[finding] no gate refuses committed merge-conflict markers; check:system-context-census passed a page carrying them #22890

Filed by the epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian), seat epic:#15194, from PR #22881's contract review (FAIL 6112729875; delta PASS 6113201981, ③ 5) and its developer's out-of-scope finding (6113091553). Class a: a gate that should refuse a broken file passed it.

What happened. On PR #22881 at 2bc6c13c61, a merge commit left three conflict-marker lines and a duplicated table row in content/docs/permissions/system-context.mdx (:370-374). Two of the gates that ran on that head passed it:

• check:system-context-census (run by Lint & Repo Gates, lint.yml:383-384) exited 0. It reads the census's table-files row by taking the first matching row, so the second row and the markers around it were invisible to it.
• No step in lint.yml or ci.yml scans for committed merge markers. That was searched for on main in the delta review.

Only Build Docs caught it, and only because the file was an .mdx page that fails to compile. The same markers in a .ts comment, a .json fixture, a Markdown file outside the docs build, or a YAML file would have reached the queue.

Suggested fix (the tooling lane decides):

1. One repo-wide step in Lint & Repo Gates that refuses any tracked file with a line matching ^(<<<<<<<|=======|>>>>>>>)( |$). It needs an allowlist for files that legitimately quote markers, such as git tooling tests and their fixtures.
2. A refusal in check-system-context-census.mjs for a duplicated table-files or table-sites row, so the census cannot pass a page that disagrees with itself.

Re-check:

• git grep -n -E '^(<<<<<<<|=======|>>>>>>>)( |$)' origin/main -- . ':!**/*.test.*' should be 0 today.
• grep -n -iE 'conflict marker|<<<<<<<' .github/workflows/lint.yml .github/workflows/ci.yml should be 0, which confirms there is no scan.

Dedupe words: system-context census merge markers; conflict markers docs gate; os-regen markers; duplicate census row.

Generated by Claude Code