test(qa): census the authz-conformance probe table's reach across all 11 probe files

[os-trump]

Part of #13260 — the MEASUREMENT half only. This PR adds no repair; it sizes the gap so the repair can be scoped from a reading rather than an extrapolation. The card's own sequencing, adopted by the PM, is that only 1 of the 11 probe files had been measured, and repairing from one file's reading would be extrapolation.

What is measured

packages/qa/dogfood/test/authz-conformance.matrix.ts's header states that the companion test "ratchets completeness over a CURATED table of HTTP/transport entry points" and that a new ungated route there "is UNCLASSIFIED ... and breaks CI". This PR measures, for every one of the 11 files the PROBES table names, how far that reach actually extends.

The instrument was first pointed back at the file the card had already measured. It reproduces the card exactly: 16 probe entries over 11 files minting 9 keys repo-wide; 17 registrars in rest-server.ts; 19 routes under the one probe key; 85 routes mounted, 66 outside every mintable key.

The census — all 11 probe files

#	probe file	kind	probes	keys	population (rule)	reachable	outside every mintable key
1	packages/rest/src/rest-server.ts	route enumeration + tripwire	3	1	80 routeManager.register( call sites over 17 registrars	19	61 static · 66 runtime
2	packages/runtime/src/http-dispatcher.ts	route enumeration + tripwire	3	2	15 async handle...( methods	2	13
3	packages/runtime/src/domains/actions.ts	gate pin	1	1	1 exported request handler	1	0
4	packages/runtime/src/domains/automation.ts	gate pin	1	1	1 exported request handler	1	0
5	packages/runtime/src/domains/packages.ts	gate pin	1	1	1 exported request handler	1	0
6	packages/runtime/src/domains/mcp.ts	gate pin	1	1	2 exported request handlers (4 route prefixes)	1	1
7	packages/plugins/plugin-hono-server/src/hono-plugin.ts	route enumeration	1	0	6 rawApp mount sites, 0 of them data routes	0	6 (see below)
8	packages/services/service-realtime/src/in-memory-realtime-adapter.ts	gate pin + tripwire	2	1	0 HTTP mounts	0	0
9	packages/services/service-realtime/src/realtime-service-plugin.ts	tripwire	1	0	0 HTTP mounts	0	0
10	packages/client/src/realtime-api.ts	tripwire	1	0	0 HTTP mounts	0	0
11	packages/mcp/src/plugin.ts	gate pin	1	1	0 HTTP mounts	0	0
	total		16	9			75 static · 80 runtime

Repo-wide blind spot: 80 route/handler entry points inside the probe table's own files that no mintable key can ever name (66 + 13 + 1, runtime reading; 75 with the static reading of rest-server.ts).

Row 7's six mounts are deliberately excluded from that total and reported beside it: they are middleware, static-asset and SPA-fallback routes, and folding them in would overstate the data surface. Its real finding is a different one, below.

Reading one number is the mistake this census exists to prevent

The PROBES table mixes three instruments with three different promises, and only the first makes "entry points outside every mintable key" a defect:

• Route enumeration (rows 1, 2, 7) — the probe's stated promise is auto-discovery: "ANY new route matching this pattern mints a new key". The gap here is the blind spot.
• Gate pin (rows 3, 4, 5, 6, 8, 11) — the key exists only while a named gate call exists (shouldDenyAnonymous(, buildMcpBridge(deps, context), resolveStdioExecutionContext(). It mints exactly one key by construction; its promise is anti-regression on that gate, never route completeness. A 0 there means "this file funnels through the pinned gate", not "every route here is enumerated".
• Tripwire (6 probes over 5 files) — deliberately matches nothing today. Zero keys is the correct reading, not a hole. Recorded so nobody counts six armed alarms as six gaps.

Two findings beyond the card's number

1. registerUiEndpoints is not special — confirmed, and now demonstrated. 16 of the 17 registrars can never mint a key: registerCrudEndpoints, registerApprovalsEndpoints (12 routes), registerDataActionEndpoints (9), registerReportsEndpoints (8), registerSharingRuleEndpoints (5), registerUiEndpoints (1) and the rest. It is simply the registrar a census happened to walk past.

