write-flag axis: --json was the whole write gate, so the three caller-path write flags were ungraded; second axis lands, 6 mutations 6 red-or-green as predicted, gate 6/6

Measured before: at ea8fe24 a worktree with queue_index's --write guard
narrowed to PermissionError reads 21 probed / 21 ok / rc 0 under that
revision's write_probe. Same tree, this tick's instrument: 24 probed,
23 ok, 1 fault TRACEBACK, rc 1, while that tool's --json row stays OK.

Landed: FLAG_PROBES per (tool, flag); name-based discovery of
add_argument("--write*"/"--save*") with UNAXED for an unprobed flag and
STALE_FLAG for a table entry the source dropped; the discovered set and
its covered count printed on every run; selftest 11 -> 15 cells (c12
coverage rule, c13 the three real flags, c14 json-clean/flag-TRACEBACK,
c15 guarded twin).

Boundary read in source, not assumed: --emit-baseline writes stdout
(checkin_check.py:935, only file write inside c33), check_lint --log is a
read.

Mutation study: wizard-outputs/volt/2026-10-21-write-flag-axis/ (CTL PASS,
M1 TRACEBACK+FAULT, M2 RC_OTHER, M3a UNNAMED, M3b SILENT, M4 UNAXED);
M3a recorded as measured, not as predicted -- doc_census prints its report
to stdout before the write, so SILENT is unreachable there.

verify.py: 6 legs, 6 pass, 0 fault. write_probe --repo .: 24 probed,
24 ok. doc_command_check 64/64. doc_census 0 STALE. TOOLS.md re-rendered,
byte-identical.

tools/verify.py

@@ -60,7 +60,9 @@ WHAT IT RUNS -- one row per leg, cheapest first, never in parallel
   write-axis      tools/write_probe.py
                   every tracked tool's `--json PATH` pointed at a target this
                   host cannot write: rc 2, one line naming the path, never a
-                  traceback. The read axes grade an input a tool cannot read;
+                  traceback -- and, since 2026-10-21, every caller-path write
+                  flag other than `--json` (`--write`, `--save-vocab`) on the
+                  same rule. The read axes grade an input a tool cannot read;
                   this is the other end, and until 2026-10-21 nothing ran it.
 
   The legs are ordered by cost, and a leg is never skipped because an earlier
@@ -171,7 +173,8 @@ LEGS = (
      "what": "every tool's --selftest and both read-refusal axes"},
     {"key": "write-axis", "tool": "write_probe.py", "slow": False,
      "what": "a --json target this host cannot write: rc 2, one line naming "
-             "it, never a traceback"},
+             "it, never a traceback -- and the same rule for every caller-path "
+             "write flag (--write, --save-vocab)"},
 )
 
 # A detail line is a courtesy, not the verdict -- but a verdict with no line