test(dogfood): the authz census and the matrix docblock read the runtime route ledger as the 92 rows it holds (#24069)

Fixes #24056

Clause-②: no
Basis for the Clause-② line: a test-only change to a private package
(`@objectstack/dogfood`). No request, schema or published text changes.

No changeset: `@objectstack/dogfood` is private and the diff is
test-only, so this PR takes `skip-changeset` (the seat writes the
label).

## What changed

Two pins in `packages/qa/dogfood` still read
`packages/runtime/src/route-ledger.ts` as 88 rows. The ledger has held
92 rows since PR #24009 (for #23909) ledgered the `GET`, `PUT`, `PATCH`
and `DELETE /keys` mounts. `main`'s `Dogfood Regression Gate` has been
red on shards 1/3 and 3/3 since then. The ledger is right; the pins
follow it. `packages/runtime/src/route-ledger.ts` is unchanged.

- `test/authz-probe-blind-spot.census.ts`, the route-ledger row:
`population` and `reachable` move 88 -> 92, and `blindSpot` stays 0. The
`"route: '"` and `"domain: '"` controls move 88 -> 92, and
`RouteLedgerEntry` stays at 2. `keys` stays 23. One dated history
comment in the row's own style says which four rows arrived. The
population-source docblock line in the same file moves to "92 rows over
23 domains".
- `test/authz-conformance.matrix.ts:28`: the one figure the
docblock-figure pin in `authz-conformance.test.ts` reads, `(88 rows /
23` -> `(92 rows / 23`. Nothing else in the file changes.

Every figure was measured on the ledger at base `905f57bc7` with the
census's own rule (the scoped `ROUTE_LEDGER` table): 92 `route: '`, 92
`domain: '`, 23 distinct domains and 5 rows carrying `domain: '/keys'`
(the existing `POST /keys` row plus the four new ones), so all four new
rows are reachable through an existing key. Whole-file controls: 92 / 92
/ 2.

## Which figures the checker reads

The docblock-figure pin (`checkFoldedDocblockFigures` in
`authz-conformance.test.ts`) reads only `authz-conformance.matrix.ts`.
It folds the comment continuations, then reads the backticked ledger
path followed by `(N rows / M families|domains)`, one per ledger:
`packages/rest/src/rest-route-ledger.ts` (81 rows / 18 families, already
correct) and `packages/runtime/src/route-ledger.ts` (was 88 rows / 23
domains). It reads nothing in the census file. The census test reads the
row's numeric fields, not its prose.

## Verification

All runs went through `scripts/pm/os-verify-lock.sh`. The closure was
built with `pnpm exec turbo run build
--filter='@objectstack/dogfood^...' --concurrency=2`: VERDICT
command-exit 0, 65 of 65 tasks.

Command: `pnpm --filter @objectstack/dogfood exec vitest run
--maxWorkers=2 test/authz-conformance.test.ts
test/authz-probe-blind-spot.test.ts`

| tree | result |
|---|---|
| base `905f57bc7` | VERDICT command-exit 1, `Tests 4 failed \| 104
passed (108)`: exactly the four tests named on the card, and nothing
else red in either file |
| `86ed87210` (census row only) | VERDICT command-exit 1, `Tests 2
failed \| 106 passed (108)`: only the two docblock-figure tests remain |
| head `3888a39e7` | VERDICT command-exit 0, `Test Files 2 passed (2)`,
`Tests 108 passed (108)` |

Ablations, one per changed figure. Each went through `node
scripts/ablation-replace.mjs` (WRAP mode: the anchor must hit, the write
and the restore are proven on disk):

- Census `population: 92,` -> `population: 88,` (anchor x1 -> x0, blob
`9841799b7a20` -> `0816269a58bc`): `authz-probe-blind-spot.test.ts` gave
`Tests 1 failed | 46 passed (47)` on
"packages/runtime/src/route-ledger.ts — population, reach and blind spot
are unchanged", `expected 92 to be 88`. Restored: blob == HEAD
`9841799b7a20`, `git diff HEAD` empty.
- Matrix `(92 rows / 23` -> `(88 rows / 23` at head `3888a39e7` (anchor
x1 -> x0, blob `c5d3442b8a73` -> `97d165b1593b`):
`authz-conformance.test.ts` (61 tests, 2 failed) red on "every figure
the docblock states equals what its ledger holds TODAY" and "the anchor
is the PATH, ..." (`docblock says 88 rows, the table holds 92`).
`authz-probe-blind-spot.test.ts` stayed green (47 / 47). Restored: blob
== HEAD `c5d3442b8a73`, `git diff HEAD` empty.

Both ablations went red, the predicted direction. No `dist/` is on the
path, because the tests import these modules by relative path.

