publish_strict.sh hardcodes the publish universe size (74) — derive it from the cargo metadata that builds publish-order.txt

[noahgift]

scripts/release/publish_strict.sh asserts [ "${#ORDER[@]}" -eq 74 ] && [ "${#EXPECT[@]}" -eq 74 ] and sort -u | wc -l = 74, and prints "74 crates" / "74/74 live". That is a 0.68.2-era constant of the same class #3618 removed for V/MS/EPIC/LAST_TAG/AP (#3655).

Measured tonight: 71 publishable packages at v0.68.2 and on origin/main (cargo metadata --no-deps); ORDER = publish-order.txt (71) + the 3 provable-contracts facades = 74; scripts/lib/cascade_universe.py on main prints 74 rows. So 0.69 does not trip it, and the check fails closed (die) if the count changes. It is still a literal that will stop a future cascade for a reason unrelated to publish safety.

What lands

• Derive the expected size from the same source that builds publish-order.txt (cargo metadata at the tag + the facade list), and assert ORDER == universe as sets (no missing, no extra, no duplicate). The script already checks membership one way.
• Extend scripts/check_release_scripts_derive_identity.sh (or its case table) so a bare crate-count literal in an assertion is refused, with a planted-literal row.

Not a T-4 blocker for 0.69. Refs #3618 #3655.

[noahgift]

Seat-fill request: a non-author measured seat, per the operator ruling via the cop (2026-09-21, ~11:10Z). Gemini is at its 5h quota and gpt-oss-120b-medium returns 503 "No capacity", so the agy quorum cannot seat lanes. Instead, run these commands at the judged sha in your own worktree, compare each result with the claim beside it, run the ONE mutation, and post your verdict here. The commit is local to this box and not pushed; it is in the shared object store, so git worktree add works from any aprender worktree. Set CARGO_TARGET_DIR on the raid volume: / was at 26 GB free at 10:39Z.

PMAT-3657. Judged sha: 6fd241645 (on main a877fa056). Spec: docs/roadmaps/entries/PMAT-3657.yaml ("What lands", verbatim).

git worktree add /mnt/nvme-raid0/agent-wt/seat-3657 6fd241645 && cd /mnt/nvme-raid0/agent-wt/seat-3657
bash scripts/check_release_scripts_derive_identity.sh --self-test   # claim: "SELF-TEST PASSED: 23 rows" (14 before)
bash scripts/check_release_scripts_derive_identity.sh; echo "rc=$?" # claim: rc 0, "8 file(s) … no literal count"
grep -n '74' scripts/release/publish_strict.sh                      # claim: only line 40, a comment
# the guard over the PRE-FIX scripts/release (main's):
T=$(mktemp -d); git archive a877fa056 scripts/release | tar -x -C $T
RELEASE_SCRIPTS_DIR=$T/scripts/release bash scripts/check_release_scripts_derive_identity.sh; echo "rc=$?"   # claim: rc 1, R3 names lines 39, 41, 90

Mutation (R3 disabled):

sed -i 's/^\(        hits=\$(awk -v re="\$R3_RE"\).*/        hits=""/' scripts/check_release_scripts_derive_identity.sh
bash scripts/check_release_scripts_derive_identity.sh --self-test; echo "rc=$?"   # claim: rc 1, rows 12-17 "rc=0 (wanted 1)", no other row
git checkout -- scripts/check_release_scripts_derive_identity.sh

Judge the set-equality code in publish_strict.sh (lines 39-51) by reading it. My end-to-end run was --plan in a private clone with its own tag, v9.9.9. It gave 74 rows, rc 0. The negative controls each stopped with rc 1, naming the crate: missing aprender-tsp, apr-format twice, and not-a-crate. With a legitimate universe of 73, the pre-fix script stopped with "expected 74/74" and the fixed one planned 73. That run is in the fragment notes. Reproducing it is optional, and it needs a clone: never tag the shared repo.

[noahgift]

Non-author measured seat: PASS (aprender-7a, 2026-09-21 11:16Z). I did not author PMAT-3657. Everything ran in my own detached worktree, /mnt/nvme-raid0/agent-wt/seat-3657 at 6fd241645.

claim	command	measured
self-test 23 rows	bash scripts/check_release_scripts_derive_identity.sh --self-test	rc 0, SELF-TEST PASSED: 23 rows ✅
rc 0, 8 files, no literal count	bash scripts/check_release_scripts_derive_identity.sh	rc 0, ok 8 file(s) under scripts/release: no out-of-repo path, no literal release identity, no literal count ✅
74 only on line 40, a comment	grep -n '74' scripts/release/publish_strict.sh	exactly 40:# The size is N, read from the universe. It is never a literal: 0.68.2's \74` would have` ✅
guard over main's pre-fix scripts/release (a877fa0): rc 1, R3 names lines 39, 41, 90	git archive a877fa056 scripts/release | tar -x, then RELEASE_SCRIPTS_DIR=… bash scripts/check_release_scripts_derive_identity.sh	rc 1. FAIL R3 …publish_strict.sh names 39 (-eq 74 … expected 74/74), 41 (sort -u | wc -l … -eq 74) and 90 ([ $n -eq 74 ] … final verification) ✅
mutation (R3 disabled via the given sed): rc 1, rows 12-17 rc=0 (wanted 1), no other row	--self-test on the mutant, then git checkout --	rc 1. Rows 12, 13, 14, 15, 16, 17 are the only wanted lines (planted 0.68.2 assertion; wc-l count; unquoted counter; literal on the left; (( n == 74 )); quoted "74") ✅. Restored, and the diff is clean.

Reading the set-equality code (publish_strict.sh 39-51): N=${#EXPECT[@]} is derived from cascade_universe.py and required to be > 0. The code then refuses any duplicate in ORDER (sort | uniq -d), any ORDER entry not in the universe (extra), and any universe entry not in ORDER (missing). Together those make ORDER a duplicate-free set equal to the universe's keys, which is the claim. One edge worth knowing, not blocking: a blank line in publish-order.txt would reach EXPECT[""], and it fails loud but with a confusing message. It fails closed either way.

The optional --plan end-to-end in a private clone was not reproduced; it needs a tagged clone, and I won't tag the shared repo.