@ssheleg/agent-sync 1.19.3 → 1.20.0

package/CHANGELOG.md

@@ -1,3 +1,16 @@
+## v1.20.0 — the two-sources duty stops carrying its own elaboration
+
+Sherlock external-v3 (14 findings) plus the House audit gap they introduced.
+
+- The audit's doctrine grew SKILL.md past the house working limit, and the rule
+  for that is a SPLIT, not a trim. The `Two documentation sources` section keeps
+  what a reader needs before opening anything — the two questions, the gap IS the
+  finding, the duty at both ends, and that `reconcile` is mechanical so its green
+  is not agreement — and hands the rest to `references/two-sources.md`, which
+  already held every one of those points in full.
+- `references/adapter-contract.md` passed 100 lines and gained a `## Contents`.
+- CI now MEASURES the token budget with a real tokenizer instead of estimating it.
+
 ## v1.19.3 — the boundary ships with the skill, and two descriptions stop looking like drift
 
 Close-out of the 2026-09-06 family audit (wave AUDIT-WAVE-0906). One bullet

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/agent-sync",
-  "version": "1.19.3",
+  "version": "1.20.0",
   "description": "Let concurrent coding agents share one project without colliding — leases with TTL, race-free id reservation, a run journal and a generated board, over a pluggable knowledge cloud.",
   "bin": {
     "agent-sync": "bin/agent-sync.js"

package/plugins/agent-sync/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "agent-sync",
   "displayName": "Agent Sync",
-  "version": "1.19.3",
+  "version": "1.20.0",
   "description": "Coordination layer for multi-agent repositories — leases with TTL, race-free ID reservation, a run journal, a cross-repo signal feed and a generated board, over a pluggable knowledge cloud.",
   "author": {
     "name": "ssheleg",

package/plugins/agent-sync/hooks/guard.sh

@@ -3,6 +3,30 @@
 # Any other non-zero code is NON-blocking in Claude Code, so every internal
 # failure must also exit 2 — a crashing guard that fails open guards nothing.
 set -uo pipefail
+# --------------------------------------------------------------------------
+# THE PROTECTION BOUNDARY IS ADVISORY, AND STATED SO (FIX-SY-07.01).
+#
+# This guard is a best-effort PreToolUse check, not a sandbox. It covers the
+# mutation surfaces a Claude Code matcher can name; everything else is a write
+# vector it cannot see. The capability matrix, per write vector:
+#
+#   Write / Edit / MultiEdit / NotebookEdit   COVERED  (file_path matcher)
+#   Bash: git commit (incl. -C, env, compound) COVERED (parsed below)
+#   Bash: apply_patch                          UNSUPPORTED (no file_path parse)
+#   Bash: python -c "...write_text(...)"        UNSUPPORTED (a runtime, not a path)
+#   Bash: sed -i / perl -i                      UNSUPPORTED (in-place edit, no arg parse)
+#   Bash: > redirect / tee                      UNSUPPORTED (shell effect, not a tool arg)
+#   Bash: git -C <dir> commit                   COVERED (repo resolved from -C)
+#   Bash: env VAR=x git commit                  COVERED (env prefix skipped)
+#   Bash: compound (a && git commit)            COVERED (each segment parsed)
+#
+# An UNSUPPORTED vector is not silently trusted — it is DECLARED unenforced.
+# A caller that needs a hard guarantee routes file writes through a trusted
+# mutation API, an isolated worktree, or OS controls with resource locks; a
+# regex shell parser is not a universal sandbox and this guard never claims to
+# be one. The late staged-path check on a commit cannot recover a working tree
+# already overwritten by an unsupported vector before staging.
+# --------------------------------------------------------------------------
 . "${CLAUDE_PLUGIN_ROOT}/hooks/_lib.sh"
 S="$AGENT_SYNC_PY"
 agent_sync_configured || exit 0

