docs(scripts): reconcile renderCountsFile's docblock with the merge guidance it emits

[os-bill]

Fixes #18960

Clause-②: no

renderCountsFile()'s docblock said merge=os-regen was "the right resolution" for
docs/audits/2026-08-tenant-audit-write-call-sites.counts.md, "the same as its
strictness-ledger sibling". The header that the same function emits into that file says
the opposite. One of the two had to be wrong; measurement says the docblock was.

Prose only. No behaviour change, no .gitattributes change, no .counts.md change.

The measurement that decides it

git check-attr merge, run in this worktree with a lit control (the sibling the
docblock itself named) and a dark control (a path that does not exist) — because the
object and the dark control read the same value, so unspecified alone cannot tell a real
absence from a dead instrument. The lit control is what separates them.

Before the edit, at base 2767af8e83:

path	merge	role
docs/audits/2026-08-tenant-audit-write-call-sites.counts.md	unspecified	object
docs/audits/2026-07-unknown-key-strictness-ledger.counts.md	os-regen	lit control — fires, instrument alive
docs/audits/totally-fabricated-xyz.counts.md	unspecified	dark control

After the edit, same three paths, same three values — this PR does not touch attributes.

So the parity claim was false by exactly the comparison it named, and the emitted header
was the accurate side.

The docblock as it now reads

/**
 * The audit ledger: every site, regenerated WHOLE.
 *
 * No prose to preserve, so nothing here is spliced -- the file is rewritten. Two
 * branches that each add a write call site produce rows that git merges cleanly and
 * a header that merges cleanly and WRONG, so the correct resolution is always
 * "recompute from the merged tree" -- `node scripts/tenant-audit-census.mjs --write`,
 * which is what the header this function emits tells a merging author to do.
 *
 * That resolution is not delegated to a merge driver: no `.gitattributes` entry
 * covers this path, so `git check-attr merge` over it reads `unspecified` and git
 * text-merges it like any other file. `scripts/check-tenant-audit-census.mjs` is the
 * backstop -- a wrongly merged file fails the build loudly instead of landing
 * silently.
 */

No assertion is left that this counts file is, or ought to be, merge=os-regen — the
parity wording included. The two claims the card named as true and load-bearing are kept,
and both still agree with the emitted header:

1. regenerated whole, no prose to preserve, the file is rewritten — the emitted header
   says the same thing;
2. two branches each adding a write call site merge rows cleanly and a header cleanly
   and WRONG, so the correct resolution is always to recompute from the merged tree —
   the emitted header says the same thing, and now the docblock names the command it
   prescribes.

What replaced the false sentence is a measured statement (no covering entry, so
check-attr reads unspecified) plus the backstop the emitted header already points at.
It deliberately does not restate the emitted header's rationale for the absence —
see the acceptance note below.

What this PR does not touch

• .gitattributes — this card is not "add a missing os-regen registration". Registering
  this path is the wrong action the false sentence was inviting.
• The prose the function emits into the generated file (out.push(...)).
• Any .counts.md, and any census verdict, out.push line, or
  scripts/check-tenant-audit-census.mjs.
• Whether the two .counts.md siblings ought to merge the same way. The card names that as
  a separate question and this PR does not answer it.

Verification

• Behaviour dark leg — node scripts/tenant-audit-census.mjs --write run before the
  edit and again after it, both at the same HEAD so the generator's measurement stamp is a
  constant. Output byte-identical across the two runs:
  4851056362eb1b196acef0dac60dee1cbddc2870 for the counts file and
  084932491a2b68a856880b68086f485ca58aaf3b for tenant-audit-census.mdx, both runs. The
  artefacts were then restored to their committed bytes, so this PR's diff is one file.
• node scripts/check-tenant-audit-census.mjs --self-test — exit 0 before and after
  (44 + 24 cases).
• node scripts/check-tenant-audit-census.mjs — exit 0 before and after, 225 write call
  sites certified, 23 prose figures held to the census.
• Gate families derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack against the real change set (1 path): 28 commands, all run,
  all exit 0; reconciled with --ran recording each exit code — "28 derived, 28 run,
  0 NOT-MEASURED, 0 UNRUN", a derived zero.
• Changeset: skip-changeset. Measured per file rather than asserted: every non-private
  manifest in the tree (70) was read and each diff path tested against its files[].
  scripts/tenant-audit-census.mjs lands on none — it is root-level tooling, and a files[]
  entry is package-relative. Positive controls through the same predicate fire:
  packages/spec/dist/index.js hits @objectstack/spec files[] "dist" and
  packages/cli/dist/cli.js hits @objectstack/cli files[] "dist". Nothing published moves,
  and the change is a comment.

Acceptance notes

Noted, not filed here — the emitted header's stated reason for the absence looks stale.
The header this function emits says the file is not merge=os-regen because "that driver
resolves an artefact's gen:/check: scripts in @objectstack/spec only, and these are
root-level tooling". Two readings in this tree point the other way: scripts/git-merge-regen.mjs
documents at reconcileScripts() that resolution reads "the owner's manifest, whichever that
is" since #13585 — root included, manifestFor('.') being package.json — and .gitattributes
already routes root-owned artefacts such as scripts/platform-object-tenancy-census.json and
docs/protocol-upgrade-guide.md to merge=os-regen. That is about the reason, not about the
fact: the absence itself is measured above and is not in doubt, and whether this path ought to
be registered stays the separate question the card excludes. It is out of scope here — the card
fences the emitted prose as read-only — so this PR states only what it measured and leaves the
rationale to whoever takes that question. Reported to the dispatching seat in the round report.

Out of scope: #18944, a separate card on this same file (the census's engine-door
classification rule); deliberately not combined, per triage.

---

Generated by Claude Code