[piyushmakhija28]

Why

PR #308 consolidated three session policies into one, taking docs/policies/ from 46 files to 44. It was docs-only, so CI's path filter skipped the test matrix and the breakage landed on main unnoticed — surfacing on the next unrelated PR (#309).

scripts/verify_policy_audit_matrix.py AC1 asserts row-set identity between the matrix and the live corpus:

FAIL: in corpus but missing from matrix: session-management-policy.md
FAIL: in matrix but absent from corpus: session-chaining-policy.md
FAIL: in matrix but absent from corpus: session-memory-policy.md
FAIL: in matrix but absent from corpus: session-pruning-policy.md

What changed

Rows 34/35/36 collapse into one row for session-management-policy.md, and every derived count that AC6/AC7 recompute was updated with it:

	before	after
rows	46	44
verification split	9 MEASURED / 37 CITED	8 / 36
delete disposition	11	9
CONTRADICTED	8	6
Rule 1 keep-as-is	18 (12E/6P)	17 (12E/5P)
OAQ-2 provenance	15	13
orphans	14 of 46	12 of 44

Rows 37-46 renumbered to 35-44 with ~15 cross-references updated — including row 40's evidence, which said "shares row 41's registration" and would otherwise have pointed at the wrong policy.

The historical findings are preserved, not erased

The three retired rows recorded real, measured defects. Consolidation does not make them false. New §1.4 transcribes all three verbatim (status, plan, verification, finding) and records that V2-034 removed the spawn sites on 2026-08-05 — three days after the audit. §3.1 and §5 are deliberately left unedited as dated findings whose cited line numbers no longer hold the code.

Row 34's Basis carries a new CONSOLIDATION provenance class, explicitly not folded into Rule 1 (hooks/session_context.py gives it residual hook coupling).

Also left behind by #308, fixed here

• docs/README.md linked to the three deleted files and said "46 file(s)". It also asserted that docs/policies/ mirrors ~/.claude/policies/ — false, and this repo's own CLAUDE.md says so. Corrected.
• tests/test_verify_policy_orphan_dispositions.py pinned SAMPLE_ORPHAN to session-pruning-policy.md and hardcoded "(14 of 46)". That would have failed CI too; it now reads the count out of the heading.

Verification

python scripts/verify_policy_audit_matrix.py         -> EXIT 0   PASS (AC1-AC7)
python scripts/verify_policy_orphan_dispositions.py  -> EXIT 0   PASS (AC1, AC2, SUP1)
python scripts/verify_policy_capability_dispositions.py -> EXIT 0
pytest tests/test_verify_policy_{orphan,capability}_dispositions.py -> 24 passed

Follow-ups this exposed (not fixed here)

1. The CI path filter should trigger these gates on docs/ changes. All three are stdlib-only and run in seconds, and they read docs/. As configured, a docs-only PR can break a hard gate and merge clean, and the cost lands on an unrelated author — exactly what happened.
2. Treating a docs/reports/ point-in-time audit as a live registry is not sustainable. AC1 binds a document stamped "MEASURED 2026-08-02" to a directory that changes whenever anyone edits a policy. Every corpus edit forces recomputation of ~15 interlocking derived counts by hand, and the gates check only 7 of them — the rest can drift while CI still exits 0. The registry should be a generated artifact the gate reads; the audit should be frozen prose that cites it.

🤖 Generated with Claude Code