package/plugins/agent-sync/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "agent-sync — lease enforcement and run lifecycle. Every hook exits 0 immediately when the project has no .claude/agent-sync.json, so installing the plugin globally changes nothing in projects that do not use it.",
+  "description": "agent-sync — ADVISORY lease guard and run lifecycle. The PreToolUse guard covers exactly the mutation surfaces a Claude Code matcher can name: Edit, Write, MultiEdit, NotebookEdit, and a Bash `git commit` (parsed for compound/`-C`/env forms). It is NOT a sandbox: a language-runtime write (Python write_text), a `sed -i`, or a shell redirect is OUTSIDE the boundary and is not enforced — see the capability matrix in guard.sh. Real enforcement needs a trusted mutation API, an isolated worktree, or OS controls with resource locks, not a regex shell parser. Every hook exits 0 immediately when the project has no .claude/agent-sync.json, so installing the plugin globally changes nothing in projects that do not use it.",
   "hooks": {
     "SessionStart": [
       {

package/plugins/agent-sync/skills/agent-sync/SKILL.md

@@ -4,7 +4,7 @@ description: "Use when several coding agents work one repository at the same tim
 compatibility: "Requires the task-pipeline skill for its stages (npx sshlg-skills install). Needs python3 3.9+ (stdlib only, HTTP included - nothing to pip install) and bash for the hooks. The knowledge backend is configured per project; with none configured it degrades to git-file leases. Enforcement hooks are Claude Code only - on other agents the same checks run as a self-check."
 license: MIT
 metadata:
-  version: "1.19.3"
+  version: "1.20.0"
   author: ssheleg
 ---
 
@@ -45,8 +45,9 @@ recorded in `docs/MERGES.md`, the `--key` lease released; `merges` says what lan
 you were away. **Read `references/branching.md`** before merging.
 
 **3. Hooks exist only in Claude Code.** Elsewhere nothing blocks a guarded edit: run
-`guard` yourself and record the run as `ungated`. Do not describe a project as protected
-when it is not.
+`guard` yourself and record the run as `ungated`. A mode's five capability fields
+live in ONE place — `references/adapter-contract.md` → *The status capability
+contract*, never restated here. Do not describe a project as protected when it is not.
 
 **4. Parse liberally, and never call an unreadable log a lost race.** The store rewrites
 what you wrote — Outline turns a `- ` bullet into `* `. Emit `- `, accept `-`/`*`/`+`,
@@ -93,21 +94,19 @@ registers — decisions belong to the parent. Then take the chain above from `in
 
 ## First command in a project: `init`
 
-**Never run anything else against an uninitialised project.** `init` is where the storage
-question gets asked and answered, once, and written down.
+**Never run anything else against an uninitialised project.** `init` asks and answers
+the storage question once, and writes it down.
 
 **Ask the operator these two things in chat — do not guess, do not pick a default:**
 
 1. **Where should coordination state live?**
    - a knowledge cloud — `outline`, hosted or self-hosted, or `notion` — the shared
-     record, awareness and board across machines. **Neither decides leases**; nothing
-     in either can (trap 1);
+     record, awareness and board across machines — **neither decides leases** (trap 1);
    - or local files (`fs`) — no credentials, and no visibility to an agent on another
-     machine: no shared awareness, no cross-repo signals, no shared board.
+     machine — no shared awareness, cross-repo signal or board.
 
    The lease is decided separately by `leaseBackend` (trap 2), and **`gated` follows that
-   choice, never the record plane**. Report the guarantee you actually have, not the
-   stronger one the record plane suggests.
+   choice, never the record plane** — report the guarantee you actually have.
 2. **If cloud: where.** Outline needs its instance URL; Notion needs the id of the page
    the container goes under. Both are configuration, not secrets, so you may write them.
    The **token is not** — you never ask for it in chat, never read it back, and never
@@ -145,9 +144,10 @@ cannot give two answers about one project.
   away — watermarked per run, so it stays quiet until something changes. A dependency that
   moved may unblock what you planned, or invalidate it.
 
