Stop the crate root counting the types that hold something, and anchor the command that counts the block

[iderex]

The issue this belongs to

Closes #434

What changed

The crate root's paragraph about the compile-time thread assertions stops counting
the types that hold something, and the command it hands a reader to derive the list
is anchored so that it counts the block rather than itself.

The paragraph said "One of them holds something now" and named
measurement::Measurement. Measurement stays as the example; what goes is the
count. In its place the comment records what it said, why the number went stale,
and that nine of the types asserted below carry a borrowed parameter and therefore
hold a reference in the same sense - written as a floor rather than as a
population, because a type does not need a lifetime to hold a field.

The command gained a ^ anchor. An assertion is indented inside the block and
the doc-comment line quoting the command is not, so the anchor is what keeps that
line out of its own answer.

What failure it prevents

A reader sizing what a green build proves about thread safety here. The closing
sentence of the paragraph says an assertion over a type holding nothing cannot fail
on the bytes in this tree, and it is there so that the day the type holds something
is the day the compiler starts judging it. With "one of them" standing above it,
that reads as a block of empty names waiting for a day that has not come. The day
has come for at least nine of them.

This is a correction rather than a new guard, and both halves had already happened.
The count was right when it landed on 2026-08-26 over five assertions and has been
wrong since the block grew. The command was off by one on the day it arrived.

How it was found: reading the paragraph against the block under it. Nothing in this
tree would have said so.

git grep -n "ls-files '\*\.md'" origin/main -- .github/doc-paths/doc-paths.sh
origin/main:.github/doc-paths/doc-paths.sh:440:  git ls-files '*.md'

doc-paths reads Markdown and never opens a Rust file, so a count in a doc comment
is read by nothing here.

Evidence

All readings at the commit pushed, f4a03c540408c4180e742ce02d38af8c466c7f80,
except where a historical commit is named.

The block, and what the two forms of the command answer against it:

git grep -c '^    any_thread::<' -- src/lib.rs
src/lib.rs:145
git grep -c 'any_thread::<' -- src/lib.rs
src/lib.rs:146

145 is the block. The unanchored form still answers 146 at this commit, because the
doc-comment line quoting the anchored command still carries the substring, which is
the whole reason the anchor is there.

Where the count came from, and what the block was then:

git log origin/main --format='%h %ad %s' --date=short -S'One of them holds something now' -- src/lib.rs
a22c8bd 2026-08-26 Build the measurement facility every subsystem shares (#61) (#196)
git show a22c8bd:src/lib.rs | grep -c '^    any_thread::<'
5

Where the command came from, and that it was already one too many:

git log origin/main --format='%h %ad %s' --date=short -S"git grep -c 'any_thread::<'" -- src/lib.rs
fbf90a1 2026-08-27 Fix the unit a playback position is expressed in, and refuse an unstated one
git show fbf90a1:src/lib.rs | grep -c 'any_thread::<'
15
git show fbf90a1:src/lib.rs | grep -c '^    any_thread::<'
14

The nine the comment now names, and three of the eight that are not Measurement:

git grep -oE "any_thread::<[^;]*<'static>>" -- src/lib.rs | sed 's/^[^:]*://' | sort
any_thread::<cache::bound::TieredCache<'static>>
any_thread::<cache::envelope::Entries<'static>>
any_thread::<diagnostics::Diagnostics<'static>>
any_thread::<lifecycle::Supplied<'static>>
any_thread::<measurement::Measurement<'static>>
any_thread::<playback::handover::Preferences<'static>>
any_thread::<server::certificate::PresentedChain<'static>>
any_thread::<server::certificate::Refused<'static>>
any_thread::<server::federation::Federation<'static>>

sed -n '/^pub struct Entries/,/^}/p' src/cache/envelope.rs
pub struct Entries<'a> {
    cache: &'a TieredCache<'a>,
    diagnostics: &'a Diagnostics<'a>,
    drops: Drops,
}
sed -n '/^pub struct Supplied/,/^}/p' src/lifecycle/mod.rs
pub struct Supplied<'a> {
    byte_store: Option<&'a dyn ByteStore>,
    secret_store: Option<&'a dyn SecretStore>,
    diagnostics_sink: Option<&'a dyn DiagnosticsSink>,
}
sed -n '/^pub struct Federation/,/^}/p' src/server/federation.rs
pub struct Federation<'a> {
    clocks: &'a dyn Clocks,
    acts: Mutex<Vec<Act>>,
    next_id: AtomicU64,
}

The diff is one file and one comment block:

git diff --stat origin/main...HEAD
 src/lib.rs | 37 +++++++++++++++++++++++++++++++------
 1 file changed, 31 insertions(+), 6 deletions(-)

The runs, at this commit. cargo build --locked --all-targets and
cargo test --locked both finish without error; the suite's own totals:

cargo test --locked 2>&1 | grep -c '^test result: ok'
10

Ten result lines, all reading ok. A run that collected nothing would print a
result line too, which is what .github/test/test.sh refuses on the gate; that leg
was not run here.

bash .github/format/format.sh check | tail -1
Every tracked source file above is written the way the formatter would write it.
bash .github/lint/lint.sh check | tail -1
Every lint the groups above carry was refused, outside the register printed with it.
bash .github/doc-paths/doc-paths.sh check | tail -1
Every path these documents name resolves against the tracked set.
bash .github/invariants/invariants.sh check | tail -1
Every rule above was applied to its subject and refused nothing.

What this does not cover

• No assertion, type or field changes. No any_thread line is added or removed
  and no declaration is touched, so what the compiler judges is what it judged
  before this change. The diff is a doc comment.
• How many of the 145 hold something. Nine is what a command settles, and it is
  written into the comment as a floor. Counting the rest needs a reading of every
  declaration, and a number from such a reading typed into this file is the thing
  the issue is about.
• No guard is added. Nothing in this tree compares a count written into a doc
  comment against what it counts, and nothing here builds one. doc-paths reads
  git ls-files '*.md' and widening it to Rust is not asked for here.
• .github/shell-analysis/shell-analysis.sh was NOT run. shellcheck is not on
  this machine, and the script says so rather than passing. No shell file is touched
  by this change and the gate runs that leg.
• No cross-toolchain, target, coverage, mutation or thread-detector leg was run
  here. Those run on the gate.
• The directory counts further up the same file are README.md and src/lib.rs both count three directories beside the six, and the tree carries four #322's and are untouched;
  they read correctly against the tree at this commit.

Who has read it

Nobody other than the author. There is no second reader on this board tonight, and
the evidence above stands in place of one rather than the question being left open.