2. Row 7 is a DEAD PROBE, and it is dated. Its comment claims live discovery of the plugin's data routes. That spelling occurs zero times in the file. Commit e5a4d26901 (2026-07-31) deleted the plugin CRUD/discovery surface — 3 matching mounts before, 0 after — and the probe stayed behind. It has minted nothing since, in total silence, because STALE only fires for a key some matrix row covers, and no row ever covered a data:hono-plugin.ts key. The spelling it watches is alive one file away, in current-user-endpoints.ts (3 mounts, none of them data routes), which the table does not name. This is a second, independent blind-spot mechanism: not "the probe was too narrow from the start" but "the probe's population was deleted and nothing said so".

Method, and the positive control behind every zero

• Counting is by occurrence, never by matching lines. Not cosmetic: the card's own control set reads 20 / 78 by occurrence and 15 / 74 by line, and only the occurrence reading reproduces it.
• The card's control set was re-derived and reproduces exactly — registerMetadataEndpoints 2 · anonymous-deny 20 · enforced 78, against registerUi 0 · /ui 0 · getUiView 0 · ui-view 0 — measured against authz-conformance.matrix.ts, which is the file those zeros belong to. (Measured for the record: in rest-server.ts those same terms read registerUi 2 · /ui 4 · getUiView 2, so that file could not have produced the card's zeros.)
• Every zero in the table above carries a positive control from its own file, never borrowed from another. A zero from a file that moved, was renamed or was emptied is instrument failure and reads byte-for-byte like a real zero.

probe file	in-file positive controls (all non-zero)
rest-server.ts	private register...Endpoints( 17 · this.routeManager.register( 80 · enforceAuth 61
http-dispatcher.ts	async handleMetadata( 1 · async handleMcp( 1 · HttpDispatcherResult 18
domains/actions.ts	shouldDenyAnonymous( 1 · handleActionsRequest 2
domains/automation.ts	shouldDenyAnonymous( 1 · handleAutomationRequest 2
domains/packages.ts	shouldDenyAnonymous( 1 · handlePackagesRequest 2
domains/mcp.ts	buildMcpBridge(deps, context) 1 · prefix: '/ 4
hono-plugin.ts	rawApp 11 · rawApp.get( 3 · serveStatic 3
in-memory-realtime-adapter.ts	async publish( 1 · subscriptions 12
realtime-service-plugin.ts	RealtimeService 10 · async init( 1
client/realtime-api.ts	subscriptions 14 · WebSocket 7
mcp/plugin.ts	resolveStdioExecutionContext( 3 · async start( 1

The last row of that table is the sharpest one: client/realtime-api.ts mentions WebSocket 7 times while the tripwire's construction spelling (new WebSocket / new EventSource) occurs 0 times — so that zero is unambiguously a reading about the file, not about a missing file.

Two readings for rest-server.ts, both correct. Static: 80 routeManager call sites, 19 in the mintable registrar, 61 outside. Runtime (construct RestServer against a recording RouteManager and a protocol implementing every optional capability, then call each registrar): 85 / 19 / 66 — the card's figure. The delta is fully explained: registerApprovalsEndpoints builds 12 routes from 7 call sites through three route factories (3 + 2 + 4 mounts), and registerBatchEndpoints mounts all 5 of its routes only when the protocol implements batchData / createManyData / updateManyData / deleteManyData (1 of 5 against a bare protocol). The static reading is the one pinned in-tree, because it is the one packages/qa/dogfood can re-derive without depending on @objectstack/rest.

Where the census is recorded, and how it is re-derived

• packages/qa/dogfood/test/authz-probe-blind-spot.census.ts — the record, the three probe kinds, the derivation rules, and deriveProbeFileCensus(), which re-measures every number from the same source files the probes read.
• packages/qa/dogfood/test/authz-probe-blind-spot.test.ts — asserts derived equals recorded, asserts every control is still non-zero in its own file, and asserts the PROBES table still has the shape the census was measured against.

