From c07b9ff381e782774d434750c02fa9d9edf3f194 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 9 Sep 2026 09:35:30 +0000 Subject: [PATCH] docs(qa): re-measure the two route-census figures #16955 left behind, and split the two moves inside one sentence MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Five sites in the tree read 76% false-ungated; two still read the pre-repair figures, and one file carried both — `authz-probe-blind-spot.census.ts:129` said 8 while `:147`, eighteen lines down, said 76%. Which number a reader got depended on which line they reached first. Carrier 1 (`authz-conformance.matrix.ts`) is arithmetic: 22 of 30 -> 22 of 29, 73% -> 76%. The five existing 76% sites are the authority; nothing new was measured for it. Carrier 2 is not arithmetic, which is why #16955 left it alone: the 8 carried a ledger-grade decomposition (3 server-only / 3 public / 2 sdk) and 29 - 22 = 7 does not say how the four numbers redistribute. Measured rather than guessed, with an AST instrument over `rest-server.ts` — the two registration spellings the census's own population rule counts, gatedness read from the call expression's syntax tree so comments cannot answer for code. It reproduces the recorded 80 / 51 gated / 29 ungated and all four pinned controls at `5abca1792e`, the commit the census anchors its own re-measurement to, and reads identically at `f6b7c53db7` despite 78 lines of drift in that file. The 7 mounts grade 3 `server-only` / 3 `public` / 1 `sdk` — the arithmetic-looking answer, arrived at by measurement. A naive text scan of the same sites reads 59/21 instead: its paren matcher runs away on an apostrophe in a comment, spanning one site from line 5244 to 10360. That is the failure mode this file already warns about for its forwarder slice, and it is why the reading is taken from a parser. The same sentence also carried `sdk` 84 / `server-only` 7 / `public` 3, which moved for an unrelated reason — #14503 took three REST package rows out of the ledger (94 -> 91), a re-measurement this file's own probe row already records. Both figures are corrected and the two causes are now named apart, because a reader had no way to tell which of them moved for which reason. The population is still 80, deriving authorization from source syntax stays rejected, and "the single route in this whole population ever measured unguarded" is preserved verbatim — guarding the route did not make it false. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8 --- .../dogfood/test/authz-conformance.matrix.ts | 4 +-- .../test/authz-probe-blind-spot.census.ts | 35 +++++++++++++++---- 2 files changed, 30 insertions(+), 9 deletions(-) diff --git a/packages/qa/dogfood/test/authz-conformance.matrix.ts b/packages/qa/dogfood/test/authz-conformance.matrix.ts index 9af91ee746..de9e47f8c3 100644 --- a/packages/qa/dogfood/test/authz-conformance.matrix.ts +++ b/packages/qa/dogfood/test/authz-conformance.matrix.ts @@ -31,8 +31,8 @@ // domain cannot be silently absent from them, and therefore cannot be silently // absent from here. Widening a regex instead was refused: it rots on the next // added file, which is the mechanism this replaces. Deriving "gated" from -// source syntax was refused too, on a measurement — 22 of 30 apparently -// ungated `register(` sites in `rest-server.ts` are false, a 73% false-ungated +// source syntax was refused too, on a measurement — 22 of 29 apparently +// ungated `register(` sites in `rest-server.ts` are false, a 76% false-ungated // rate — because that trades a visible gap for a written-down false assurance. // The ledgers supply the POPULATION; the classification stays a reviewed row // here. diff --git a/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts b/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts index 540e4a9a14..040d026cf5 100644 --- a/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts +++ b/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts @@ -125,15 +125,36 @@ // // 1. NO NOTION OF "GATED", and this ratchet's promise is about UNGATED // routes. Ledger dispositions grade SDK expressibility, not authorization: -// REST reads `sdk` 84 / `server-only` 7 / `public` 3. Cross-checked -// directly rather than assumed — of the 8 REST route mounts measured to +// REST reads `sdk` 81 / `server-only` 7 / `public` 3. Cross-checked +// directly rather than assumed — of the 7 REST route mounts measured to // carry no `enforceAuth`, the ledger grades 3 `server-only`, 3 `public` -// and 2 `sdk`; and one of those two `sdk` rows is +// and 1 `sdk`, and that one row is `GET /api/v1/discovery`. +// +// ⚠️ RE-MEASURED 2026-09-09 against `f6b7c53db7`. Both halves of the +// sentence above moved, FOR TWO UNRELATED REASONS, and separating them is +// the whole value of re-recording it. +// +// THE SET LOST A ROW: 8 -> 7, and the row it lost is // `GET /api/v1/ui/view/:object/:type`, the single route in this whole -// population ever measured unguarded. Its ledger row is shape-identical to -// the 83 `sdk` rows that ARE gated. `public` states INTENT for 3 -// browser-facing form routes; it is not a gate measurement and was never -// built as one. +// population ever measured unguarded. Guarding it at `cc837dbfec` is the +// same repair that moved 30 ungated to 29 one paragraph below, so it is +// gated at the call site now and leaves this set, taking the second `sdk` +// with it: 3 / 3 / 2 became 3 / 3 / 1. ⛔ Its LEDGER row did not move at +// all — still `sdk`, still shape-identical to every other `sdk` row, the +// 79 that are gated and the 1 that is not. That is this blocker restated +// by a live example: the grade did not notice the gate arriving, and it +// would not notice one leaving either. +// +// THE LEDGER TOTAL MOVED FOR A REASON THAT IS NOT ABOUT GATES AT ALL, and +// ⛔ must not be read as evidence about them: `sdk` 84 -> 81 when #14503 +// took the three REST package read/delete rows out of the ledger +// (94 rows -> 91, already recorded on the `rest-route-ledger.ts` probe row +// in the PROBES table below). It is written down here only because both +// figures live in one sentence, where a reader has no way to tell which of +// them moved for which reason — the failure this whole census is named for. +// +// `public` states INTENT for 3 browser-facing form routes; it is not a +// gate measurement and was never built as one. // // 2. DERIVING "gated" FROM SOURCE SYNTAX IS UNSAFE — measured, not assumed. // Scanning each of the 80 registration sites in `rest-server.ts` for