gate(spec): register packages/spec/src/** doc blocks as the fourth symbol-anchor corpus, censused first (#17241)

* feat(gates): register packages/spec/src/** doc blocks as a symbol-anchor corpus

The fourth corpus of the shared symbol-anchor resolver (scripts/symbol-anchors.mjs),
joined by a `defineCorpus` call in the deliberately thin shape
check-adr-symbol-anchors.mjs and check-scripts-symbol-anchors.mjs already use --
no second resolver.

The census came first and the exit contract second. Measured on 08e38c6 in
--list / --list-unresolvable reporting mode over 1,317 tracked .ts files:

  198  raw extractAnchors over the whole file (counts spec's own fixture data)
  189  through the commentProse projection (doc prose only)
    6  ...and the cited path names a tracked file -- what this gate judges

7 hard findings across 6 files (6 line-anchor + 1 unresolved-path), 183 declined
citations naming no tracked file, 3 soft cross-repo rows. That is a gate, not a
migration -- the opposite of docs/adr/**'s 243-of-337 (72.1%).

Repairing those 7 edits packages/spec/** text, which is domain:spec work with its
own cards, so the exit contract is a pinned day-one residual: CENSUS_RESIDUAL
enumerates the 7 sites with their repairs, every finding outside it is a hard red
from day one, and a row whose citation gets repaired goes STALE and reds until it
is deleted. Rows are keyed by citation TEXT, never by line -- a line-keyed row
would be a line anchor inside the line-anchor gate.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU

* fix(gates): stop the new corpus header from quoting a broken anchor verbatim

`scripts/**` is itself a registered corpus, so the new gate's own header is
swept by check-scripts-symbol-anchors. Quoting the websocket.zod.ts citation in
anchor form -- and spelling the bare-word-colon-path shape literally -- made
this file a finding against that corpus (1 unresolved-path, 1 soft cross-repo).

Both are now described in words, with the reason stated inline so the next
author does not reintroduce them. The citation itself is unchanged: it stays
pinned in CENSUS_RESIDUAL as a string literal, which the commentProse
projection blanks as code.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.github/workflows/lint.yml

@@ -2503,6 +2503,7 @@ jobs:
           run_self_test node scripts/symbol-anchors.mjs --self-test
           run_self_test node scripts/check-adr-symbol-anchors.mjs --self-test
           run_self_test node scripts/check-scripts-symbol-anchors.mjs --self-test
+          run_self_test node scripts/check-spec-docblock-symbol-anchors.mjs --self-test
           if [ -n "$failed" ]; then
             echo ""
             echo "Symbol-anchor self-tests — the following FAILED:"
@@ -2521,6 +2522,20 @@ jobs:
       - name: scripts/** symbol anchors resolve (no line citations on tracked targets survive)
         run: node scripts/check-scripts-symbol-anchors.mjs
 
+      # The THIRD corpus (#17065) — `packages/spec/src/**` doc blocks, again a
+      # `defineCorpus` registration and ⛔ not a second resolver. Separate sweep
+      # step for the same `check-step-collectors` reason stated above.
+      #
+      # ⭐ Its exit contract is a PINNED DAY-ONE RESIDUAL, not a clean tree: the
+      # census (7 findings across 6 of 1,317 files, taken in reporting mode
+      # BEFORE any exit code was chosen) is enumerated in the gate's
+      # `CENSUS_RESIDUAL`, every finding outside it is a hard red, and a row
+      # whose citation gets repaired goes STALE and reds until it is deleted.
+      # Repairing those 7 edits `packages/spec/**` text, which is `domain:spec`
+      # work with its own cards — the registration does not do it.
+      - name: packages/spec/src/** doc-block symbol anchors resolve (no NEW line citations on tracked targets)
+        run: node scripts/check-spec-docblock-symbol-anchors.mjs
+
       # NOTE: the standing platform test checklist (docs/qa/platform-checklist/)
       # is validated by `pnpm check:platform-checklist`, but by MAINTAINER
       # DECISION it is NOT wired into CI — it runs on a periodic manual cadence

package.json

@@ -91,6 +91,7 @@
     "check:adr-links": "node scripts/check-adr-links.mjs --self-test && node scripts/check-adr-links.mjs",
     "check:adr-symbol-anchors": "node scripts/symbol-anchors.mjs --self-test && node scripts/check-adr-symbol-anchors.mjs --self-test && node scripts/check-adr-symbol-anchors.mjs",
     "check:scripts-symbol-anchors": "node scripts/symbol-anchors.mjs --self-test && node scripts/check-scripts-symbol-anchors.mjs --self-test && node scripts/check-scripts-symbol-anchors.mjs",
+    "check:spec-docblock-symbol-anchors": "node scripts/symbol-anchors.mjs --self-test && node scripts/check-spec-docblock-symbol-anchors.mjs --self-test && node scripts/check-spec-docblock-symbol-anchors.mjs",
     "check:platform-checklist": "node scripts/checklist-select.mjs --self-test && node scripts/check-platform-checklist.mjs --self-test && node scripts/check-platform-checklist.mjs",
     "check:org-identifier": "node scripts/check-org-identifier.mjs --self-test && node scripts/check-org-identifier.mjs",
     "check:runner-env-posture": "node scripts/check-runner-env-posture.mjs --self-test && node scripts/check-runner-env-posture.mjs",