diff --git a/‎.gitattributes‎
Lines changed: 39 additions & 24 deletions b/‎.gitattributes‎
Lines changed: 39 additions & 24 deletions
diff --git a/‎scripts/doc-line-anchors.mjs‎
Lines changed: 34 additions & 9 deletions b/‎scripts/doc-line-anchors.mjs‎
Lines changed: 34 additions & 9 deletions
diff --git a/‎scripts/regen-artifacts.mjs‎
Lines changed: 64 additions & 30 deletions b/‎scripts/regen-artifacts.mjs‎
Lines changed: 64 additions & 30 deletions
@@ -86,38 +86,53 @@
 # merge-and-regenerate round. The cure is the one the header above records for
 # the three hottest artifacts; each gate sums its shards when it reads them.
 #
-# The elevation census page joined at #13646 — a generated `file:line` anchor
-# table whose correct merged values are on NEITHER side of a conflict (measured on
-# #13625: five conflicted anchors resolved to 4408/5771/6019/6382/6575 against
-# branch 4407/5770/… and main 4284/5647/…), so no text merge and no hand merge can
-# reach them. ⚠️ It is routed as the FILE and NOT as `content/docs/permissions/**`:
-# unlike `content/docs/references/**` above, which is generated whole, that
-# directory is 22 hand-written prose pages around one generated one, and the glob
-# would defer the prose to OURS. See NOT_DRIVER_MANAGED for that entry.
+# The elevation census page joined at #13646, when it was a generated `file:line`
+# anchor table whose correct merged values were on NEITHER side of a conflict
+# (measured on #13625: five conflicted anchors resolved to 4408/5771/6019/6382/6575
+# against branch 4407/5770/… and main 4284/5647/…), so no text merge and no hand
+# merge could reach them. ⚠️ It is routed as the FILE and NOT as
+# `content/docs/permissions/**`: unlike `content/docs/references/**` above, which
+# is generated whole, that directory is 22 hand-written prose pages around one
+# generated one, and the glob would defer the prose to OURS. See
+# NOT_DRIVER_MANAGED for that entry.
 #
 # This is also the row where the header's own warning is answered rather than
 # accepted: `scripts/check-system-context-census.mjs` still reddens on every PR from
-# the required `Lint & Repo Gates` job — it RE-DERIVES the census from the tree, so
-# it catches the stale anchors a merge leaves behind even when nothing conflicted,
-# which is the majority case (#13625: 18 anchors stale, 5 marked). The driver removes
-# hand-merge rounds; it is never the only signal.
+# the required `Lint & Repo Gates` job — it RE-DERIVES the census from the tree.
+# While the page carried line anchors, that is what caught the stale anchors a merge
+# left behind even when nothing conflicted, which was the majority case (#13625: 18
+# anchors stale, 5 marked). The driver removes hand-merge rounds; it is never the
+# only signal.
 #
 # ⚠️ #14064 CORRECTED the sentence that used to open that paragraph — "deferring is
-# safe here BECAUSE the census gate re-derives". The gate re-derives the census and
+# safe here BECAUSE the census gate re-derives". The gate re-derived the census and
 # the anchors. It re-derives no PROSE, because prose is derived from nothing, and
 # this page is the one routed path that carries both. So the argument was true and
 # its domain was half the risk surface: the driver drops a side WHOLE, and on this
-# page that side can carry hand-written paragraphs the gate is constitutionally
-# unable to miss. Measured, not reasoned — deleting a 3-line anchor-free paragraph
-# and running ten doc-family gates returned ten exit 0 over deleted documentation.
-#
-# Routing this file is still RIGHT (the correct anchors are on neither side; nothing
-# above changes). What #14064 added is the missing half: the row now declares
-# `mixed: 'line-anchors'` in scripts/regen-artifacts.mjs, and the driver refuses to
-# defer SILENTLY when the incoming side carries anything but anchor numbers — it
-# text-merges instead, and conflicts loudly if that cannot be done. The cheap case
-# stays cheap: of the last 25 main commits to this page, 24 changed nothing but
-# anchor numbers.
+# page that side can carry hand-written paragraphs whose loss the gate is
+# constitutionally unable to notice. Measured, not reasoned — deleting a 3-line
+# anchor-free paragraph and running ten doc-family gates returned ten exit 0 over
+# deleted documentation.
+#
+# #14064 kept the routing (the correct anchors were on neither side) and added the
+# missing half: the row declares `mixed: 'line-anchors'` in
+# scripts/regen-artifacts.mjs, and the driver refuses to defer SILENTLY when the
+# incoming side carries anything but anchor numbers — it text-merges instead, and
+# conflicts loudly if that cannot be done. The cheap case stayed cheap: of the last
+# 25 main commits to this page when that was measured, 24 changed nothing but anchor
+# numbers.
