chore(docs,scripts): system-context page states no census totals; the census gate keeps the register (#22950)

Fixes #22927
Clause-②: no

Executes ruling letter B on #22927 (comment 6117410296): the CI-checked
statistics leave `content/docs/permissions/system-context.mdx`; "every
elevation site is registered" (POPULATION) and "every anchor resolves"
(RESOLUTION) stay enforced, unchanged, in the required `Lint & Repo
Gates`.

## What changed

| File | Change |
|:---|:---|
| `content/docs/permissions/system-context.mdx` | The headline, the
plugin-sharing sentence, the "no split" ruling's argument and the
maintenance note are rewritten without exact numbers ("over a hundred
sites across some twenty packages"; `node scripts/isystem-census.mjs`
for a live count). The CI-checked figures leave the decomposition table,
which is split into a dated raw-text snapshot (the six figures that were
never compared, unchanged) and a numberless list of census steps. Every
register row and every anchor is untouched. The "no split" decision is
unchanged; only its wording moved. |
| `scripts/check-system-context-census.mjs` | `DECLARED_COUNTS`,
`regenerateDeclaredCounts`, `carryOnwardRowCount`, the two count helpers
and the COUNTS check are deleted. `--fix` now refuses with exit 2 and
says why (nothing on the page is generated) instead of rewriting
numbers. POPULATION, RESOLUTION, CLASSIFICATION, the row-reference check
and the dated-decomposition presence check are unchanged. |
| `.gitattributes` | The page leaves `merge=os-regen`; the page's
comment block is rewritten to say it is plain prose now and why. |
| `package.json` | `gen:system-context-census` is deleted (callers
below). |
| `scripts/regen-artifacts.mjs` | The page's `REGEN_ARTIFACTS` row goes
with its route (a short tombstone comment stays); the `mixed` docblock
and the `content/docs/permissions/**` ledger entry stop saying the page
is routed. |
| `scripts/pm/os-regen-merge.sh` | The page's `OS_REGEN_CLASSES` row
goes; the self-test drives its mixed limb on a synthetic pattern while
no real pattern is mixed (details below). |

Size: 6 files, +289 / -878 against the merge base (net -589). The card
estimated -200 to -400.

## Measurements behind the file list (dispatch hypotheses H1 to H5)

- **H1, same-day churn.** Every count sentence was located by content at
`1bd612bd6`, then `origin/main` was merged once (`e357a441c`, two
commits, neither touching these six files). Open PR #22935 also edits
the page; it had not landed when this was opened.
- **H2, importers.** `git grep` at `1bd612bd6`: `DECLARED_COUNTS`,
`regenerateDeclaredCounts` and `carryOnwardRowCount` have no importer
outside the gate (two prose mentions only: the page and a comment in
`scripts/regen-artifacts.mjs`). The only symbol anchor into the gate
from elsewhere is
`scripts/check-system-context-census.mjs#UNENFORCED_TEXT_COUNTS`, cited
twice by `scripts/check-tenant-audit-census.mjs` as the precedent for
its own maintainer-ruled enforced/unenforced split; that export, its
present-and-dated check and the quoted paragraph are kept, so the
sibling is not touched. Self-test batteries: `counts` (6 cases) and
`CRITERION` (2) tested only the counts and are deleted; `the same
criterion, behaviourally` (3) is renamed `the dated decomposition:
present and dated, never compared` with the same three cases; the
POPULATION case under `the contract still reds` no longer asserts a
headline count; the 8-case `--fix regenerates` battery is replaced by a
4-case `--fix is retired` battery that runs the flag as a child and
asserts exit 2. The roster floor moves 18 to 16 for the two deleted
batteries.
- **H3, what leaving the route requires.** `check:merge-driver`
(`git-merge-regen.mjs --self-test`) reconciles `.gitattributes` with
`REGEN_ARTIFACTS` both ways and requires every `gen:*` script to have a
disposition, so the page's row had to go with its route and
`gen:system-context-census` had to go or gain a `NOT_DRIVER_MANAGED`
entry. Separately, `bash scripts/pm/os-regen-merge.sh --self-test` (a
step of the required `Lint & Repo Gates` job, not in the derived family
list) holds `OS_REGEN_CLASSES` equal to `.gitattributes` and to the
driver's mixed rows: measured red with the route removed (2 cases: the
classification table and its control). The page was the only `mixed`
row, and that self-test pinned at least one mixed pattern, so with none
left it now drives the same fixture and the same two discriminating
mutations on a synthetic pattern (`docs/fixture/mixed-census.mdx`), and
the control's third leg injects that synthetic route so it still fires
instead of comparing empty to empty. All cases pass after the change,
the mutations included. `git-merge-regen.mjs` needed no edit: its mixed
end-to-end case already reports "no mixed rows declared, nothing to
prove", by design.
- **H4, callers of `gen:system-context-census`.** `package.json` itself,
the page's `REGEN_ARTIFACTS` row (`gen` field), the page's own prose,
and comments in `scripts/pm/os-regen-merge.sh` and in the gate. No
workflow, skill, AGENTS.md line or other script runs it. Deleted rather
than turned into a live-count command: the live count already has a
direct command (`node scripts/isystem-census.mjs`) and the gate's pass
line prints it on every run, and a `gen:` name that writes nothing would
still need a merge disposition for a script that generates nothing.
- **H5, size.** The diff shrinks (net -589).

