rdmsm4x-changelog-20260903-2033-lib-domain-docs-init-and-drift-fixes

Rewrote ~/dev/lib/CLAUDE.md for the current shape of the domain, then fixed the three documentation-drift items that survey turned up — all committed the same session.

When: 2026-09-03, 20:02:08 → 20:33:09 EDT (31 minutes)
Host: rdmsm4x (canonical dev root)
Agent: claude@rdmsm4x, Claude Code session 9b884bd7
Ticket: DOC-20260903-01 (opened and resolved this session)
Scope: ~/dev/lib only. No other host touched. No app, no build, no deploy.

1. Why

/init on ~/dev/lib. The existing CLAUDE.md was written 2026-08-25 and accurately described a five-directory documentation folder. The domain now has 17 entries including two Swift packages that compile into the app portfolio, and two third-party vendored clones. The file no longer described the thing it governs.

2. What changed

`~/dev/lib/CLAUDE.md` — rewritten (2,730 → ~9,400 bytes)

Not versioned by git (~/dev/lib is not a repo). New material, none of it previously written down at the domain level:

Blast radius. ecs0lib has 28 consumers in apps/*/Package.swift; ECSCloudKit has 14 — all path dependencies, no version pinning, no lockfile. An edit to Sources/ here lands in those apps on their next build with nothing warning the consumer.
t3code/ and tokenbar/ are third-party upstream clones (pingdotgg/t3code, Nanako0129/TokenBar), ingested as donor repos. They carry their own AGENTS.md that reads like fleet policy and is not. Flagged: do not normalize, do not push to those remotes.
~/dev/lib is not a git repo. Seven subdirectories are; five are not versioned at all. No commit spans the domain — commit inside the subdirectory changed, by explicit path.
The platform-floor inversion is deliberate, not a bug: ECSCloudKit targets macOS 14 while the app family targets macOS 27, because two fleet Macs are Intel on 26.7 forever. Consumers raise the floor; the library never does.

Drift fix 1 — the hardcoded domain count (5 files)

Five owned documents said "439 domains" while domains/domains.json .count said 455 (generated 2026-09-01): README.md, index.html, app-baseline/README.md, app-baseline/PROJECT_KICKOFF.md, domains/SKILL-domain-portfolio.md.

Fixed by removing the number, not by correcting it to 455 — a hardcoded count in prose re-arms the identical trap on the next refresh. All now point at .count as the source. SKILL-domain-portfolio.md keeps a dated snapshot (honest, and the date is readable), refreshed to the 2026-09-01 generation: 455 domains, 385 ACTIVE, 385/385 on Cloudflare DNS.

I had originally reported this as affecting two files. It was five.

Drift fix 2 — template count

README.md said 11 fleet templates; there are 10. The ten names it enumerates match the ten files exactly, so only the numeral was wrong. Corrected.

Drift fix 3 — stale `.bak` copies archived

Six .bak-<date> files sat beside live docs, where a grep for a rule can match the stale copy. Moved, not deleted, into dated archives:

From	To
`app-baseline/PLATFORM_INTELLIGENCE_AND_PERFORMANCE.md.bak-20260830-1244`	`app-baseline/archive/bak-20260903/`
`app-baseline/PLATFORM_TARGETS.md.bak-20260830-2043`	`app-baseline/archive/bak-20260903/`
`app-baseline/VERIFICATION_AND_EVIDENCE.md.bak-20260831-160956`	`app-baseline/archive/bak-20260903/`
`domains/domains.json.bak-20260823-0128`	`domains/archive/bak-20260903/` (`git mv`)
`domains/domains.json.bak-20260829-0118`	`domains/archive/bak-20260903/` (`git mv`)
`domains/domains.md.bak-20260829-0118`	`domains/archive/bak-20260903/` (`git mv`)

I had reported five; the inclusion list found six. The three app-baseline ones are untracked (app-baseline/.gitignore carries *.bak-*), so they moved with plain mv and stay untracked.

3. Commands run (the ones that changed state)

# archive moves
mkdir -p app-baseline/archive/bak-20260903 domains/archive/bak-20260903
mv app-baseline/*.bak-* app-baseline/archive/bak-20260903/          # 3, untracked
git -C domains mv <3 files> archive/bak-20260903/                   # 3, tracked

# stale lock, moved aside not deleted
mv domains/.git/index.lock <scratchpad>/domains-index.lock.stale-20260903

chmod 644 domains/SKILL-domain-portfolio.md                          # was 600, outlier

git -C app-baseline add README.md PROJECT_KICKOFF.md && git -C app-baseline commit
git -C domains add SKILL-domain-portfolio.md && git -C domains commit

Commits: app-baseline 636830c · domains aae178c + b2c3d32.

4. Verification evidence

Claim	Check	Result
28 / 14 consumers	`grep -rl --include=Package.swift 'lib/ecs0lib' ~/dev/apps \| wc -l`	28 / 14
No `439` left in owned docs	`grep -rn 439 README.md index.html app-baseline/.md domains/.md`	no matches
Zero `.bak` at top level	`find app-baseline domains -maxdepth 1 -name '.bak-' \| wc -l`	0
All 6 preserved	`find app-baseline/archive domains/archive -name '.bak-'`	6
Live docs intact	`ls -la` on the 5 files the `.bak` copies shadowed	all present, mtimes unchanged
`domains.json` not damaged	`python3 -c "json.load(...)"`	parses, `count: 455 len: 455`
Both trees clean	`git status --short` in each repo	empty

Not verified, stated plainly: no swift build and no swift test was run in either package this session. The build commands written into CLAUDE.md are transcribed from ecs0lib/CLAUDE.md, not exercised. There is no test count recorded, so this session provides no before-value for a test-drop check.

5. Two traps hit while doing this — both caught, both worth keeping

auto_renew vs renew_auto. Probing auto_renew returned False for all 385 ACTIVE domains — a portfolio-wide renewal failure, and entirely plausible. The real field is renew_auto, which is True for all 385. A missing key yields False for every record and looks exactly like a real finding. Caught by checking the key names before believing the result; recorded in SKILL-domain-portfolio.md and the domains commit message so the next agent doesn't repeat it.
A git add that failed under suppressed stderr. I passed already-moved pathspecs alongside a live one under 2>/dev/null; git add rejected the whole invocation, added nothing, and the subsequent commit silently captured only the pre-staged renames. The post-commit git status --short check caught it. Same defect class as everything in the fleet CLAUDE.md: a failure that reads as success.

6. Backups / how to undo

.bak archives: reversible with one mv (or git mv) per file back to the parent directory. Nothing was deleted.
Commits: git -C app-baseline revert 636830c; git -C domains revert b2c3d32 aae178c.
Stale git lock: kept at /private/tmp/claude-501/-Users-richh-dev-lib/9b884bd7-.../scratchpad/domains-index.lock.stale-20260903 (0 bytes; restoring it would only re-block git).
~/dev/lib/CLAUDE.md: not under git. The prior version is quoted in full in this session's transcript; no on-disk copy was kept. This is the one item here with no clean rollback path.

7. Outstanding owner actions

None blocking. ~/dev/lib/CLAUDE.md "Needs Rich's attention" is now empty.
Worth a decision at some point: ~/dev/lib not being a git repo means CLAUDE.md, README.md, index.html, SESSION-STATE.md and LIBRARY-CANDIDATES.md at the domain root have no version history at all. Every meaningful subdirectory is versioned; the root is not.

8. Secrets

None written. xcode-config/ holds team IDs and signing identities — identifiers, not secrets — and no key material was read, copied, or referenced by value in any file this session.