the per-pds account counts are meant to equal the repo rows that are active with that pds, which is what the v6 rebuild counts. only the relay moved them, and from the row it read, so every other writer of `active` or `pds` let them drift: a backfill sets the pds from the doc and can force a repo active, the backfill finish flips active from the status, the crawler's listings deactivate and reactivate rows, a failed fetch marks a repo inactive, the minidoc refresh rewrites the pds, and erasing or discarding a repo removes its row. eg a deactivation took one off, a backfill forced the repo active without adding it back, and the next active event saw it active already, so the host stayed one short for good. the relay also counted the row it made up or read rather than the rebased row it wrote, so a row made inactive meanwhile still counted once its probe failed. every repo row write now goes through Txn::put_repo or Txn::remove_repo. they take the repo lock, read the row the write replaces (or what the same txn already put), and move the count from that row's host to the new one, counting a row the same way the v6 rebuild does. the relay applies the host limit status for the hosts a write moved. AGENTS.md names the rule.