test(accounting): the published tbx count is one number, guarded without the delivery

`assert sum(tbx.values()) == 568` sat behind a `skipif` on a file only
this machine has, so on a fresh clone the sentence five files publish was
unguarded again -- the state in which 574 survived in four docstrings
until PM counted it.

`N101_TBX_TAGS` is now the one place the number lives, the delivery test
asserts against it, and a second test reads the published sentence out of
all five files and holds them to it. It needs no corpus and no clock:
editing CLAUDE.md to 600 is red on a fresh clone.

It was red at birth for a reason worth keeping: the scan read this test
file's own known-positive string (`574`) as a sixth publisher. The
known-positive is now assembled from pieces, and that failure is the
demonstration that the scan reads what it is pointed at.

What it does NOT prove is stated in the docstring: five files agreeing is
agreement, not a count. The measurement stays where it was.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_accounting_gate.py

@@ -20,6 +20,7 @@ inventory or a per-element account. These tests are GREEN and prove three things
 from __future__ import annotations
 
 import json
+import re
 import subprocess
 import sys
 import tempfile
@@ -377,6 +378,68 @@ def test_a_prefixed_tag_that_names_no_role_stays_uncounted() -> None:
         assert witness._sts_role_json(witness._local(tag), "sec", "body") is None
 
 
+#: THE ONE PLACE THIS NUMBER LIVES. The count itself is measured over the
+#: delivery by `test_n101s_own_prefixed_tags_are_counted_here_and_name_no_role`
+#: -- but that test is `skipif`-gated on a file only this machine has, so on a
+#: fresh clone the four published sentences were unguarded again, which is how
+#: 574 survived in four docstrings until PM counted it. The guard below needs
+#: no delivery: it reads the published sentences and holds them to each other
+#: and to this constant.
+N101_TBX_TAGS = 568
+
+#: The published sentence, in the five files that carry it. Anchored on `N101`
+#: and on the literal `tbx:` that follows the number, so it cannot match some
+#: other count standing nearby.
+_PUBLISHED_TBX = re.compile(r"N101(?:'s)?[^.]{0,80}?\*{0,2}(\d+)\*{0,2}\s*`tbx:`")
+
+#: Every file that states it. A sentence moving to a sixth file without being
+#: added here is the residual, and it is the same residual the constant
+#: replaces one level down -- this list is what keeps the number readable in
+#: one place rather than five.
+_TBX_PUBLISHERS = (
+    "CHANGELOG.md",
+    "CLAUDE.md",
+    "tools/okf_witness.py",
+    "tests/test_accounting_gate.py",
+    "docs/2026-09-19-regnskapsgaten-rest-og-normaliseringsdoren.md",
+)
+
+
+def test_the_published_tbx_count_is_one_number_and_needs_no_delivery() -> None:
+    """The published strings are held to each other, on any machine.
+
+    This is the half the measurement could not cover. `_tags_of` counts the
+    real delivery and is right to; it also cannot run where the delivery is
+    absent, and an assertion that skips guards nothing. Editing `CLAUDE.md` to
+    600 tomorrow is red here, on a fresh clone, with no corpus.
+
+    It proves nothing about the WORLD -- five files agreeing is agreement, not
+    a count -- which is why the delivery test keeps its own measurement and
+    this one only holds the sentences to the constant it asserts.
+    """
+    root = Path(__file__).resolve().parents[1]
+    for name in _TBX_PUBLISHERS:
+        path = root / name
+        assert path.is_file(), f"{name}: the file that publishes the count is gone"
+        # Whitespace-folded first: the sentence wraps differently in each file.
+        text = " ".join(path.read_text(encoding="utf-8").split())
+        found = _PUBLISHED_TBX.findall(text)
+        assert found, f"{name}: the published sentence is gone, or no longer says `tbx:`"
+        assert [int(value) for value in found] == [N101_TBX_TAGS] * len(found), (
+            f"{name}: publishes {found}, and the number this repository stands behind "
+            f"is {N101_TBX_TAGS}"
+        )
+
+    # KNOWN-POSITIVE for the pattern itself: it must find a number that is
+    # NOT the published one, or the loop above could be passing over nothing.
+    # Assembled from pieces so the scan above does not read this line as a
+    # sixth publisher -- written whole, it made the guard red on its own
+    # fixture, which is also the clearest demonstration that the scan reads
+    # the file it is pointed at.
+    wrong = "N101 ships " + "574" + " `tbx:` tags"
+    assert _PUBLISHED_TBX.findall(wrong) == ["574"]
+
+
 N101_DELIVERY = gate.N200_DEFAULT.parent / "N101-2025-860031.json"
 
 
@@ -412,7 +475,7 @@ def test_n101s_own_prefixed_tags_are_counted_here_and_name_no_role() -> None:
     names = _tags_of(N101_DELIVERY.read_bytes())
     assert sum(names.values()) > 0, "the walk found no tag at all"
     tbx = {tag: n for tag, n in names.items() if tag.startswith("tbx:")}
-    assert sum(tbx.values()) == 568
+    assert sum(tbx.values()) == N101_TBX_TAGS
     for tag in sorted(tbx):
         assert witness._sts_role_json(witness._local(tag), "sec", "body") is None, tag