-What else `status` decides: no credentials → degraded mode, reported, and it continues;
-`task-pipeline` absent → it prints the install line and stops. Do not improvise a substitute
-flow — without those stages there is nothing to bind to.
+`status` also decides: no credentials → degraded mode; `task-pipeline` absent → it
+prints the install line and stops. Absence is checked across every host layout or an
+explicit `pipelinePath` — no host's copy masks or is missed. The lease core
+(`acquire`/`renew`/`release`) needs a backend + lease, not the binding.
 
 ```bash
 npx sshlg-skills install
@@ -163,7 +163,8 @@ npx sshlg-skills install
 | `acquire <KEY>` | Take the lease on a task id. Prints `won` or `lost <holder>` |
 | `renew <KEY>` | Extend the lease. The `PostToolUse` hook does this for you |
 | `release <KEY>` | Give the lease back. Always do this, including on failure |
-| `reserve <REG>` | Reserve the next id in a register (`DEC`, `OQ`, `DEP`, …). Prints the id |
+| `reserve <REG> [--key K] [--offline]` | Reserve the next id in a register (`DEC`, `OQ`, `DEP`, …); prints it. `--key` makes a retry idempotent (one key, one number); `--offline` issues a namespaced `REG-o-…` id with no global authority |
+| `map-offline <REG> <ID> <N>` | Bind an offline id to a properly reserved number — append-only, never rebound |
 | `release-id <REG> <ID>` | Return an id you did not end up writing to git |
 | `journal <text>` | Append one line to this run's journal |
 | `record <text>` | Append what you **actually built** — `--decision DEC-…`, `--files a,b` |
@@ -232,10 +233,19 @@ python3 "$SKILL_DIR/scripts/agent_sync.py" guard docs/DECISIONS.md
 ```
 
 **Exit 2 is about *this run*: it holds no lease** — not that somebody else holds that file.
-One lease covers every guarded file; hold one or write none. A denial names the other run
-**and its key**, because "r-x holds a lease" beside a path gets repeated as "r-x holds this
-file". Do not edit anyway, and do not "just fix one line" — a clobbered decision looks exactly
-like a decision.
+A denial names the other run **and its key**, because "r-x holds a lease" beside a path gets
+repeated as "r-x holds this file". Do not edit anyway, and do not "just fix one line" — a
+clobbered decision looks exactly like a decision.
+
+**Two write modes, and the tool does not promise the wrong one.** A task lease authorizes
+the TASK, never the file — so a guarded write also takes the FILE's own **resource claim**
+(`res--<repo>--<canonical path>`, SY-04). That is the **short transaction lock**: two agents
+on one shared registry serialize on it, independent files never serialize, honest
+cross-machine only under `leaseBackend: "git"` (advisory otherwise). The other mode is
+**isolated worktree + merge** — each agent a private checkout, a merge policy reconciling
+them — for when writes overlap so heavily a lock would just queue everyone. What the guard
+does NOT promise is enforcement from a single task owner: holding *a* lease was never
+holding *this* file.
 
 Claude Code's `PreToolUse` hook runs this for you. Elsewhere nothing does.
 
@@ -262,32 +272,24 @@ the generated-object contract: `references/two-sources.md`.
 ## Two documentation sources, and the duty to reconcile them
 
 Git docs answer **how it should be**; the as-built record answers **how it actually is**.
-Neither outranks the other, and **the gap between them is the finding**, not a defect.
+Neither outranks the other, and **the gap between them is the finding**, not a defect. The
+duty runs at both ends of a task: `reconcile` before starting, `record` and `reconcile`
+after finishing — and `reconcile` is mechanical, so treating its green as agreement is how
+a divergence survives both ends.
 
-The duty runs at both ends of a task: `reconcile` and resolve every divergence before
-starting, then `record` and `reconcile` again after finishing. Building on an unresolved
-divergence is writing code against a system that does not exist.
-
-**The trap: `reconcile` is mechanical and refuses to judge** whether the built thing matches
-the document — it compares ids, commits, presence and claim tags. That reading is yours, and
-treating its green as agreement is how a divergence survives both ends.
-
-Every project also carries a **generated snapshot** of its own wiring (`setup`) — commit it
-and link it from the agent instructions, so agents read the pipeline instead of inferring it.
-
-**Read `references/two-sources.md`** before the first reconcile, and whenever deciding which
-side a document belongs on.
+**Read `references/two-sources.md`** before the first reconcile: it holds the full duty,
+what `reconcile` refuses to judge, the generated `setup` snapshot, where a document
+belongs, and why nothing is deleted.
 
 ## Binding to task-pipeline
 
-This skill supplies stages; the names are `task-pipeline`'s own. Five of the eleven stages
-carry an ordering rule: **0** `acquire` before the brief is committed; **1** `reconcile` before
-writing code; **3** `reserve` every id before it reaches git; **9** the main write point;
-**10** `merge` or `release` every lease.
+This skill supplies stages; the names are `task-pipeline`'s own.
+Five of the eleven stages carry an ordering rule: **0** `acquire` before the brief
+commits; **1** `reconcile` before code; **3** `reserve` ids before git; **9** the main
+write; **10** `merge`/`release` every lease.
 