Other local readings at head `3888a39e7`:

- `pnpm --filter @objectstack/dogfood exec tsc --noEmit --listFiles`
gave VERDICT command-exit 0, with both changed files in the program.
- `pnpm exec eslint --no-inline-config` over both changed files exited
0, with no output. A control-byte grep over both files found none.
- Gate union: `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` (2 paths vs merge base `905f57bc7`) derived
47 commands, all run at `3888a39e7`, each exit captured before any pipe.
46 exited 0. `pnpm check:dual-build-cjs-loads` exited 3, PREREQUISITE
NOT MET: 8 packages outside the dogfood closure have no `dist/`, so it
is NOT MEASURED locally (CI builds the whole tree). The `--ran`
reconciliation exited 0: "47 derived, 46 run, 1 NOT-MEASURED, 0 UNRUN".
- `origin/main` moved 3 commits past the base while this was open (to
`b1d5569d9`). None of them touches the two dogfood test files, the
census, the matrix or `route-ledger.ts`, and the one runtime file among
them has no reader in `packages/qa/dogfood`. No merge.

⚠️ The two pins this PR moves run only in `main`'s push battery: the
`dogfood` job in `ci.yml` is skipped for `pull_request` and
`merge_group` events. This PR's check-runs therefore cannot show them;
the local readings above are the evidence, and the next `main` battery's
`Dogfood Regression Gate` (1/3) and (3/3) is the confirmation.

## Acceptance notes

- The census population-source paragraph
(`authz-probe-blind-spot.census.ts` around `:103`–`:114`) still says
`packages/rest/src/rest-route-ledger.ts`: 82 audited rows over 18
families, while `REST_ROUTE_LEDGER` holds 81 rows / 18 families at
`905f57bc7` (the census row itself records 81). Its "290 rows in total"
was not re-measured. No checker reads either figure, and both are
outside this card's surface, so they are left as they are. carrier:
none.
- This card is derived from #23050, and PR #24054 (its slice 11) edits
other rows of the same census and `authz-conformance.test.ts`, not
`authz-conformance.matrix.ts`.

---
_Generated by [Claude
Code](https://claude.ai/code/session_018t6a5rvqPRvEDMCVVW9kYT)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

packages/qa/dogfood/test/authz-conformance.matrix.ts

@@ -25,7 +25,7 @@
 // dispatcher domain files.
 //
 // The population comes from `packages/rest/src/rest-route-ledger.ts` (81 rows
-// / 18 families) and `packages/runtime/src/route-ledger.ts` (88 rows / 23
+// / 18 families) and `packages/runtime/src/route-ledger.ts` (92 rows / 23
 // domains) because those two are enumerated from a RUNNING server and guarded
 // in both directions by their own conformance tests — so a new family or
 // domain cannot be silently absent from them, and therefore cannot be silently

packages/qa/dogfood/test/authz-probe-blind-spot.census.ts

@@ -106,7 +106,7 @@
 //     `RestServer.getRoutes()` on a booted server and guarded per route by
 //     `rest-route-ledger.conformance.test.ts`. It reaches all 17 registrars;
 //     this table reaches 1.
-//   `packages/runtime/src/route-ledger.ts`: 88 rows over 23 domains. Its
+//   `packages/runtime/src/route-ledger.ts`: 92 rows over 23 domains. Its
 //     machine contract is DOMAIN-level, by live registry introspection
 //     (`domainRegistry.list()`), the per-route rows being documentation. It
 //     covers all 15 `async handle*(` methods in `http-dispatcher.ts` and all
@@ -469,11 +469,19 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
     // `/security` domain dispatches to it — so the domain-file counts in the
     // note below are unchanged. Controls moved with the row ("route: '" and
     // "domain: '" 87 -> 88, RouteLedgerEntry unchanged at 2).
-    population: 88,
-    reachable: 88,
+    // [#23909] 88 -> 92: the `GET`, `PUT`, `PATCH` and `DELETE /keys` rows
+    // arrived with their mounts (every `/api/v1/keys` verb is mounted, so an
+    // anonymous caller is answered 401 on the standalone server). All four
+    // carry `domain: '/keys'`, the EXISTING key the `POST /keys` row already
+    // carries, so `reachable` moves with `population`, `blindSpot` stays 0 and
+    // `keys` stays 23 (23 distinct domains before and after, re-derived).
+    // Controls moved with the rows ("route: '" and "domain: '" 88 -> 92,
+    // RouteLedgerEntry unchanged at 2).
+    population: 92,
+    reachable: 92,
     blindSpot: 0,
     populationRule: 'ledger rows inside ROUTE_LEDGER; reachable = rows carrying a `domain` (each distinct value mints a key)',
-    controls: { "route: '": 88, "domain: '": 88, RouteLedgerEntry: 2 },
+    controls: { "route: '": 92, "domain: '": 92, RouteLedgerEntry: 2 },
     // [#22432] Re-derived on the merged ref: the note's two counts had stood at
     // 11 files / 5 classified / 16 baselined since before the `/analytics`
     // domain was classified (#21061), which named one more file and moved one