Say What the HomeAutomation-Config Intent Advisories Measure

reports/homeautomation-config/audit.md

@@ -62,7 +62,7 @@ The two defects below are both outside what the runner evaluates, which is why a
 
 ## Drift Findings
 
-- **The four intent advisories are date-only.** `.editorconfig`, `.editorconfig-checker.json`, `.gitattributes`, and `version.json` are each byte-identical to the hub's current canonical at `2c5802f`, so there is nothing to carry. The advisory fires because the repository's last commit on each file predates the hub's last commit on the canonical, and an intent finding verified satisfied has no way to be cleared. That is hub #727, so these four advisories recur on every run until it lands and are not a repository finding.
+- **The four intent advisories are date-only.** `.editorconfig`, `.editorconfig-checker.json`, `.gitattributes`, and `version.json` are each byte-identical to the hub's own copy at `2c5802f`, so there is nothing to carry. The advisory does not compare against that copy. It measures each file against its `intentRef` document (`spec/files.json:18-25`), `GOVERNANCE.md` for the first three and `WORKFLOW.md` for `version.json`, and it fires because that document changed after the repository's last commit on the file. A config file never matches the document it is measured against, so the advisory's identity skip cannot clear it, and the only other way to clear it is a commit to a file that needs no change. That is hub #727, so these four advisories recur on every run until it lands and are not a repository finding.
 - **`PSScriptAnalyzerSettings.psd1` is an untriaged path collision.** The file is the repository's own PSScriptAnalyzer configuration for its Windows host scripts (`PSScriptAnalyzerSettings.psd1:3-8`), which the hub gate reads from the root, so the `hub-only` hit is a collision rather than a carry, and deleting it would change what the gate enforces. The remedy is an `accepted` entry in `spec/divergences.json`, the shape `.github/actionlint.yaml` and `.github/actions/validate/action.yml` already have for this repository. Tracked as hub #1718.
 - **Two workflows leave the token grant to the repository default, and that default is write.** Neither `.github/workflows/test-pull-request.yml` nor `.github/workflows/publish-release.yml` declares a workflow-level `permissions:` block, where the hub's reference stubs declare `permissions: {}` (`catalog/snippets/workflows/test-pull-request.yml:17`, `catalog/snippets/workflows/publish-release.yml:22`). The aggregator job (`test-pull-request.yml:27-39`) and the `plan` job (`publish-release.yml:16-22`) therefore run under the repository's default workflow token, which the Actions settings API reads as `write` with pull request approval allowed. No D-guarantee names a workflow-level block, so this is a letter miss against the reference rather than a contract defect. The fix is `permissions: {}` at the top of both files, tracked downstream as ptr727/HomeAutomation-Config#437, and the setting half is escalated below.
 - **Whole-tree prose backlog, fixed as each file is next edited.** 429 findings from the hub `scripts/prose_lint.py` at `2c5802f` over a `main` export, 30 files, all repository-owned: `comment-wrap` 208, `charset` 81, `comment-case` 63, `semicolon` 35, `dash` 23, `home-path` 17, `dupword` 2. The heaviest files are `PhotoCleaner/PhotoCleaner.sh` (129), `Hailo/install-hailo.sh` (59), `Docker/stacks/immich/immich-heic-decode-failures.md` (47), and `README.md` (32). The `home-path` hits sit at `ARCHITECTURE.md:71`, `Docker/stacks/automation/compose.yml:313`, `Docker/stacks/immich/immich-heic-decode-failures.md:347`, `HARDWARE.md:620-624,969-970`, and `README.md:272,1016,1379-1380`, and are the ones worth reading first, since each is an absolute home path committed to the tree. The diff-scoped CI gate keeps the backlog from growing.