fix(OMN-18606): let the lane census refresh itself instead of waiting for a human

[jonahgabriel]

Closes OMN-18606. Parent OMN-13034 (the lane-census ratchet, retro B-6).

What was actually wrong

Lane Census Staleness has been red on every omnibase_infra PR since 2026-09-17T10:07Z because deploy/lane-census/census-snapshot.json carried emitted_at 2026-09-10T10:06:57Z against a 7-day limit.

The reported cause was a hung census timer on .201. It was not. onex-disk-gc.timer is a systemd user unit, which is why a system-scope probe reported it absent and misread its state. Under systemctl --user it reads Active (waiting) since 2026-08-23, Trigger: Thu 2026-09-17 13:00:42 EDT, and its service ran 12:00:18 -> 12:36:24 EDT that morning and exited 0/SUCCESS. Nothing was hung, and nothing was restarted.

Four separate defects meant the census had no self-refreshing path and never had one.

	Defect
D1	The lane-census drop-in was never installed on .201. ~/.config/systemd/user/onex-disk-gc.service.d/ did not exist; the effective unit carried four ExecStart lines and no census pass. A clean hourly SUCCESS looked identical to a healthy install.
D2	Even installed, the drop-in ran the script with no output path, so the tick wrote nothing. The committed census was only ever refreshed by a hand-opened PR.
D3	The gate's own remediation told the reader to run --json, which emits the plan document. The plan carries no emitted_at, the one field the gate reads, so the documented fix produced a file the same gate rejected as malformed. The snapshot it actually reads is the typed event document, emitted only by --dry-run, which was undocumented for that purpose.
D4	The script returned 0 before building that event whenever has_drift was false. A fleet matching its manifest could emit no census by any path, so the gate was satisfiable only while the fleet was drifting.

D2's cost is measurable: every refresh in the file's history is a hand-opened PR (#2395, #2691, #2846, #2998, #3394, #3489), and OMN-13034 itself was reopened and re-closed five times, each time to heal this same gate.

The fix

• lane-census-check.sh --snapshot PATH (- for stdout) builds the typed event before the no-drift early exit and writes it. The drift verdict and every exit code are untouched, so the fail-soft drop-in semantics and the bus publish are unaffected. --snapshot - refuses --json and --dry-run, which together wrote two concatenated JSON documents to stdout.
• The hourly drop-in passes --snapshot, so the tick refreshes the census.
• The gate's two remediation messages and its module docstring name the recipe that works. The docstring's claim that the timer produced the snapshot was false and is corrected.
• install-lane-census.sh --verify turns an uninstalled or stale drop-in into an exit code rather than something a reader has to notice in printed output.

Verified end to end on .201 under a scratch directory that was removed afterwards. The new flag wrote a gate-valid document at emitted_at 2026-09-17T16:46:03Z and still returned 30 for the five warning-severity drift items. The committed snapshot is that run's output.

All three workflow steps pass locally against it:

check_lane_census_age.py   -> OK: census snapshot is 0h old (lanes=['stability-test','judge','dev','lakshman']); exit 0
check_lane_env_drift.py    -> OK: no env-vs-manifest drift; exit 0
generate_claude_lane_block -> renders; verified: 2026-09-17T16:46:03Z via lane-census-check.sh on .201; exit 0

Five new tests in tests/unit/scripts/test_lane_census_snapshot_emit_omn18606.py, each proven red against the origin/dev pre-image read out of the object store (no stash, no working-tree mutation). The load-bearing one is the round trip: a zero-drift plan through the real build_event and the real check_census_age, which on the old tree had no document to hand the gate at all. One test was vacuous on first write, matching the script name in a header comment rather than the build line, and was re-anchored on the assignment.

uv run pytest tests/unit/scripts/ -k census  ->  78 passed
pre-commit run --files <changed>             ->  all hooks Passed
uv run mypy scripts/check_lane_census_age.py --strict  ->  Success

Note for the reviewer

This PR makes the census refreshable; it does not by itself install the drop-in on .201. D1 is a host-state fact and --verify is what makes it observable. The gate should stay advisory until this lands: a gate that cannot be satisfied on a clean fleet (D4) must not be made blocking.

https://claude.ai/code/session_01Mg3nhbHwH7a3UoKLhRMFKk

Evidence-Ticket: OMN-18606
Evidence-Source: OCC#10045

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: glm-review
Models failed: codex
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 9
Nit-level findings suppressed: 2