-**Read `references/pipeline-binding.md`** when wiring `pipeline.json` — it holds the
-per-stage reasoning, the `skills[]` entries, what must be guarded, and the gate
-expressions.
+**Read `references/pipeline-binding.md`** when wiring `pipeline.json` — per-stage
+reasoning, `skills[]` entries, what to guard, and the gate expressions.
 
 ## Configuration
 

package/plugins/agent-sync/skills/agent-sync/references/adapter-contract.md

@@ -14,6 +14,16 @@ candidate backend can be trusted with leases.
 A backend is an adapter that implements six primitives and declares three
 capabilities. Nothing else about it is the coordinator's business.
 
+## Contents
+
+- [Primitives](#primitives)
+- [Capabilities](#capabilities)
+- [The status capability contract — one source, five fields](#the-status-capability-contract--one-source-five-fields)
+- [Degradation — non-negotiable](#degradation--non-negotiable)
+- [Errors and retries](#errors-and-retries)
+- [Credentials](#credentials)
+- [Adding a backend — checklist](#adding-a-backend--checklist)
+
 ## Primitives
 
 | Primitive | Signature | Semantics |
@@ -44,6 +54,28 @@ capabilities. Nothing else about it is the coordinator's business.
   it. Declaring it true without one is the most damaging lie an adapter can tell, so
   the default is false and the burden of proof is on the adapter.
 
+## The status capability contract — one source, five fields
+
+The RECORD-plane capabilities above (`atomicAppend`/`totalOrderRead`/…) are not
+the same axis as the STATUS the coordinator reports about a run. The status is
+`Sync.capabilities()` in `scripts/agent_sync.py` (FIX-SY-06.01), and it is the
+ONE source every doc describes a mode from — SKILL.md and `backend-fs.md` point
+here rather than restating it, so a single mode can never be described three
+different ways. The five fields:
+
+| field | values | meaning |
+|---|---|---|
+| `lease_scope` | cross-machine \| machine-local | where exclusion holds |
+| `enforcement_mode` | enforced \| advisory | enforced only for a cross-machine CAS the operator asked for on a reachable backend |
+| `awareness_scope` | shared \| isolated | whether other agents can see this project's state |
+| `identity_strength` | strong \| weak | how strongly a run identity is bound |
+| `backend_health` | up \| failed | an unreachable backend is `failed`, never reported active |
+
+**Legacy `gated` is a DERIVED summary** of `enforcement_mode`, kept for old
+callers. **An unavailable observation is `unknown`/`failed`, never asserted**:
+a backend the coordinator cannot reach collapses `enforcement_mode` to advisory
+and `backend_health` to failed rather than showing green.
+
 ## Degradation — non-negotiable
 
 **No adapter is the lease authority.** Exclusion is an atomic local lock; the adapter

package/plugins/agent-sync/skills/agent-sync/references/backend-fs.md

@@ -34,6 +34,11 @@ from `leaseBackend` (`local` = `O_EXCL`, `git` = a pushed ref). What this backen
 1. says so at session start, in one plain sentence;
 2. keeps the lease exactly as configured — `leaseBackend` is independent of this choice;
 3. marks every run `ungated` on the board, because nobody else can read the state.
+   In the five-field contract (`adapter-contract.md` → *The status capability
+   contract*, the one source this file describes the mode from) that is
+   `awareness_scope: isolated`, `enforcement_mode: advisory` — and if the local
+   state cannot even be read, `backend_health: failed`, reported as `unknown`,
+   never as active green.
 
 ## The lease is not this backend's job
 

package/plugins/agent-sync/skills/agent-sync/references/lease-protocol.md

@@ -42,7 +42,8 @@ so a parser anchored to the character you wrote rejects every line the server ha
 back. Observed live, and it presented as a lost race rather than a parse failure.
 
 Required on every line: `op`, `key`, `run`. `op` is one of
-`acquire` · `release` · `renew` · `base` · `reserve` · `release_id` · `signal` · `journal`.
+`acquire` · `release` · `renew` · `base` · `reserve` · `release_id` ·
+`reserve_offline` · `map_offline` · `signal` · `journal`.
 
