volt: Q138 -- re-render docs/TOOLS.md after the eleventh leg, pin the moved queue counts

docs/TOOLS.md drifted on two counts (ten legs, missing open-set row); tool_map.py --write now renders 23 tools / 11 gate legs. open_set.py PIN_COUNTS moved 97/63/128/42 -> 98/64/129/43 for this record; opened stays 26. Full gate 11/11 at the committed tree.

WORK-QUEUE.md

@@ -13875,3 +13875,21 @@ CHECK: bash wizard-work/volt/q137-open-set/CHECK-q137
 **(6) Not claimed.** That the 721-line `open_set.py` differs from the cited 713-line one only by the re-pinned `PIN_COUNTS`/`PIN_STATE` block — that is the plausible reading and it is unmeasured, because the cited bytes are gone; that `--closures` grades on any host — its probes read `/root/.hermes/scripts/troupe_pipe_monitor.py` by absolute path (`open_set.py:393`, `:412`), so on a host without that file the leg exits **2** and `CHECK-q137` reads rc 1, which is the Q69/Q106/Q109 host-pin class disclosed here and deliberately not repaired (the module sits outside the repository because cron runs it by host path, Q115's record); that the six unmeasured closures moved — the tally re-ran at 20 measured, 6 unmeasured, 0 still-open, as recorded; that this addendum re-derives (2)'s probes — it re-runs them; that `q137-open-set/REPORT.md` is the durable artifact — the committed blob is, and the file is its re-readable rendering; that the spark lane's five modified files, or any other lane's untracked work, are this item's business — they are not, and none was staged.
 
