volt: Q138 -- re-render docs/TOOLS.md after the eleventh leg, pin the moved queue counts

docs/TOOLS.md drifted on two counts (ten legs, missing open-set row); tool_map.py --write now renders 23 tools / 11 gate legs. open_set.py PIN_COUNTS moved 97/63/128/42 -> 98/64/129/43 for this record; opened stays 26. Full gate 11/11 at the committed tree.

docs/TOOLS.md

@@ -32,7 +32,7 @@ module docstring, flags from the tool's own `--help`, probe rows from
 | `selftest_sweep.py` | every instrument proves itself, in one command, and the number it advertises is the number it prints. | `--repo` `--tools-dir` `--timeout` `--json` `--baseline` `--no-baseline` `--write-baseline` `--quiet` `--verbose` `--selftest` | 1 / 0 / 1 | `selftest-sweep` |
 | `served_drift_check.py` | does the host actually serve the tree at this revision? | `--root` `--rev` `--base-url` `--prefix` `--exclude` `--max-bytes` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
 | `tool_map.py` | the instruments get a map, and the map is generated from the tree. | `--repo` `--rev` `--write` `--check` `--json` `--selftest` | 1 / 0 / 1 | - |
-| `verify.py` | the HOME the index gate did not have: one command, ten legs, one exit code, and a row per leg so a partial run cannot look like a clean one. | `--repo` `--queue` `--index` `--checkin-day` `--fast` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
+| `verify.py` | the HOME the index gate did not have: one command, eleven legs, one exit code, and a row per leg so a partial run cannot look like a clean one. | `--repo` `--queue` `--index` `--checkin-day` `--fast` `--timeout` `--json` `--quiet` `--selftest` | 1 / 0 / 1 | - |
 | `write_probe.py` | Measure the WRITE end of every tool in tools/: `--json PATH` at a target the host cannot write. | `--repo` `--only` `--timeout` `--json` `--selftest` `--verbose` | 1 / 0 / 1 | `write-axis` |
 
 ## The gate
@@ -53,6 +53,7 @@ dropped by `--fast`.
 | `write-axis` | `write_probe.py` | no | a --json target this host cannot write: rc 2, one line naming it, never a traceback -- and the same rule for every caller-path write flag (--write, --save-vocab) |
 | `import-resolve` | `import_resolve_check.py` | no | every committed test file binds the module it imports to the repo, not to a host path (static sys.path scan plus --import-probe) |
 | `closed-artifacts` | `closed_artifact_guard.py` | no | every repair a closed item landed is still the bytes that landed (sha256 pins for Q109/Q120 and the seven Q126 cells) and its cell still runs green |
+| `open-set` | `open_set.py` | no | the work queue's declared open set and its record counts, graded against a pin (Q137: 0 open, 26 ever opened) |
 
 A tool that appears in no leg is still graded by `selftest-sweep`, which runs
 every tracked tool's `--selftest` and both read-refusal axes -- so the