fix(spec): shard the generated liveness and strictness counts so PRs moving different units stop conflicting on a committed total

[objectstack-fleet]

Fixes #20361
Clause-②: no

What changed

• Liveness counts are sharded. gen:liveness-counts writes packages/spec/liveness/state-counts/TYPE.md, one shard per governed type (40). Each shard carries only its own row. packages/spec/liveness/state-counts.md is deleted. No total is committed anywhere. check:liveness sums the shards at read time, prints the sum on its success line, and carries it in --json as countsTotal. The generator prints the sum too.
• Strictness-ledger counts are sharded the same way, because a measurement showed the same shared-total shape (see below). gen:strictness-ledger writes docs/audits/2026-07-unknown-key-strictness-ledger.counts/DIR.md, one shard per packages/spec/src directory with object sites (5 triaged, 9 untriaged). The global section, the posture total row and the global bucket split are summed at read time by check:strictness-ledger and gen:strictness-ledger, and committed nowhere. The single ….counts.md is deleted.
• Both gates reconcile shard by shard. They name a MISSING directory or shard, a STALE shard (with the shard's path and its first differing line), a STRAY file that no unit renders, and the RETIRED single file if a merge brings it back. Both generators rewrite only the shards whose bytes moved, prune strays, and delete the retired file. These are new legs inside the two existing gates; ⛔ no new gate or check: script was added. The text-shard read/write/reconcile helpers live in packages/spec/scripts/lib/sharded-artifacts.ts and serve both artifacts.
• Routing. .gitattributes, scripts/regen-artifacts.mjs and packages/spec/scripts/check-generated.ts route the two directories (…/** with merge=os-regen), so the local driver still owns a same-unit collision.
• Readers of the retired names. Updated: the liveness README (the two paragraphs that linked the file, and the connector Notes cell that named it), the _note of liveness/book.json and of liveness/translation.json, and seven links in the strictness ledger. Those links now point at the shards; the per-directory anchors (#ui--open and the rest) keep working inside each shard.

Measured before the change

Dispatch base 2b24b8b823. Probe: a bare --shared clone with no merge driver registered (git config --get merge.os-regen.driver exits 1). Each side was regenerated with the real generator and committed, then git merge-tree --write-tree --name-only was run on the pair.

pair	result
liveness: field.useGrouping planned→dead vs sharing_rule.type planned→live	exit 1, CONFLICT (content) in state-counts.md. The two rows are 36 lines apart; the only overlap is the total row.
liveness: field.useGrouping planned→dead vs sharing_rule.type planned→dead (equal delta)	exit 0 and WRONG. The merged total reads dead 149 / planned 8; the two moves make 150 / 7.
strictness: 1 strict site added in ui/ vs 2 added in data/	exit 1, CONFLICT (content) in ….counts.md. Both .zod.ts sources merged clean.

Measured after the change

The same probe on branch head 1be2134dc1, with the real generators.

pair	result
liveness: planned→dead vs planned→live (the conflicting pair above)	exit 0. Each side touched only its own shard.
liveness: equal delta (the clean-but-wrong pair above)	exit 0. The merged tree was materialised: check:liveness exits 0 on it, and its read-time total is 150 dead · 7 planned, which is correct.
liveness: two moves of field	exit 1, conflict on state-counts/field.md only. This residue is expected and the local driver owns it.
strictness: ui/ vs data/	exit 0
strictness: two moves in ui/	exit 1 on ….counts/ui.md (plus the shared source file)

The pin is packages/spec/scripts/count-shards-merge.test.ts. It builds a throwaway repository with the real attribute line and no driver, commits each real renderer's output, and asks git merge-tree:

• pairs that move different units (different deltas, equal deltas, adjacent liveness rows, adjacent untriaged directories) merge clean, and the merged tree equals the regeneration of both moves;
• a same-unit pair conflicts on that unit's shard and nowhere else. This is the lit control.

