Message leg of the truthful top-X/N-hours report: hub-message-census.sh, rows and sends side by side with the aro half declared unavailable

DELIVERED 2026-10-06, pushed c800d15: hub-message-census.sh v1.0 + hub-message-census.test.sh (14 assertions, 2 mutants caught, suite green). FILED AS A CHILD RATHER THAN AS KPI-66 ITSELF, deliberately. KPI-66's description is TOKEN accounting over fleet_tokens - pg/web identity disagreement, bucket-grain vs event-grain, automation_job class - and its contract half is KPI-68, which is untouched by this and still gated on Elazar ratifying fleet_tokens as the fleet store of record. What pmmaster-evolutiva-cc ordered built today (2026-10-06 10:22 ART) is the MESSAGE leg: top-X senders over an arbitrary N-hour window, grouped on the tag stem, rows and sends side by side, served window printed, aro half stated as not distinguishable rather than estimated. That is a different substrate (the hub's v2.sqlite, not telemetry pg) answering a different question, and closing KPI-66 on it would mark the token epic done on work that never touched a token. A row in the wrong project misroutes exactly as a misattributed finding does. WHAT IT DOES: deliveries and sends side by side, never one number where two exist. 23.8% of all 145633 stored rows are fan-out duplicates of another row (25.1% in the last 24h), so a raw count(*) per sender ranks fan-out habit as much as volume - 1033 rows / 460 sends for one seat against 400/354 for another on the same day. HOW A SEND IS RECOVERED, and its exact limit: tag is UNIQUE so N recipients cannot share one; the hub writes sender-nonce-recipient for a to:[] array of N>1 and a bare sender-nonce for N=1, so stripping a trailing -recipient yields the send. 16054 multi-row stems in the corpus, ZERO spanning two senders, exactly ONE spanning more than 0 seconds. WHAT IT REFUSES TO ESTIMATE: an aro broadcast is not recoverable this way (one broadcast can land as several stems - scrp-syscheck-whey at ts 1791286388 has a two-row suffixed stem beside a separate bare-nonce row one second later), and the only grouping available is to bucket by sender+aro+time, which IS the guess being tested, so any rate from it is circular. Aro rows are counted on the same convention and the column is labelled an UPPER BOUND with the send count UNAVAILABLE. It reads neither fanout nor explicit_to and prints that it does not: both are 1 on a single-recipient array send and on a 4-recipient one alike, and both are 0 on every row before 2026-07-30. WINDOWS SERVED, NOT SUBSTITUTED (KPI-66's own contract clause): --hours refuses non-numeric and non-positive with exit 2, a window reaching before the oldest stored row is served TRUNCATED with both bounds and the store floor on its own line, an unreadable store exits 3 rather than reporting an empty census, and one shared server-side query feeds the table and the totals so they cannot disagree about the window. SELECT only, mode=ro. CONTROLS FORCED RED BEFORE ACCEPTANCE: fixture with a known true send count (one 4-recipient array send, three sequential singles, one aro broadcast split across two stems). Mutant A uses the tag as the stem - the array send reads as 4 sends. Mutant B drops the distinct-stem count from the headline - it reports 0.0% duplicates where the fixture's true figure is 40%. Case [5] asserts the tool reports 2 sends for a broadcast whose true count is 1 AND labels it, not that 2 is correct. Case [9] reads the live store for SHAPE only, asserting the UNIQUE constraint the convention rests on still exists. CONSUMER: monitor-llmmsgsrv-cc, who confirmed 2026-10-06 10:12 ART they will rank by stem count rather than row count. NOT MEASURED: whey and lezama hold no copy of this store - it is venus-local.