+#
+# Today (since #15921) the page carries `path#symbol` anchors and no line numbers,
+# so the `line-anchors` comparator is the IDENTITY on it (measured on #16612:
+# `extractLineAnchors(page).length === 0`, `blankAnchorLineNumbers(page) === page`).
+# Every real edit therefore takes the text-merge branch, or conflicts loudly, by
+# design; the renumbering case is gone because there is nothing left to renumber.
+# What the census gate catches after a merge is now a symbol anchor that no longer
+# resolves, a population that no longer matches, or a declared count that no longer
+# equals the census. ⛔ The `mixed` field stays: it is what routes this row through
+# the lossless check at all, and deleting it sends the row to the unconditional
+# deferral, the silent deletion #14064 closed (reproduced on #16612). The row's
+# comment in scripts/regen-artifacts.mjs carries the measurements.
 
 #
 # #13731 enumerated this file's blind spot and closed it: `check:merge-driver` now
 
@@ -2,21 +2,45 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * doc-line-anchors -- the ONE reader for `file:line` anchors written in docs prose.
+ * doc-line-anchors -- the parser for `file:line` anchors written in docs prose,
+ * built as their ONE reader. Its one in-tree importer today is the merge driver;
+ * "Today, since #15921" below is the current state, and the rest of this header
+ * is the record of why the module exists.
  *
  * A docs page that cites source by `` `<file>.ts:1560` `` has created a
  * two-sided invariant with no owner: the line lives in one tree, the citation in
  * another, and nothing relates them. Measured on
- * `content/docs/permissions/system-context.mdx` over 19 days, **101 of its 111
- * anchors rotted** -- the construct still existed, the line number no longer
- * named it -- while CI stayed green throughout.
+ * `content/docs/permissions/system-context.mdx` over 19 days, while it still
+ * carried them, **101 of its 111 anchors rotted** -- the construct still existed,
+ * the line number no longer named it -- while CI stayed green throughout.
  *
- * This module is the parsing half of the fix, kept separate from the gate that
- * uses it because the defect is not specific to one page: any page carrying
+ * This module was the parsing half of the fix, kept separate from the gate that
+ * used it because the defect is not specific to one page: any page carrying
  * `file:line` anchors has it, and the second page should cost a ledger rather
  * than a parser.
  *
- * ## The three anchor shapes, all of which are real on the corpus
+ * ## Today, since #15921
+ *
+ * That page now cites source by `path#symbol`. The grammar is
+ * `scripts/symbol-anchors.mjs`, which reads a line-number spelling only to report
+ * it as a finding, and the page's census gate reads its anchors through that
+ * module, not this one. So on the page this module was built for,
+ * `extractLineAnchors` finds nothing and `blankAnchorLineNumbers` is the IDENTITY
+ * -- measured on #16612: `extractLineAnchors(page).length === 0` and
+ * `blankAnchorLineNumbers(page) === page`.
+ *
+ * The one in-tree importer is `scripts/git-merge-regen.mjs`: its `'line-anchors'`
+ * comparator is `blankAnchorLineNumbers`, selected by that page's `mixed` field in
+ * `scripts/regen-artifacts.mjs`. The identity is the intended answer there, not a
+ * broken one. The driver proves a deferral lossless only when the incoming side
+ * equals the ancestor or ours byte for byte, so every real edit to the page takes
+ * the text-merge branch, or conflicts loudly, by design -- and the field stays,
+ * because it is what sends the page through that check at all (that row's comment
+ * carries the measurement). The account of `--fix` in `blankAnchorLineNumbers`'s
+ * docblock below is the pre-#15921 one: the census `--fix` no longer touches
+ * anchors, and regenerates only the page's declared counts.
+ *
+ * ## The three anchor shapes, all of which were real on that page
  *
  * A naive reader finds only the first and undercounts by a third.
  *
@@ -54,8 +78,9 @@
  * ## What is deliberately NOT here
  *
  * No knowledge of what a line should CONTAIN. That is the consuming gate's
- * question -- for `system-context.mdx` it is answered by an AST census -- and
- * baking any answer in here would make the module single-use.
+ * question -- for `system-context.mdx` it was answered by an AST census, which
+ * since #15921 holds that page's symbol anchors instead -- and baking any answer
+ * in here would make the module single-use.
  *
  * @module
  */
 
@@ -234,9 +234,12 @@ export const REGEN_ARTIFACTS = Object.freeze([
     gen: 'gen:liveness-counts',
     check: 'check:liveness',
   },
-  // #13646. The elevation census page — a generated `file:line` anchor table, and
-  // the first row here owned by ROOT tooling rather than by `packages/spec` (the
-  // owner field #13585 added exists for exactly this).
