refactor(rest): re-point every reader of the moved security bodies (#23050 slice 6)

Each reader whose reading included a moved line now reads it in
security-routes.ts, with its sum unchanged:

- the nine registrar-list readers re-read their numbers at length 7
  (query-number 9, canonical query slots 4, meta-draft switches 8,
  docblock floors 29, execctx 62 sites / 109 mentions with eight
  forwarders = (7 - 1) + 2, ui-view pair 55 / 70, the dogfood tripwire 0,
  the blind-spot row 70 / 19 / 51 with register 63 and enforceAuth 92);
- check-route-envelope declares security-routes.ts dialectOnly at
  stringError 0 / siblingCode 0 (rest-server.ts unchanged at 17 / 17);
- a new ADR anchor for security-routes.ts (ADR-0090, ADR-0105, ADR-0112)
  restores check-adr-anchors' decision-letter reading 1751 -> 1761;
- error-response.ts' nestedRefusalEnvelope docblock names the three
  families' current homes.

Claude-Session: https://claude.ai/code/session_01Q9PZ5Pzqcus4woVvTZwWNU
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/qa/dogfood/test/authz-conformance.test.ts

@@ -1627,7 +1627,8 @@ describe('#9084 — the rest-server.ts transport tripwire keys off mechanics', (
     // text is every file on it, in order — so the zero is not a list ignored.
     // [#23050 slice 4] Length 4 → 5 (`sharing-routes.ts`), still 0 over it.
     // [#23050 slice 5] Length 5 → 6 (`analytics-routes.ts`), still 0 over it.
-    expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(6);
+    // [#23050 slice 6] Length 6 → 7 (`security-routes.ts`), still 0 over it.
+    expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(7);
     expect(REST_SERVER_REGISTRAR_PATHS[0]).toBe(REST_SERVER);
     const listed = REST_SERVER_REGISTRAR_PATHS.map((file) => readFileSync(join(REPO_ROOT, file), 'utf8'));
     for (const probe of [MECHANICS, ROUTES]) {

packages/qa/dogfood/test/authz-probe-blind-spot.census.ts

@@ -519,10 +519,11 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
       'indentation and the subtrahend is pinned at 1 by the `forwarder slice:` control, never inferred from a ' +
       'terminator spelling), PLUS `registerPerItemRoute(` call sites; counted over this file AND every ' +
       'module on the registrar list (`packages/rest/src/rest-server-registrar-files.ts`) — ' +
-      '`data-action-routes.ts`, `batch-routes.ts`, `approvals-routes.ts`, `sharing-routes.ts` and ' +
-      '`analytics-routes.ts`, the modules the bodies of `registerDataActionEndpoints`, `registerBatchEndpoints`, ' +
-      '`registerApprovalsEndpoints`, `registerSharingEndpoints`, `registerSharingRuleEndpoints` and ' +
-      '`registerAnalyticsEndpoints` moved to; ' +
+      '`data-action-routes.ts`, `batch-routes.ts`, `approvals-routes.ts`, `sharing-routes.ts`, ' +
+      '`analytics-routes.ts` and `security-routes.ts`, the modules the bodies of `registerDataActionEndpoints`, ' +
+      '`registerBatchEndpoints`, `registerApprovalsEndpoints`, `registerSharingEndpoints`, ' +
+      '`registerSharingRuleEndpoints`, `registerAnalyticsEndpoints`, `registerSecurityExplainEndpoints` and ' +
+      '`registerSecurityEndpoints` moved to; ' +
       'reachable = those inside registerMetadataEndpoints',
     // [#15542 / #15854] ⭐ THE POPULATION RULE LEARNED A SECOND SPELLING, and
     // the numbers it produces did NOT move: 80 / 19 / 61, exactly as before.
@@ -703,23 +704,37 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
     // counted in both readings; the four new occurrences are this slice's
     // seam, the same two spellings once (the host literal's forwarder, two;
     // the host interface's member, two). No call site was added.
+    // [#23050 slice 6] 70 / 19 / 51 UNCHANGED, the same measurement again:
+    // `registerSecurityExplainEndpoints`' and `registerSecurityEndpoints`'
+    // bodies (six registration sites, three and three, all outside
+    // `registerMetadataEndpoints`, so all six in the blind spot) moved to
+    // `security-routes.ts`, which joins the list (length 6 -> 7) with its own
+    // control. `this.routeManager.register(` stays 63 over the seven files
+    // (27 here + 9 + 5 + 7 + 8 + 1 + 6), `private register*Endpoints(` stays
+    // 16 (both registrars are still declared here), and `enforceAuth` 84 -> 92
+    // is RE-ANCHORED, not relaxed: the five call sites moved with their routes
+    // and are counted in both readings; the eight new occurrences are this
+    // slice's seam, the same two spellings TWICE, because the module carries
+    // two registrars (two host literals' forwarders, four; two host
+    // interfaces' members, four). No call site was added.
     controls: {
       'private register*Endpoints(': 16,
       'this.routeManager.register(': 63,
-      'registrar list length': 6,
+      'registrar list length': 7,
       'data-action-routes.ts: this.routeManager.register(': 9,
       'batch-routes.ts: this.routeManager.register(': 5,
       'approvals-routes.ts: this.routeManager.register(': 7,
       'sharing-routes.ts: this.routeManager.register(': 8,
       'analytics-routes.ts: this.routeManager.register(': 1,
+      'security-routes.ts: this.routeManager.register(': 6,
       // Both halves of the new rule carry their own control, so neither can go
       // silently to zero: a helper deleted and its routes inlined back would
       // still read population 80, and only these two controls would notice the
       // shape moved and force this provenance to be re-read.
       'registerPerItemRoute(': 8,
       'const registerPerItemRoute =': 1,
       'forwarder slice: this.routeManager.register(': 1,
-      enforceAuth: 84,
+      enforceAuth: 92,
     },
     note:
       'The single non-tripwire probe names ONE registrar of 16. The other 15 can never mint a key: ' +

