VM101 / WG Paid Machine Git count methods
Generated UTC: 20260713-193942

Canonical tools on router-ops:
- /opt/router-ops/lib/machine-git-count-contract.sh
- /opt/router-ops/bin/router-machine-git-facts
- /opt/router-ops/bin/router-step-machine-git-guard
- /opt/router-ops/tests/test-machine-git-count-contract.sh
- /opt/router-ops/policy/machine-git-count-contract-v1.md

Mandatory contract:
- Full tree count: git ls-tree -r --full-tree --name-only.
- Independent count: non-directory entries from git archive.
- Counts must match or STEP is STOP.
- tracked_file_count is forbidden.
- Use git_tree_file_count, published_archive_file_count, changed_file_count, changed_files.
- Run router-step-machine-git-guard before changes and again before PASS.

Regression proof:
- legacy command from a root subdirectory returns 2 of 4 files;
- canonical command returns 4 from work-tree root, subdirectory and /tmp;
- git archive independently returns 4;
- unsafe sample code and ambiguous facts are rejected.

R13A correction:
- previous reported count: 21 (root subtree);
- correct Git tree count: 44;
- changed files: 1 (root/hmn/hmn-download-all-awg.sh);
- published archive files: 44;
- runtime classification remains PASS.

Access and machines:
- No VM was inspected or modified in this STEP.
- Machine source facts were taken from the published R13A and VM101 Machine Git folders.
- VM101 current model remains: https://receiver-rejected-average-combat.trycloudflare.com/r/e94a0859747d7b96f29c7fdafc2d0351ba603bb0a7e9e5a4/20260713-192030_vm101_model_hmn_download_selector_r13a/vm101-model.txt