## A consequence of removing the counts, measured

Probe at `1bd612bd6`, driving the gate's `evaluate()` with the real
page, census and sweep, plus or minus one read in a symbol the page
already anchors (`packages/objectql/src/engine.ts#insert`, two reads):

```text
before  +1 read in that symbol: 5 problem(s) [declared-count]  (headline-sites 130 vs 131, ...)
before  -1 read in that symbol: 5 problem(s) [declared-count]
after   +1 read in that symbol: 0 problem(s)
after   -1 read in that symbol: 0 problem(s)
```

So adding or deleting one of several reads inside an already-anchored
symbol no longer reds anything. Before, it reddened only the counts, and
the gate's own prescription for that red was the generator, which
rewrote the numbers and required no row; POPULATION has always worked at
symbol granularity. A read in a symbol no row anchors still reds, and a
symbol whose last read is gone still reds through CLASSIFICATION. The
page's precision callout and the "What CI holds" section now state this
hole for additions as well as deletions, and the gate header records the
probe. Closing it is the span-aware resolver the gate header already
names as its own card.

## One correction in a rewritten sentence

The plugin-sharing sentence said "The largest single consumer — 17 of
the 130 sites"; only the numbers were checked. Measured at `1bd612bd6`
(`node scripts/isystem-census.mjs --json`, reads per package):
`packages/runtime` 26, `packages/plugins/plugin-security` 21,
`packages/plugins/plugin-sharing` 17. It now reads "One of the largest
consumers of the flag".

## Deviations from the claimed file surface

- Two files beyond the four claimed, `scripts/regen-artifacts.mjs` and
`scripts/pm/os-regen-merge.sh`: both are required by the route removal
the ruling orders (H3), each red without its edit.
- Page edits beyond the four sentences and the maintenance note, each
forced by the ruling's headline or made false by it: the info callout
said every count is checked by CI; the precision callout said one
deleted read "may not" red (it now does not, for additions too); the
CI-checked figures in the decomposition table (the table is split, the
six dated figures unchanged); "9 of the 59 anchored files" (a checked
figure); "a site that vanishes takes the census total with it"; the
`Counts` row of the checks table (replaced by a `Dated snapshot` row,
since that check still runs); one sentence naming `DECLARED_COUNTS`; and
the declarations paragraph, which described "the enforced declarations
row".

## Gates

Run on the final head `9354a731e`, derived with `node
scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` (the same 69 families as the dispatch's
lead), plus `bash scripts/pm/os-regen-merge.sh --self-test`.

