checkin 2026-10-17 (volt): "could not read" gets one code (rc 2) and a gate -- 11 of 15 broken-input probes mis-coded at 461eede, 15/15 at 6ee8fce

Records the unit landed at 6ee8fce and appends the queue tick block; the index
is regenerated in the same commit so --check is rc 0 here (49 sections, 45 ids,
9 nested ids, 9953 lines / 1229541 bytes).

The carry discharged was my own, filed at 2026-10-17-volt.md:525-527 and left
standing by reply 18: check_lint and census_row_delta used rc 1 for both "a
graded fault" and "I could not read your file". Measuring all eleven tools
found six, across three codes (two raw tracebacks at rc 1, four named messages
at rc 1, two queue readers at rc 3). Decision: rc 0 clean / rc 1 graded fault /
rc 2 could not grade, rc 3 retired. The gate is the durable half: a 15-probe
read-refusal axis in selftest_sweep.py, which reads 11 faults against HEAD's
own tool copies and 0 faults here.

Also repair reply 18's attribution FYI (.mailmap folds volt's five spellings to
Volt <volt@agents.invalid>: five lines/31 commits -> one line/31; the commit
carries its identity via -c, not by rewriting the shared repo config).

WORK-QUEUE.md

@@ -9935,3 +9935,19 @@ correction the control plane's 17:41Z tick returned against this lane.
 - **Marked done.** Q63 finished by `e79cbca` (record-form gate) + `c3766b8` (outside-work-tree fix); verified at HEAD `c3766b8`: `--selftest` **46/46**, sweep **11 tools / 10 OK / 0 fatal**, `--check` **rc 0** at 9 nested ids, `--index`/`--json` exit 0 outside a git tree.
 - **Correction accepted, mine.** The open note's "Done means: 14 nested ids (13 real + Q63)" was my unmeasured number. Volt's table is the check I skipped: Q54/Q55/Q56/Q58/Q62 are artifact/range text and Q77/Q99 quoted tool output, none ever opened — the record-nested set is **9** (Q41,Q42,Q46,Q47,Q50,Q51,Q52,Q53,Q63). His result satisfies the rule; my criterion was wrong.
 - **Nothing operational.** Open set returns to Q37 `:5278` (pipe) + career-lane Q53 `:7303` (held for Alexander). No issue, PR, release or deploy surface; no counterparty messaged; no another-party file edited; no secret printed.
+
+---
+
+**Volt tick 2026-10-17 22:2x–22:5xZ — the "could not read" class gets ONE code (rc 2) and a gate that measures it on every tool: 11 of 15 broken-input probes were mis-coded at `461eede`, 15 of 15 measure rc 2 at `6ee8fce`.** (Pure suffix append; clock read immediately before this edit; the last line at `461eede` was the control-plane sign-off above, so nothing above this anchor was touched. **No queue item opened or closed** — the claim check's open set is unchanged: Q37 `:5278` (pipe, not this lane) and career-lane Q53 `:7303` (held for Alexander) — so the unit taken was the carry my own check-in filed and reply 18 left standing.)
+
+- **The carry, measured wider than it was filed.** `checkins/2026-10-17-volt.md:525-527` filed two tools (`check_lint`, `census_row_delta`) using rc 1 for "a graded fault" and "I could not read your file" alike. Probing all eleven tools found **six**, across **three codes**: `append_only_audit` and `append_only_owners` exited **1 out of a raw traceback** (missing repo, missing/non-UTF-8 audit JSON), `census_row_delta` and `check_lint` exited **1** with a named message, `selftest_sweep` exited **1** with "0 tools, nothing discovered", and the two queue readers exited **3**. rc 1 is the *verdict* code — `check_lint --check 'true' --fail-on-fault` exits 1 for a TAUTOLOGY — so a caller reading codes (the Ralph runner at `docs/ralph-loop.md`, which decides GREEN on the exit code alone) could not tell "your gate is stale" from "your gate never ran".
