test(dogfood): the authz census and the matrix docblock read the runtime route ledger as the 92 rows it holds

[objectstack-fleet]

Fixes #24056

Clause-②: no
Basis for the Clause-② line: a test-only change to a private package (@objectstack/dogfood). No request, schema or published text changes.

No changeset: @objectstack/dogfood is private and the diff is test-only, so this PR takes skip-changeset (the seat writes the label).

What changed

Two pins in packages/qa/dogfood still read packages/runtime/src/route-ledger.ts as 88 rows. The ledger has held 92 rows since PR #24009 (for #23909) ledgered the GET, PUT, PATCH and DELETE /keys mounts. main's Dogfood Regression Gate has been red on shards 1/3 and 3/3 since then. The ledger is right; the pins follow it. packages/runtime/src/route-ledger.ts is unchanged.

• test/authz-probe-blind-spot.census.ts, the route-ledger row: population and reachable move 88 -> 92, and blindSpot stays 0. The "route: '" and "domain: '" controls move 88 -> 92, and RouteLedgerEntry stays at 2. keys stays 23. One dated history comment in the row's own style says which four rows arrived. The population-source docblock line in the same file moves to "92 rows over 23 domains".
• test/authz-conformance.matrix.ts:28: the one figure the docblock-figure pin in authz-conformance.test.ts reads, (88 rows / 23 -> (92 rows / 23. Nothing else in the file changes.

Every figure was measured on the ledger at base 905f57bc7 with the census's own rule (the scoped ROUTE_LEDGER table): 92 route: ', 92 domain: ', 23 distinct domains and 5 rows carrying domain: '/keys' (the existing POST /keys row plus the four new ones), so all four new rows are reachable through an existing key. Whole-file controls: 92 / 92 / 2.

Which figures the checker reads

The docblock-figure pin (checkFoldedDocblockFigures in authz-conformance.test.ts) reads only authz-conformance.matrix.ts. It folds the comment continuations, then reads the backticked ledger path followed by (N rows / M families|domains), one per ledger: packages/rest/src/rest-route-ledger.ts (81 rows / 18 families, already correct) and packages/runtime/src/route-ledger.ts (was 88 rows / 23 domains). It reads nothing in the census file. The census test reads the row's numeric fields, not its prose.

Verification

All runs went through scripts/pm/os-verify-lock.sh. The closure was built with pnpm exec turbo run build --filter='@objectstack/dogfood^...' --concurrency=2: VERDICT command-exit 0, 65 of 65 tasks.

Command: pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/authz-conformance.test.ts test/authz-probe-blind-spot.test.ts

tree	result
base 905f57bc7	VERDICT command-exit 1, Tests 4 failed | 104 passed (108): exactly the four tests named on the card, and nothing else red in either file
86ed87210 (census row only)	VERDICT command-exit 1, Tests 2 failed | 106 passed (108): only the two docblock-figure tests remain
head 3888a39e7	VERDICT command-exit 0, Test Files 2 passed (2), Tests 108 passed (108)

Ablations, one per changed figure. Each went through node scripts/ablation-replace.mjs (WRAP mode: the anchor must hit, the write and the restore are proven on disk):

• Census population: 92, -> population: 88, (anchor x1 -> x0, blob 9841799b7a20 -> 0816269a58bc): authz-probe-blind-spot.test.ts gave Tests 1 failed | 46 passed (47) on "packages/runtime/src/route-ledger.ts — population, reach and blind spot are unchanged", expected 92 to be 88. Restored: blob == HEAD 9841799b7a20, git diff HEAD empty.
• Matrix (92 rows / 23 -> (88 rows / 23 at head 3888a39e7 (anchor x1 -> x0, blob c5d3442b8a73 -> 97d165b1593b): authz-conformance.test.ts (61 tests, 2 failed) red on "every figure the docblock states equals what its ledger holds TODAY" and "the anchor is the PATH, ..." (docblock says 88 rows, the table holds 92). authz-probe-blind-spot.test.ts stayed green (47 / 47). Restored: blob == HEAD c5d3442b8a73, git diff HEAD empty.

Both ablations went red, the predicted direction. No dist/ is on the path, because the tests import these modules by relative path.

Other local readings at head 3888a39e7:

• pnpm --filter @objectstack/dogfood exec tsc --noEmit --listFiles gave VERDICT command-exit 0, with both changed files in the program.
• pnpm exec eslint --no-inline-config over both changed files exited 0, with no output. A control-byte grep over both files found none.
• Gate union: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (2 paths vs merge base 905f57bc7) derived 47 commands, all run at 3888a39e7, each exit captured before any pipe. 46 exited 0. pnpm check:dual-build-cjs-loads exited 3, PREREQUISITE NOT MET: 8 packages outside the dogfood closure have no dist/, so it is NOT MEASURED locally (CI builds the whole tree). The --ran reconciliation exited 0: "47 derived, 46 run, 1 NOT-MEASURED, 0 UNRUN".
• origin/main moved 3 commits past the base while this was open (to b1d5569d9). None of them touches the two dogfood test files, the census, the matrix or route-ledger.ts, and the one runtime file among them has no reader in packages/qa/dogfood. No merge.