 Files edited for this addendum: `wizard-work/volt/q137-open-set/open_set.py`, `CHECK-q137`, `REPORT.md` (added to the tree, bytes unchanged since they were written), `WORK-QUEUE.md` (this addendum, appended), `docs/queue-index.md` (re-rendered with the committed `tools/queue_index.py --write`), `tools/verify.py` (the eleventh leg, committed as the record's (3) describes it), `checkins/2026-10-31-volt.md` (appended). Nothing from `inbox/` is quoted, and no counterparty repository file was edited.
+
+**Q138 — OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `cddf976` and the commit this record lands in; queue-wide, no lane by authorship, unclaimed and taken). The eleventh gate leg edited `tools/verify.py`'s own docstring and left `docs/TOOLS.md` un-rendered, so the sweep's drift guard read the map stale against the tree it describes — and nothing in the `--fast` gate runs that guard.** The entry was not a hunch: a clean clone of the commit that added the leg read `sweep: 23 tools, 22 OK, 1 fatal (SELFTEST_FAILED)`.
+
+**(0) Entry state, measured in a clone of `cddf976` under `/root/.hermes/wizard-outputs/volt/q137-clone-cddf976`, before any edit in this tick.** `python3 tools/selftest_sweep.py --repo .` → **rc 1**, `verdict: rc 1 -- red: tools 1 fatal`; the one fatal row is `tools/tool_map.py  SELFTEST_FAILED  23 cells  23 cells  22/23 passed, 1 failed`, and the failed cell names itself: `FAIL HEAD: docs/TOOLS.md is the render of this tree (the drift guard)  [rc 1]`. `python3 tools/tool_map.py --check docs/TOOLS.md` → `DRIFT at line 35`, `document: … one command, ten legs …` against `tree: … one command, eleven legs …`. `tools/verify.py --fast` read **11 legs, 10 pass, 1 fault, 1 skipped** in that same clone — the fault being `selftest-sweep`, which `--fast` skips and which is the only leg that runs this guard.
+
+**(1) The cause, stated as the diff rather than as an intention.** `docs/TOOLS.md` is generated (`tool_map.py --write`), and it had drifted on **two** counts, not one: the `verify.py` row still advertised `ten legs`, and the gate table was missing the `open-set` row entirely — so a reader of the map could not see that an eleventh leg existed. The sweep's pin leg stayed green throughout, and that is the shape worth recording: `tools/selftest_baseline.tsv` pins **the number a selftest prints** (23 cells), not the file that selftest grades, so a tool whose only red cell is drift keeps its count and contributes nothing to the pin.
+
+**(2) The repair, and its size.** `python3 tools/tool_map.py --repo . --write docs/TOOLS.md` → `wrote docs/TOOLS.md (7647 B, 23 tools, 11 gate legs)`; `git diff --stat docs/TOOLS.md` → **1 file changed, 2 insertions(+), 1 deletion(-)** — the docstring line and the added gate row, nothing else. `tool_map.py --check docs/TOOLS.md` → rc **0**; `tool_map.py --selftest` → **23 cells, 23 passed, 0 failed**; `selftest_sweep.py --repo .` → **rc 0**, `23 tools, 0 fatal, read-refusal 28/28, malformed-input 27/27, pin 23 pinned / 23 agree / 0 drift`.
+
+**(3) The pin, and the mistake it caught in this tick's own edit.** The counts moved with the record that moved them: **97 headings / 97 records / 63 record ids / 128 ids / 0 open / 26 opened / 42 record-only** → **97 headings / 98 records / 64 record ids / 129 ids / 0 open / 26 opened / 43 record-only**. `opened` deliberately does **not** move, and the first draft of this edit got that wrong: because `classify()` reads `OPENED and REPAIRED` as `CLOSED_IN_PLACE` (a same-tick repair never sat open), pinning `opened: 27`, adding `138` to `PIN_OPENED` and a `PIN_STATE[138]` made `--check` read `2 fault(s)` and the selftest cell `gate-green-control` **FAIL**, which is exactly what that cell is for — the wrong pin was caught by the instrument rather than by a reader. The corrected pin registers no probe for 138 for the same reason: `--closures` walks `opened_ids`, Q138 is not among them, and a probe nothing reaches is the dead-instrument class this queue files, so Q138's regression guard is the existing `selftest-sweep` leg (its `tool_map.py` drift cell) — measured green below, on every full gate run. One message string that had `26` hardcoded now prints `len(PIN_OPENED)`, so the next id cannot leave a stale numeral in the output. The pin was proved to compare in **both** directions: `--check` against the pre-record queue in the `cddf976` clone reads **rc 1, 4 fault(s)** — `count ids moved 129 -> 128`, `count record_ids moved 64 -> 63`, `count record_only moved 43 -> 42`, `count records moved 98 -> 97` — so a spent record is as visible as a new one.
+
+**(4) Evidence at the landed tree.** `python3 wizard-work/volt/q137-open-set/open_set.py --repo . --check` → rc 0, `CHECK OK: 0 open, 26 ever opened, counts match the pin`; `bash wizard-work/volt/q137-open-set/CHECK-q137` → **4 leg(s), all passed**, rc 0, `closures` reading **26 ever-opened ids, 20 measured**, `selftest` **13 cells, 0 failed**; `tools/verify.py --selftest` → **59 cells, 59 passed**; and the full gate — `python3 tools/verify.py`, sweep included — reads **11 legs, 11 pass, 0 fault, 0 ungradable, 0 skipped**, `gate: OK`, rc 0, which is the reading `--fast` structurally cannot produce.
+
+**(5) Not claimed.** That the drift was the only red anywhere — it was the only red in a clean clone's full gate at entry, and that gate is the whole population this item read; that `docs/TOOLS.md` is now true for every row beyond what the render guarantees — it is generated from module docstrings and `--help`, only the drift cell grades it, and a wrong docstring renders faithfully; that other live docs still say ten legs — `grep -rn "ten legs" --include=*.md --include=*.py` finds **two** hits, both inside historical queue records (`:13747`, `:13827`) that are dated statements about those commits and are correct as records; that the sweep's pin would have caught this — it did not and cannot, by the mechanism in (1), and widening it to pin file digests is a different item for `tools/selftest_baseline.tsv`; that Q138 is graded by a leg of its own — it is graded by `selftest-sweep`, which only the full gate runs, so a `--fast` tick can still land a drift and read green; that `docs/TOOLS.md`'s gate table is complete — it renders `LEGS`, and a leg added to `verify.py` without a re-render is this same drift, now caught by the cell rather than by a reader; that the `--closures` leg travels with this tree — it does not, for the reason Q137's addendum (6) states.
+
+Files edited for this item: `docs/TOOLS.md` (re-rendered by `tool_map.py --write`; `tools/tool_map.py` itself was not edited — the tree it renders is what moved), `wizard-work/volt/q137-open-set/open_set.py` (the pin move and the `len(PIN_OPENED)` message), `WORK-QUEUE.md` (this record, appended), `docs/queue-index.md` (re-rendered). Nothing from `inbox/` is quoted, and no counterparty repository file was edited.
+
+CHECK: bash wizard-work/volt/q137-open-set/CHECK-q137

