q98: register import_resolve_check.py on all three sweep axes and re-render docs/TOOLS.md

c30f372 landed tools/import_resolve_check.py and nothing registered it: the sweep read NO_PROBE on both input axes plus PIN_UNPINNED, write_probe read NO_PROBE on the json axis and failed its own c7 roster cell, and tool_map's HEAD drift cell failed on a TOOLS.md that did not name the tool. Measured at 7ffd177: verify.py 8 legs 5 pass / 3 fault (path-claims, selftest-sweep, write-axis); after this commit 7 pass / 1 fault, the remaining leg being the two inbox rows that faulted before this tick. Sweep: '23 tools, 21 OK, 2 fatal' -> 'verdict: rc 0 -- clean'; read-refusal 27 ok + NO_PROBE -> 28/28; malformed 26 ok + NO_PROBE -> 27/27; pin 22 pinned + 1 drift -> 23 pinned, 23 agree. write_probe: selftest 14/15 (c7 tool-only=['import_resolve_check.py']) -> 15/15, live axis 27 probed / 27 ok. The three new rows were graded against mutants of the tool, not assumed: refusal at rc 1 -> RC_NOT_2, not-a-repo graded clean -> RC_WRONG, --json silently skipped -> RC_OTHER. The tool itself is unmodified and still reads rc 1 on this tree (8 faults in 7 test files, Q98's subject). No other lane's file edited.

docs/TOOLS.md

@@ -7,7 +7,7 @@ disagree). Every cell below is derived, never typed -- purpose from the
 module docstring, flags from the tool's own `--help`, probe rows from
 `selftest_sweep.py`'s tables, the gate leg from `verify.py`'s `LEGS`.
 
-**22 tools, 22 with a `--help` oracle.** Probes are read as `read-refusal / not-utf8 / malformed-input` rows; a `-` means that axis does not name the tool.
+**23 tools, 23 with a `--help` oracle.** Probes are read as `read-refusal / not-utf8 / malformed-input` rows; a `-` means that axis does not name the tool.
 
 | tool | what it grades | flags | probes | gate leg |
 |---|---|---|---|---|
@@ -21,6 +21,7 @@ module docstring, flags from the tool's own `--help`, probe rows from
 | `doc_census_check.py` | does a tool's own docstring census match the census that tool PRINTS? | `--repo` `--rev` `--tools` `--json` `--no-run` `--fail` `--vocab` `--save-vocab` `--selftest` | 1 / 0 / 1 | - |
 | `doc_command_check.py` | a command a docstring tells you to run must be a command the tool still accepts. | `--repo` `--rev` `--tools` `--json` `--fail` `--selftest` | 1 / 0 / 1 | `doc-commands` |
 | `gate_blame.py` | which landing turned a gate leg red? | `--repo` `--leg` `--range` `--ref` `--queue` `--index` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
+| `import_resolve_check.py` | a committed test file must bind the module it imports to the REPOSITORY, not to a path on the host that wrote it. | `--repo` `--rev` `--all-files` `--import-probe` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
 | `landing_check.py` | is every file at this revision actually served by the forge? | `--repo` `--rev` `--branch` `--base-url` `--path` `--max-bytes` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
 | `manifest_audit.py` | does an artifact's `files.sha256` still describe the bytes beside it? | `--root` `--baseline` `--strict` `--fail` `--json` `--quiet` `--selftest` | 1 / 0 / 2 | - |
 | `path_claim_check.py` | does every in-namespace path this archive names exist at this revision? | `--repo` `--rev` `--corpus` `--json` `--only` `--context` `--fail-on-missing` `--baseline` `--selftest` | 1 / 0 / 1 | `path-claims` |

tools/selftest_baseline.tsv

@@ -19,6 +19,7 @@ citation_resolve_check.py	14	fixtures
 doc_census_check.py	104	cells
 doc_command_check.py	18	cells
 gate_blame.py	21	cells
+import_resolve_check.py	32	cells
 landing_check.py	26	cells
 manifest_audit.py	17	cells
 path_claim_check.py	31	cells

tools/selftest_sweep.py

@@ -256,6 +256,11 @@ READ_PROBES = (
     ("doc_command_check.py", ["--repo", "{nope}"]),
     ("doc_census_check.py", ["--repo", "{nope}", "--no-run"]),
     ("gate_blame.py", ["--repo", "{nope}"]),
+    # import_resolve_check.py landed at c30f372 and sat on this axis unnamed for
+    # one commit: the sweep read `NO_PROBE import_resolve_check.py/missing`, which
+    # is exactly the "uncovered tool" fault the table exists to raise. Its input
+    # is a git work tree, so a path that is not there is the read refusal.
+    ("import_resolve_check.py", ["--repo", "{nope}"]),
     ("landing_check.py", ["--repo", "{nope}"]),
     # manifest_audit.py's input is an artifact ROOT (a directory of artifact
     # directories), so the refusal is a root that is not there -- and it must
@@ -337,6 +342,12 @@ MALFORMED_PROBES = (
     # malformed shape, and it must name that rather than pass a window of nothing.
     ("gate_blame.py", "not-a-repo", ["--repo", "{notrepo}"],
      2, None),
+    # The same tree, decodable and the wrong SHAPE: a directory with a file in
+    # it and no .git must be refused at rc 2, not graded as a clean census of
+    # nothing. Measured at 7ffd177: `cannot grade: git rev-parse --show-toplevel
+    # failed: fatal: not a git repository`, rc 2.
+    ("import_resolve_check.py", "not-a-repo", ["--repo", "{notrepo}"],
+     2, None),
     ("landing_check.py", "not-a-repo", ["--repo", "{notrepo}"],
      2, None),
     # manifest_audit.py grades CLAIMS, so its malformed axis is two-sided. A

tools/write_probe.py

@@ -167,6 +167,7 @@ WRITE_PROBES = (
     ("doc_command_check.py", ["--repo", "{tinyrepo}", "--json", "{target}"]),
     ("gate_blame.py", ["--repo", "{tinyrepo}", "--leg", "selftest-sweep",
                        "--range", "1", "--json", "{target}"]),
+    ("import_resolve_check.py", ["--repo", "{tinyrepo}", "--json", "{target}"]),
     ("landing_check.py", ["--repo", "{tinyrepo}", "--json", "{target}"]),
     ("manifest_audit.py", ["--root", "{tinyrepo}", "--json", "{target}"]),
     ("path_claim_check.py", ["--repo", "{tinyrepo}", "--json", "{target}"]),