+  // #13646. The elevation census page, and the first row here owned by ROOT tooling
+  // rather than by `packages/spec` (the owner field #13585 added exists for exactly
+  // this). It was routed as a generated `file:line` anchor table, and since #15921
+  // it carries no line anchors at all: the argument below is kept as the record of
+  // why the row exists, in the past tense, and "Today" at the end of this block is
+  // the current state.
   //
   // ⚠️ The row is the FILE, not `content/docs/permissions/**`, and the difference
   // is safety rather than tidiness. Its routed sibling `content/docs/references/**`
@@ -246,20 +249,22 @@ export const REGEN_ARTIFACTS = Object.freeze([
   // prose edit, which is the exact trade `migrations/registry.ts` is kept out of
   // this table for. The glob is recorded in NOT_DRIVER_MANAGED below.
   //
-  // Why it belongs here at all: two PRs that each ran `--fix` against their own
-  // tree write correct-for-themselves line numbers into the same rows, and the
-  // merged tree's correct values equal NEITHER side — measured on #13625's merge,
-  // where the five conflicted anchors resolved to `4408/5771/6019/6382/6575`
-  // against branch `4407/5770/…` and main `4284/5647/…`. A text merge cannot reach
-  // that answer from either input, so this is a deferral-and-regenerate shape.
+  // Why it was routed here (#13646, while the page carried `file:line` anchors): two
+  // PRs that each ran `--fix` against their own tree wrote correct-for-themselves
+  // line numbers into the same rows, and the merged tree's correct values equalled
+  // NEITHER side — measured on #13625's merge, where the five conflicted anchors
+  // resolved to `4408/5771/6019/6382/6575` against branch `4407/5770/…` and main
+  // `4284/5647/…`. A text merge could not reach that answer from either input, so it
+  // was a deferral-and-regenerate shape.
   //
   // ⚠️ #14064 CORRECTED the safety argument this row used to carry, and the
   // correction is why it is the one row with a `mixed` field. The old text said the
   // deferral is safe *because* `check-system-context-census.mjs` re-derives the
-  // census from the tree on every PR. That argument is TRUE and it covers HALF of
-  // what the driver discards. The gate re-derives the census and the anchors; it
+  // census from the tree on every PR. That argument was TRUE and it covered HALF of
+  // what the driver discards. The gate re-derived the census and the anchors; it
   // re-derives no prose, because the prose is derived from nothing. So the argument's
-  // domain and the risk surface do not coincide, and the gap is not theoretical:
+  // domain and the risk surface did not coincide, and the gap was not theoretical
+  // (#14064's measurements, taken while the page still carried line anchors):
   //
   //   - The driver never writes `%A`, so the side left behind is OURS and the side
   //     dropped is always THEIRS — i.e. always main's already-landed work, never the
@@ -271,29 +276,56 @@ export const REGEN_ARTIFACTS = Object.freeze([
   //     `check:docs-single-h1`, `check:corpus-claim-drift`, `check:docs-audit-scope`,
   //     `check:role-word`, `check-doc-frontmatter`, `check-docs-section-name`,
   //     `check-doc-route-spelling`): ten exit 0 over silently deleted documentation.
-  //   - It is not a rare path. main rewrites this page about every 75 minutes, so any
-  //     PR touching it and older than an hour meets the driver by construction.
+  //   - It was not a rare path. main rewrote this page about every 75 minutes, so any
+  //     PR touching it and older than an hour met the driver by construction.
   //
-  // ⭐ The routing itself is still RIGHT and #14064 does not undo it: the merged
-  // tree's correct anchors are on NEITHER side (measured on #13625 — five conflicted
-  // anchors resolve to 4408/5771/6019/6382/6575 against branch 4407/5770/… and main
-  // 4284/5647/…), so no text merge and no hand merge can reach them. Moving this row
-  // to NOT_DRIVER_MANAGED would buy the prose back by handing a page that conflicts
-  // hourly to a human who cannot resolve it correctly. The census over every routed
-  // path says that trade is worse than it looks: of the last 25 main commits to this
-  // page, 24 changed nothing but anchor line numbers — the case the driver handles
-  // correctly and cheaply — and exactly 1 touched prose.
