docs: TOOLS.md rendered at 2556dbb (21 tools, 6 gate legs); queue record for the write path; index re-rendered

WORK-QUEUE.md

@@ -10465,3 +10465,20 @@ Verification, read at `6cd2114` (the revision this record was written against; a
 5. **Nothing else operational.** No issue, PR, release or deploy surface touched; no another-party file edited (reply 78 is a new file, this block is appended, the index is regenerated); no secret printed; inbox items 31/33/34 standing and not quoted into any public artifact.
 
 — Timmy (control plane)
+
+**Tools landing 2026-10-21 (volt, Workhorse) — the write path: 18 of the 20 tracked tools answered an unwritable `--json` with a traceback at rc 1, the guards now return rc 2 with one line, and `write_probe.py` is leg 6 of the gate that keeps it so.** No item opened or closed; the open set is as the previous record left it (`Q37`'s pipe span, the career-lane `Q53` decision held for Alexander, `Q64`'s design question Alexander's). Appended at the foot; `docs/queue-index.md` re-rendered in the same commit.
+
+1. **The measurement, before any edit.** In a clean detached worktree at `67f94cc` (20 tools tracked), `write_probe.py` graded every tool's `--json` at a path whose parent does not exist: **18 TRACEBACK at rc 1**, 1 `UNNAMED` (`gate_blame.py` returned rc 2 from its own input, an all-UNGRADABLE window, and never reached the write, so its write path was UNGRADED, not clean), 1 `OK` (`queue_append_audit.py` already printed "cannot write json" at rc 2). A traceback is fatal under this repo's contract, and rc 1 is the code that means *a graded fault*, so those 18 made "the grade is bad" indistinguishable from "the artifact was never written".
+
+2. **What landed at `2556dbb`.** Nineteen tools wrap their `--json` write: the grade runs first and its stdout report stands, the write prints one line naming the path on stderr and returns 2. `gate_blame.py` additionally moves its write ahead of the all-UNGRADABLE early return, so a write refusal is not shadowed by a cannot-grade return; that hunk also arrived carrying a mis-indented `try:` and one surplus `]`, which made the module unimportable — both fixed before commit, and its selftest is 21/21. `checkin_check.py` grew a named `write_json()` used by both of its write points plus a 36th cell asserting rc 2, one stderr line naming the target, and no traceback.
+
+3. **The instrument, and the two counts it replaced.** `tools/write_probe.py` is new: one probe per tracked tool, verdicts graded in this order — TRACEBACK, RC_OTHER, SILENT, UNNAMED, NO_REACH (rc 2 from the input, so the write is ungraded), OK — with NO_PROBE fatal on the sweep's own rule, and it probes itself so that rule applies to its author. Two docstrings already in the tree claimed "five" and "13 of 20" for this measurement before any probe existed; neither was reproducible, and both now carry the measured 18 / 1 / 1 beside the worktree command that re-derives it.
+
+4. **It is a gate leg, not a report.** `verify.py` now reads six legs: `write-axis` is the sixth, 5.0s on this archive, and `selftest_sweep.py` carries both a read probe and a malformed probe for the new tool so it cannot arrive ungraded. The gate's own selftest moved 5→6 legs in the same edit (cells 1, 1b, 7, 11, 12b), so its advertised cell count still reads 51/51 instead of drifting off by one.
+
+5. **Verification.** `write_probe.py --selftest` **10/10 rc 0**; `selftest_sweep.py --selftest` **30/30 rc 0**; `verify.py --selftest` **51/51 rc 0**; `gate_blame.py --selftest` **21/21 rc 0**; `write_probe.py --repo .` **21 probed, 21 OK, 0 faults**; `verify.py --repo .` at the commit carrying this record — **6 legs, 6 pass, 0 fault**. At `2556dbb` the sweep read 21 tools, 20 OK, 1 fatal: `tool_map.py`'s drift cell, because `docs/TOOLS.md` was still the render of the previous tree. It is re-rendered here (**21 tools, 6 gate legs**), not waived.
+
+6. **What it does not claim.** These guards change what a refusal *says*, not whether a grade happened: a tool whose artifact cannot be written still returns 2, and the caller still has no file. `NO_REACH` is counted and never passed. No Q-item state changed, and nothing here decides anything Alexander holds.
+
+— Volt
+

docs/TOOLS.md

@@ -7,7 +7,7 @@ disagree). Every cell below is derived, never typed -- purpose from the
 module docstring, flags from the tool's own `--help`, probe rows from
 `selftest_sweep.py`'s tables, the gate leg from `verify.py`'s `LEGS`.
 
-**20 tools, 20 with a `--help` oracle.** Probes are read as `read-refusal / not-utf8 / malformed-input` rows; a `-` means that axis does not name the tool.
+**21 tools, 21 with a `--help` oracle.** Probes are read as `read-refusal / not-utf8 / malformed-input` rows; a `-` means that axis does not name the tool.
 
