# Work queue census v2

Corrected, complete census of every numbered work-queue item in
`WORK-QUEUE.md`, extracted for the **Extract** lane (data extraction and
tables).

## What this is

One row per `## Q<n> ...` heading in the source: 97 headings, 86 distinct q
labels, 11 reopened labels. Each row carries the verbatim heading title plus a
`status` (first `**Status:` marker, whitespace collapsed, truncated at the
first sentence end) and `done_implies` (first `**Done means:` line).

A record written in the bold-lead form (`**Q135 — ...`) is not a heading and
therefore has no row. That is deliberate and unchanged: the table's unit is the
heading, and `WORK-QUEUE.md` carries 93 bold-lead records that no heading
parser can see. Counting those is a different artifact's job, not this one's.

## Artifacts (in this directory)

| File | Purpose |
|---|---|
| `workqueue-census.tsv` | Tab-separated table of all 97 rows (artifact of record). |
| `workqueue-census.md` | Markdown table of the same rows. |
| `extract_manifest.json` | Schema + counts + provenance + the source pin. `extracted_at_utc` is the measured run moment, not a constant. |
| `CHECK` | Real verification: re-derives the rows from the **pinned** source bytes with plain string operations (no import of the extractor) and compares. Python 3; exits 0 only if correct. |
| `extract_workqueue.py` | The extractor that produced the TSV/MD/manifest. |

## Provenance (Q135, 2026-10-31)

The manifest no longer names its source by absolute host path — that was the
Q69/Q106/Q109 class, and it made the artifact grade whatever tree the host
happened to hold. It records:

| Field | What it is |
|---|---|
| `source` | `WORK-QUEUE.md` — repo-relative, never a host path |
| `source_rev` | `git rev-parse HEAD` at generation |
| `source_blob_sha` | `git rev-parse HEAD:WORK-QUEUE.md` — the pinned bytes |
| `source_sha256` | sha256 of the bytes actually read |
| `source_lines` | line count of those bytes |
| `source_matches_head_blob` | whether the pin was taken from a clean worktree |
| `row_digest` | sha256 of the emitted TSV data rows |

The pin is honest or the extractor refuses. If the worktree's `WORK-QUEUE.md`
differs from the HEAD blob, `extract_workqueue.py` exits 1 and writes nothing:
a pin to a blob that does not contain the rows in the TSV is a false
provenance claim. `--allow-dirty` snapshots the worktree anyway and records
`source_blob_sha: null` with `source_matches_head_blob: false`, so `CHECK`
grades the worktree bytes and says so.

## Verification

`CHECK` is a Python 3 program, not a shell script. Run it with the interpreter
itself (the file is executable, so `./CHECK` works too):

    python3 CHECK
    python3 CHECK --now=2026-10-31T00:00:00Z    # also grade stamp recency
    python3 CHECK --selftest                    # prove every leg can fail

It reads the source from the blob the manifest pins (`git cat-file blob`), not
from the worktree file, re-derives the expected rows with string operations
(independent implementation from `extract_workqueue.py`), then compares qid +
title against the committed TSV, recomputes the manifest's counts and row
digest, grades the provenance and the extraction timestamp, and checks for
delimiter corruption. It exits 0 only if every graded check passes, 1 if a
check fails, 2 on a bad invocation.

**A declared pin that git cannot read is a fault, never a fallback.** An
artifact that cites a blob nobody can open has no provenance, and grading
whatever the worktree now holds would grade bytes the manifest never named.
(The one cost: a shallow clone that does not carry the pinned object fails
this leg. Full clones are the norm here; `--allow-dirty` generation records no
pin and skips the problem by declaring it.)

**The timestamp leg does not read the wall clock.** `extracted_at_utc` is
graded on what the artifact can prove about itself — it parses as a UTC `Z`
stamp and it is not the stale constant the v1 census shipped — and its
*recency* is graded only against a reference time the caller supplies
(`--now=`). With no reference, that one leg prints `SKIP` and the rest of the
gate still decides.

**Drift is reported, not graded.** When the worktree's heading count differs
from the pinned source's, `CHECK` prints
`ADVISORY source-moved worktree=<n> pinned=<m>` and still exits 0. A census is
a snapshot of named bytes; a snapshot that goes red because the world moved is
a snapshot nobody regenerates. Regenerate to move the snapshot forward:

    python3 extract_workqueue.py        # refuses on a dirty source, by design

## Why a new census

The earlier `2026-10-28-workqueue-census/` failed its own contract:

1. Its `CHECK` re-imported `extract_workqueue_census`, so it could never fail
   (a tautology, which the Standing Agreement forbids).
2. Its `extracted_at_utc` was a hardcoded constant
   (`2026-10-28T00:00:00Z`) that did not match the source commit time.

This v2 production is the corrected, independently verified replacement.

### v2's own corrections

**2026-10-28 (Q122).** v2 fixed the tautology and then bound its verdict to the
clock instead: the recency leg was `abs(now - dt) < 120` against the frozen
`2026-10-28T18:31:34Z`, so the artifact could only ever be green for the two
minutes after its own generation, and the documented command `bash CHECK`
could not run at all (the file is Python). Both are repaired: the recency leg
takes its reference as an argument, and the interpreter is named once, in the
shebang and here.

**2026-10-31 (Q135).** Three things had gone wrong with the artifact itself,
all measured at `7b42050` before the repair: its `CHECK` was **red at HEAD**
(`FAIL row count 'committed=96 golden=97'`, `FAIL manifest.rows 96 vs 97`,
`FAIL manifest.distinct_q_labels 85 vs 86`) because the table was a
2026-10-28 snapshot of a file that had since gained a heading and nothing
regenerated it; its `manifest.source` was the absolute host path
`/root/troupe-standup/WORK-QUEUE.md`; and its verdict was a function of the
worktree at read time, so every append moved the answer. The repair pins the
bytes, grades the pin, records a row digest, and makes drift an advisory. The
counterfactual is committed as a selftest cell and demonstrated on real
commits: at a descendant revision carrying three extra headings, `CHECK` still
reads `ALL CHECKS PASSED (97 rows, ...)` rc 0 plus the advisory.

## Evidence

- Source: `WORK-QUEUE.md` at the repo root (resolved from this directory:
  `HERE/../../..`), pinned to blob `624ecb72ead1f01b60cdbaca892278858167aa5e`
  at rev `7b4205014c8f95e6dbf45d1ba62a0b39cc926a88`.
- Extracted: `2026-10-31T09:42:38Z` UTC (measured at generation; the manifest
  carries this stamp, and `--now=` grades recency against it).
- Independent re-derivation count: 97 rows; 86 distinct labels; 11 reopened
  (`Q37 Q38 Q39 Q43 Q60 Q72 Q79 Q81 Q82 Q83 Q93`).
- `python3 CHECK` → `ALL CHECKS PASSED (97 rows, 86 distinct labels, 11
  reopened)`, rc 0.
- `python3 CHECK --selftest` → `SELFTEST OK (9 cells: 3 green controls, 6 red
  mutations)`, rc 0 — the red cells being an unreadable pin, a host-path
  source, a corrupted row digest, a corrupted title, the stale constant, and a
  stamp moved one day.
- `python3 extract_workqueue.py` on an uncommitted `WORK-QUEUE.md` → rc 1,
  `REFUSED: the worktree's WORK-QUEUE.md is not the HEAD blob`, TSV untouched.