⚠️ The two pins this PR moves run only in main's push battery: the dogfood job in ci.yml is skipped for pull_request and merge_group events. This PR's check-runs therefore cannot show them; the local readings above are the evidence, and the next main battery's Dogfood Regression Gate (1/3) and (3/3) is the confirmation.

Acceptance notes

• The census population-source paragraph (authz-probe-blind-spot.census.ts around :103–:114) still says packages/rest/src/rest-route-ledger.ts: 82 audited rows over 18 families, while REST_ROUTE_LEDGER holds 81 rows / 18 families at 905f57bc7 (the census row itself records 81). Its "290 rows in total" was not re-measured. No checker reads either figure, and both are outside this card's surface, so they are left as they are. carrier: none.
• This card is derived from [maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050, and PR refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054 (its slice 11) edits other rows of the same census and authz-conformance.test.ts, not authz-conformance.matrix.ts.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 077b75f5593d813aa5bd1c6d51a3fb19a7d6322f → packageMentionDocs.

[objectstack-fleet]

席位核对

ACCEPT · #24056 · domain:cli seat 2 · os-tesla · session session_018t6a5rvqPRvEDMCVVW9kYT · 2026-10-16T23:04Z · reviewed head 3888a39e728e7948cff1cb76c8be304708f14f4d, against GitHub and the branch, not against the report's prose. Holder of claim 6225454612, amended 6225943267; report on #24056.

1. Shape.
   • Draft (the relay opens every PR as a draft), base main, assignee os-tesla. Line 1 is Fixes #24056; Clause-②: no is in the body; skip-changeset is written by this seat.
   • 2 files, +13 / −5, both in the private @objectstack/dogfood test package.
   • check-governed-merges --pr 24069: NOT governed; 18 changed lines.
   • git merge-tree is clean against origin/main.
2. The change, read by this seat against the amended surface.
   • authz-probe-blind-spot.census.ts: the route-ledger.ts row reads population 92, reachable 92, blindSpot 0, controls 92 / 92 / 2.
     • It carries one dated [#23909] history comment: four /keys rows, each with the existing /keys key, so 23 distinct domains before and after.
     • The :109 line reads 92.
   • authz-conformance.matrix.ts :28: (88 rows / 23 → (92 rows / 23, the one figure the #17111 checker reads.
   • packages/runtime/src/route-ledger.ts is unchanged.
3. Review of record: this record. A test-only change to a private package has no contract face.
4. Changeset: none (skip-changeset); nothing published changes.
5. Gates, pinned to the head. Check-runs on 3888a39e7, read at this stamp, latest run per name: 41 names, 32 success, 9 skipped, nothing running.
   • The successes include Build Core, Test Core 1–6/6, TypeScript Type Check, Lint & Repo Gates and Governed Surface Queue Guard.
   • Check Changeset failed once before the label was written and was skipped by it after; that skip is the latest run.
   • The skips are roster names. The Dogfood Regression Gate shards are skipped on pull requests by the job's own if:, so the moved pins' CI proof is main's next push battery.
   • The dev's local readings of the two files:
     • base 905f57bc7: 4 failed / 104 passed, exactly main's four;
     • 86ed87210: 2 failed, the #17111 pair only;
     • head: 108 / 108.
   • Each figure's ablation went red on its own tests only. The dev's gate union: 47 derived, 46 run with exit 0, and check:dual-build-cjs-loads NOT MEASURED (exit 3, outside the dogfood closure).
6. Accepted deviations:
   • the draft open (the relay forces it);
   • the full union re-run at the final head;
   • the turbo-cached closure build;
   • no main merge, because the three upstream commits touch none of these paths.

Noted, filed by this seat in its next filing window: dispatch-gates prints the Dogfood job as "scheduled by" a route-ledger.ts change, and leaves out that the job's if: skips it on pull_request and merge_group. So neither CI nor the derived local commands ran these pins on PR #24009. This is the dev's out-of-scope finding, class a, with #24009 as the named producer.

Noted, not filed: the census population-source paragraph still says "82 audited rows" for rest-route-ledger.ts (81 at base). No checker reads it. It is in the PR's Acceptance notes.

Landing: pr_ready + automerge_enable through the relay, in this act. The card closes on the merge (Fixes). PR #24054 (#23050 slice 11) merges main after it.

---

Generated by Claude Code