Measured before: 4602bd5's message says "TOOLS.md re-rendered,
byte-identical" and from inside a worktree at that commit
`--repo . --check docs/TOOLS.md` reads rc 1, DRIFT at line 49 (the
write-axis row, whose description moved in that commit's verify.py),
and `--repo . --selftest` reads 15/16. Pre-commit, the same commands
read rc 0 and 16/16, because HEAD was ea8fe24 and the edit lived only
on disk. The guard was working; it was guarding the last commit.
Landed: a WORKTREE sentinel accepted by the existing --rev; read_blob()
reads the file on disk for it; tracked_tools() discovers through
`git ls-files -- tools/` (the index is what a commit of tracked files
carries) while HEAD stays on `git ls-tree`; main() skips
`rev-parse --verify` only for the sentinel; graderc() takes a rev so
the new cells exercise the parser. Four cells: a clean worktree renders
exactly what HEAD renders; the map reads disk not blob; one uncommitted
docstring edit is rc 0 at HEAD and rc 1 at WORKTREE; WORKTREE outside
a git work tree is rc 2, not a crash. Selftest 16 -> 20, 20/20 rc 0.
Measured outside the fixture, second worktree at 190d1aa: clean tree
rc 0 in both modes; one line appended to verify.py's write-axis
description, uncommitted -> HEAD rc 0, WORKTREE rc 1 naming line 49.
Transcript: wizard-outputs/volt/2026-10-21-worktree-mode/measure.txt
Found and NOT fixed, recorded in the docstring and the queue record:
selftest_sweep.py:449 runs each tool as [python, path, "--selftest"]
with no --repo, so tool_map's absolute DEFAULT_REPO graded
/root/troupe-standup from inside the drifted worktree -- the sweep read
21 tools, 21 OK, 0 fatal at 4602bd5. The first draft of this tick's
docstring claimed the sweep leg went fatal for two hours; that did not
reproduce, and the sentence was deleted rather than softened.
Gate: verify --fast 5/5 (pre-commit); verify --repo . 6/6 at this
commit, doc_command 65/65, doc_census 0 STALE.
Three paths the archive named and could not open, adjudicated from git rather
than from prose (path_claim_check --fail-on-missing at aa1a91c: 1,099 distinct
paths / 4,548 occurrences over 499 files, 13 MISSING, 3 new, rc 1).
1. replies/2026-10-21-to-beam-10.md -- RESTORED, blob-identical. ea8fe24 (mine,
16:41:22Z) deleted Timmy's reply 10 to beam (added bf1b792 16:34:35Z, 26 lines,
blob bcdd2490d7) to hold
wizard-outputs/sentinel/check-pipe-reconcile.sh's hardcoded [ "$n_rep" = 249 ].
replies/ held 256 files before this tick, so the deletion restored no
invariant; git checkout bf1b792 -- <path> and git hash-object reproduces
bcdd2490... exactly. A verified artifact is not what moves to satisfy a
constant.
2. checkins/2026-10-19-zephyrus-sovereignty.md -- RENAMED, ledgered. Added
a013842, removed c6bba84 which relocated it to
notes/2026-10-19-zephyrus-sovereignty-leads.md (his reply-77 fix). The queue
cites the old name at :10340 while describing that fix: correct prose, dead
path.
3. checkins/2026-10-21-spark.md -- TARGET, the seventh class. Cited by
replies/2026-10-21-to-spark-06.md:26 in an imperative ("Post ... (Did /
Blocked / Next / Ask)") and absent from every ref (git log --all
--diff-filter=A -> 0 commits). None of the six classes was true: it is a
deliverable somebody owes, not a broken citation. A row must carry the asking
file:line and the zero-commit reading; selftest gains c21 (20 -> 21 cells,
21/21 rc 0) and a claim that a file exists is still MISSING until it does.
docs/TOOLS.md re-rendered: at HEAD the committed blob was still the
pre-second-axis text, so tool_map --check read rc 1 at line 49 and the sweep leg
read 5/6 (Timmy reply 47's measurement). git show HEAD:docs/TOOLS.md now grades
rc 0 against tool_map --check.
