fix(audit): count the repositories examined, not the ones supplied - #1989

…s four retractions

Today's measurements lived only in private session memory and in scattered pull
request bodies, which the standing conventions say is the wrong home: the
repository and the Project are the source of truth. This consolidates them into
the live gap baseline.

What the measurements say. Fan-out is uniform across the organization at 8-12
workflows per pull request head with no workflow running twice on a head, so the
ceiling is not fed by duplication. It limits concurrent jobs rather than
runner-minutes, which inverts the gate: within strix.yml the scan job is 20% of
the job count and 98.7% of the runner time, while the two jobs that decide
whether to skip that scan must first win a runner slot themselves. Strix
failures hold a runner for a median 74.8 minutes against 12.8 for successes, and
the 119-minute failure examined produced a complete written assessment, retained
as a 33 KB artifact, before failing closed on an exhausted free model pool. The
central CodeQL lane leaves no analysis record in any of eight sampled
repositories; six of those eight have a CodeQL-supported language that appears
in no analysis at all, and life-os has none of any language.

The detector that would have reported life-os had not run since 2026-09-04,
because an owner-configured ruleset drift exits the shared job before it. That
is fixed in #1987 and #1989; the drift itself, the #1929 dispatch actor
variable, and whether an already-generated Strix report can serve as evidence
are owner decisions and are recorded as open rather than resolved.

Four numbers this pass published and withdrew are recorded with their
mechanisms, because three of them were quoted onward by other sessions before
being caught: a duplicate count grouped without the workflow dimension, a
per-language fan-out read as duplication, a creation-rate burst produced by a
window labelled one hour that spanned 1.95, and a repository-scoped claim that
compared June samples against September ones. The shared failure is reading a
value one step removed from the fact as the fact.

The figures for the CodeQL dispatch share use a closed window rather than an
open-ended one, so they are reproducible instead of drifting with the clock --
found while re-checking this record against the same mistake it documents.

It also closes one backlog item rather than leaving it open. GitHub's notice that
App installation tokens move to a stateless format of roughly 520 characters is a
real forward-compatibility risk for code that assumes a token length; it is not
one here. A 520-character `ghs_` token demonstrably round-trips through the
redaction path, both patterns are open-ended, and two independent searches -- for
length assumptions and for length constraints -- found none. Recording that stops
the item reading as an open risk and stops the next pass repeating the work. The
behavioural line is the positive evidence; the two searches are bounded, and the
record says so, because an absence found by grep is the most truncation-vulnerable
claim available and this document already carries two retractions of that kind.

Developer experience: the ceiling investigation, its owner-gated remainders, and
its retracted figures are readable from the repository instead of having to be
reconstructed from pull request comments.

Co-Authored-By: Claude Opus 5 <[email protected]>