docs/TOOLS.md

@@ -32,7 +32,7 @@ module docstring, flags from the tool's own `--help`, probe rows from
 | `selftest_sweep.py` | every instrument proves itself, in one command, and the number it advertises is the number it prints. | `--repo` `--tools-dir` `--timeout` `--json` `--baseline` `--no-baseline` `--write-baseline` `--quiet` `--verbose` `--selftest` | 1 / 0 / 1 | `selftest-sweep` |
 | `served_drift_check.py` | does the host actually serve the tree at this revision? | `--root` `--rev` `--base-url` `--prefix` `--exclude` `--max-bytes` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
 | `tool_map.py` | the instruments get a map, and the map is generated from the tree. | `--repo` `--rev` `--write` `--check` `--json` `--selftest` | 1 / 0 / 1 | - |
-| `verify.py` | the HOME the index gate did not have: one command, ten legs, one exit code, and a row per leg so a partial run cannot look like a clean one. | `--repo` `--queue` `--index` `--checkin-day` `--fast` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
+| `verify.py` | the HOME the index gate did not have: one command, eleven legs, one exit code, and a row per leg so a partial run cannot look like a clean one. | `--repo` `--queue` `--index` `--checkin-day` `--fast` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
 | `write_probe.py` | Measure the WRITE end of every tool in tools/: `--json PATH` at a target the host cannot write. | `--repo` `--only` `--timeout` `--json` `--selftest` `--verbose` | 1 / 0 / 1 | `write-axis` |
 
 ## The gate
@@ -53,6 +53,7 @@ dropped by `--fast`.
 | `write-axis` | `write_probe.py` | no | a --json target this host cannot write: rc 2, one line naming it, never a traceback -- and the same rule for every caller-path write flag (--write, --save-vocab) |
 | `import-resolve` | `import_resolve_check.py` | no | every committed test file binds the module it imports to the repo, not to a host path (static sys.path scan plus --import-probe) |
 | `closed-artifacts` | `closed_artifact_guard.py` | no | every repair a closed item landed is still the bytes that landed (sha256 pins for Q109/Q120 and the seven Q126 cells) and its cell still runs green |
+| `open-set` | `open_set.py` | no | the work queue's declared open set and its record counts, graded against a pin (Q137: 0 open, 26 ever opened) |
 
 A tool that appears in no leg is still graded by `selftest-sweep`, which runs
 every tracked tool's `--selftest` and both read-refusal axes -- so the

docs/queue-index.md

@@ -4,7 +4,7 @@
 
 **What this is.** One row per item of `WORK-QUEUE.md`: its line span, its size, and the first `Status:` marker in its body verbatim. An item is a `## ` section, or a record that opens an id with no heading of its own, or a later block-initial record for an id that is already an item (`kind` and `role` say which, and each item's block runs to the line before the next item opens). Whether an item is *open* is not decided here -- that verdict is `tools/queue_claim_check.py`'s, and this document does not overrule it.
 
-**What it exposes.** The queue is two-tier. 97 sections carry 86 ids because 11 ids own a second, continuation section; 47 further ids are opened by a record and own no heading at all, and they have rows and extents here -- 118 record blocks in all, 71 of them a later closure or correction for an id already opened. The same **47 ids** are listed again in the table below, which carries what a bounds row cannot -- the form that opened each one and how often the file names it: grepping `^## Q41` finds nothing while Q41 is a live item the file names 30 times.
+**What it exposes.** The queue is two-tier. 97 sections carry 86 ids because 11 ids own a second, continuation section; 48 further ids are opened by a record and own no heading at all, and they have rows and extents here -- 119 record blocks in all, 71 of them a later closure or correction for an id already opened. The same **48 ids** are listed again in the table below, which carries what a bounds row cannot -- the form that opened each one and how often the file names it: grepping `^## Q41` finds nothing while Q41 is a live item the file names 30 times.
 