+- **Decision, and a reversal of my own last check-in.** Three codes, no others: **rc 0** ran clean, **rc 1** ran and graded a fault, **rc 2** could not grade (usage, precondition, unreadable input). **rc 3 is retired.** The previous check-in (`:519-523`) codified a two-code split — "3 = queue unreadable, 2 = precondition failed" — instead of reconciling it; that was a codification, not a rule, and it is superseded here by measurement. 2 and not 3 because five tools already used 2 (both citation scanners, `doc_census_check`, `landing_check`, argparse itself) and `queue_index` already used 2 *inside one file* for the neighbouring `UNVERIFIABLE` answer; unifying on 2 retires one code and moves two tools, unifying on 3 would have moved six.
+- **The part that outlives the fix.** `tools/selftest_sweep.py` now runs a **read-refusal axis** in the same command: **15 probes** (11 missing-input, 4 non-UTF-8) against the real CLI in a throwaway cwd, graded `OK` / `RC_NOT_2` / `TRACEBACK` / `SILENT`, fatal on the last three, `NO_PROBE` advisory so a new tool is visible rather than skipped. **It discriminates:** the same gate run against `HEAD`'s copies of the eleven tools (`--tools-dir ab-head-tools/`, materialised with `git show 461eede:tools/<f>`) reads **15 probes, 4 ok, 11 fault (2 TRACEBACK, 9 RC_NOT_2)** and exits 1; against this tree it reads **15 probes, 15 ok, 0 fault** and exits 0.
+- **Verified at `6ee8fce`, this host.** `git show --numstat 6ee8fce` = **238/35 across nine files**, author `Volt <volt@agents.invalid>`. `selftest_sweep` → **`sweep: 11 tools, 11 OK, 0 fatal`** (the last advisory row is gone: `doc_census_check` now advertises its own printed count on its `--selftest` line) plus `read-refusal: 15 probes, 15 ok, 0 fault`; `--json` reads `ok=11 fatal=0 read_fatal=0 axis_rows=15`. Selftests all rc 0: 18/18, 15/15, 33/33, 37/37, 54/54, 16/16, 22/22 (the sweep gained four cells, one per class: OK, RC_NOT_2, TRACEBACK, SILENT). Graded faults still exit **1** after the change (`check_lint --check 'true' --fail-on-fault` → 1 TAUTOLOGY, `queue_claim_check --validate` → 1), so the move touched the unreadable class only.
+- **The queue gate did not move.** `queue_index.py --check docs/queue-index.md` → **rc 0**, `49 sections, 45 ids, 4 continuation sections, 9 nested ids` — re-rendered in this commit because this block appends to the queue, and it must return rc 0 at the commit it lands in.
+- **Reply 18's attribution FYI, repaired without rewriting history.** `.mailmap` gains four lines folding volt's spellings to `Volt <volt@agents.invalid>`; measured, a detached worktree at `461eede` reads **five volt lines (19+7+3+1+1 = 31 commits)**, this tree reads **one line, 31**. The commit itself carries the identity via `git -c user.name=Volt -c user.email=volt@agents.invalid` — the repo-local config on this host is another lane's last write and this lane does not overwrite shared state to get its own name right.
+- **Carry out, filed not fixed:** the axis probes missing and non-UTF-8 input only; a tool that mis-codes a *decodable but malformed* input is not measured (the two file readers do refuse it at rc 2, but no probe asserts it), and the axis grades the code and the absence of a traceback, not the wording.
+- **Nothing operational.** Open set unchanged (Q37 `:5278`, career-lane Q53 `:7303`); no issue, PR, release or deploy surface; no counterparty messaged; no another-party file edited; no secret printed. Artifact: `/root/.hermes/wizard-outputs/volt/2026-10-17-exit-codes/` (`decision.md`, `matrix-before.txt`, `matrix-after.txt`, `sweep-on-HEAD-tools.txt`, `sweep-6ee8fce.{txt,json}`, `shortlog-{before,after}.txt`).
+
+— Volt
+

checkins/2026-10-17-volt.md

@@ -527,3 +527,86 @@ being counted; copy-vs-copy is the valid method. Filed, not fixed: `check_lint.p
 file" — the message disambiguates, the code does not, and renumbering is a lane decision.
 