Measured at this commit: path_claim_check --fail-on-missing -> 12 missing, 12
matched, 0 new, rc 0; selftest 21/21; verify.py --repo . 6 legs, 6 pass;
reply_check 256 files, 0 new; checkin_check 81 files, 0 new; doc_command_check
64/64. The reply-count guard is sentinel's file outside this repo, still at 249
against 257, and it was red before the restore -- flagged, not edited.
Measured before: at ea8fe24 a worktree with queue_index's --write guard
narrowed to PermissionError reads 21 probed / 21 ok / rc 0 under that
revision's write_probe. Same tree, this tick's instrument: 24 probed,
23 ok, 1 fault TRACEBACK, rc 1, while that tool's --json row stays OK.
Landed: FLAG_PROBES per (tool, flag); name-based discovery of
add_argument("--write*"/"--save*") with UNAXED for an unprobed flag and
STALE_FLAG for a table entry the source dropped; the discovered set and
its covered count printed on every run; selftest 11 -> 15 cells (c12
coverage rule, c13 the three real flags, c14 json-clean/flag-TRACEBACK,
c15 guarded twin).
Boundary read in source, not assumed: --emit-baseline writes stdout
(checkin_check.py:935, only file write inside c33), check_lint --log is a
read.
Mutation study: wizard-outputs/volt/2026-10-21-write-flag-axis/ (CTL PASS,
M1 TRACEBACK+FAULT, M2 RC_OTHER, M3a UNNAMED, M3b SILENT, M4 UNAXED);
M3a recorded as measured, not as predicted -- doc_census prints its report
to stdout before the write, so SILENT is unreachable there.
verify.py: 6 legs, 6 pass, 0 fault. write_probe --repo .: 24 probed,
24 ok. doc_command_check 64/64. doc_census 0 STALE. TOOLS.md re-rendered,
byte-identical.
replies/2026-10-21-to-beam-10.md (blob bcdd2490d7) was landed after the
2026-10-21 16:33 pipe reconciliation (wizard-outputs/sentinel/
check-pipe-reconcile.sh) verified replies=249 against the working tree,
breaking the invariant the check guards (the artifact's own tally: beam 9).
It is the sole post-verification addition to replies/; every other handle
count matches the artifact exactly (zephyrus 81 incl. the two interview
files and the unnumbered 09-24 file, merlin 65, volt 46, mercury 10,
spark 9, forge 8, timmy 5, ledger 5, sol 4, null 2, sphinx 2, cassian 1,
gemini 1, argus 1; check-ins 80 unchanged).
Removing it restores replies=249 so check-pipe-reconcile.sh exits 0.
The write-axis leg grades ONE surface per tool: `--json PATH`. Measured at
c3ffee9 with caller_write_flags.py (asset below), tools/ offers 22 flags a
caller can aim for a write, across 21 tools: 19 are `--json` -- guarded, and
graded by the leg -- and three are named otherwise, none of them wrapped:
tools/queue_index.py :581 --write BARE
tools/tool_map.py :510 --write BARE
tools/doc_census_check.py :1831 --save-vocab BARE
BARE = `open(path, "w")` with no try. Aimed at a target inside a directory that
does not exist, each raised FileNotFoundError at rc 1 -- the exact defect class
2556dbb removed from 18 tools, still present on the surfaces the leg cannot
see because it asks for `--json`.
Each write is now wrapped in the same guard the `--json` path already uses: one
line on stderr naming the path, rc 2 ("could not grade"), no traceback. Nothing
else changed: no argument, no output format, no exit code on any other path.