+  // ⭐ #14064 kept the routing, and its argument was right about the page it
+  // measured: the merged tree's correct anchors were on NEITHER side (measured on
+  // #13625 — five conflicted anchors resolved to 4408/5771/6019/6382/6575 against
+  // branch 4407/5770/… and main 4284/5647/…), so no text merge and no hand merge
+  // could reach them. Moving this row to NOT_DRIVER_MANAGED would have bought the
+  // prose back by handing a page that conflicted hourly to a human who could not
+  // resolve it correctly. The census over every routed path said that trade was
+  // worse than it looked: of the last 25 main commits to this page when that was
+  // measured, 24 changed nothing but anchor line numbers — the case the driver
+  // handled correctly and cheaply — and exactly 1 touched prose.
   //
-  // ⇒ So the row keeps its routing and declares WHEN the deferral is lossless.
+  // ⇒ So the row kept its routing and declared WHEN the deferral is lossless.
   // `mixed` names the equivalence: two revisions equal after
-  // `blankAnchorLineNumbers` differ only in the half `--fix` re-derives, and
-  // dropping either loses nothing. `git-merge-regen.mjs` refuses to defer silently
-  // when they are not equal, so the 1-in-25 prose case becomes a text merge or a
-  // loud conflict instead of a silent deletion, and the 24-in-25 anchor case keeps
-  // #13646's win untouched. This is the field to reach for when the NEXT mixed
+  // `blankAnchorLineNumbers` differed only in the anchor numbers `--fix` re-derived
+  // then, and dropping either lost nothing. `git-merge-regen.mjs` refuses to defer
+  // silently when they are not equal, so the 1-in-25 prose case became a text merge
+  // or a loud conflict instead of a silent deletion, and the 24-in-25 anchor case
+  // kept #13646's win. This is still the field to reach for when the NEXT mixed
   // artifact arrives — a whole-file generator needs no `mixed`, because there is
   // nothing on its page a regeneration cannot restore.
   //
+  // ⭐ Today (since #15921): every citation on the page is a `path#symbol` anchor
+  // (`scripts/symbol-anchors.mjs`), which does not move when its file grows, and the
+  // census gate reports a surviving line number as a finding. So
+  // `blankAnchorLineNumbers` finds nothing to blank, and the `'line-anchors'`
+  // comparator is the IDENTITY on this page — measured on #16612,
+  // `extractLineAnchors(page).length === 0` and
+  // `blankAnchorLineNumbers(page) === page`.
+  // A deferral is proven lossless only when THEIRS equals the ancestor or OURS byte
+  // for byte, so every real edit — prose, an anchor, a declared count — takes the
+  // text-merge branch, or conflicts loudly. That is by design, not a degraded mode:
+  // it is the safe half of #14064's trade, and what it gives up is the 24-in-25
+  // renumbering case, which can no longer occur because there are no numbers left to
+  // renumber. A clean text merge is still recorded as owing
+  // `gen:system-context-census`, which `pre-commit` collects.
+  //
+  // ⛔ Keep `mixed: 'line-anchors'` anyway. The field is not only the comparator's
+  // name; it is what routes this row through the lossless check at all. Without it
+  // the driver takes the unconditional deferral every wholly-generated row takes —
+  // keep OURS, drop THEIRS — and that is the silent deletion #14064 closed. Measured
+  // on #16612 in a throwaway repo with this driver, ours and theirs making
+  // non-overlapping edits: field present ⇒ text-merged, the incoming paragraph kept;
+  // field deleted ⇒ `git merge` exit 0, no markers, the incoming paragraph gone. It
+  // is also the row `endToEndMixed()` in `git-merge-regen.mjs --self-test` exercises,
+  // and that self-test reports "nothing to prove", and passes, once no row carries
+  // `mixed`.
+  //
   // No `readsDist`/`readsSchemaTree`: the census is an AST walk over `src/`, so a
   // merged tree is the whole prerequisite. `gen` still cannot launder a POPULATION
   // change into a row nobody wrote: a site that arrived or vanished needs a human
@@ -474,7 +506,9 @@ export const NOT_DRIVER_MANAGED = Object.freeze([
     why:
       'the DIRECTORY is not what #13646 routed, and recording that is the point of this ledger. '
       + '22 of its 23 pages are hand-written permissions prose; exactly one — `system-context.mdx`, '
-      + 'declared above — is a generated anchor table. Routing the tree the way its sibling '
+      + 'declared above — is routed, as a MIXED row (a generated `file:line` anchor table when it was '
+      + 'routed; today its anchors are `path#symbol` ones and only its declared counts are '
+      + 'generated). Routing the tree the way its sibling '
       + '`content/docs/references/**` is routed reads as symmetry and is not: that sibling is '
       + 'generated whole, this one would defer 21 prose files to OURS and lose the other side\'s '
       + 'edits silently. Route the generated FILE; leave the neighbours to text-merge, which is '