED','Q41:OPEN','Q40:CLOSED']
pre-fix, the expected list post-fix; both measured). HAND_READ 11 -> 12
answers: :7303 OPEN added, :8530 corrected to CLOSED (its closure is real).
--validate rc 1 -> rc 0, 12/12.
Post-fix census: 15 opening records, 13 closed, 2 open, open set
Q37:5278 + Q53:7303; other 13 rows unmoved. doc_census_check on this tool: 19
claims, 0 STALE, 0 split, 0 leg failures. Queue block appended and
docs/queue-index.md re-rendered in this same commit.
The old guard cut at the first '**', which is right for '**Status: value**'
and returns '' for '**Status:** value'. Empty is falsy, so the parse stored
None and docs/queue-index.md rendered '--' for Q13:1129, which states
'1 of 8 has a decision and staged correction'. status_value() strips a
leading bold close, then a trailing one, so both forms yield the value.
selftest 54 -> 58 cells (inline fixture, no existing line numbers move).
docs/queue-index.md regenerated: exactly 2 lines (the Q13 cell + its pin).
Independent witness in wizard-outputs: rc 0 on the fixed document, rc 1
naming row 13 on the pre-fix one. verify.py 3/3 rc 0.
Found while demonstrating the NO_PROBE fix: the gate graded selftest-sweep FAULT and
printed 'sweep: 15 tools, 14 OK, 0 fatal' beside it, because pick_detail took the
first hint-matching line and 'fatal' matched a summary asserting zero of them.
- pick_detail: zero-count summaries (' 0 fatal' / ' 0 fault') are second-pass only,
so a clean run keeps its sweep line and a red run names the red axis
- selftest 24 -> 26 cells: c13 a zero-fault summary is not a reason line,
c13b a clean run still gets its sweep line; both advertised counts updated
The read/malformed axes only covered tools named in READ_PROBES / NOT_UTF8_PROBES /
MALFORMED_PROBES. A 15th tool dropped into tools/ produced two advisory NO_PROBE rows
and the sweep still printed '15 tools, 14 OK, 0 fatal' with rc 0: measured on a copy of
the 14 tracked tools plus one probe-free tool, pre-fix rc 0 / post-fix rc 1.
- NO_PROBE joins FATAL_READ; the two rows now say 'ungraded, fatal'
- axis_faults() is the single red predicate, used by report_read
- selftest 28 -> 30 cells: c29 an unprobed tool is NO_PROBE on both axes and counts,
c30 every FATAL_READ verdict is red and OK is not
- two stale counts corrected in this tool's own docstring: 'ten'/'Nine tools must
refuse at rc 2' -> eleven (measured: 11 of 14 tools carry rc 2 probes)
index-current (queue_index --check), append-audit (queue_append_audit --guard
--to HEAD), selftest-sweep (skippable with --fast, printed SKIP and counted as
skipped). rc 0 graded clean / 1 graded a fault / 2 could not grade, with 2
outranking 1 so an ungradable leg cannot be read as a certified run; the fault
count is still printed beside it. Tools resolve from --repo, not from this
file's directory, so a worktree is graded with its own instruments.
selftest 24/24 (stub legs through the real CLI: rc mapping incl. retired rc 3,
missing tool, timeout, --fast, --json, missing repo, fixed order). Added to
both sweep probe axes (read-refusal 19/19, malformed 17/17, 14 tools 14 OK) and
the sweep's stale "15 such probes / nine tools" prose corrected to 17 / ten.
Green at 019b75c: 3/3 pass, rc 0. Red paths on a full 785-commit clone:
0 -> 1 (working-tree append, no re-render) -> 0 (--write) -> 1 (committed
stale: both legs faulted) -> 2 (tool absent; index fault still printed).
Queue tick appended and index re-rendered in this same commit.
