Document the persecution-safety field rule where an author will find it

A standing work item reads "gospel-resources + cities-internet maps must
render with REAL resource links" -- one line batching two profiles whose
contracts are opposite. gospel-resources genuinely renders 155 real eBible
links. cities-internet renders zero, deliberately: its own header says
"PERSECUTION-SAFETY: this profile carries connectivity + population +
language only. It has NO gospel-resource, church or believer field and must
not gain one."

So taking that line literally means adding a gospel-resource field to a
profile whose header forbids exactly that. The instruction is stale in the
worst way -- not merely wrong, but pointing at work that would remove a
safety property.

The rule existed only as a comment in one .vue header. It now has a section
in reference.md under Data sources, with the measurement behind it: zero href
bindings across all three cities-internet profiles, 1,567 live nodes and 0
anchors, and a `source` field that is API provenance rather than a
destination.

Also recorded that "persecution-safe" means three different things in this
repo -- field separation here, placename precision in key-cities, a
dependency-free table in DashboardDataTable -- so nobody generalises one into
the others. Only the first governs what data a profile may hold.

documentation/reference.md

@@ -352,6 +352,38 @@ Edit this one file, then `bun run build`.
 
 ## Data sources
 
+### ★ Persecution-safety — a rule about WHICH FIELDS a profile may carry
+
+Read this before adding a field or a link to any profile. **Some profiles are deliberately kept free of
+gospel/church/believer data, and a profile failing a "should have resource links" check may be OBEYING
+that rule rather than missing a feature.**
+
+The binding instance, stated in the code it governs (`plugin-designs/cities-internet/connectivity-list.vue`):
+
+> **PERSECUTION-SAFETY:** this profile carries connectivity + population + language only. It has **NO
+> gospel-resource, church or believer field and must not gain one.**
+
+Measured 2026-09-22: all three `cities-internet` profiles have **zero** `href` bindings, and the live leaf
+renders 1,567 nodes with **0 anchors**. That is correct. Its `source` field —
+`{name: "World Bank Open Data", url: "https://api.worldbank.org/v2"}` — is **API provenance**, not a
+user-facing destination, and it is surfaced as a citation paragraph when a region is expanded, which is the
+separate promise that header makes ("every figure carries its source, so the numbers can be audited").
+
+★ **Why this is written down here and not left in one file header.** A standing work item reads
+*"gospel-resources **+ cities-internet** maps must render with REAL resource links"* — one line batching two
+profiles whose contracts are opposite. `gospel-resources` genuinely renders 155 real eBible links; taking
+the same line literally for `cities-internet` means **adding a gospel-resource field to a profile whose
+header forbids exactly that**. A requirement that names two subjects deserves a per-subject check before
+anyone drains it.
+
+> **"Persecution-safe" is used for three different things in this repo** — don't assume one rule. Here it
+> means FIELD SEPARATION. In `key-cities/cities-list.vue` it means placename precision ("a wrong placename
+> in a persecution-sensitive dataset is the dangerous kind of wrong"). In
+> `research-dashboard/.../DashboardDataTable.vue` it means a dependency-free table (no third-party grid).
+> Only the first governs what data a profile may hold.
+
+---
+
 Maps read data through `@map/api/` driven by `library/api/sources.json`. Three source types:
 
 | Type | What | Points at |