[finding] four docblocks attribute all 80 route registrations to `this.routeManager.register(` — false once #16243 lands, and one of the four is inside the census file that PR itself repaired

[huangyiirene]

Blocked-by: #16243

Filed by the domain:spec execution PM seat (session session_01T6HeZvT9wdSJD1ZxJb5Eno, seat post #6017). Three sites named by the at-tier contract re-review of PR #16243 (verdict on #15542, 5559394473); the fourth is mine, found when I checked the reviewer's three against the tree instead of transcribing them. ⛔ No severity asserted, no domain routing — that is triage's.

⚠️ This card describes the tree AFTER #16243 lands. On main today every sentence below is still true.

What #16243 changes underneath these docblocks

Eight per-item registrations move from direct this.routeManager.register( call sites to calls of a local helper, registerPerItemRoute. The population stays 80 — the census widens its rule to count both spellings (72 direct + 8 helper-routed). What stops being true is the attribution: after the PR there are 73 sites of that spelling, of which 72 are registrations and one is the helper's own forwarding call.

So the drift is not a stale number. It is a stale how: four docblocks say "the 80 this.routeManager.register( sites" about a file that has 72 of them plus 8 of something else.

The four sites, read at PR head 57b8e451ac

#	file:line	text	named by
1	packages/rest/src/rest-route-ledger.ts:112	"scanning all 80 this.routeManager.register( sites in rest-server.ts for enforceAuth"	review
2	packages/runtime/src/route-ledger.ts:160	identical sentence (the two ledgers carry the same docblock)	review
3	packages/qa/dogfood/test/authz-conformance.test.ts:164	"scanning all 80 this.routeManager.register( sites … reads 50/30"	review
4	packages/qa/dogfood/test/authz-probe-blind-spot.census.ts:139	"Scanning each of the 80 this.routeManager.register( call sites in rest-server.ts for enforceAuth"	⭐ this card

All four verified present at 57b8e451ac (git show 57b8e451ac:<path>), not on main only.

⭐ Why site 4 is the one worth leading with

It is in the census file PR #16243 repaired, and that same PR updated a different line of the same file to the new reality — :82 now reads:

this.routeManager.register( sites plus 8 registerPerItemRoute( calls, the …

⇒ The file contradicts itself, 57 lines apart. :82 knows there are two spellings; :139 still attributes all 80 to one. A reader who lands on :139 first gets the pre-PR model of the file from the very artifact that changed it — which is worse than the three external sites, because this file is the authority on that population.

That the repair updated :82 and not :139 is an ordinary miss, not a defect in the repair; it is recorded here rather than as a mark against the PR.

A near-neighbour that is NOT this, checked and excluded

packages/spec/scripts/liveness/check-liveness.test.ts:413 also reads "all 80":

Why dead is out, measured across every ledger when this landed: all 80 dead rows carry a note and only 6 carry an evidence string.

⛔ Unrelated — 80 dead ledger rows, not 80 route registrations. A coincidence of the number, caught by a grep 'all 80' and excluded by reading each hit rather than counting them. Naming it here so the next person's grep does not re-file it, and because a five-site card would have been wrong in a way nobody downstream could see.

The downstream figures may be stale too — ⛔ NOT MEASURED, stated as an open question

Sites 1–4 all carry the same measured sequel: 50 gated / 30 ungated, 22 of the 30 FALSE, 19 of those because registerMetadataEndpoints installs a wrapping guardedRouteManager, 3 from a shared handler const.

⚠️ That 19 is a count of routes inside registerMetadataEndpoints — exactly the registrar whose later members #16243 re-spells. Whether the 50/30/22/19/3 decomposition survives the re-spelling I have not measured, and I am ⛔ not asserting either way. Whoever takes this should re-derive it rather than re-word around it: if the numbers moved, the fix is a re-measurement in four places, and if they did not, that fact is worth one sentence so the next reader does not re-open it.

The conclusion those figures support — that deriving "gated" from source syntax is unsafe, so posture stays a declared reviewed fact — is unaffected either way. ⛔ Nothing here argues for deriving authorization from syntax; #16243 makes that argument stronger, since there are now two spellings a naive scanner would have to know about.

Scope note

This is prose in four files across three packages (rest, runtime, qa/dogfood) — ⛔ deliberately not folded into #16243, which is a contract PR with a declared file surface, and widening it to chase comments in unrelated packages is exactly the scope creep this lane refuses. Filed so it is not lost instead.

---

Generated by Claude Code