docs(rest,runtime,qa): attribute the 80 route registrations to both spellings, and re-measure the gated split (#16955)

* docs(rest,runtime,qa): attribute the 80 route registrations to both spellings, and re-measure the gated split

Four docblocks said "all 80 `this.routeManager.register(` sites". The population
is still 80, but it is now counted across two spellings — 72 direct call sites
plus 8 `registerPerItemRoute(` calls through the per-item family's
switch-carrying helper. One of the four sites is inside the census file that is
itself the authority on this population, whose `:82` already knew about the
second spelling while `:139` did not.

The sequel figures were re-derived rather than re-worded, using the census's own
population rule. 22 = 19 + 3 did not move across the re-spelling: the same 19
routes inside `registerMetadataEndpoints`, 11 still direct and 8 now
helper-routed through the same wrapping `guardedRouteManager`, and the same 3
sharing one handler const. The headline split did move, earlier and for an
unrelated reason — 50 gated / 30 ungated became 51 / 29 when the one route that
resolved no identity was guarded — so the four sites are re-measured, not
re-worded, and the "did not move" half is written down so it is not re-opened.

The conclusion those figures support is unchanged and stated as such: deriving
"gated" from source syntax stays rejected, and the second spelling strengthens
that, since a naive scanner would now have to know both.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

* docs(qa): anchor the re-measurement at the tree it was re-verified on

`rest-server.ts` moved between the branch point and the merge (a docs-only
change to the batch-cap comment), so the note names the tree the reading was
re-verified against rather than the one it was first taken on. Every figure is
unchanged there: population 80, 51 gated / 29 ungated, 19 inside
`registerMetadataEndpoints` (11 direct + 8 helper-routed), 3 sharing a handler
const.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager

packages/qa/dogfood/test/authz-conformance.test.ts

@@ -162,11 +162,24 @@ const PROBES: readonly Probe[] = [
   // never authorization: `sdk` / `server-only` / `public` / `gap` / `mismatch`
   // say nothing about whether a caller is authenticated. Deriving "gated" from
   // source syntax instead was measured and rejected — scanning all 80
-  // `this.routeManager.register(` sites in `rest-server.ts` for `enforceAuth`
-  // reads 50/30 and 22 of the 30 ungated are FALSE (a wrapping
-  // `guardedRouteManager` for 19 of them, a shared handler const for 3), a 73%
-  // false-ungated rate on the largest registrar. What these two probes supply
-  // is the POPULATION; the classification stays a reviewed row.
+  // registration sites in `rest-server.ts` for `enforceAuth` (TWO spellings: 72
+  // direct `this.routeManager.register(` sites plus 8 `registerPerItemRoute(`
+  // calls through the per-item family's switch-carrying helper) reads 51/29 and
+  // 22 of the 29 ungated are FALSE (a wrapping `guardedRouteManager` for 19 of
+  // them, a shared handler const for 3), a 76% false-ungated rate concentrated
+  // on the largest registrar.
+  //
+  // ⚠️ RE-MEASURED 2026-09-08. The 22 = 19 + 3 decomposition did NOT move when
+  // the per-item helper landed — the same 19 routes, 11 still direct and 8 now
+  // helper-routed through the same wrapping registrar — and the population
+  // stayed 80. Only the headline split moved, earlier and unrelatedly: 50/30
+  // became 51/29 when `registerUiEndpoints`, the one route in that file
+  // resolving no identity, was guarded. Recorded so the next reader does not
+  // re-derive a figure that has now been checked; the full reading lives in
+  // `authz-probe-blind-spot.census.ts`, the authority on this population.
+  //
+  // What these two probes supply is the POPULATION; the classification stays a
+  // reviewed row.
   {
     kind: 'ROUTE_ENUMERATION',
     file: 'packages/rest/src/rest-route-ledger.ts',