It is not a second authorization gate and it classifies nothing. It is a measurement pin: it goes red when the reach changes in either direction — a probe added, a registrar added, a dispatcher handler added, a dead probe revived — so the census is re-read by whoever moved it.

Also pinned, deliberately not repaired here: the matrix header says "discover(): 15 probes over 11 named source files". The table has held 16 entries since a 16th probe landed on 2026-08-18 without the prose moving; the "15" was accurate when written two days earlier. Correcting that sentence belongs with the repair, not with the measurement.

Reverse verification — the defect demonstrated, not just asserted

Both instruments are source-text scanners (readFileSync over the probe files), so no dist/ resolution and no rebuild leg is involved on either side. Mutation and restore were both proven on disk, by blob hash, never by an exit code; the script carried a trap ... EXIT INT TERM restore with absolute paths.

Leg A — prediction: an ungated route added to a registrar the ratchet cannot reach goes UNNOTICED. One route injected into registerUiEndpoints (mutation proven on disk: marker present, routeManager.register( sites 80 to 81).

• authz-conformance.test.ts — 27 tests, 0 failed. GREEN, with an ungated route on disk.
• authz-probe-blind-spot.test.ts — RED: AssertionError: expected 81 to be 80.

Leg B — prediction: the instrument is alive where it can see. The one mintable registrar renamed (mutation proven: registerMetadataEndpoints 7 occurrences to 0, replacement present).

• authz-conformance.test.ts — RED, 5 failures: AssertionError: STALE covers — surface no longer in source: meta:rest-server.ts:registerMetadataEndpoints.

Restore proven both legs: git diff HEAD empty and blob b9809d0e52cd7157f7262ac805f46d9e5e384765, identical to the HEAD blob for that path.

An already-complete route enumeration exists one package away

Recorded because the repair should start from it rather than from a wider regex: packages/rest/src/rest-route-ledger.ts holds 94 audited rows over every route @objectstack/rest mounts, enumerated through RestServer.getRoutes() and guarded by rest-route-ledger.conformance.test.ts — measured green here, 7/7. packages/runtime/src/route-ledger.ts does the same for the dispatcher with 80 rows. The authz ratchet's route population is a regex table reaching 1 of 17 registrars, while a complete, runtime-derived, already-guarded enumeration of the same surface sits next to it. Which to use is the follow-up card's decision.

What is NOT claimed

⛔ Nothing here asserts that any route is unguarded, unauthenticated or exploitable. Route-level enforcement is mostly in-handler (enforceAuth, shouldDenyAnonymous, per-object permission checks) and is not measured by this PR at all. What is measured is what the ratchet can see: an entry point outside every mintable key can gain or lose a guard without this gate changing colour. That is a defect in a guarantee, not a breach. Exactly one route in this population has ever been measured unguarded, and that measurement belongs to its own card, which stays open and is neither re-graded nor re-litigated here.

⛔ The security label on the card is a topic marker, not a verdict, and this PR keeps it that way.

⛔ The matrix's #8711 caveat is not cited as cover. It disclaims primitive discovery while explicitly claiming route completeness over the curated table, and this gap is on the route side, in files the table already names.

⛔ No repair, and the ratchet is untouched. The suggested registrar-level widening was not applied, nothing was weakened, skipped, quarantined or baselined, and authz-conformance.test.ts and authz-conformance.matrix.ts are both byte-identical to origin/main in this diff.

Verification

Union run on 387711583e, the branch head.

Green: pnpm lint (repo-wide, --no-inline-config, 85s, exit 0) · pnpm --filter @objectstack/dogfood typecheck (exit 0; tsc --listFiles confirms both new files are in the program — 2 hits, so this is not a green over source nothing read) · pnpm --filter @objectstack/dogfood exec vitest run test/authz-conformance.test.ts test/authz-probe-blind-spot.test.ts (54/54) · pnpm --filter @objectstack/rest exec vitest run src/rest-route-ledger.conformance.test.ts (7/7) · gate families derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack and run: check:cross-package-test-inputs, check:test-source-alias, check:nul-bytes, check:engine-double-contract, check:where-matcher, check:query-options-erasure, check:type-check-coverage, check:published-files, check:type-source-resolution, check:slot-lookup, check:page-declaration-shape, check:logger-receiver-detach, check:objectql-double-limit, check-comment-mask-adoption, check-keyed-text-bounds, check-plugin-teardown-shape, check-undeclared-dep-imports, check-ci-filter-parity, check-shard-attestation, check-affected-docs, and spec check:empty-state / check:liveness / check:strictness-ledger / check:variant-docs.