68 of 69 derived families exit 0 at `9354a731e`; the record reconciles
with `node scripts/pm/dispatch-gates.mjs --ran`: "69 derived, 68 run, 1
NOT-MEASURED, 0 UNRUN". `bash scripts/pm/os-regen-merge.sh --self-test`
also exits 0 ("all cases pass"; before its edit, 2 cases failed: the
classification table and its control).

- NOT MEASURED: `pnpm check:dual-build-cjs-loads`. Reason: it loads
every package's built `dist/`, and this worktree built only the
`@objectstack/lint` and `@objectstack/client-react` closures (exit 3,
the gate's own PREREQUISITE NOT MET). The diff touches no package
source, manifest or build config.
- Partial: `pnpm check:dts-closure` and `pnpm
check:sourcemap-no-sources-content` passed over the 36 packages built
here, not the whole workspace.
- `node scripts/check-system-context-census.mjs`: "OK — 130 elevation
read sites in 20 packages across 59 files, living in 110 symbol(s); the
page cites 123 symbol(s) against 123 required, over 146 anchors and 7
file-level citation(s); 21 declared non-read; 9 file(s) hold more than
one read in one symbol (the declared precision loss); 20 row
reference(s) resolve to their keyed row, 0 declared unheld." Its
`--self-test`: "all cases passed" (16 batteries). `--fix`: exit 2,
"RETIRED".
- `pnpm check:merge-driver`: "all 42 generator(s) across 82 manifest(s)
have a recorded disposition", "0 mixed row(s) name a comparator that
exists and discriminates", "merge driver wiring is consistent (37
path(s) deliberately excluded)".
- `pnpm --filter @objectstack/spec run check:docs`: "226 generated files
in sync". `pnpm check:role-word` caught a reserved word in the first
draft of one new sentence; reworded, now exit 0.
- ESLint, narrowed to the two changed `.mjs` files (the other changed
files match no `files` glob in `eslint.config.mjs`): 2 files linted by
the `--format json` count, 0 errors, 0 warnings. The config enables no
type-aware linting (no `parserOptions.project`), so this diff cannot
move a verdict on an untouched file. The repo-wide `pnpm lint` is CI's.
- No package is touched, so no package `test` or `typecheck` is owed;
the two builds ran only to give build-reading gates their input.

## Acceptance notes

Observations, not defects; nothing filed.

- `scripts/git-merge-regen.mjs`: the `line-anchors` comparator and its
comments name this page as the generated case; no row uses it now. Kept
on purpose (`regen-artifacts.mjs` keeps `mixed` for the next mixed
artifact). Carrier: none.
- Comments in `scripts/doc-line-anchors.mjs`,
`scripts/check-lockstep-package-count.mjs`,
`scripts/check-regen-pending.mjs` and
`docs/audits/gate-census-2026-09.md` describe the page's generated
anchors or counts. They are history or dated audits and are left as
written. Carrier: none.
- Line 23 of the page still says "in twenty packages": a round prose
figure, never CI-checked, left alone.

---
_Generated by [Claude
Code](https://claude.ai/code/session_012yK1ddAdAqfzwigRHZq3r2)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.gitattributes