packages/rest/src/error-response.ts

@@ -760,7 +760,9 @@ export function sandboxFaultAnswer(
  * ## Why it exists
  *
  * Three hand-built route families in `rest-server.ts` — the sharing-rule, the
- * suggested-binding (and the since-retired overlay-discard) and the approval arms — answered a
+ * suggested-binding (and the since-retired overlay-discard) and the approval arms, which
+ * have since moved to `sharing-routes.ts`, `security-routes.ts` and `approvals-routes.ts`
+ * (#23050 slices 4, 6 and 3) — answered a
  * refusal their own arms could not read as a server fault, relaying
  * `.message`. For a sandboxed hook's refusal `.message` is the QuickJS debug
  * wrapper, so each answered `500` with `hook '<name>' threw: Error: …` where

packages/rest/src/execctx-consumer-census.test.ts

@@ -93,6 +93,10 @@ const SOURCE = readFileSync(resolve(HERE, 'rest-server.ts'), 'utf8');
  *
  * [#23050 slice 5] …and `registerAnalyticsEndpoints`' body to
  * `analytics-routes.ts`, with its one.
+ *
+ * [#23050 slice 6] …and `registerSecurityExplainEndpoints`' and
+ * `registerSecurityEndpoints`' bodies to `security-routes.ts`, with their five
+ * (two and three) — the second module on the list to carry TWO registrars.
  */
 const SITE_FILES = REST_SERVER_REGISTRAR_FILES;
 const SOURCES = new Map<string, string>(SITE_FILES.map((file) => [
@@ -104,7 +108,8 @@ const siteKey = (file: string, line: number) => `${file}:${line}`;
  * The frames in `rest-server.ts` that are NOT consumers: the host literal each
  * moved registrar (`registerDataActionEndpoints`, `registerBatchEndpoints`,
  * `registerApprovalsEndpoints`, `registerSharingEndpoints`,
- * `registerSharingRuleEndpoints`, `registerAnalyticsEndpoints`) hands
+ * `registerSharingRuleEndpoints`, `registerAnalyticsEndpoints`,
+ * `registerSecurityExplainEndpoints`, `registerSecurityEndpoints`) hands
  * its moved body forwards each member to the server with
  * `(...a) => this.<member>(...a)`, so a moved site's stack shows that forwarder
  * above the site itself. The site is the first censused frame that is not one.
@@ -120,9 +125,12 @@ const FORWARDERS = new Set(FORWARDER_LINES.map((line) => siteKey('rest-server.ts
  * [#23050 slice 4] The moved registrars beyond one per moved module:
  * `sharing-routes.ts` carries two registrars' bodies, each handed over by its
  * own host literal and so through its own forwarder.
+ *
+ * [#23050 slice 6] `security-routes.ts` carries two as well, on the same terms.
  */
 const EXTRA_MOVED_REGISTRARS: Readonly<Partial<Record<(typeof SITE_FILES)[number], number>>> = {
     'sharing-routes.ts': 1,
+    'security-routes.ts': 1,
 };
 