The 15:15Z block adopted "append and re-render in the same commit" as a rule
and left enforcement to hand probes; that loop produced three wrong-slice
counts in one week. tools/queue_append_audit.py (8a450a3) grades each
queue-touching commit in its own tree. Measured at 8a450a3: default range 9
commits -- 6 PASS, 3 STALE (f2c3067, ece5228, 067afdf), 0 UNGRADABLE -- with
328 earlier queue-touching commits counted and not listed; --all lists all 337
(328 UNGRADABLE); --guard reads 1 PASS at c034175, rc 0. Reply 24's corrected
set reproduces from the commits by a second route, with its two rc-2 commits
(12b4497, 0bdb9d4) landing in UNGRADABLE as it said. The tool's fixture also
found and fixed a --write IndexError in queue_index.py (zero-byte document, rc
1) for any queue with no nested records; the real render did not move.
This commit is the append + the re-render, and --check reads rc 0 at it.
WHY: docs/queue-index.md pins WORK-QUEUE.md by sha256, so an append that
skips the re-render is STALE by construction, and nothing obliged a commit to
re-render. f2c3067 and 067afdf each left the gate red until a later repair
(2h37m for the second). Enforcing that rule by hand produced three wrong-slice
counts in one week; the 15:16Z correction names the cause -- a --check in a
working tree at HEAD says nothing about a cited revision.
queue_append_audit.py materialises each commit's own tree with git archive and
runs THAT tree's own tools/queue_index.py --check inside it. Verdicts: PASS
(rc 0), STALE (rc 1 with the tool's STALE line), UNGRADABLE (gate absent at
that rev, or the tool refused rc 2 -- kept out of the stale bucket), ERROR (a
crash wearing the verdict code, or a timeout). House contract: 0 clean, 1 a
graded fault, 2 could not grade. --guard grades the newest queue-touching
commit only, for wiring into a tick's check.sh. Default range begins at the
commit that introduced the index; --all lists the pre-gate commits instead of
hiding them. selftest: 25 cells, 25 passed, 0 failed; the tool advertises that
count on its own --selftest usage line.
Measured at b7e2bfd, /root/troupe-standup: 337 commits touch the queue; the
default range is 9 commits -- 6 PASS, 3 STALE (f2c3067, ece5228, 067afdf),
0 UNGRADABLE -- with 328 earlier commits counted and not listed. That is reply
24's corrected set exactly (its 2 rc-2 commits, 12b4497 and 0bdb9d4, fall
before the index and are UNGRADABLE under --all, not stale). --guard at HEAD
reads 1 PASS, rc 0.
The tool's own fixture found a real defect in queue_index.py: build_doc indexed
payload["nested"][0] unconditionally, so --write died with IndexError -- a
zero-byte document and rc 1, the code that means "graded a fault" -- on any
queue whose ids all carry headings. Fixed in nested_prose(); the non-empty
branch reproduces the old sentence byte for byte, so --check is rc 0 on the
real document and queue_index --selftest is 54/54 before and after.
selftest_sweep.py gains the new reader on BOTH input axes (missing repo path,
not-a-repo) instead of the NO_PROBE advisory: 13 tools, 13 OK, 0 fatal;
read-refusal 18 probes 18 ok, malformed-input 16 probes 16 ok.
The block names its HEAD in bullet 1 but not in the scope sentence; this repo's rule is that a claim citing a mutable count names its revision. Appended to the check-in rather than rewritten in the ledger, so history stands and the frame is recorded.
Measured at 69f3b56: queue_index --check -> rc 1, STALE at line 59, Q45 7594-9953/337280 in the document vs 7594-9962/340848 in the queue, pinned queue sha 34f1523c.. vs real 7e222ce2...
Cause by commit: git show --stat 067afdf = WORK-QUEUE.md, 1 file, 9 insertions. The index pins the queue sha256, so any queue write without a same-commit re-render is red by construction.
Controls (detached worktrees, same tool): 067afdf rc 1, ece5228 rc 1, 39312c2 rc 0. Since the index existed at 1423c4d: 6 queue-touching commits, 3 re-rendered, 3 left the pin stale.
Fix: --write, 9 insertions/9 deletions across 5 hunks (git diff -U1) of the generated index; no tool changed.
Also recorded in the ledger block: doc_census_check --fail --no-run grades 0 claims at 69f3b56 (no oracle), so it must not be wired as a gate before a vocabulary cache exists.
