docs: record the separate namespace statistics document in monolith/S04 and its plan

What does this MR do and why?

Brings monolith/S04 and the namespace statistics plan in line with what gitlab!256618 merged.

The plan's Step 2 and S04 both specified the header's artifactRegistry { statistics } selection inside get_repositories.query.graphql, with a widened update reducer and a narrowed error hook. In review, @rchanila asked for a separate document, and that is what merged: get_namespace_statistics.query.graphql, read by repositories_list.vue with CACHE_AND_NETWORK, under a new LIST_BATCH_KEY set on both smart queries, and clearing the figures in both error() and result({ error }). The list document, its update reducer, and its error hook are unchanged; the list smart query gains only the batch key. The batch has one accepted cost, which S04 and the plan now record: a slow statistics read holds the table's first render.

The plan had rejected a separate document because it would add a second browser round trip. That premise did not hold: the shared batchKey routes both operations through BatchHttpLink, so the first load is still one HTTP request (app/assets/javascripts/lib/graphql.js), and a filter, sort, or page change re-reads only the list.

Spec amendment (docs/specs/monolith/S04-repositories-list.md)

• Namespace statistics: the example is now the statistics-only document, and a new paragraph says why it is separate and how batching keeps the first load at one request.
• Aggregate header, read-fails row: the reason the table survives is the separate document, not null propagation inside one document.
• Apollo: "its query" becomes "both of its documents".
• Resolutions: a new bullet, Which document the header reads.
• Authorization premise: the plan recorded this correction as owed. S04 said the registry type declares no authorization. It declares authorize :read_artifact_registry, and the organization's artifactRegistry field skips that type-level check (ee/app/graphql/ee/types/organizations/organization_type.rb). The inheritance conclusion is unchanged.

S04 stays Approved. S10 needs no change: it declares the field and its merge order, not the list's document shape.

Plan record (docs/plans/monolith/2026-09-21-namespace-statistics.md, docs/plans/README.md)

Following the precedent of the monolith/S03 plan amendment (!1347 (merged)) and the writing-discipline.md rule A merged step turns its plan entry into a record, this adds a dated note and makes in-place "as merged" edits rather than deleting the original reasoning:

• Approach: the single-document paragraph now records what was planned, that review reversed it, and why the rejection's premise failed.
• Step 2: Scope, Files, Shared seams, Acceptance, and Tests now list what merged. This includes the files the plan did not name (cache_update.js and its spec, the feature spec stub, and the new namespace_statistics.rb fixture in place of the planned repositories.rb change). It also records that Step 3 landed humanSizeClamped while this step left utils.js unchanged and added the clamp's subtests.
• Pointers narrowed the same way:
  • The parent-field research finding. Its heading was renamed, and the plan's only link to it is updated.
  • The data-owner finding.
  • Testing strategy.
  • Step MRs opened ahead of this plan.
  • The index row in docs/plans/README.md.
• Status table: filled with the three merged step MRs: gitlab!256610, gitlab!256621, gitlab!256618.

Steps 1 and 3 keep their plan-time Files lists. The plan now says so explicitly.

Phase wording (883288046)

The plans index row and the plan's scope line no longer call the work "the Phase 2 capability both specs defer". They name it the capability both specs specify. The plan's Context paragraph is dated history: statistics was the one Phase 2 capability no longer waiting on AR when the plan was written, and both specs have since moved it into Phase 1. The index row's authorization divergence is explicit, per the GitLab Duo thread.

Verification

• The shipped files were read from gitlab origin/master (c7183662e, rechecked at 7295cb9aa464): the squash commit 4cf9eaf5dbce and Step 3's 4b1f2b3571b3.
• The merge state of all three step MRs was checked through the API.
• The review ask is thread 764fe721 on !256618.
• pre-commit run --files passes on all four files: markdownlint, vale, lychee, editorconfig.

Rebased onto main after !3177 (merged) merged

!3177 (merged) moved the statistics field and the aggregate header into Phase 1 across S04, and edited the same Namespace statistics paragraph this MR rewrites.

• The conflict, in S04's Namespace statistics section: resolved by keeping !3177 (merged)'s sentence, now on main (no phase, and the resolver reads the handle from its parent), and this MR's separate-document paragraph. Dropped is the old "Both selections travel in one document" sentence, which this MR exists to correct.
• The other hunks of the S04 commit applied cleanly on top of !3177 (merged)'s text: the read-fails row, the Apollo wording, the authorization premise, and the new resolution bullet.
• Dropped from the branch: the commit 3f8c3930f and its revert c21b9029a. They netted to zero, and the phase change they touched now lives on main.
• Checks:
  • git range-diff shows the S04 commit differing only by that resolved paragraph, and the two plan commits carrying identical content, with only the surrounding index rows that landed on main moved;
  • no "Phase 2" or "one document" wording about the field or the header remains in S04 or the plan, outside dated history and rejected alternatives;
  • pre-commit run --files passes on all four files.

Self-review after the rebase (fd9cc4d0e, 536a261d2, 883288046)

Each fix went into the commit that wrote the text it corrects; the branch is still three commits on main.

• S04: the batch's accepted cost is in the Namespace statistics section and the "Which document the header reads" resolution, with the unbatched alternative recorded as rejected. The read-fails row now says what stays out of the list view's error state: an AR failure of the read, or a GraphQL error on its parent.
• Plan:
  • Step 3's Shared seams is a merged record (it landed the clamp first; Step 2 added the subtests);
  • Step 3's utils_spec.js entry notes it was not modified, and the kept Files lists name what the merged diffs added;
  • Step 2 names the new LIST_BATCH_KEY, and its acceptance names the statistics field rather than the parent resolving null;
  • the research finding on round trips, the gate-inheritance finding, and the Testing strategy fixture clause now match what merged;
  • a positional "above" is now a link.
• Plans index row: the shared seam is the clamp in utils.js and its spec, and the authorization sentence no longer reads as the shipped type specifying the header.

Rebased onto main after !3000 (merged) merged

• docs/plans/README.md: the predicted one-line conflict. This MR's edited namespace-statistics row is kept, and !3000 (merged)'s sidebar-counts row stays directly below it. Against main, the file differs by that one row only.
• docs/plans/monolith/2026-09-28-repository-sidebar-counts.md: a semantic conflict, so a one-sentence edit. !3000 (merged)'s plan said the namespace-statistics plan "still records the single-document shape", which stops being true when this MR lands. It now says that plan planned the single-document shape, the merged MR departed from it at review, and the plan now records the departure.
• docs/specs/monolith/S04-repositories-list.md: main's rename of the S09 follow-up bullet ("Repository access management") merged cleanly.
• Checks: git range-diff shows the S04 commit identical. The plan commit differs only by the README row placement and the sidebar-counts sentence. The namespace-statistics plan is byte-identical to before the rebase, and S04 differs from its pre-rebase version only by main's rename. pre-commit run --files passes on all four files.

Related to gitlab-org/gitlab#628183