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 9 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] scripts/lane-census-check.sh (glm-review) — EVENT_JSON unset when snapshot to stdout with no drift suppressed path | When SNAPSHOT_OUT is set and HAS_DRIFT is True, the snapshot file is written before the drift block. But when SNAPSHOT_OUT is n
• [MAJOR] scripts/lane-census-check.sh (glm-review) — Snapshot write is non-atomic; readers can observe truncated file | printf redirects directly to $SNAPSHOT_OUT. The CI gate and any other consumer reading deploy/lane-census/census-snapshot.json (or th
• [MAJOR] scripts/lane-census-check.sh (glm-review) — Snapshot written even when plan generation failed upstream | The script exits 3/4 on missing deps or unobservable inventory before reaching the snapshot block, but if PLAN_JSON is produced by a degrad
• [MAJOR] deploy/lane-census/census-snapshot.json (glm-review) — Committed snapshot drops the two critical container_absent findings | The new snapshot records drift_count 5, all warnings, severity 'warning'. The prior snapshot recorded two critical container_absen
• [MAJOR] tests/unit/scripts/test_lane_census_snapshot_emit_omn18606.py (glm-review) — Tests assert on script source text, not behavior | test_script_accepts_a_snapshot_flag, test_snapshot_is_built_before_the_no_drift_exit, test_stdout_snapshot_refuses_to_share_stdout, test_gate_remedia
• [MINOR] scripts/lane-census-check.sh (glm-review) — Snapshot destination path taken unvalidated from argument | --snapshot accepts any path and mkdir -p's its dirname. In the drop-in the path is fixed, but the flag is also the documented remediation fo
• [MINOR] tests/unit/scripts/test_lane_census_snapshot_emit_omn18606.py (glm-review) — Source-order pin is brittle to benign refactors | test_snapshot_is_built_before_the_no_drift_exit anchors on body.index('No lane drift. Desired == actual.'), a log string, and requires exactly one occ
• [MINOR] deploy/lane-census/install-lane-census.sh (glm-review) — --verify checks only registration, not execution health | --verify passes when the drop-in exists and the unit mentions --snapshot. It does not check that the last census run succeeded or that the sna
• [MINOR] scripts/check_lane_census_age.py (glm-review) — Gate trusts emitted_at, a client-supplied field | The staleness gate accepts any JSON with an emitted_at within seven days. The new snapshot path makes it trivial to satisfy the gate by running the sc

[github-actions]

⚠️ Hostile Reviewer — DEGRADED (informational)

Critical findings: 0
Major findings: 2
Total findings: 6
Models succeeded: glm-review

Note: Fewer than 2 reviewer models succeeded. Degraded results are informational (OMN-8468/OMN-8524) and do not block merge. Error: cli_review exit 2 (fewer than 2 models succeeded — partial/total outage)

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	No

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review, qwen3-review-b, glm-review (OMN-8468/OMN-8524/OMN-17492)

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: glm-review
Models failed: codex
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 5
Nit-level findings suppressed: 1

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 5 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [MAJOR] tests/unit/scripts/test_lane_census_snapshot_emit_omn18606.py (glm-review) — No test executes the shell script; round-trip test bypasses the fixed defect | The headline fix is in lane-census-check.sh's control flow (event built before the no-drift early exit, --snapshot writes
• [MAJOR] deploy/lane-census/census-snapshot.json (glm-review) — Committed snapshot drops prior critical findings with no gate on severity | The replaced snapshot previously recorded two container_absent findings at severity critical (both tenant-projection-writer
• [MINOR] deploy/lane-census/install-lane-census.sh (glm-review) — --verify passes on a stale ExecStart because grep matches the drop-in comment | The verify branch greps systemctl --user cat output for the literal string --snapshot. The drop-in conf itself contain
• [MINOR] scripts/lane-census-check.sh (glm-review) — Snapshot write is not atomic | printf '%s\n' "$EVENT_JSON" >"$SNAPSHOT_OUT" truncates then writes. If the tick is interrupted mid-write, or a concurrent reader (the CI workflow that copies the committ
• [MINOR] scripts/lane-census-check.sh (glm-review) — No declared behavior for --snapshot when inventory is unobservable | The header documents exit 4 (inventory unobservable) as distinct from drift, but the change does not state whether the snapshot is