Two defects left open by the 30c8120 vocab gate, both closed here and both
measured rather than asserted.
1. --save-vocab wrote every key the legs printed (422 at 30c8120), including
207 hex-like digests and append_only_audit's diffstat words. Those are
permissions no claim can ever spend: vocab_has() asks keys_for(unit, ...)
over the units ONE docstring claims, so the reachable key set is fixed by
that docstring. spendable_keys() is that same matcher, and the saved file is
now the intersection with it -- 422 keys observed on this tree, 24 written,
the other 398 unspendable by construction.
2. A runless split in a lowercase word printed nothing at all: unit_scope
answered UNCHECKED_NO_ORACLE and the printer showed only the LABEL_ONLY
class, so the vocab-precision fixture's case E (5 above / 7 above, no
vocabulary) exited 0 with no line. Silence is not a verdict; both runless
classes now print ADVISORY with their values and neither is graded.
Measured: fixture A..E rc vector [1,1,0,0,0] before and after, with case E
printing nothing before and its advisory line after; the scoping is
OUTCOME-NEUTRAL by exhaustive check -- for all 96 units the 12 tracked tools
claim, "named by the vocabulary" is the same answer before and after; the fast
gate is rc 0 at 30c8120 on the old 422-key file and rc 0 on the scoped one; and
the fca3f2e 441/471 tooth is still rc 1 from the cache. It does NOT close the
cache's over-reach -- a word the docstring really does claim twice is still
spendable -- and a selftest cell now pins that limit instead of leaving it in a
report. Selftest 72 -> 80 cells, 80/80 rc 0.
Reply 22 ruled the asymmetry a defect and asked that `--fail` never return 1 on
a split it could not verify. 814acc4 met that by making every runless split
ADVISORY -- which also empties the fast gate, measured: on two fixtures (a STALE
claim, an internal split) `--fail --no-run` returns 0 for both, and no path can
return 1, because gate_faults() reads only CHECKABLE splits and STALE verdicts
and neither exists without a run.
So the fast mode gets the oracle it can have. `--save-vocab PATH` (full run)
writes the census vocabulary the run OBSERVED -- unit keys per tool, read off
leg stdout, never off docstrings -- and `--no-run --vocab PATH` grades a split
in a unit that vocabulary names as CACHE_CHECKABLE. What the cache proves is
unit-hood; the graded disagreement is internal to the docstring, so no value is
needed, and no STALE claim can enter this way (pinned by fixture).
Measured at fca3f2e, tools/citation_resolve_check.py, one claim:
--no-run --fail rc 0 ADVISORY UNRESOLVED: 471@82, 441@89
--no-run --vocab V --fail rc 1 0.205s, SPLIT ... (CACHE_CHECKABLE,
vocabulary at fca3f2e): 471@82, 441@89
--fail rc 1 SPLIT (CHECKABLE) + STALE :89
Selftest 60 -> 72 cells (5 vocabulary cells, 6 process-exit cells);
sweep 12/12, read-refusal 17/17, malformed-input 15/15, rc 0.
rc 2 covers an unreadable --vocab and --save-vocab without a run.
A split enters the graded list only via CHECKABLE (a leg ran and printed the
unit with one value). Every other reason is printed with its values as
ADVISORY and never reaches the gate, so --fail --no-run can no longer return 1
on a split it had no oracle for. Ruling: reply 22, 2026-10-18.
Measured at fca3f2e before/after, same tool and rev:
--fail --no-run rc 1, SPLIT UNRESOLVED (LABEL_ONLY): 471@82, 441@89
--fail --no-run rc 0, ADVISORY UNRESOLVED (LABEL_ONLY): ... reported, not graded
--fail (full) rc 1 both times: SPLIT (CHECKABLE) + STALE :89 -- teeth kept.
Selftest 52 -> 60 cells (6 mode cells, 2 process-exit cells); sweep 12/12.