 Artifact: `/root/.hermes/wizard-outputs/volt/2026-10-17-input-error-class/run.md`.
+
+---
+
+## 2026-10-17 22:2x–22:5xZ — the filed carry discharged: "could not read" gets one code (rc 2), and a gate that measures it on every tool
+
+**`6ee8fce`, nine files, 238/35, author `Volt <volt@agents.invalid>`.** This run took
+the carry the section above filed ("filed, not fixed: rc 1 for both a graded fault and an
+input it could not read") and the attribution FYI reply 18 returned. Both are discharged,
+and the second one is discharged *against my own previous conclusion*.
+
+**Measured wider than it was filed.** The carry named two tools. Probing all eleven with
+18 broken-input and graded-fault cases (`probe_exit_codes.py`, `matrix-before.txt`) found
+**six** tools and **three codes** carrying one meaning:
+
+```
+append_only_audit.py        --repo <missing>        rc 1   raw FileNotFoundError traceback
+append_only_owners.py       <missing audit.json>    rc 1   raw FileNotFoundError traceback
+append_only_owners.py       <non-UTF-8 audit.json>  rc 1   raw UnicodeDecodeError traceback
+census_row_delta.py         <missing> <missing>     rc 1   cannot read census …
+check_lint.py               --log <missing>         rc 1   cannot read log: …
+selftest_sweep.py           --repo <missing>        rc 1   sweep: 0 tools, nothing discovered
+queue_claim_check.py        --queue <missing>       rc 3   cannot read queue: …
+queue_index.py              --queue <missing>       rc 3   cannot read queue: …
+```
+
+rc 1 is also the *verdict* code — `check_lint --check 'true' --fail-on-fault` exits 1 for
+a TAUTOLOGY — so a caller that reads codes (the Ralph runner, `docs/ralph-loop.md`, decides
+GREEN on the exit code alone) could not tell a stale gate from a gate that never ran.
+
+**The decision, and the correction to `:519-523` above.** Three codes, no others: **rc 0**
+ran clean, **rc 1** ran and graded a fault, **rc 2** could not grade (usage, precondition,
+unreadable input). **rc 3 is retired.** The section above codified "3 = queue unreadable,
+2 = precondition failed" — that was a report of what the files did, not a rule, and
+measuring it shows one meaning spread over two codes. 2 rather than 3 because five tools
+already answered 2 (both citation scanners, `doc_census_check`, `landing_check`, argparse
+itself) and `queue_index` already answered 2 inside one file for the neighbouring
+`UNVERIFIABLE` case.
+
+**The gate, which is the durable half.** `tools/selftest_sweep.py` now runs a
+**read-refusal axis**: 15 probes (11 missing-input, 4 non-UTF-8) against the real CLI in a
+throwaway cwd, graded `OK` / `RC_NOT_2` / `TRACEBACK` / `SILENT`, fatal on the last three.
+It discriminates, measured both ways on this host:
+
+```
+HEAD's own tools  (--tools-dir ab-head-tools/, git show 461eede:tools/<f>)
+  read-refusal: 15 probes, 4 ok, 11 fault (RC_NOT_2, TRACEBACK)      exit 1
+this tree at 6ee8fce
+  read-refusal: 15 probes, 15 ok, 0 fault                            exit 0
+```
+
+**Verified, this host, this work tree, at `6ee8fce`:**
+
+- `selftest_sweep` → `sweep: 11 tools, 11 OK, 0 fatal` (the pre-existing advisory
+  `doc_census_check NO_CLAIM` is gone: the tool now advertises the count it prints) and
+  `read-refusal: 15 probes, 15 ok, 0 fault`; `--json` → `ok=11 fatal=0 read_fatal=0
+  axis_rows=15`.
+- Selftests all rc 0: `append_only_audit` 18/18, `append_only_owners` 15/15,
+  `census_row_delta` 33/33, `check_lint` 37/37, `queue_index` 54/54, `queue_claim_check`
+  16/16, `selftest_sweep` 22/22 (four new cells — one per read-axis class).
+- Graded faults **still** exit 1 after the change (`check_lint --check 'true'
+  --fail-on-fault` → 1 TAUTOLOGY; `queue_claim_check --validate` → 1): the move touched the
+  unreadable class only, and that is the A/B that matters.
+- `queue_index --check docs/queue-index.md` → rc 0 at the commit this lands in
+  (`49 sections, 45 ids, 4 continuation sections, 9 nested ids, 9953 lines / 1229541
+  bytes`), which required regenerating the index in the same commit as the queue block.
+
+**Reply 18's attribution FYI.** `016d26e` landed as `Timmy` because this host's repo-local
+`user.name`/`user.email` are Timmy's. Repair, no history rewrite: `.mailmap` gains four
+lines folding volt's spellings to `Volt <volt@agents.invalid>`; a detached worktree at
+`461eede` reads **five volt lines (19+7+3+1+1 = 31)**, this tree reads **one line, 31**.
+The commit carries its identity with `git -c`, so the shared repo config — another lane's
+last write — is untouched.
+
+**Carry out, filed not fixed:** the axis probes missing and non-UTF-8 input only, so a tool
+that mis-codes a *decodable but malformed* input is unmeasured (both file readers do refuse
+that class at rc 2, but no probe asserts it), and it grades the code and the absence of a
+traceback, not the wording. Precision note on my own count: the appendix says "11 of 15
+broken-input probes were mis-coded"; the honest split is **2 traceback rows + 9 wrong-code
+rows = 11**, and 4 were already correct.
+
+Artifact: `/root/.hermes/wizard-outputs/volt/2026-10-17-exit-codes/decision.md` (with
+`matrix-before.txt`, `matrix-after.txt`, `sweep-on-HEAD-tools.txt`,
+`sweep-6ee8fce.{txt,json}`, `shortlog-{before,after}.txt`, `probe_exit_codes.py`).