Parity

• Liveness. The sum of the 40 shards equals the total the single file committed: 940/5/1/148/9/1103 at the dispatch base. This branch then merged main twice, taking in main's qa move and its rest_api move. At main fb386074f5 both sides read 949/5/1/139/9/1103, and every per-type row is byte-equal to main's last single-file table.
• Strictness. All 96 per-directory rows are byte-equal to main's ….counts.md. The only rows dropped are the cross-directory ones:
  • the posture total 461/331/4/1/125;
  • the global buckets 1/0/120/3/0/1;
  • the global measures: 5 dirs, 461 sites, 125 strip, 22 files.
    The gate's read-time sums print exactly those numbers.
• Pinned. check-liveness.test.ts asserts that the printed total equals the sum of the shards on disk, read back row by row. strictness-ledger-doc.test.ts asserts that the read-time totals equal the sums of the shard rows on disk.

Verification

The full union ran at ac64401fec. That commit is the head after the first main merge that met the retired file, plus its regeneration.

• Gates. node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 93 families, and I ran each one with its exit code captured before any pipe. --ran reconciliation: 93 derived, 91 run, 2 NOT-MEASURED, 0 UNRUN.
  • 90 exit 0. This includes check:liveness, check:strictness-ledger, check:generated (15/15 up to date), check:merge-driver, check:cross-package-test-inputs, check:nul-bytes, check:adr-0087-registration --base origin/main, check:api-surface and check:pm-dispatch-gates (1976/1976).
  • 1 red, already red on main: check:platform-checklist. It reports one ✗, the anchor packages/plugins/plugin-auth/src/auth-plugin.ts#twoFactor in docs/qa/platform-checklist/areas/identity-auth.json (ABSENT SYMBOL). The same single ✗ appears on origin/main fb194c70e5 and 4a1df19656, and on the dispatch base 2b24b8b823. This diff does not touch it.
  • NOT MEASURED: check:dual-build-cjs-loads and check:type-check-debt. Both exit 3 (PREREQUISITE NOT MET) because they need a whole-workspace build. They are declared to CI.
• Spec tests (vitest run --project local --maxWorkers=2, then --project repo): local 573 files, 16820 passed and 1 todo; repo 40 files, 709 passed.
• Spec typecheck (pnpm --filter @objectstack/spec typecheck: tsc, the scripts program and the test program): exit 0. tsc -p tsconfig.scripts.json --listFiles includes all 10 changed script and test files.
• Narrowed lint. eslint --no-inline-config --format json over the 13 changed .ts/.mts/.mjs files: 13 files linted, 0 errors, 0 warnings. --print-config resolves a config for each of the 13 files. eslint.config.mjs never enables type-aware linting (no parserOptions.project, no typed rules), so this diff cannot move the verdict on any untouched file. The repo-wide pnpm lint is CI's.
• One-shot reverse verification of the strictness gate's new legs. I put the retired file back, dropped in a stray shard, and skewed one shard's posture row through scripts/ablation-replace.mjs. Each run exited 1 with exactly one drift, named RETIRED, STRAY and STALE respectively. Restoration was proven by blob equals HEAD, git diff HEAD empty and git status --porcelain empty. The liveness legs are pinned permanently in check-liveness.test.ts (missing, skewed, retired, row-set, hand-count, and the verbatim-copy control).

Re-run at the final head 0190e0e55f, after the second main merge (main's rest_api move) and its regeneration:

• the ratchet family, all exit 0: check:liveness, check:strictness-ledger, check:generated (after a fresh spec build, 15/15), check:merge-driver, check:nul-bytes, check:cross-package-test-inputs;
• the liveness and strictness tests: local 11 files, 271 passed; repo 4 files, 80 passed.

A driver-free merge-tree of 0190e0e55f against origin/main 0368a336db exits 0.

