measure(fp): the upload door costs a human on 16-53% of benign documents

Every field measurement this repo had published was per URL. None answered
what a consumer actually feels: how often does an ordinary document fail to
persist unattended? Three benign populations, each against its own
denominator, run through screen_output under PRESET_USER_UPLOAD and counted
at document granularity:

  vendor-harvest    98 of 185 (53.0%) non-WARN -- 64 fail-secure, 34 held
  generated-notes   88 of 547 (16.1%) non-WARN -- 61 fail-secure, 27 held
  reference-corpus 133 of 389 (34.2%) non-WARN -- 80 fail-secure, 53 held

The number is bad and ships as measured; PLAN-v1 committed to that in advance
("et roedt FP-resultat er like verdifullt"). The response is a documented
limitation, not a recalibration: moving the grading fires the locked
linkedin-studio notification promise, and the drivers are residuals
LIMITATIONS already concedes. Counted at each document's worst severity,
active:raw-html -- the MDX-component over-reach -- is a top driver in 52 of
vendor-harvest's 98 and 53 of generated-notes' 88; about ten per population
are genuinely injection-shaped text, which security-adjacent documentation
honestly contains.

Method traps closed rather than stepped in:

- The unit is in the number. Document-level rates are NOT comparable to the
  URL-level 16/16, 28/28, 149/1694 above them, and the three rows are not
  summable -- the 2400 != 2401 defect class one level up.
- The gate is the strict one. The trusted door WARNs every non-CRITICAL
  finding, so it would have handed back a beautiful, meaningless near-zero;
  it is printed as a footnote and labelled structurally blind.
- "not WARN" is only a risk statement while the default action map sends
  exactly NONE and LOW to WARN. action_map became a supported override last
  commit, so the equivalence is pinned in the suite and the sweep aborts if
  it breaks.
- Ground truth for benign is provenance, not inspection, and says so.
- The populations are disjoint as documents but not independent as content:
  184 of generated-notes' 547 are same-named derivatives of vendor-harvest.
  Measured, not assumed, and the two rows read as one observation.

Also fixed: tests/test_wiring.py credited a consumer's capture store with
35 of 35 query-carrying URLs. That consumer retracted the number the next day
and re-measured 28 of 28 on the same 81-URL corpus. LIMITATIONS was corrected
then; the comment was not, so a retracted figure has been sitting beside a
live one since 07-27.

717 tests (was 716, none changed), coverage matrix 128/128 with 6/6 gaps
holding, every population swept twice with identical counts.

docs/LIMITATIONS.md

@@ -233,6 +233,62 @@ items; this is the full list, each with the mechanism.
   by roughly the ratio of closing to opening active tags (measured at 1.6× on one
   corpus). Severity and finding count are unaffected — the class collapses to one
   finding — but the `count` field is not a document count.
+- **Measured, document by document: a large minority of *benign* documents do not
+  persist unattended at the upload door.** The bullets above bound single rules on
+  single URLs. This one bounds the thing a consumer actually feels — how often an
+  ordinary document costs a human — and the honest answer is *often*, on corpora of
+  technical documentation. Three benign populations, each reported against its own
+  denominator (`docs/fp-sweep.py`, run on the post-0.4.0 tree carrying the axis
+  separation, which renders every 0.4.0 disposition identically):
+
+  | population | provenance | n | disposed non-WARN |
+  |---|---|---|---|
+  | vendor-harvest | vendor-published doc pages, harvested verbatim | 185 | **98 (53.0%)** — 64 fail-secure, 34 held |
+  | generated-notes | model-written notes at their own persist gate | 547 | **88 (16.1%)** — 61 fail-secure, 27 held |
+  | reference-corpus | first-party authored reference material | 389 | **133 (34.2%)** — 80 fail-secure, 53 held |
+
+  **The unit is a document and the gate is the strict one:** `screen_output(doc,
+  PRESET_USER_UPLOAD)`, counting `disposition is not WARN`. WARN is the benign
+  outcome (persisted, with a note), so a *finding* is not a false positive — only a
+  document the pipeline cannot persist unattended is. Under the default action map
+  that count is equivalent to *assessed `ELEVATED` or worse*, and the equivalence is
+  pinned by `tests/test_corpus.py::test_the_published_fp_metric_is_a_risk_statement`
+  so an `action_map` override cannot silently redefine the published number.
+  **These are not comparable to the URL-level measurements above** (16 of 16, 28 of
+  28, 149 of 1694): different unit, different corpora, and they must never be
+  combined or read as an update to each other. **Nor are the three rows summable** —
+  different provenance, different denominators.
+  **What moved them is mostly residuals this document already concedes**, counted by
+  the labels at each document's *worst* severity (a histogram of every label present
+  would credit the over-block to whatever else happened to be in the document). In
+  vendor-harvest, `active:raw-html` is a top driver in **52 of the 98** — the MDX
+  component / relative-attribute over-reach two bullets up — `markdown:link-anchor-
+  injection` in 23, and only about ten documents are moved by genuinely
+  injection-shaped text, which is what security-adjacent documentation contains
+  honestly. Generated-notes tracks it almost exactly, as 184 shared ancestors imply
+  — `active:raw-html` in 53 of its 88, `markdown:link-anchor-injection` in 23 — so
+  read those two rows as one observation, not two. In reference-corpus, which shares
+  no upstream with either, the same shape holds with a different mix:
+  `active:markdown-link` 38 (largely the `?view=` documentation-version class from
+  the query bullet above), `active:data-uri` 36, `active:raw-html` 27,
+  `markdown:link-anchor-injection` 27, and eleven injection-shaped.
+  **Ground truth for "benign" is provenance, not inspection:** nobody hand-read
+  these corpora — each is benign by where it came from. A planted injection sitting
+  in a harvested corpus is scored here as a false positive, which is a real caveat
+  and not a formality.
+  **The populations are disjoint as documents but not independent as content:** 184
+  of generated-notes' 547 are same-named derivatives of vendor-harvest's 185, which
+  is most of why their driver labels agree. The third population shares no upstream
+  with either, and is the one whose provenance is first-party.
+  **The trusted door cannot produce this number and is printed only as a footnote**
+  (162 of 185, 527 of 547, 366 of 389 WARN there): every non-CRITICAL finding WARNs
+  under trust, which is the structural blindness that let the 0.3.0 active-content
+  regression pass a green suite. Read the contrast as the intended one — the same
+  corpus is cheap to persist from a source you trust and expensive from one you do
+  not.
+  **Every population was swept twice and reproduced its counts exactly**, and the
+  largest document in any of them is 362 kB — no document approached the 1 000 000-
+  character input cap, so truncation confounds nothing here.
 - **URL fragments are not graded.** A fragment is never sent to the server, so it
   cannot carry data to the host a renderer auto-fetches, and `…/overview#section` is
   the most common shape in real documentation. The residual: a *clicked* link to an