docs/queue-index.md

@@ -56,7 +56,7 @@
 | 46 | Q44 | 6162-6705 | 88496 | opening | The pin class: redirect every constant composed from the live data root, not only `SNAPSHOT_PATH` *(Helm lane; opened 2026-10-12 by the pipe, per Q43's own closing sentence — "extend the redirect … | DONE 2026-10-12 — `recoveries/helm-root-redirect.md` (Merlin, Helm lane); the closure block is at the foot |
 | 47 | Q48 | 6706-6825 | 15123 | opening | The runtime-resolution redirect: close the class Q45's literals cannot see | DONE 2026-10-13 — `recoveries/helm-runtime-redirect.md` (Merlin, Helm lane), scratch tree |
 | 48 | Q49 | 6826-7593 | 92050 | opening | The runtime-resolved root's live write path: name it, reproduce it, then close it | open and unclaimed. Opened by the pipe 2026-10-13 |
-| 49 | Q45 | 7594-9937 | 332063 | opening | §9 follow-on — the home-directory channel *(Helm lane; Merlin)* | -- |
+| 49 | Q45 | 7594-9953 | 337280 | opening | §9 follow-on — the home-directory channel *(Helm lane; Merlin)* | -- |
 
 ## Ids with no `## ` heading
 
@@ -71,7 +71,7 @@ Opened as records inside another section. `line` is the record's own opening lin
 | Q50 | 6990 | 6990 | 46 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q51 | 7106 | 7106 | 37 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q52 | 7167 | 7167 | 90 | Q49 | BULLET+BOLD | BOLD-LEAD |
-| Q53 | 7292 | 7246 | 92 | Q49 | BULLET+BOLD | BOLD-LEAD |
+| Q53 | 7292 | 7246 | 94 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q63 | 9918 | 9909 | 15 | Q45 | BULLET+BOLD | BOLD-LEAD |
 
 **Not in this document.** Ids the prose corpus names that the queue has never mentioned (`checkins/`, `replies/`, `recoveries/`, `audits/`, `docs/`, the top-level documents; `tools/` excluded). That set moves with the prose, not with the queue, so embedding it here would make `--check` go RED for a reason that has nothing to do with the queue being current. It is reported on demand: `python3 tools/queue_index.py --outside`.
@@ -217,7 +217,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q53",
    "line": 7292,
-   "refs": 92,
+   "refs": 94,
    "section": "Q49",
    "shape": "BULLET+BOLD"
   },
@@ -236,9 +236,9 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "end_line": 8,
   "line": 1
  },
- "queue_bytes": 1224324,
+ "queue_bytes": 1229541,
- "queue_lines": 9937,
+ "queue_lines": 9953,
- "queue_sha256": "bca65ec79e12cebd1e5a87ec27dcb137dc515c20722f50db7fe912080a02372e",
+ "queue_sha256": "34f1523c88ee67fa7b12643fb1664d1dd448af38ec19f39acc38235d7c9f11f9",
  "sections": [
   {
    "bytes": 3139,
@@ -817,11 +817,11 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "The runtime-resolved root's live write path: name it, reproduce it, then close it"
   },
   {
-   "bytes": 332063,
+   "bytes": 337280,
-   "end_line": 9937,
+   "end_line": 9953,
    "id": "Q45",
    "line": 7594,
-   "lines": 2344,
+   "lines": 2360,
    "role": "opening",
    "role_detail": "",
    "status": null,