docs(qa): re-measure the two route-census figures #16955 left behind, and split the two moves inside one sentence

[claude]

Fixes #16954

Clause-②: no

Five sites in the tree already read 76% false-ungated. Two still read the pre-repair figures, and the sharpest fact is one the card did not state: one file carried both. authz-probe-blind-spot.census.ts:129 said 8; :147, eighteen lines further down, said 76%. That is not a repair that missed two sites — it is one file contradicting itself, and which number a reader gets depends on which line they reach first.

The two carriers cost completely different things

Carrier 1 — authz-conformance.matrix.ts:34-35 — arithmetic. 22 of 30 becomes 22 of 29, 73% becomes 76%. Nothing new was measured for it: the five existing 76% sites are the authority, exactly as the card says.

Carrier 2 — authz-probe-blind-spot.census.ts blocker 1 — measured, not guessed. This is why #16955 left it alone: the 8 carried a ledger-grade decomposition (3 server-only / 3 public / 2 sdk), and 29 - 22 = 7 does not say how those four numbers redistribute. The card is explicit that guessing 7 = 3+3+1 is not acceptable. So it was measured.

The instrument, and why a text scan was not good enough

Gatedness is read from the syntax tree of each registration call, using the two spellings the census's own populationRule counts, with the forwarder's own call sliced out. The AST is what keeps comments from answering for code.

It reproduces the census's recorded reading exactly, at the commit the census anchors its own re-measurement to and at this branch point:

	5abca1792e (census anchor)	f6b7c53db7 (branch point)
population	80 (72 direct + 8 helper)	80 (72 direct + 8 helper)
gated / ungated	51 / 29	51 / 29
this.routeManager.register(	73	73
registerPerItemRoute(	8	8
const registerPerItemRoute =	1	1
forwarder slice: register(	1	1
whole-file enforceAuth	64	64

rest-server.ts moved 78 lines between those two commits. None of the figures moved with it, so the drift is eliminated as a variable rather than assumed away.

⚠️ A naive text scan of the same 80 sites reads 59 / 21 instead. Its balanced-paren matcher runs away on an apostrophe inside a comment — one site spans line 5244 to line 10360, swallowing five neighbours. That is the same failure mode this file already documents for its forwarder slice ("the slice ran from line 5132 to line 9004"), reproduced by accident on the first attempt. It is recorded here because the wrong number looks entirely ordinary.

The measurement

29 ungated, less the 22 false ones (19 inside registerMetadataEndpoints, 3 sharing a handler const in registerSecurityExplainEndpoints), leaves 7:

route mount	ledger disposition
GET /api/v1	server-only
GET /api/v1/openapi.json	server-only
GET /api/v1/docs	server-only
GET /api/v1/forms/:slug	public
POST /api/v1/forms/:slug/submit	public
GET /api/v1/forms/:slug/lookup/:field	public
GET /api/v1/discovery	sdk

⇒ 3 server-only / 3 public / 1 sdk. Every one of the 7 has a ledger row; none is unmatched. The answer is the arithmetic-looking one — arrived at by measurement, which is the whole point of the card's instruction not to guess it.

The row the set lost is GET /api/v1/ui/view/:object/:type, guarded at cc837dbfec. Its ledger row did not move at all: still sdk, shape-identical to every other sdk row on both sides of the gate line. That makes blocker 1's own argument stronger than it was — the grade did not notice the gate arriving, and would not notice one leaving.

⚠️ A third figure in the same sentence, and the card's cause for it is wrong

The card attributes sdk 84 / server-only 7 / public 3 to "the reading that moved". It does not descend from that reading at all. Measured:

• 73709893f1^ (before packages/rest package read routes claim to SHADOW their dispatcher twins, but the dispatcher answers /packages and /packages/:id on a stock showcase boot #14503): ledger = 94 rows, sdk 84 / server-only 7 / public 3 — exactly the census prose.
• f6b7c53db7 (today): ledger = 91 rows, sdk 81 / server-only 7 / public 3.

#14503 took the three REST package read/delete rows out of the ledger. Guarding a route never changes its disposition. The figure is corrected, and the two causes are now named apart in the docblock — a reader had no way to tell which of the two figures in that one sentence moved for which reason.

This site is repaired because the card names it explicitly as part of carrier 2. Its cause is corrected in the report rather than silently adopted.

Red lines, all preserved

• The population is still 80. Not rewritten.
• Nothing here reopens "derive authorization from source syntax" — the docblock still rejects it, and now carries a live example of a ledger grade failing to track a gate, which strengthens the rejection.
• "the single route in this whole population ever measured unguarded" is preserved verbatim. Guarding the route did not make it false; only the counts were stale.