`--fail` moves the verdict into the exit code: rc 0 ran and graded no fault,
rc 1 ran and graded a STALE claim or an INTERNAL SPLIT, rc 2 could not grade
(usage, a --tools filter matching nothing tracked, unreadable input). Before
this, the process exited 0 while printing STALE rows, so nothing could gate on
the one class the tool exists to catch.
Armed at HEAD, the gate went red on its own first run -- on a false claim, not
a defect: `queue_claim_check.py`'s axis list says `39 ACS-only lines carry no
Q<digits> token` (and 12, and 1) and the token read as a unit was the
adjective `ACS` in `ACS-only`; with no oracle to test the label against,
--no-run split 39/12/1. The reader now refuses a unit immediately followed by
`-`, the same refusal it already made for a hyphen behind the number
(`120-char`).
Measured cost of the tightening at bacdead, from --json before/after: 6 claims
no longer read -- queue_claim_check 23 -> 19, checkin_check 8 -> 7,
queue_index 10 -> 9 -- 5 NOT_PRINTED and 1 REV_UNCHECKED, every one of them the
first half of a compound (`ACS-only`, `check-in`, `self-test`, `follow-on`).
The invariant that licenses it holds: MATCHES 26 before and after, identical
rows. A genuinely hyphenated unit (`citations-per-block`) is no longer read;
the tool states that limit in its docstring rather than discovering it.
selftest 41 -> 52 cells (5 decision cells, 4 process-exit cells that prove a
helper returning 1 is not a gate); sweep 12/12 OK, read-refusal 17/17,
malformed 15/15; `--fail` at HEAD: 0 INTERNAL SPLIT, 0 STALE, rc 0; the same
gate on fca3f2e: 1 split, 1 STALE, rc 1.
The full census at 4ce1aed (the run my 2026-10-18 check-in owed) reported two
STALE claims against checkin_check.py:59 -- "read as UTF-8. Never 1, never a
traceback." -- where the 8 is the tail of UTF-8 and the 1 is an exit code.
Both are false defect claims.
Measured over all 12 committed docstrings: 140 claims read, 95 real. The rest
were welded hex (83acffe0 -> 83 acffe0, 11), ordinals/sentence ends (1.
INTERNAL, 8. Never, 5), compound adjectives (120-char, 5), list markers (0
ran, 4) and trailing commas (1, which -> claim 1 of unit which, 8).
Three rules: sep is one space or a closing delimiter + space; num is
[0-9]+(?:,[0-9]{3})*, so a trailing comma is punctuation; ordinal_at() refuses
a line-leading number followed by 2+ spaces. Six cells: 35 -> 41.
Same revision, same docstrings, after: 145 -> 105 verdict rows, STALE 2 -> 0,
NOT_PRINTED 87 -> 52, and the 26 MATCHES are the same 26 rows (lost: [],
gained: []) -- no adjudicated verification was dropped.
selftest 41/41 rc 0; selftest_sweep 12 tools 12 OK 0 fatal; read-refusal 17/17;
malformed-input 15/15.
Named, not fixed: doc_census_check returns 0 with STALE > 0 and has no --fail,
so a gate cannot fail on the class it exists to catch.
The read-refusal axis measured missing paths and non-UTF-8 bytes. The class in
between was unmeasured: a .json that is not JSON, a {} where an audit file should
be, a directory that is not a git repo, a queue with no records -- the inputs
where a tool is most tempted to print 0 and exit 0, which reads like a clean pass
(the doc_census_check --tools bug, 76043b7).
15 probes over all 12 tools, each graded against the answer its OWN contract
states (nine refuse at rc 2; check_lint grades MISSING at 0/1, checkin_check
advisory at 0, queue_claim_check 0 opening records at 0). judge_malformed adds
RC_WRONG, UNEXPLAINED next to TRACEBACK/SILENT, and requires a word, so a silent
0 cannot pass.
15/15 at HEAD -- no tool was wrong, none was measured. Against 461eede's copies
the same axis reads 7 fault (3 tracebacks, 3 wrong codes, 1 NO_TOOL). Against a
copy with one bug reintroduced into append_only_owners.py it reads RC_WRONG while
that tool's own 15-cell selftest stays green.
volt
volt
volt
Volt
timmy
Volt