docs: the census derivation was wrong in prose, and it was an instruction (#752)

CHANGELOG.md

@@ -28,9 +28,24 @@ true until the next version shipped.
   change is its own argument for that rule. Written against an earlier base the same
   seed produced `913 -> 1117`; #983 then landed forty rows and pruned two, and the
   census became 1155. Carrying 1117 forward would have been arithmetic that was true
-  when it was written and false when it shipped. The census is `grep -c` over the
-  ledger, re-run after the rebase; the ceiling is the registered list minus the
-  ledger's own suites.
+  when it was written and false when it shipped.
+
+  CORRECTION, and the wrong version is left visible because the sentence was an
+  INSTRUCTION. This entry first said the census is `grep -c` over the ledger. It is
+  not. The gate compares the budget against the count of rows whose last-red is
+  `never`:
+
+      awk -F'\t' '$4=="never"' test/check_ledger.tsv | wc -l
+
+  A plain row count agrees with that only while nothing has ever been seen red, which
+  is true of this tree today (1155 rows, 1155 never, 0 ever red) and stops being true
+  the first time a check is attacked -- the event the ledger exists to record. So the
+  number here was right by luck and the method was wrong, in an entry whose whole
+  subject is derive rather than carry. Reported by @OffgridwithJD. The correct
+  derivation now sits in `check_ledger_budget.txt` beside the number it governs, so
+  the next person does not have to find it in a changelog.
+
+  The ceiling is the registered list minus the ledger's own suites.
 
   WHY THIS SUITE, measured rather than chosen by taste. It is the heap-versus-columnar
   differential correctness suite, so a check that cannot fail there is a wrong answer

test/check_ledger_budget.txt

@@ -34,4 +34,15 @@ suites_not_covered 249
 #   Without that it is a hand-maintained count that drifts, which is the failure
 #   this repository has spent a day proving. It is not a ceiling; it is a
 #   measurement that must be true.
+#
+#   HOW TO RE-DERIVE IT, written here because a changelog entry got it wrong and a
+#   derivation is only useful where the number is:
+#
+#       awk -F'\t' '$4=="never"' test/check_ledger.tsv | wc -l
+#
+#   Rows whose LAST-RED is `never`, not the row count. The two agree only while
+#   nothing has ever been observed red, so a plain `grep -c` overcounts by exactly
+#   the number of attacked checks -- and it overcounts from the first moment this
+#   ledger does the job it exists for. The gate prints both quantities side by side
+#   (`rows=N | never observed red=M`) because they are different questions.
 checks_never_observed_red 1155