packages/qa/dogfood/test/authz-probe-blind-spot.census.ts

@@ -136,16 +136,43 @@
 //     built as one.
 //
 //  2. DERIVING "gated" FROM SOURCE SYNTAX IS UNSAFE — measured, not assumed.
-//     Scanning each of the 80 `this.routeManager.register(` call sites in
-//     `rest-server.ts` for `enforceAuth` reads 50 gated / 30 ungated, and 22 of
-//     those 30 are FALSE, in two structural shapes: `registerMetadataEndpoints`
+//     Scanning each of the 80 registration sites in `rest-server.ts` for
+//     `enforceAuth` — the SAME two spellings the `populationRule` below counts,
+//     72 direct `this.routeManager.register(` call sites plus 8
+//     `registerPerItemRoute(` calls — reads 51 gated / 29 ungated, and 22 of
+//     those 29 are FALSE, in two structural shapes: `registerMetadataEndpoints`
 //     installs a wrapping `guardedRouteManager` so its 19 inner routes are
 //     gated with no `enforceAuth` at the call site, and
 //     `registerSecurityExplainEndpoints` shares one `handler` const declared
-//     outside its 3 `register(` calls. A 73% false-ungated rate, concentrated
+//     outside its 3 `register(` calls. A 76% false-ungated rate, concentrated
 //     on the largest registrar, and hand-annotating the exceptions is the same
 //     rot this instrument already has.
 //
+//     ⚠️ RE-MEASURED 2026-09-08 against `5abca1792e`, because the 19 is a count
+//     inside the very registrar the per-item helper re-spelled, and because
+//     this paragraph attributed all 80 sites to the direct spelling alone
+//     while `:82` above already knew there were two — the authority on this
+//     population contradicting itself 57 lines apart.
+//
+//     WHAT DID NOT MOVE: 22 = 19 + 3. The same 19 routes, 11 still direct and
+//     8 now helper-routed, all through the same wrapping; the same 3 sharing
+//     one handler const; the population still 80. The re-spelling moved none
+//     of the five figures.
+//
+//     WHAT DID MOVE, and not here: 50 gated / 30 ungated became 51 / 29 when
+//     `registerUiEndpoints` — the one route in this file that resolved no
+//     identity, the same repair recorded as `enforceAuth` 61 -> 64 on the
+//     rest-server.ts row below — was guarded. That landed the day AFTER this
+//     paragraph was first written and hours BEFORE it was copied into
+//     `rest-route-ledger.ts`, `route-ledger.ts` and `authz-conformance.test.ts`,
+//     which is why four sites carried 50/30 in step. ⛔ Written down as a
+//     checked figure rather than left as one nobody dared touch: the two read
+//     identically on the page, and only this note tells them apart.
+//
+//     ⛔ The rejection stands whatever the numbers do, and the second spelling
+//     strengthens it: a naive scanner now has to know both spellings before it
+//     can read the file even this badly.
+//
 //  3. A LEDGER IS A DERIVED DATA FILE, ONE GUARDED STEP BEHIND THE SOURCE.
 //     Adding a route to a registrar in `rest-server.ts` does not touch
 //     `rest-route-ledger.ts`, so a ledger-sourced population mints no new key
@@ -184,7 +211,7 @@
 // point, where a new route is already being read.
 //
 // ⛔ Two readings stay REJECTED and are recorded here so they are not
-// re-proposed: deriving "gated" from source syntax (73% false-ungated), and
+// re-proposed: deriving "gated" from source syntax (76% false-ungated), and
 // taking a ledger disposition as an authorization fact (blocker 1).
 
 import { readFileSync } from 'node:fs';

