Hold the isSystem census page to the code: committed AST census, population gate, converted anchors (#13051)

* wip: isystem census + gate scripts

* docs+gate: census-derived enforcement for the isSystem page

* ci: fold the isSystem census gate into the docs-anchors step

* docs(system-context): reword the reserved word out of the census prose

* docs(system-context): re-derive the census figures on the merged tree

`main` moved under the open PR and the page's live numbers went stale:

* +5 line rot in `plugin-security/src/security-plugin.ts` (the import block
  #13065 added at :66 pushed every anchored read down five lines), plus the
  `field.zod.ts` `readonly` citation `--fix` re-anchored mechanically.
* Six decomposition-table counts re-measured against the merged tree:
  lines 1804->1810, in tests 1010->1012, in sources 794->798, identifier
  appearances 809->813, keys 308->310, comments/strings 356->358.

The census population itself did NOT move: 109 elevation read sites in 20
packages across 45 files, before and after. The gate, its criterion and its
self-test are untouched -- the page's numbers were made true, not the check
made lenient.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPrUz21stTFhJRUirdc4yw

* fix(scripts): stop enforcing whole-corpus text counts on the isSystem census page

The six raw text counts (lines carrying the identifier, the test/source split,
identifier appearances, object-literal keys, the prose remainder) are properties
of the whole corpus, not of the elevation population the page certifies. They
move whenever any file under packages/ or examples/ gains or loses a line
mentioning isSystem -- a test, a seed object, a comment -- and because CI scores
a PR's MERGE with main and the merge queue re-derives that merge against a newer
main on every attempt, a page carrying them races a moving target.

Measured on this branch: three unrelated merges to main moved those six numbers
eight times in one night, while every census-derived figure held flat across the
same refs -- 109 sites, 20 packages, 45 files, 6 ledger subtractions, 21/115/9
role counts, at db39dfc, 8a483b3, ca1965f and the merged tree.

So they move out of DECLARED_COUNTS into UNENFORCED_TEXT_COUNTS: still required
to be PRESENT on the page and to carry a dated measurement marker, never
compared. The POPULATION, RESOLUTION and CLASSIFICATION checks and every
census-derived count are untouched, and an empty census still refuses.

Seven self-test cases pin the new criterion, two of them over the real lists:
every entry of DECLARED_COUNTS must hold still under a whole-corpus text drift,
and all six UNENFORCED_TEXT_COUNTS must move under it -- so re-adding a text
count to the enforced list fails the self-test by name.

Also re-anchors permission-set-projection.ts:987 to :1009 (pure line rot from
today's main, repaired by --fix).

* docs(permissions): repair 31 rotted isSystem anchors against today's main

* docs(permissions): re-anchor the field.zod.ts readonly citation after today's drift

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Elon Musk

.github/workflows/lint.yml

@@ -1330,8 +1330,39 @@ jobs:
       # dependency-free `node` checks), and it is REQUIRED where that lane is
       # advisory. The four anchors that were already dead were fixed in the same
       # PR, so this ships with no baseline and no allowlist.
+      #
+      # ── FOLDED IN, deliberately: the `file:line` anchor half ──────────────
+      #
+      # `content/docs/permissions/system-context.mdx` calls itself "the
+      # authority" for every behaviour keyed off `ExecutionContext.isSystem`
+      # and says it is "built by census over the whole repo, not by recall".
+      # Nothing held it to either claim, and it rotted at a measured rate: 101
+      # of its 111 anchors pointed at a line that no longer held what the row
+      # named, 19 days after the census was written, with CI green throughout.
+      #
+      # ⭐ The load-bearing direction is CENSUS -> PAGE, not page -> code. At
+      # the commit that motivated the card, re-resolving EVERY anchor on the
+      # page would have passed while it was missing 32 sites and its headline
+      # was 29 too low: a gate that only checks what a page already says can
+      # never find what the page failed to say. Measured again here on the
+      # shipped gate -- with an unanchored read site injected, the resolution
+      # checks report 0 findings and the population check names the site.
+      #
+      # It is a second command in THIS step rather than a step of its own: this
+      # job has no paths filter, so the census runs on code-only PRs (the ones
+      # that ADD a read site), and folding costs no new check context, no new
+      # `check:*` manifest key, and no new required-status entry for one page.
+      # The `--self-test` invocation is what `check:self-test-wired` requires,
+      # and it is the only instrument on this gate's matching rules -- a clean
+      # tree cannot tell a working rule from a weakened one.
+      #
+      # Invoked as `node` rather than through a `pnpm check:*` alias: see the
+      # GATE INVOCATION IDIOM note at the top of this file.
       - name: Docs anchors resolve to real headings
-        run: pnpm check:doc-anchors
+        run: |
+          pnpm check:doc-anchors
+          node scripts/check-system-context-census.mjs --self-test
+          node scripts/check-system-context-census.mjs
 
       # #12236 one <h1> per doc page. `DocsTitle` renders the frontmatter `title`
       # as the page's <h1> unconditionally (apps/docs/app/[lang]/docs/[[...slug]]/