 | tool | what it grades | flags | probes | gate leg |
 |---|---|---|---|---|
@@ -30,7 +30,8 @@ module docstring, flags from the tool's own `--help`, probe rows from
 | `selftest_sweep.py` | every instrument proves itself, in one command, and the number it advertises is the number it prints. | `--repo` `--tools-dir` `--timeout` `--json` `--quiet` `--verbose` `--selftest` | 1 / 0 / 1 | `selftest-sweep` |
 | `served_drift_check.py` | does the host actually serve the tree at this revision? | `--root` `--rev` `--base-url` `--prefix` `--exclude` `--max-bytes` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
 | `tool_map.py` | the instruments get a map, and the map is generated from the tree. | `--repo` `--rev` `--write` `--check` `--json` `--selftest` | 1 / 0 / 1 | - |
-| `verify.py` | the HOME the index gate did not have: one command, five legs, one exit code, and a row per leg so a partial run cannot look like a clean one. | `--repo` `--queue` `--index` `--checkin-day` `--fast` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
+| `verify.py` | the HOME the index gate did not have: one command, six legs, one exit code, and a row per leg so a partial run cannot look like a clean one. | `--repo` `--queue` `--index` `--checkin-day` `--fast` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
+| `write_probe.py` | Measure the WRITE end of every tool in tools/: `--json PATH` at a target the host cannot write. | `--repo` `--only` `--timeout` `--json` `--selftest` `--verbose` | 1 / 0 / 1 | `write-axis` |
 
 ## The gate
 
@@ -45,6 +46,7 @@ dropped by `--fast`.
 | `index-current` | `queue_index.py` | no | render the index and byte-compare it with the document |
 | `append-audit` | `queue_append_audit.py` | no | grade the newest queue-touching commit in its own tree |
 | `selftest-sweep` | `selftest_sweep.py` | yes | every tool's --selftest and both read-refusal axes |
+| `write-axis` | `write_probe.py` | no | a --json target this host cannot write: rc 2, one line naming it, never a traceback |
 
 A tool that appears in no leg is still graded by `selftest-sweep`, which runs
 every tracked tool's `--selftest` and both read-refusal axes -- so the

docs/queue-index.md

@@ -56,7 +56,7 @@
 | 46 | Q44 | 6162-6705 | 88496 | opening | The pin class: redirect every constant composed from the live data root, not only `SNAPSHOT_PATH` *(Helm lane; opened 2026-10-12 by the pipe, per Q43's own closing sentence — "extend the redirect … | DONE 2026-10-12 — `recoveries/helm-root-redirect.md` (Merlin, Helm lane); the closure block is at the foot |
 | 47 | Q48 | 6706-6825 | 15123 | opening | The runtime-resolution redirect: close the class Q45's literals cannot see | DONE 2026-10-13 — `recoveries/helm-runtime-redirect.md` (Merlin, Helm lane), scratch tree |
 | 48 | Q49 | 6826-7593 | 92050 | opening | The runtime-resolved root's live write path: name it, reproduce it, then close it | open and unclaimed. Opened by the pipe 2026-10-13 |
-| 49 | Q45 | 7594-10467 | 504275 | opening | §9 follow-on — the home-directory channel *(Helm lane; Merlin)* | OPEN — awaiting Alexander's zoom/whole-shop answer; build is the pipe's. |
+| 49 | Q45 | 7594-10484 | 507975 | opening | §9 follow-on — the home-directory channel *(Helm lane; Merlin)* | OPEN — awaiting Alexander's zoom/whole-shop answer; build is the pipe's. |
 
 ## Ids with no `## ` heading
 
@@ -71,9 +71,9 @@ Opened as records inside another section. `line` is the record's own opening lin
 | Q50 | 6990 | 6990 | 46 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q51 | 7106 | 7106 | 37 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q52 | 7167 | 7167 | 90 | Q49 | BULLET+BOLD | BOLD-LEAD |
-| Q53 | 7292 | 7246 | 146 | Q49 | BULLET+BOLD | BOLD-LEAD |
+| Q53 | 7292 | 7246 | 147 | Q49 | BULLET+BOLD | BOLD-LEAD |
 | Q63 | 9918 | 9909 | 17 | Q45 | BULLET+BOLD | BOLD-LEAD |
-| Q64 | 10308 | 10308 | 9 | Q45 | BULLET+BOLD | BOLD-LEAD |
+| Q64 | 10308 | 10308 | 10 | Q45 | BULLET+BOLD | BOLD-LEAD |
 
 **Not in this document.** Ids the prose corpus names that the queue has never mentioned (`checkins/`, `replies/`, `recoveries/`, `audits/`, `docs/`, the top-level documents; `tools/` excluded). That set moves with the prose, not with the queue, so embedding it here would make `--check` go RED for a reason that has nothing to do with the queue being current. It is reported on demand: `python3 tools/queue_index.py --outside`.
 
@@ -218,7 +218,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q53",
    "line": 7292,
-   "refs": 146,
+   "refs": 147,
    "section": "Q49",
    "shape": "BULLET+BOLD"
   },
@@ -236,7 +236,7 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q64",
    "line": 10308,
-   "refs": 9,
+   "refs": 10,
    "section": "Q45",
    "shape": "BULLET+BOLD"
   }
@@ -246,9 +246,9 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "end_line": 8,
   "line": 1
  },
- "queue_bytes": 1396536,
- "queue_lines": 10467,
- "queue_sha256": "7b9a67d86b92f7d1ff0ed068cf698b8bf359226485c1acb2fe9f58f9b53bdaf7",
+ "queue_bytes": 1400236,
+ "queue_lines": 10484,
+ "queue_sha256": "d74551c3f747c60c1a4ca71529cf26bf9cd47472963e0420e75231dc083dd329",
  "sections": [
   {
    "bytes": 3139,
@@ -827,11 +827,11 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "The runtime-resolved root's live write path: name it, reproduce it, then close it"
   },
   {
-   "bytes": 504275,
-   "end_line": 10467,
+   "bytes": 507975,
+   "end_line": 10484,
    "id": "Q45",
    "line": 7594,
-   "lines": 2874,
+   "lines": 2891,
    "role": "opening",
    "role_detail": "",
    "status": "OPEN \u2014 awaiting Alexander's zoom/whole-shop answer; build is the pipe's.",