 Unparseable lines are **counted and reported**, never guessed at. Anything
 entry-shaped (`^[-*+] \``) that fails the full pattern counts as unparseable; blank
@@ -74,6 +75,15 @@ documents, and implemented nowhere except a warning line on the board that retur
 5. won      write {run, ts, ttl, repo}; publish op=acquire to the plane for visibility
 ```
 
+**Every local writer shares ONE critical section — and step 3 is it.** The
+`.steal` guard is not the stealer's private door any more: `renew` and the
+local release enter the same section, so a renewal arriving mid-steal DEFERS
+to the next heartbeat instead of rewriting a timestamp the stealer's expiry
+re-read already consumed. Ownership changes bump a `gen` counter a renewal
+preserves — a reader holding a stale generation is holding a stale ownership.
+And a host where the O_EXCL primitive itself fails gets an explicit
+`unsupported` refusal naming the remedy, never an unlocked fallback (SY-03).
+
 **Step 3 is one critical section, not two calls.** `unlink` followed by `O_EXCL create`
 leaves a gap, and a second stealer that has already read the lock as expired removes the
 lock the first one just created — both then hold what each believes is exclusive. Twelve
@@ -127,6 +137,32 @@ the second read is the state.
 identically to an operator and mean opposite things, so they are printed differently and
 `reap` exits non-zero on the first.
 
+## The lock is published FULL, never created empty (SY-05)
+
+A lock created empty by `O_EXCL` and filled by a later write has a window a
+competitor reads as `{}` — not live, therefore stealable — and steals while
+the creator writes on into a now-unlinked inode: two winners. So a lock is
+PUBLISHED already carrying its body — written to a temp inode, fsync'd, then
+`os.link`ed onto the final name (an atomic no-replace create of a FULL inode)
+— and no reader ever observes an empty lock. Any empty or partial lock that
+does appear is a creation IN FLIGHT, not an expired lease: it is left alone
+within a short creation grace and reclaimed only once its own file age proves
+it abandoned — arbitrated by age, never by the heuristic that empty JSON means
+free.
+
+## Resource identity — the file's own claim (SY-04)
+
+A task lease is ownership of the TASK, never of a file: two runs holding two
+different task ids used to both pass the guard and interleave writes to one
+shared registry. A guarded write now also takes the file's own claim — key
+`res--<repo>--<canonical path>` (realpath on both sides: a `/var` vs
+`/private/var` symlink split makes one file two names, and a guard that sees
+two names guards neither). The claim is auto-taken under the task lease, so a
+single agent feels nothing; two agents on one file serialize on the FILE;
+independent files carry independent keys and never serialize without cause.
+Releasing the run's last task key releases its resource claims with it — a
+file claim only ever rides under a task lease.
+
 ## Expiry and stealing
 
 A lock is expired when `now > ts + ttl` for the timestamp inside it.
@@ -136,6 +172,25 @@ lock file in `local` mode, and re-pushes the ref with `--force-with-lease` again
 exact object it read in `git` mode. The `op=renew` line it also appends to the record plane
 is visibility, not renewal.
 
+**And a renewal is FENCED, not unconditional (SY-03.02).** Three refusals stand
+between a heartbeat and the lock: the run id must match; the lease must still be
+LIVE — an expired lease is not renewed, it is acquired again, because a stealer
+may already have read it as up for grabs; and the lock's `gen` must equal the
+generation this session acquired under. The third is what the run id cannot do:
+a replacement session shares the run id and the checkout, so after its steal
+(gen bump) the old session's heartbeat matches on run and would resurrect the
+lease forever — only the in-memory generation, the one thing a zombie does not
+share with its replacement, tells the two apart. Re-taking one's own expired
+lease is therefore a steal with a generation bump, never a refresh.
+
+**The heartbeat's throttle is per (run, key), never shared.** It was one file per
+checkout, and one agent touching it every hundred seconds meant every OTHER run's
+heartbeat read "renewed recently" and refreshed nothing — a 45-minute lease expiring
+under live work because a neighbour was busy (SY-02). Each key of each run now ages
+against its own marker; an `acquire` stamps only the key it just took; and an
+**explicit `renew <key>` never hides behind the throttle** — it refreshes for real or
+answers with the precise per-key reason it could not.
+
 That distinction is the whole of the bug fixed in 1.5.3: `renew` wrote *only* the record
 line. The lock's `ts` was written once, by `acquire`, so a run holding a lease lost it at
 TTL while still working — its own guard began denying it, and another run acquired the task
@@ -248,29 +303,64 @@ contracts on purpose. Do not "align" them by widening `reap`.
 
 ## Id reservation
 
-Reading a "next free id" line from a file is not reserving it. Allocation is
-**positional over the log**, so no agent has to trust another's arithmetic.
-
-A register is opened once:
+Reading a "next free id" line from a file is not reserving it. An issued id is
+**immutable**: once `reserve` has printed a number, no replay, late-arriving shard or
+appended base may move it. The line that records it carries the value —
 