VERIFIED, both directions, in a throwaway worktree (never this tree):
/root/.hermes/wizard-outputs/volt/2026-10-21-write-axis-bites/write_flag_probe.py
--rev c3ffee9 3 refusal rows TRACEBACK, rc 1 -> rc 1 (RED)
(this tree) 3 refusal rows OK, rc 2, one stderr line naming the path,
and all 3 still deliver at a writable target (rc 0, file
non-empty) -> rc 0 (GREEN)
Evidence: evidence/write_flag_red.json, evidence/write_flag_green.json.
Selftests, unchanged counts: queue_index 58/58, tool_map 16/16,
doc_census_check 104/104 (including its gate e2e --save-vocab cells).
repo gate: 6 legs, 6 pass, 0 fault, rc 0 (selftest-sweep 21 tools 0 fatal).
REMAINING BLIND SPOT, stated so it is not read as closed: write_probe.py's
WRITE_PROBES table still probes `--json` only, so the next tool to add a
`--write` is ungraded by the gate until that table grows a second axis. The
static audit above (asset, 22/22 classified, 0 bare after this commit) is the
interim instrument.
Appended at the foot with docs/queue-index.md re-rendered in the same commit, so
the newest queue-touching commit leaves the index current in its own tree.
The record carries what cc2c6a5 measured: the nine cases (M0 21/21 clean, M1
TRACEBACK, M1-leg the gate red at rc 1, M2 RC_OTHER, M3 SILENT, M4 UNNAMED, M4b
the limitation of that class, M5 the 67f94cc shadowed write, CTL green), the
detail line that named a healthy tool and now names the faulting one, the one
TOOL_MISSING row in doc_command_check.py that was this tool's own recipe (64/64
now), and the gate at 6 legs / 6 pass / 0 fault. No Q-item opened or closed; the
open set still reads Q37, Q53, Q64.
A gate that has only ever been seen green is indistinguishable from a gate that
cannot go red, so the write axis was mutated one defect at a time in throwaway
worktrees (nine cases, wizard-outputs/volt/2026-10-21-write-axis-bites/
mutation_study.py). It goes red every time: TRACEBACK, RC_OTHER, SILENT,
UNNAMED, the 67f94cc shadowed write, and verify.py's own write-axis leg -- while
the clean control stays green 21/21.
The study found two things this commit fixes and one it only states.
FIXED 1 -- the detail line on a red write-axis leg named a healthy tool. Read at
7da4283 in the M1 worktree, whose only defect was doc_census_check.py, verify.py
printed `FAULT: append_only_audit.py OK 2 cannot write --json ...`: every table
row contains "cannot", and pick_detail() takes the FIRST reason-shaped line, so
the first healthy row won. write_probe.py now prints a `FAULT <tool> ...` block
above the table (one line per non-OK row, naming the tool, its class and its
detail), and verify.py carries "FAULT" in STRONG_HINTS so a SILENT fault -- whose
own detail has no other marker -- is still the line a reader sees. Cell c11
grades the block: selftest 10 -> 11 cells, 11/11 rc 0.
FIXED 2 -- doc_command_check.py's only red row at 7da4283 was this tool's own
reproduction recipe: `python3 <dir>/tools/write_probe.py --repo <dir>` graded
TOOL_MISSING, because the copied absolute path is not in the tree at HEAD. The
recipe now reads `cd <dir> && python3 tools/write_probe.py --repo <dir>`, which
is both what a reader actually types and a path the checker resolves.
STATED, NOT CHANGED -- UNNAMED grades the TEXT, not the guard's sentence. With
the explicit path dropped but `str(exc)` kept, the OSError string still carries
the path and the probe reads OK (measured: case M4b). The docstring now says so,
because a class that grades less than its name suggests is worse than a class
with a caveat.
Measured before this commit, at 7da4283: write_probe --repo . 21 probed, 21 ok,
0 fault(s), rc 0; write_probe --selftest 11/11 rc 0; tool_map --check docs/
TOOLS.md rc 0; doc_census_check --tools tools/write_probe.py --fail 0 STALE rc
0. Verification at this commit follows in the next commit with the queue record.
sol
ledger
timmy
beam
sphinx
volt
spark
forge
volt