Acceptance notes

• The one-time transition for other in-flight PRs. A PR that edits state-counts.md or ….counts.md meets a modify/delete on its next base merge. The settlement is to keep the deletion (git rm) and run the generator. Both gates refuse the retired file while it is present, and both generators delete it. This branch met exactly that twice, with main's qa and rest_api moves, and settled it that way.
• An adjacent-line README overlap with PR 20458. The connector Notes cell named the retired file, so this branch updates it. That cell sits directly above the analytics_cube row, which PR 20458 edits. A driver-free merge-tree of this head against that PR's head f639af5f3d conflicts on packages/spec/liveness/README.md only. Whichever of the two lands second keeps both lines. The file is hand-written and not driver-managed.
• Historical prose left alone (carrier: none). The scripts/pm/dispatch-gates.mjs docblock names liveness/state-counts.md inside a measurement pinned at ad54eb342. packages/spec/CHANGELOG.md and earlier .changeset entries are release-owned. The strictness ledger's merge-queue narrative (it says counts.md was recorded as pending) is past tense.
• AGENTS.md is still accurate. Its sentence that the three hottest artifacts are sharded stays true: five directories are sharded now. It is governed and is not edited here.
• Changeset. @objectstack/spec gets a patch changeset. npm pack --dry-run measured 40 liveness/state-counts/* files shipped, liveness/state-counts.md absent (control: liveness/README.md and liveness/book.json present), and nothing under docs/audits shipped.
• A second hot spot, reported to the seat and not changed here: the hand-written step18.rationale tail in packages/spec/src/migrations/registry.ts. Two synthetic appends at the dispatch base still conflict driver-free. 16 of 101 registry-touching first-parent commits in the 14 days to 2b24b8b823 rewrote that closing line.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 45 changed file(s) yielded no anchor (packages/spec/liveness/README.md, packages/spec/liveness/book.json, packages/spec/liveness/state-counts.md, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 45 changed file(s) yielded no anchor (packages/spec/liveness/README.md, packages/spec/liveness/book.json, packages/spec/liveness/state-counts.md, …) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0368a336dbd6935385b442503b043d937357f4df → packageMentionDocs.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0190e0e55fa1a1838420545d0265b5b260da8d6a
Local-runs: none

Inputs read: card #20361 (body; comments 5862528282 triage, 5864175448 second hot spot, 5877297491 claim, 5881200824 os-dev-report), PR #20532 (body, its one bot comment, 76-file list, net diff of the head against merge base fb386074f5, read from git objects in the shared checkout via refs/os-seat2/pr20532), and the 32 check-runs on the head, read once at 2026-09-29T00:22Z. origin/main has moved three commits past the merge base (b43a814d49, 0368a336db, 1378ec7c0c); none touches packages/spec or docs/audits, so the shards at the head are still what the merged tree renders.

① Derived judgments

Accept set: unchanged — right. No .zod.ts, no src/ schema, no export, no authorable key and no conversion/migration entry is in the diff. The 76 files are 54 generated shards, 2 retired single files, 2 hand-written ledgers/README prose, 2 ledger _note strings, 12 scripts/tests/config rows, 1 changeset and .gitattributes. Type Check · source gates (success) ran check:authorable-surface, check:spec-changes, check:upgrade-guide, check:export-origins, check:docs and check:generated --reconcile-only on this head with nothing to report.

Public surface: the tarball layout of liveness/ moves — right, and declared. @objectstack/spec files[] ships liveness; docs/audits is not shipped. The tarball loses liveness/state-counts.md, gains forty liveness/state-counts/TYPE.md shards, and the prose in liveness/README.md, liveness/book.json and liveness/translation.json that named the removed file is repointed. The changeset names all of that (see ②).