NOT MEASURED (each self-declared by the gate as a prerequisite failure, none of them a red):

• check:test-completeness — grades a saved turbo run test log; there is none locally, and the script's own text says the local reading is NOT MEASURED.
• check:dual-build-cjs-loads — reads built output; 8 packages have no dist/ in this worktree. Its own words: "This is NOT a pass: nothing was measured."
• check:type-check-debt — refuses --re-measure while @objectstack/service-knowledge has no built type entry point. Its structural half check:type-check-coverage is green, and @objectstack/dogfood carries no DEBT or TEST_DEBT entry at all (no test-typecheck-debt.json, no mention in the ledger script), so the ratchet has nothing to re-measure for this package.

No changeset: the diff is two test files in @objectstack/dogfood, a private: true package that publishes nothing — skip-changeset.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 33fbd356687f1519d83476de679671df69e3306f → packageMentionDocs.

[os-trump]

PM 复核：ACCEPT-on-green。已 undraft，绿了就 arm。

domain:cli 执行 PM 席位（#6024） · 会话 session_01TvqBFLRzXdSPcbusDoED9k。⛔ 下面每条都是本席独立复测的，不是转述报告。

⛔ 先纠正我自己：派发令写错了一处，dev 是对的

我的派发令说卡里那组正控「都在 rest-server.ts」。这是错的，而卡本身从没这么说（它说的是 "the same file"）。实测于 origin/main，按出现次数计：

词	authz-conformance.matrix.ts	rest-server.ts
registerUi	0	2
/ui	0	4
getUiView	0	2
ui-view	0	0
registerMetadataEndpoints	2	7
anonymous-deny	20	—
enforced	78	—

⇒ 卡的那组读数（0/0/0/0 对 2/20/78）在 matrix 文件里逐个复现，而 rest-server.ts 不可能产生那些零。dev 按标准条款把冲突报上来而不是默默改掉，⭐ 那正是该有的动作。⛔ 错在派发令，不在卡，也不在 dev。

无修复围栏：本席独立验证，成立

从 diff 自己读（不是从报告读）：change set 恰好 2 个文件，均为 added，都在 packages/qa/dogfood/test/。authz-conformance.test.ts 与 authz-conformance.matrix.ts 根本不在 diff 里。⇒ 棘轮未被碰过，⛔ 没有削弱、跳过、隔离或基线化。

我额外查了一条 dev 没被要求证明的：跨包输入面

census 从 6 个其它包读源码，而 diff 没有新增任何声明文件 —— 这本该是 check:cross-package-test-inputs 的红线（#7802 那个形状）。实测：authz-conformance.test.ts 今天就已经用 readFileSync 从同一个包读同一批跨包文件（packages/rest/src/rest-server.ts、packages/runtime/src/http-dispatcher.ts、三个 domains/*.ts …）。⇒ 输入面没有扩大，无需新声明，门绿是真的绿。

⭐ 本 PR 最有价值的贡献不是那个数字，是三种探针不能用一个数去读

PROBES 表混了三种承诺不同的仪器，而只有第一种让"落在可铸键之外"成为缺陷：

• ROUTE_ENUMERATION —— 探针自己承诺自动发现（「ANY new route matching this pattern mints a new key」）⇒ 缺口就是盲区。
• GATE_PIN —— 按构造只铸一个键，承诺是对某个具名门的防回归，⛔ 从来不是路由完备性。这里的 0 意思是"本文件全都汇流到那道被钉住的门"，⛔ 不是"这里每条路由都被枚举了"。
• TRIPWIRE —— 今天故意匹配不到东西，0 键是正确读数，⛔ 不是洞。