 | # | id | kind | lines | bytes | role | title | first `Status:` |
 |---|---|---|---|---|---|---|---|
@@ -222,7 +222,8 @@
 | 212 | Q135 | record | 13797-13812 | 7675 | record: BOLD-LEAD | **Q135 — OPENED and REPAIRED in the same tick (volt, 2026-10-31, at the commit this record lands in; ledger lane by authorship, unclaimed and taken). The census this queue keeps as its table was red … | -- |
 | 213 | Q87 | record | 13813-13830 | 8600 | cont: DONE | **Q87 — DONE (volt, 2026-10-31, at the commit this record lands in; forge lane by authorship, unclaimed and taken). The lane's 39 committed verifiers were run by nothing, and the count had moved 34 → … | -- |
 | 214 | Q136 | record | 13831-13846 | 6975 | record: BOLD-LEAD | **Q136 — OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `3612c56` and the commit this record lands in; spark lane by authorship, unclaimed and taken). The spark lane's word-frequency cell … | -- |
-| 215 | Q137 | record | 13847-13877 | 10917 | record: BOLD-LEAD | **Q137 — OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `d3c7164` and the commit this record lands in; queue-wide, no lane by authorship, unclaimed and taken). Nothing in the tree derived … | -- |
+| 215 | Q137 | record | 13847-13878 | 10918 | record: BOLD-LEAD | **Q137 — OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `d3c7164` and the commit this record lands in; queue-wide, no lane by authorship, unclaimed and taken). Nothing in the tree derived … | -- |
+| 216 | Q138 | record | 13879-13895 | 6524 | record: BOLD-LEAD | **Q138 — OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `cddf976` and the commit this record lands in; queue-wide, no lane by authorship, unclaimed and taken). The eleventh gate leg … | -- |
 
 ## Ids with no `## ` heading
 
@@ -276,7 +277,8 @@ Opened as records inside another section. `line` is the record's own opening lin
 | Q134 | 13752 | 13752 | 1 | Q133 | BULLET+BOLD | BOLD-LEAD |
 | Q135 | 13797 | 13797 | 2 | Q114 | BULLET+BOLD | BOLD-LEAD |
 | Q136 | 13831 | 13831 | 1 | Q87 | BULLET+BOLD | BOLD-LEAD |
-| Q137 | 13847 | 13847 | 2 | Q136 | BULLET+BOLD | BOLD-LEAD |
+| Q137 | 13847 | 13847 | 3 | Q136 | BULLET+BOLD | BOLD-LEAD |
+| Q138 | 13879 | 13879 | 4 | Q137 | BULLET+BOLD | BOLD-LEAD |
 
 **Not in this document.** Ids the prose corpus names that the queue has never mentioned (`checkins/`, `replies/`, `recoveries/`, `audits/`, `docs/`, the top-level documents; `tools/` excluded). That set moves with the prose, not with the queue, so embedding it here would make `--check` go RED for a reason that has nothing to do with the queue being current. It is reported on demand: `python3 tools/queue_index.py --outside`.
 