packages/rest/src/rest-route-ledger.ts

@@ -109,15 +109,30 @@ export interface RestRouteLedgerEntry {
    * SDK expressibility; none of them says whether a caller must be
    * authenticated, and `public` states INTENT for a handful of browser-facing
    * routes rather than measuring a gate. Deriving the answer from source
-   * syntax instead was measured and rejected: scanning all 80
-   * `this.routeManager.register(` sites in `rest-server.ts` for `enforceAuth`
-   * reads 50 gated / 30 ungated, and 22 of those 30 are FALSE — a wrapping
-   * `guardedRouteManager` gates 19 of them with no `enforceAuth` at the call
-   * site, and one registrar shares a handler const across its 3 mounts. A 73%
-   * false-ungated rate on the largest registrar is a written-down false
-   * assurance, which is strictly worse than an honest blank. So the posture is
-   * DECLARED at the producer, where a new route is already reviewed, instead of
-   * guessed at the consumer.
+   * syntax instead was measured and rejected: scanning all 80 registration
+   * sites in `rest-server.ts` for `enforceAuth` — TWO spellings, 72 direct
+   * `this.routeManager.register(` sites plus 8 `registerPerItemRoute(` calls
+   * through the per-item family's switch-carrying helper — reads 51 gated / 29
+   * ungated, and 22 of those 29 are FALSE: a wrapping `guardedRouteManager`
+   * gates 19 of them with no `enforceAuth` at the call site, and one registrar
+   * shares a handler const across its 3 mounts. A 76% false-ungated rate,
+   * concentrated on the largest registrar, is a written-down false assurance,
+   * which is strictly worse than an honest blank. So the posture is DECLARED at
+   * the producer, where a new route is already reviewed, instead of guessed at
+   * the consumer.
+   *
+   * ⚠️ RE-MEASURED 2026-09-08, and the two halves moved differently. The
+   * 22 = 19 + 3 decomposition did NOT move when the per-item helper landed —
+   * the same 19 routes, 11 still direct and 8 now helper-routed, all through
+   * the same wrapping registrar — and the population stayed 80. Only the
+   * headline split moved, earlier and for an unrelated reason: 50/30 became
+   * 51/29 when `registerUiEndpoints`, the one route in that file resolving no
+   * identity, was guarded. Recorded so the next reader does not re-derive a
+   * figure that has now been checked. ⛔ The rejection stands either way, and
+   * the second spelling strengthens it — a syntactic scanner has to know both
+   * before it can read the file even this badly. The full reading lives in
+   * `packages/qa/dogfood/test/authz-probe-blind-spot.census.ts`, the
+   * authority on this population.
    *
    * ABSENT MEANS "UNDECLARED", and that is the state of nearly the whole
    * surface. This field is filled INCREMENTALLY, exactly like `responseSchema`

packages/runtime/src/route-ledger.ts

@@ -157,15 +157,30 @@ export interface RouteLedgerEntry {
    * SDK expressibility; none of them says whether a caller must be
    * authenticated, and `public` states INTENT for a handful of browser-facing
    * routes rather than measuring a gate. Deriving the answer from source
-   * syntax instead was measured and rejected: scanning all 80
-   * `this.routeManager.register(` sites in `rest-server.ts` for `enforceAuth`
-   * reads 50 gated / 30 ungated, and 22 of those 30 are FALSE — a wrapping
-   * `guardedRouteManager` gates 19 of them with no `enforceAuth` at the call
-   * site, and one registrar shares a handler const across its 3 mounts. A 73%
-   * false-ungated rate on the largest registrar is a written-down false
-   * assurance, which is strictly worse than an honest blank. So the posture is
-   * DECLARED at the producer, where a new route is already reviewed, instead of
-   * guessed at the consumer.
+   * syntax instead was measured and rejected: scanning all 80 registration
+   * sites in `rest-server.ts` for `enforceAuth` — TWO spellings, 72 direct
+   * `this.routeManager.register(` sites plus 8 `registerPerItemRoute(` calls
+   * through the per-item family's switch-carrying helper — reads 51 gated / 29
+   * ungated, and 22 of those 29 are FALSE: a wrapping `guardedRouteManager`
+   * gates 19 of them with no `enforceAuth` at the call site, and one registrar
+   * shares a handler const across its 3 mounts. A 76% false-ungated rate,
+   * concentrated on the largest registrar, is a written-down false assurance,
+   * which is strictly worse than an honest blank. So the posture is DECLARED at
+   * the producer, where a new route is already reviewed, instead of guessed at
+   * the consumer.
+   *
+   * ⚠️ RE-MEASURED 2026-09-08, and the two halves moved differently. The
+   * 22 = 19 + 3 decomposition did NOT move when the per-item helper landed —
+   * the same 19 routes, 11 still direct and 8 now helper-routed, all through
+   * the same wrapping registrar — and the population stayed 80. Only the
+   * headline split moved, earlier and for an unrelated reason: 50/30 became
+   * 51/29 when `registerUiEndpoints`, the one route in that file resolving no
+   * identity, was guarded. Recorded so the next reader does not re-derive a
+   * figure that has now been checked. ⛔ The rejection stands either way, and
+   * the second spelling strengthens it — a syntactic scanner has to know both
+   * before it can read the file even this badly. The full reading lives in
+   * `packages/qa/dogfood/test/authz-probe-blind-spot.census.ts`, the
+   * authority on this population.
    *
    * ABSENT MEANS "UNDECLARED", and that is the state of nearly the whole
    * surface. This field is filled INCREMENTALLY, exactly like `responseSchema`