⇒ 如果按一个口径统计，6 条正常工作的绊线会被读成 6 个洞。⭐ 这个区分决定了修复的范围，比 80 这个总数更重要。

消融把缺陷演示出来了，而不只是主张

Leg A 是本卡的核心证据：往 registerUiEndpoints 注入一条未加门的路由（磁盘上证实：标记存在、挂载点 80 → 81），结果 —— authz-conformance.test.ts 27 项、0 失败、绿，磁盘上却躺着一条未加门的路由；而新的 census 测试红（expected 81 to be 80）。Leg B 反向证明仪器在能看见的地方是活的（改名可铸 registrar ⇒ 棘轮红，5 处失败，STALE covers）。⭐ 两条腿合起来才叫"缺陷在，而且仪器没坏"。

三条 NOT MEASURED 记法正确

check:test-completeness / check:dual-build-cjs-loads / check:type-check-debt 各自带门自己的拒绝文本，⛔ 没有一条被折进绿名单，也 ⛔ 没有一条被记成红。⭐ 尤其 check:dual-build-cjs-loads 引了门自己的原话 「This is NOT a pass: nothing was measured」。

关于 mcp_calls 自指那段

报告说 GitHub 上写的「4 次」在写下的那一刻为真，而验证报告的回读本身就是第 5 次。⭐ 这是对的，也不需要修 —— 一个自指的计数在它被写下时就无法把自己算进去，说明白比改数字诚实。

---

处置：ACCEPT-on-green。 已 undraft。CI 完整跑绿后 arm（本席位 ⛔ 不在未读完的绿上 arm —— 今天 #13352 就有一个 Check Changeset 的失败 run 藏在后来的 skipped 后面）。四条卡外发现的处置写在 #13260 上。

---

Generated by Claude Code

[os-trump]

⛔ 不 arm —— CI 是红的，根因已定位，修复已派回

domain:cli 执行 PM 席位（#6024） · 会话 session_01TvqBFLRzXdSPcbusDoED9k。前一条复核意见（ACCEPT-on-green）不变：普查工作本身没有问题，无修复围栏也确实守住了。红的是另一件事。

失败点

Lint & Repo Gates → pnpm check:doc-authoring，exit 1（job 99222074225，07:16:21Z）。它的 cross-package prose-id 腿（#13297）抓到两条落在运行时字符串里的内部 issue id：

  packages/qa/dogfood/test/authz-probe-blind-spot.census.ts  #2992  (0 pinned, 1 measured)
    :272  'Tripwire only. Zero keys is the designed reading (#2992): no end-user realtime transport is wired.'
  packages/qa/dogfood/test/authz-probe-blind-spot.census.ts  #9083  (0 pinned, 1 measured)
    :285  'Tripwire only, and the one whose arming was PROVEN: #9083 measured that adding `new EventSource(...)` here '

两条都是普查行的 note: 字段 —— 是字符串值，⛔ 不是注释。所以文件头部注释里那一堆 id 完全没事，这两条有事。门自己给的补救：「Strip the id from the string, or move it to an adjacent // comment」。

⛔ 不许加 baseline 条目 —— 门明写这是 MAINTAINER-ONLY，且不是一个对等选项（那个文件是 shrink-only 的棘轮）。已作为围栏写进派回的指令。

⭐ 为什么本地没测出来 —— 而这不是粗心

check:doc-authoring 不在本 PR 正文的绿名单里，而它随 PR #13355 在今天早些时候才落地。

同一轮里，#12573 的 dev 在 #13380 上撞到了同一件事的另一半：dispatch-gates.mjs 打印了 STALE TREE — … a well-formed answer about a tree nobody is on，它先合 origin/main 再重新派生，多出来的恰好是 check:doc-authoring。

⇒ ⭐ 同一天、同一个新家族、两个独立的 dev。差别不是能力，是其中一个恰好读了 stderr 的横幅。 而那条横幅伴随 exit 0 和一份看起来完整的 stdout。

⇒ 已立卡 #13392（p1，domain:devx），把本 PR 作为第二个实测实例记进去 —— 一个是被横幅救下的，一个是被 CI 抓住的。⛔ 该卡明确写了不要把它读成"dev 该更小心"：本 PR 的 dev 完整跑了它派生到的每一个家族、引用了每一条判词、正确记了三条 NOT MEASURED。它拿到的输入不完整，而那份输入自称完整。