Gate soundness — check:liveness at the head. reconcileStateCounts now takes the shard directory (readTextShardDir) plus a legacyOnDisk flag and routes through the shared reconcileTextShardDir. Read off the code, the legs are: MISSING directory; MISSING shard (a GOVERNED type with no file); STALE shard, naming the shard and its first differing line; STRAY file or subdirectory (a type that left GOVERNED, or a hand-written file); RETIRED single file present; row set README-vs-shards in both directions (leg B, reads the rendered shards, not disk); count column back in the README (leg C, unchanged). The total is summed at read time from the same fold the shards are rendered from (sumStateCounts), printed on the success line and carried in --json as countsTotal; no file carries a total row. Pins that assert the FAILURE through the real gate (check-liveness.test.ts, spawning the gate against a mutated copy via --ledger-root, each expecting exit 1): directory gone; one skewed count in state-counts/view.md (message names the shard and the line); the retired state-counts.md put back beside the shards; a count column back in the README; a type with counts and no README row; and the verbatim control at exit 0 whose printed total is re-summed by the test from the shard rows on disk. A single missing shard and a stray shard/subdirectory are pinned at unit level on reconcileStateCounts itself (readme-table.test.ts: MISSING names state-counts/api.md, STRAY names ghost.md and nested/), not through a spawned exit code; the artifactErrors-to-exit-1 path those legs share is the one the four spawned cases exercise. The locality claim (a shard carries exactly its own row, no total, no sibling name) is asserted on the rendered bytes. Judged sound: every drift the single file used to catch is still a red, and each is asserted as a failure, not merely as an absent assertion.

Gate soundness — check:strictness-ledger at the head. Leg A is now reconcileTextShardDir over renderCountShards: MISSING directory, MISSING shard, STALE shard with first differing lines, STRAY, and RETIRED ….counts.md present; leg B (prose consistent with code) is unchanged. The global section, posture total row and global bucket split are summed at read time (formatGlobalCounts) and printed by both gen: and check:. Pins: strictness-ledger-doc.test.ts asserts the on-disk shard map equals a fresh render and nothing else is there, asserts the retired file is absent, asserts each shard names only its own directory, asserts the read-time posture totals and untriaged total equal the sums of the shard rows read back from disk, and asserts no heading carries a number. What is NOT pinned as an exit-code assertion is the strictness gate's own failure path on drift: no test spawns check-strictness-ledger.mts against a skewed copy (none did at the merge base either, so this is the base's standing, not a regression); the dev's RETIRED/STRAY/STALE exit-1 readings were one-shot. The shared helper's legs are pinned through the liveness unit cases above. Judged sound, with that boundary named.

Parity — verified from git objects, not from the report. Instrument: node over git show fb386074f5:packages/spec/liveness/state-counts.md, git ls-tree 0190e0e55f packages/spec/liveness/state-counts/ and git show 0190e0e55f:PATH per shard (same for the strictness file and its 14 shards). Liveness: 40 shards for the 40 rows the retired file carried; every shard's one table row is byte-equal to a line of the retired file (40 of 40); no shard carries a total row; the sum of the shards is 949 live · 5 experimental · 1 live-elsewhere · 139 dead · 9 planned = 1103 classified, equal to the retired file's committed **total** row at the merge base. Strictness: 14 shards (5 triaged, 9 untriaged); all 129 table rows across them appear verbatim in the retired file; the posture rows sum to 461 / 331 / 4 / 1 / 125, equal to the retired posture **total** row; the untriaged site rows sum to 1200, equal to the retired untriaged table; the per-directory bucket rows sum to authorable 1 · unresolved 0 · wire/open 120 · no door 3 · no gate 0 · covered 1, equal to the retired global bucket table. Spec property liveness (success on this head) is the CI reading that both gates find the committed shards fresh.

Merge routing — right, on an existing precedent. .gitattributes rows packages/spec/liveness/state-counts/** and docs/audits/2026-07-unknown-key-strictness-ledger.counts/** have the same shape as the routed packages/spec/authorable-surface/**, json-schema.manifest/**, api-surface/**, export-origins/**, declaration-map/** and content/docs/references/** rows. scripts/regen-artifacts.mjs entryForPath resolves a trailing /** by prefix (pathMatches), so the driver owns a shard path; check:merge-driver's self-test reconciles the two lists in both directions and pins entryForPath against git check-attr over every tracked file. scripts/pm/os-regen-merge.sh reads the merge=os-regen rows from .gitattributes at run time and hands them to git as pathspecs, partitioning per FILE (its own header says the hot patterns are directory globs over dozens of shards), so the new rows are handled by the machinery that already handles the sharded artifacts. The NOT_DRIVER_MANAGED docs/audits/** row coexists with the specific routed row exactly as it did with the single .counts.md (the self-test's overlap check is exact-string). check:merge-driver on this head: NOT concluded at read time — it runs inside Lint & Repo Gates, which was in_progress. The dev's exit 0 at the final head is the dev's reading, not CI's.