 ```
-- `…` `op=base` `key=DEC` `value=0216` `run=r-bootstrap`
+- `…` `op=reserve` `key=DEC` `value=0042` `run=r-7f3a91`
 ```
 
-Then, replaying in order and maintaining a free list:
-
+— a **receipt** of an allocation that already happened, never a claim to be computed
+later. A receipt whose value is already live lost its race and gets no assignment; the
+run that wrote it saw the loss on read-back and appended another line. Where the value
+comes from depends on the mode:
+
+- **`leaseBackend: "git"`** — the allocator is a compare-and-swap on a remote ref,
+  `refs/agent-sync/ids/<REG>`, whose tip commit records the next free number. Winning
+  the push IS the allocation: the remote accepts exactly one successor per tip, so two
+  concurrent reserves cannot take one number — the loser re-reads the moved tip and
+  takes the next, bounded at `RESERVE_RETRIES` attempts before reporting contention.
+  This is the same push semantics the lease itself rides on, and it is why positional
+  replay could never be safe across machines: a shard another machine has not pushed
+  yet is invisible, and two machines replaying different logs were both "correct" about
+  histories nobody shared. A released id is recorded for the leak report but never
+  reissued automatically here — the counter only moves forward.
+- **Total-order backends** (Outline, Notion) — the value is probed positionally over
+  the merged log, then claimed by appending the receipt and confirmed on read-back;
+  a lost race retries with the next number, bounded the same way.
+
+A receipt also **names its authority**: `backend=` (git or log), `rev=` (the
+counter commit that served it, in git mode) and `rkey=` (the reservation key).
+A retry with the same `--key` is the SAME reservation — answered from the
+merged log, or, when the run died between winning the compare-and-swap and
+writing its receipt, from the counter ref's own chain, which remembers which
+key each number was served to. One key, one number, however many retries.
+
+**Offline, there is no global sequence to pretend at.** `reserve --offline`
+issues a namespaced composite — `REG-o-<run>-<seq>` — that cannot collide with
+the numeric sequence, and `map-offline` later binds it to a properly reserved
+number, append-only: the same fact twice is one fact, a different number is
+refused, and an id never issued cannot be mapped at all.
+
+Legacy bare `op=reserve` lines (no `value=`) still resolve positionally, replaying in
+order and maintaining a free list:
+
+- `op=base key=DEC value=0216` opens a register; a `base` only ever moves allocation
+  **forward** — two runs opening a register in the same minute cannot restart each
+  other's count.
 - `op=release_id key=DEC value=NNNN` pushes `NNNN` onto the free list.
-- `op=reserve key=DEC` takes the free-list head if it is non-empty; otherwise it
-  takes `base + (count of prior reserves not served from the free list)`.
+- bare `op=reserve key=DEC` takes the free-list head if it is non-empty; otherwise
+  `base + (count of prior reserves not served from the free list)`.
 
 Every reader computes the same assignment for every reserve line, including its own —
 **and "the log" means every shard merged, never the one this run writes.** Reading only
 its own document is how `reserve` handed three runs `DEC-0007` three times (fixed in
 1.5.3): each replayed a log containing only its own lines, each seeded its own `base`
-from the register, and each was correct about a history nobody else shared. The failure
-is the same one that disqualified per-writer documents as a *lease* store, arriving in
-the allocator — so a `base` now only ever moves allocation **forward**, and two runs
-opening a register in the same minute cannot restart each other's count.
+from the register, and each was correct about a history nobody else shared. The
+value-carrying receipt closes the remaining half of that defect: the merged order
+itself could still renumber an already-issued id when a shard arrived late, and now it
+cannot (`test/audit_regressions/fix-sy-01.01.py`, finding SY-01).
 
 **An id you reserved and did not write to git must be released** with
 `release_id`. An id that is reserved, unreleased and absent from git after its run