@@ -631,15 +631,14 @@ jobs:
       # and it is the only instrument on this gate's matching rules -- a clean
       # tree cannot tell a working rule from a weakened one.
       #
-      # Invoked as `node` rather than through a `pnpm check:*` alias: see the
-      # GATE INVOCATION IDIOM note at the top of this file.
+      # Invoked through its `pnpm check:*` alias, so root `package.json` is the
+      # one definition of the command (#26086).
       - name: Docs anchors resolve to real headings
         id: docs-anchors-resolve-to-real-headings
         continue-on-error: true
         run: |
           pnpm check:doc-anchors
-          node scripts/check-system-context-census.mjs --self-test
-          node scripts/check-system-context-census.mjs
+          pnpm check:system-context-census
 
       # #3723 ADR anchors: code an accepted ADR governs must keep naming it.
       # That incident reversed three accepted ADRs with a patch-level changeset,
@@ -908,24 +907,20 @@ jobs:
       # tell a working matcher from a dead one, and the specifier FLOOR is the
       # other half (a dead matcher finds nothing, and nothing is what success
       # looks like — so it refuses with exit 2 rather than passing).
-      # Invoked as `node` rather than through a `pnpm check:*` alias: see the
-      # GATE INVOCATION IDIOM note at the top of this file.
+      # Invoked through its `pnpm check:*` alias, so root `package.json` is the
+      # one definition of the command (#26086).
       # Scans ~2k non-test src files across 78 workspace packages, no spawns; ~1s.
       - name: Published src imports only declared workspace deps
         id: published-src-imports-only-declared
         continue-on-error: true
-        run: |
-          node scripts/check-undeclared-dep-imports.mjs --self-test
-          node scripts/check-undeclared-dep-imports.mjs
+        run: pnpm check:undeclared-dep-imports
 
       # Rationale: `scripts/check-keyed-text-bounds.mjs` header (#12147, #11374, #12058,
       # #12143).
       - name: Keyed text-family columns declare their bound (#12147)
         id: keyed-text-family-columns-declare
         continue-on-error: true
-        run: |
-          node scripts/check-keyed-text-bounds.mjs --self-test
-          node scripts/check-keyed-text-bounds.mjs
+        run: pnpm check:keyed-text-bounds
 
       # Rationale: `scripts/check-bash32-floor.mjs` header (#12221).
       - name: shell scripts hold the bash 3.2 floor
@@ -1968,9 +1963,7 @@ jobs:
       - name: Platform-object tenancy census matches the tree
         id: platform-object-tenancy-census-matches
         continue-on-error: true
-        run: |
-          node scripts/check-platform-object-tenancy-census.mjs --self-test
-          node scripts/check-platform-object-tenancy-census.mjs
+        run: pnpm check:platform-object-tenancy-census
 
       # ── THE LANE'S VERDICT (#23191): the last step, and the one that keeps a
       # red gate red. The EVERY GATE RUNS note above `jobs:` argues it. ─────
@@ -3593,7 +3586,7 @@ jobs:
       - name: Declared registry log level
         id: declared-registry-log-level
         continue-on-error: true
-        run: node scripts/check-registry-log-declared.mjs --self-test && node scripts/check-registry-log-declared.mjs
+        run: pnpm check:registry-log-declared
 
       # The same defect one package down (#15484). `packages/rest`'s own fault
       # logging hands whole `Error` objects to `console.error`, and Node prints
@@ -3608,7 +3601,7 @@ jobs:
       - name: Declared REST fault-log level
         id: declared-rest-fault-log-level
         continue-on-error: true
-        run: node scripts/check-rest-log-declared.mjs --self-test && node scripts/check-rest-log-declared.mjs
+        run: pnpm check:rest-log-declared
 
       # The pairing half of the one above (#17865, ruling batch #128 item 4).
       # The `packages/rest` harness now runs at `OS_REST_LOG: 'silent'`, which
@@ -3623,7 +3616,7 @@ jobs:
       - name: Declared REST fault-log level — observers
         id: declared-rest-fault-log-level-observers
         continue-on-error: true
-        run: node scripts/check-rest-log-spy-declared.mjs --self-test && node scripts/check-rest-log-spy-declared.mjs
+        run: pnpm check:rest-log-spy-declared
 
       # Rationale: `scripts/check-live-db-isolation.mjs` header (#10382, #9350).
       - name: Live-server database isolation
 
@@ -207,13 +207,13 @@
  * has it run, so deleting BOTH invocations from `lint.yml` now reds there through
  * `check:system-context-census` -- but deleting the production invocation alone
  * still retires this gate with every check green. The self-test therefore reads
- * the workflow text and asserts both legs, the way `check-doc-frontmatter`,
+ * the workflow text and the root alias it runs (#26086) and asserts both legs, the way `check-doc-frontmatter`,
  * `check-aggregator-roster` and `check-ci-filter-parity` each assert their own -- a
  * gate that exists and is not scheduled is the dormant shape seen from the other
  * side.
  *
  * ⚠️ The pin deliberately needs NO workflow edit: `lint.yml` already invokes both
- * legs, in the required `Lint & Repo Gates` job, on a trigger set that includes
+ * legs (through the alias), in the required `Lint & Repo Gates` job, on a trigger set that includes
  * `merge_group` and with no `paths:` filter. It is the repo's busiest file and the
  * assertion reads it rather than adding to it.
  */
@@ -2305,11 +2305,22 @@ function selfTest() {
     t(`WIRING: .github/workflows/lint.yml is readable`, false, err.code ?? err.message);
   }
   if (lintYml !== null) {
+    // CI runs the root alias (#26086), so the alias is where both legs live.
     t(
-      'WIRING: lint.yml invokes this gate directly (the GATE INVOCATION IDIOM, not a package.json fence)',
-      lintYml.includes(`node ${SELF}\n`)
+      'WIRING: lint.yml invokes this gate through its root alias',
+      /^\s*pnpm (run )?check:system-context-census\s*$/m.test(lintYml)
+    );
+    let alias = null;
+    try {
+      alias = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8')).scripts?.['check:system-context-census'] ?? null;
+    } catch (err) {
+      t('WIRING: root package.json is readable', false, err.code ?? err.message);
+    }
+    t(
+      'WIRING: the alias runs the --self-test leg, then the gate',
+      alias === `node ${SELF} --self-test && node ${SELF}`,
+      alias
     );
-    t('WIRING: lint.yml runs the --self-test leg too', lintYml.includes(`node ${SELF} --self-test`));
   }
 
   // ── POPULATION DECLARATION: what the dispatch derivation is told this gate reads ──