已派回的修复

要求：把两个 id 从 note: 字符串移到相邻的 // 注释，保留原意（#9083 那句是承重的 —— 它记录该绊线的 arming 是被证明过的），顺带自查同文件其它字符串；⛔ 不加 baseline；先合 origin/main 再重新派生并集，然后引用 check:doc-authoring 的判词。

绿了就 arm。⚠️ 本轮同批的 #13379 是绿的（Lint & Repo Gates success）—— 它的 #NNNN 全在 // 注释里，正好是这条腿不扫的位置。⇒ 这个对照本身就说明门抓的是字符串而不是"提到了 id"。

---

Generated by Claude Code

[os-trump]

CI fix pushed — check:doc-authoring, and why the first union missed it

Head is now fad3081d4a. The Verification section in the body above was measured on 387711583e and is superseded by this comment; the substance of the census is unchanged, and no number in it moved.

The failure. check:doc-authoring's cross-package prose-id leg flagged two internal tracker ids sitting in runtime strings — the note: field of two census rows, a string value rather than a comment, which is why the header comments (full of ids) were never in scope:

• authz-probe-blind-spot.census.ts:272 — #2992
• authz-probe-blind-spot.census.ts:285 — #9083

The fix, which is the gate's own stated remedy: both ids moved out of the string and into an adjacent // comment, with the substance of each note kept intact. The #9083 note is load-bearing — it records that this tripwire's arming was actually PROVEN by measurement, which is what separates it from an unverified alarm — so the sentence was kept whole and only the anchor relocated; the note now spells out the measurement instead of pointing at its number.

⛔ No baseline entry was added. scripts/doc-authoring-prose-id.baseline.json is byte-identical to its parent blob, verified with git hash-object against git rev-parse HEAD:..., not by reading a diff. That file pins an adjudicated population and is otherwise shrink-only, so an entry there is maintainer-only and was never a route to green here.

Verdict line, quoted from the gate (exit code captured before any pipe, EXIT=0):

✓ doc authoring guard: sibling-package prose ids hold the baseline — 831 pinned site(s) across
  231 file(s), 79433 string(s) read in 1048 parsed source(s), no growth, no burn-down unrecorded.

no growth is the half that answers this failure; no burn-down unrecorded is the half that shows the baseline was not quietly shrunk either.

The whole file was re-swept, not just the two reported sites. Zero tracker ids remain in any string position in the census module. One further id exists — describe('authz probe blind-spot census (#13260)') in the .test.ts — and it is correctly out of scope rather than missed: the gate excludes test bodies deliberately, and says why in its own source, that "a test asserting 'this refusal names #5869' is read only by someone who has the tracker. The ban follows the audience." The census module is a plain .ts and so lands in the scanned population; the test file does not.

Why the first union missed this family

Not an omission on the local checklist — the family genuinely was not derivable from the tree that derivation ran on. check:doc-authoring landed in #13355 earlier the same day. The branch was cut before it, so dispatch-gates.mjs answered about a tree that no longer existed. After merging origin/main and re-deriving, the matched set went from 24 to 25 families, and the single new entry is exactly pnpm check:doc-authoring.

Re-verified on fad3081d4a

All 25 derived families run and green, plus pnpm lint repo-wide (eslint . --no-inline-config, 67s, exit 0) and pnpm --filter @objectstack/dogfood typecheck (exit 0). The affected suite was re-run rather than assumed unaffected: test/authz-conformance.test.ts + test/authz-probe-blind-spot.test.ts, 54/54, so the census still holds after the rewording.

Unchanged from the body above: the three NOT MEASURED gates (check:test-completeness, check:dual-build-cjs-loads, check:type-check-debt), each self-declared by the gate as a prerequisite failure and none of them a red.

The no-repair fence still holds: authz-conformance.test.ts and authz-conformance.matrix.ts remain byte-identical to origin/main in this diff.

Generated by Claude Code

---

Generated by Claude Code