Verification

Every exit code captured by redirect-then-$?, never through a pipe.

• Gate family derived from the delivered diff, not from the dispatch list: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack → 44 commands. 40 exit 0. The other 4 (check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content) exit 3 = PREREQUISITE NOT MET — they read a whole-tree dist/. Recorded as NOT MEASURED, neither pass nor finding.
• Dependency closure build — pnpm turbo run build --filter="@objectstack/dogfood^..." --concurrency=2 under scripts/pm/os-verify-lock.sh: VERDICT command-exit 0, 64/64 tasks.
• pnpm --filter @objectstack/dogfood typecheck — VERDICT command-exit 0.
• The two suites that consume both edited modules — authz-probe-blind-spot.test.ts + authz-conformance.test.ts: Test Files 2 passed (2), Tests 80 passed (80). Re-run at the final commit c07b9ff381.
• Whole-tree figure re-scan at my own head (by FIGURE, not by sentence shape — 22 of, 73%, false-ungated, 8 REST, 50 gated, 30 ungated, all 80): after this change zero carriers of 22 of 30, 73% or the stale 8 remain. The only surviving 73% in the tree is scripts/tenant-audit-census.mjs:114, an unrelated rhetorical phrase about tenant-audit coverage.
• Docs drift audit — node scripts/docs-audit/affected-docs.mjs: 0 docs name something this change touched (no anchors derived) across 0 changed package(s). ⚠️ Read as a structural zero, not a clearance: both edited files are test sources in a private package, so no doc can anchor to them. content/docs compared by tree object (80bf4e530eb2dd75b3d72bfc44017ed874226494, unchanged) rather than by the bot's sha. content/docs/releases/ untouched.
• Control characters — pnpm check:nul-bytes exit 0, plus a direct sweep of both files: grep -naP '[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]' → no match.

No changeset. @objectstack/dogfood is private: true with no files[]; both edited paths are test sources inside it. Nothing published moves.

验收备注

Noted, not filed — handed to the PM seat rather than acted on, because the dispatch's instruction was to report additional stale sites rather than quietly repair them:

1. ⚠️ authz-conformance.matrix.ts:27 carries the stale ledger size too — "The population comes from packages/rest/src/rest-route-ledger.ts (94 rows / 19 families)", present tense and undated, seven lines above carrier 1 in the same docblock. Measured 91 rows / 19 families at f6b7c53db7; the families count is right, the row count is not. Same cause as the sdk 84 above (packages/rest package read routes claim to SHADOW their dispatcher twins, but the dispatcher answers /packages and /packages/:id on a stock showcase boot #14503), not the gate move. Left alone: the card does not name it, and it is not a carrier of 22 of 30 or 73%.
2. authz-ledger-population.baseline.ts:61 also says "94 rows / 19 families", but explicitly dated ("MEASURED 2026-08-31") and the key arithmetic it supports is genuinely unmoved — the three departing rows all carried family: packages, which survives on the publish row. A dated reading of a past state, not a false present-tense claim. Weaker case; noted for completeness.
3. Triage's "[finding] four docblocks attribute all 80 route registrations to this.routeManager.register( — false once #16243 lands, and one of the four is inside the census file that PR itself repaired #16307 尚未合并" reading was wrong, and the method is the reason. It used git log --grep=16307 — the issue number. The repair landed as PR docs(rest,runtime,qa): attribute the 80 route registrations to both spellings, and re-measure the gated split #16955 (07c56b5388), and squash commits here carry only the PR number, so the issue number never appears in the log. The card's sentence "After [finding] four docblocks attribute all 80 route registrations to this.routeManager.register( — false once #16243 lands, and one of the four is inside the census file that PR itself repaired #16307 lands this is the only remaining carrier" is therefore no longer a prediction: it landed before triage read the tree, and this branch confirms it as a reading.
4. Re-grade trigger 2 does not fire. The whole-tree figure re-scan at my head found no third carrier of 73% / 22 of 30. The stale figures in note 1 belong to a different figure family (ledger row counts) with a different cause, so this stays p3 and is not routed to [finding] check-ratchet-remedy-authority's corpus note and why for check-i18n-walk-parity.mjs still say its ledger "ships EMPTY" — it now ships with three #15189 — that call is the PM seat's, on this evidence.

Carrier ownership: no open PR holds either edited file. pnpm-lock.yaml was not touched.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 91f65c4ea4ce89d824e2ea64f93a956ffff13928 → packageMentionDocs.