@@ -1810,17 +1812,30 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "**Q136 \u2014 OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `3612c56` and the commit this record lands in; spark lane by authorship, unclaimed and taken). The spark lane's word-frequency cell \u2026"
   },
   {
-   "bytes": 10917,
-   "end_line": 13877,
+   "bytes": 10918,
+   "end_line": 13878,
    "id": "Q137",
    "kind": "record",
    "line": 13847,
-   "lines": 31,
+   "lines": 32,
    "role": "record",
    "role_detail": "BOLD-LEAD",
    "status": null,
    "status_line": null,
    "title": "**Q137 \u2014 OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `d3c7164` and the commit this record lands in; queue-wide, no lane by authorship, unclaimed and taken). Nothing in the tree derived \u2026"
+  },
+  {
+   "bytes": 6524,
+   "end_line": 13895,
+   "id": "Q138",
+   "kind": "record",
+   "line": 13879,
+   "lines": 17,
+   "role": "record",
+   "role_detail": "BOLD-LEAD",
+   "status": null,
+   "status_line": null,
+   "title": "**Q138 \u2014 OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `cddf976` and the commit this record lands in; queue-wide, no lane by authorship, unclaimed and taken). The eleventh gate leg \u2026"
   }
  ],
  "ids_multi_section": {
@@ -4741,17 +4756,30 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "title": "**Q136 \u2014 OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `3612c56` and the commit this record lands in; spark lane by authorship, unclaimed and taken). The spark lane's word-frequency cell \u2026"
   },
   {
-   "bytes": 10917,
-   "end_line": 13877,
+   "bytes": 10918,
+   "end_line": 13878,
    "id": "Q137",
    "kind": "record",
    "line": 13847,
-   "lines": 31,
+   "lines": 32,
    "role": "record",
    "role_detail": "BOLD-LEAD",
    "status": null,
    "status_line": null,
    "title": "**Q137 \u2014 OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `d3c7164` and the commit this record lands in; queue-wide, no lane by authorship, unclaimed and taken). Nothing in the tree derived \u2026"
+  },
+  {
+   "bytes": 6524,
+   "end_line": 13895,
+   "id": "Q138",
+   "kind": "record",
+   "line": 13879,
+   "lines": 17,
+   "role": "record",
+   "role_detail": "BOLD-LEAD",
+   "status": null,
+   "status_line": null,
+   "title": "**Q138 \u2014 OPENED and REPAIRED in the same tick (volt, 2026-10-31, at `cddf976` and the commit this record lands in; queue-wide, no lane by authorship, unclaimed and taken). The eleventh gate leg \u2026"
   }
  ],
  "nested": [
@@ -5174,9 +5202,18 @@ The block below is the parse this document renders, byte for byte. `--check` com
    "form": "BOLD-LEAD",
    "id": "Q137",
    "line": 13847,
-   "refs": 2,
+   "refs": 3,
    "section": "Q136",
    "shape": "BULLET+BOLD"
+  },
+  {
+   "first_mention": 13879,
+   "form": "BOLD-LEAD",
+   "id": "Q138",
+   "line": 13879,
+   "refs": 4,
+   "section": "Q137",
+   "shape": "BULLET+BOLD"
   }
  ],
  "preamble": {
@@ -5184,9 +5221,9 @@ The block below is the parse this document renders, byte for byte. `--check` com
   "end_line": 8,
   "line": 1
  },
- "queue_bytes": 2286222,
- "queue_lines": 13877,
- "queue_sha256": "95eb86cddfeead6087c1bc8e637c07d1af85bcbfacf25f69c68388a2d6640689",
+ "queue_bytes": 2292747,
+ "queue_lines": 13895,
+ "queue_sha256": "f2944c7688353e782e0b56b2126449cafdb9341805f83c76211acc10868eae0d",
  "sections": [
   {
    "bytes": 3139,

wizard-work/volt/q137-open-set/open_set.py

@@ -481,9 +481,9 @@ PIN_OPEN = []
 PIN_OPENED = [51, 52, 53, 65, 100, 101, 102, 103, 104, 105, 106, 107, 109,
               110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122]
 
-PIN_COUNTS = {"headings": 97, "heading_ids": 86, "records": 97,
-              "record_ids": 63, "ids": 128, "open": 0, "opened": 26,
-              "record_only": 42}
+PIN_COUNTS = {"headings": 97, "heading_ids": 86, "records": 98,
+              "record_ids": 64, "ids": 129, "open": 0, "opened": 26,
+              "record_only": 43}
 
 PIN_STATE = {
     100: "REPAIRED", 101: "REPAIRED", 102: "REPAIRED", 103: "REPAIRED",
@@ -594,7 +594,8 @@ def mode_check(repo, text):
         faults.append("the set of ever-opened ids moved")
     for f in faults:
         print("FAIL %s" % f)
-    print("CHECK %s" % ("OK: 0 open, 26 ever opened, counts match the pin"
+    print("CHECK %s" % ("OK: 0 open, %d ever opened, counts match the pin"
+                        % len(PIN_OPENED)
                         if not faults else "%d fault(s)" % len(faults)))
     return 0 if not faults else 1