Readers left behind — no functional reader remains. Whole-tree grep at the head for state-counts.md and strictness-ledger.counts.md: hits are (a) the retirement leg by design — LEGACY_STATE_COUNTS_FILE, LEGACY_COUNTS_PATH, the RETIRED test case; (b) historical, not readers — nine earlier .changeset/*.md entries, eight lines in the release-owned packages/spec/CHANGELOG.md, the strictness ledger's past-tense merge-queue narrative at line 1329, the count-shards-merge.test.ts header, and the scripts/pm/dispatch-gates.mjs docblock at lines 6178 and 6260 (a measurement pinned at ad54eb342, inside a comment). No workflow, no scripts/pm/** path-to-family rule, no .claude/** skill, no skills/** entry and no content/docs page names either file; the only path rule in that family is spec-liveness-check.yml's docs/audits/** and packages/spec/** triggers, which the shard directories still satisfy. One stale prose string, not a reader: the NOT_DRIVER_MANAGED docs/audits/** row's why in scripts/regen-artifacts.mjs still says the one exception is the ledger's .counts.md — worth a one-word correction on a later pass, carrier: none.

Scope — inside the claim's surface; no new gate. The claim admitted the strictness counts "only if a measurement shows the same shared-total shape". The dev's driver-free probe at 2b24b8b823 (one strict site in ui/ against two in data/, CONFLICT on the counts file while both sources merged clean) is a local reading; I re-measured the shape from history instead of trusting it: the retired file carries a ## Global section and a posture **total** row, and of the last twelve main commits that touched it, six (75b2169243, 6a4aec71d5, 4db1bf1715, ccccdcc35e, adabccf5fb, e233db9dbb) each moved ONE directory's rows and rewrote both the Global lines and the posture total line — the same shared-total shape the card measured on the liveness file. The condition held; the strictness half is inside the claim. No new gate: packages/spec/package.json and the root package.json gain no check:*/gen:* script; no workflow or job is added; check-generated.ts's GATED roster is unchanged in count (two artifact strings edited); the one new file under scripts/ is a vitest test registered in the existing repo project (vitest.repo-tests.json). The migrations-registry step18.rationale tail (5864175448) is untouched, as the claim required, and reported as an out-of-scope finding with its own measurement.

The card's pin is delivered. count-shards-merge.test.ts builds a throwaway repository carrying the real attribute row and NO driver, commits each real renderer's output, and asks git merge-tree --write-tree: different-type pairs (different deltas, the equal-delta pair that merged clean and WRONG before, adjacent rows, two untriaged directories) merge clean and the merged tree equals the regeneration of both moves; the lit control (same-unit pair) still conflicts, on that unit's shard and nowhere else.

② Semver level

Clause-②: no
The changeset .changeset/20361-liveness-counts-sharded.md is @objectstack/spec: patch carrying Clause-②: no with no arm, and the PR body carries the same line. That is right: nothing widens or narrows an accept set, no export moves, no authorable key is removed, so no ADR-0087 disposition is owed. What publishes is a tarball layout change inside shipped ledger data, and the changeset states the FROM-to-TO for a reader of the old file (a type's row is now liveness/state-counts/TYPE.md, byte-for-byte; the total is summed by check:liveness and printed, and was 940/5/1/148/9/1103 at the dispatch base). Precedent agrees: the five earlier changesets that regenerated state-counts.md (14640, 18582, 19187, 20296, agent-tools-liveness-row-dead) are all patch, and the file's own introduction (#7377) landed under 17.0.0's Patch Changes. docs/audits is not in files[], so the strictness half publishes nothing. Check Changeset is success on this head.