@@ -94,53 +94,18 @@
 # merge-and-regenerate round. The cure is the one the header above records for
 # the three hottest artifacts; each gate sums its shards when it reads them.
 #
-# The elevation census page joined at #13646, when it was a generated `file:line`
-# anchor table whose correct merged values were on NEITHER side of a conflict
-# (measured on #13625: five conflicted anchors resolved to 4408/5771/6019/6382/6575
-# against branch 4407/5770/… and main 4284/5647/…), so no text merge and no hand
-# merge could reach them. ⚠️ It is routed as the FILE and NOT as
-# `content/docs/permissions/**`: unlike `content/docs/references/**` above, which
-# is generated whole, that directory is 22 hand-written prose pages around one
-# generated one, and the glob would defer the prose to OURS. See
-# NOT_DRIVER_MANAGED for that entry.
-#
-# This is also the row where the header's own warning is answered rather than
-# accepted: `scripts/check-system-context-census.mjs` still reddens on every PR from
-# the required `Lint & Repo Gates` job — it RE-DERIVES the census from the tree.
-# While the page carried line anchors, that is what caught the stale anchors a merge
-# left behind even when nothing conflicted, which was the majority case (#13625: 18
-# anchors stale, 5 marked). The driver removes hand-merge rounds; it is never the
-# only signal.
-#
-# ⚠️ #14064 CORRECTED the sentence that used to open that paragraph — "deferring is
-# safe here BECAUSE the census gate re-derives". The gate re-derived the census and
-# the anchors. It re-derives no PROSE, because prose is derived from nothing, and
-# this page is the one routed path that carries both. So the argument was true and
-# its domain was half the risk surface: the driver drops a side WHOLE, and on this
-# page that side can carry hand-written paragraphs whose loss the gate is
-# constitutionally unable to notice. Measured, not reasoned — deleting a 3-line
-# anchor-free paragraph and running ten doc-family gates returned ten exit 0 over
-# deleted documentation.
-#
-# #14064 kept the routing (the correct anchors were on neither side) and added the
-# missing half: the row declares `mixed: 'line-anchors'` in
-# scripts/regen-artifacts.mjs, and the driver refuses to defer SILENTLY when the
-# incoming side carries anything but anchor numbers — it text-merges instead, and
-# conflicts loudly if that cannot be done. The cheap case stayed cheap: of the last
-# 25 main commits to this page when that was measured, 24 changed nothing but anchor
-# numbers.
-#
-# Today (since #15921) the page carries `path#symbol` anchors and no line numbers,
-# so the `line-anchors` comparator is the IDENTITY on it (measured on #16612:
-# `extractLineAnchors(page).length === 0`, `blankAnchorLineNumbers(page) === page`).
-# Every real edit therefore takes the text-merge branch, or conflicts loudly, by
-# design; the renumbering case is gone because there is nothing left to renumber.
-# What the census gate catches after a merge is now a symbol anchor that no longer
-# resolves, a population that no longer matches, or a declared count that no longer
-# equals the census. ⛔ The `mixed` field stays: it is what routes this row through
-# the lossless check at all, and deleting it sends the row to the unconditional
-# deferral, the silent deletion #14064 closed (reproduced on #16612). The row's
-# comment in scripts/regen-artifacts.mjs carries the measurements.
+# The elevation census page (`content/docs/permissions/system-context.mdx`) was
+# routed here from #13646 to #22927 and is not any more: nothing on it is
+# generated. It joined as a `file:line` anchor table whose correct merged values
+# were on NEITHER side of a conflict, became a MIXED row when #14064 measured that
+# a whole-side deferral dropped its hand-written prose (`mixed: 'line-anchors'`),
+# lost its line numbers to `path#symbol` anchors at #15921, and lost its last
+# generated half — the census totals — to #22927's ruling. It text-merges like
+# its prose neighbours now. ⚠️ What still catches a merge that leaves it wrong is
+# `scripts/check-system-context-census.mjs`, which re-derives the census from the
+# tree on every PR in the required `Lint & Repo Gates` job: a read no row anchors,
+# or an anchor that no longer resolves. The `mixed` field and its comparator stay
+# for the next mixed artifact (scripts/regen-artifacts.mjs, scripts/git-merge-regen.mjs).
 
 #
 # #13731 enumerated this file's blind spot and closed it: `check:merge-driver` now
@@ -182,7 +147,6 @@ packages/spec/declaration-map/**                             merge=os-regen
 packages/spec/api-surface-signatures.json                    merge=os-regen
 docs/audits/2026-07-unknown-key-strictness-ledger.counts/**  merge=os-regen
 content/docs/references/**                                   merge=os-regen
-content/docs/permissions/system-context.mdx                  merge=os-regen
 skills/*/references/_index.md                                merge=os-regen
 skills/objectstack-ui/references/react-blocks.md             merge=os-regen
 scripts/platform-object-tenancy-census.json                  merge=os-regen