③ Boundary flags

open_questions: the report lists none. Dev deviations, each answered:

1. Strictness sharded in the same PR. Answered above under Scope: the measurement condition held (re-measured from history, not only from the probe), so it is inside the claim's conditional bullet. Accepted.
2. The connector Notes cell edit in packages/spec/liveness/README.md, one line above the analytics_cube row PR feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458 edits. The edit is NEEDED: the cell said the 29/1/30 split is "read from the generated state-counts.md row" and that 30 is "the dead count the generated state-counts.md row carries", and after this diff no such file exists in the package, so the sentence would ship false. The overlap is an ordinary same-file text conflict: feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458's only README hunk is the analytics_cube line directly below, git conflicts on adjacent edits, liveness/README.md is hand-written and not in .gitattributes, so nobody hand-resolves a generated file; whichever lands second keeps both lines. feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458 touches no state-counts path (its liveness files are README.md and analytics_cube.json), so it meets no modify/delete. Keep the edit.
3. Full 93-family union at ac64401fec, ratchet family only at 0190e0e55f. Between the two heads the branch-side change is one line in state-counts/rest_api.md (the regeneration after merging main's rest_api move); the rest is main's own content. The check-runs on the final head are the readings that count. At read time (2026-09-29T00:22Z): 13 concluded success (Spec property liveness, Type Check · source gates, Check Changeset, Governed Surface Queue Guard, Check Documentation Links, Check PR Size, Auto Label, filter, Flag docs affected by code changes, both No other open PR may claim… guards, Part-of PR must not also close its card, The card this PR closes must claim this branch), 3 skipped by path filter or opt-in (Build Docs, Console Pin Gate, Packed-tarball smoke), and 16 NOT concluded: Lint & Repo Gates (carries pnpm lint, check:merge-driver, check:cross-package-test-inputs, check:nul-bytes, check:pm-dispatch-gates), Type Check · workspace (the turbo typecheck that compiles the spec scripts and test programs holding the 10 changed script/test files), Type Check · debt ledger, Type Check · consumer gates, Test Core 1–6 (turbo run test test:repo, which is where count-shards-merge.test.ts, check-liveness.test.ts, readme-table.test.ts and strictness-ledger-doc.test.ts run), Build Core, Dogfood Regression Gate 1–3, Dogfood Verify CLI, Temporal Conformance. So the families with no CI answer yet on this head are check:merge-driver, check:cross-package-test-inputs, lint, the scripts/test typecheck program and the vitest suites; the two gates this diff rewires (check:liveness, check:strictness-ledger) and the artifact/changeset gates ARE answered green. No concluded run failed, so there is nothing to attribute to this diff. This verdict is a contract verdict and does not vouch for the 16 unconcluded runs; the landing waits for them under the every-check-green rule, which is the adopting seat's to read.
4. One check:pm-dispatch-gates flake from committing mid-run, rerun 1976/1976. Not a property of the diff. Noted.
5. --no-verify on throwaway synthetic commits in a scratch worktree, never pushed. Nothing of it is in the diff; the branch's own eight commits are hook-checked. Noted.
6. Attribution. All six branch commits carry Claude-Session: plus Co-authored-by: Claude with no model identifier; the PR body carries the single session-URL footer. Conforms.

Residue, not blocking: (a) the strictness gate's drift legs are pinned through the shared helper and a green-tree equality, not through a spawned exit-1 on a skewed shard (same standing as the base); (b) the NOT_DRIVER_MANAGED docs/audits/** why string still names .counts.md. Neither changes what the gates catch.

Implemented-by: claude/issue-20361-shard-liveness-counts
Reviewed-by: session_014EJ1ED8X4MMrT18BhVx4tx

VERDICT: PASS

---

Generated by Claude Code