 /** A stack frame in any censused file, as `<file>:<line>:<column>`. */
@@ -598,11 +606,21 @@ describe('[#13160] §2 the consumer surface, counted from the tree', () => {
         // mentions are this slice's seam, the same two spellings once (its host
         // literal's forwarder, two; its host interface's member, two). Six
         // forwarders now, one per moved registrar: (6 - 1) + 1.
-        expect(SITE_FILES).toHaveLength(6);
+        //
+        // [#23050 slice 6] 62 sites UNCHANGED / 101 → 109 mentions — the same MOVE.
+        // `registerSecurityExplainEndpoints`' and `registerSecurityEndpoints`'
+        // bodies left for `security-routes.ts` with their five BARE sites (two
+        // and three): 27 + 9 + 5 + 7 + 8 + 1 + 5 = 62 sites. The eight new
+        // mentions are this slice's seam, the same two spellings TWICE, as slice
+        // 4's (two host literals' forwarders, four; two host interfaces'
+        // members, four). Eight forwarders now, one per moved registrar:
+        // (7 - 1) + 2, the second module carrying two registrars counted in
+        // `EXTRA_MOVED_REGISTRARS`.
+        expect(SITE_FILES).toHaveLength(7);
         expect(SITES.length).toBe(62);
-        expect([...SOURCES.values()].reduce((n, text) => n + text.split('resolveExecCtx').length - 1, 0)).toBe(101);
+        expect([...SOURCES.values()].reduce((n, text) => n + text.split('resolveExecCtx').length - 1, 0)).toBe(109);
         const extraMovedRegistrars = Object.values(EXTRA_MOVED_REGISTRARS).reduce((n, k) => n + (k ?? 0), 0);
-        expect(extraMovedRegistrars).toBe(1);
+        expect(extraMovedRegistrars).toBe(2);
         expect(FORWARDER_LINES, 'one host-literal resolveExecCtx forwarder per moved registrar: one was respelt or removed, or a module moved without joining SITE_FILES')
             .toHaveLength(SITE_FILES.length - 1 + extraMovedRegistrars);
     });

packages/rest/src/meta-draft-read-door-census.test.ts

@@ -246,8 +246,10 @@ describe('[#20338] census: every draft switch in rest-server.ts is ledgered', ()
         // and `req.query?.preview === 'draft'`, admitted in one declaration)
         // moved with its body to `analytics-routes.ts`. A key names its route,
         // never its file, so no ledger row changed: 8 = 6 + 0 + 0 + 0 + 0 + 2,
-        // length 5 → 6.
-        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(6);
+        // length 5 → 6. [#23050 slice 6] The two security bodies
+        // (`security-routes.ts`) read no draft: 8 = 6 + 0 + 0 + 0 + 0 + 2 + 0,
+        // length 6 → 7.
+        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(7);
         expect(SOURCE_FILES.map((file) => file.fileName)).toEqual([...REST_SERVER_REGISTRAR_FILES]);
         expect(SITES).toHaveLength(8);
     });

packages/rest/src/rest-server-canonical-query-ast.test.ts

@@ -135,6 +135,11 @@ interface CensusEntry {
  * [#23050 slice 5] 4 = 1 + 3 + 0 + 0 + 0 + 0: the analytics dataset body
  * (`analytics-routes.ts`) builds no `query:` literal either — it hands
  * `queryDataset` the caller's own `selection`, never a `query:` slot.
+ *
+ * [#23050 slice 6] 4 = 1 + 3 + 0 + 0 + 0 + 0 + 0: the two security bodies
+ * (`security-routes.ts`) build no `query:` literal either — the explain doors
+ * hand the security service a parsed explain request, and the suggestion list
+ * a `status` / `packageId` pair read off `req.query`, never a `query:` slot.
  */
 const REGISTRAR_QUERY_SLOT_FLOORS: Readonly<Record<RestServerRegistrarFile, number>> = {
     'rest-server.ts': 1,
@@ -143,6 +148,7 @@ const REGISTRAR_QUERY_SLOT_FLOORS: Readonly<Record<RestServerRegistrarFile, numb
     'approvals-routes.ts': 0,
     'sharing-routes.ts': 0,
     'analytics-routes.ts': 0,
+    'security-routes.ts': 0,
 };
 
 const CENSUS: CensusEntry[] = [
@@ -332,7 +338,8 @@ describe('[#16638] §1 CONTROLS on the census instrument itself', () => {
         // A module added to the list makes this re-read its number rather than
         // widening unnoticed. [#23050 slice 4] Length 4 → 5, the sum unchanged.
         // [#23050 slice 5] Length 5 → 6, the sum unchanged.
-        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(6);
+        // [#23050 slice 6] Length 6 → 7, the sum unchanged.
+        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(7);
         expect(Object.keys(REGISTRAR_QUERY_SLOT_FLOORS).sort()).toEqual([...REST_SERVER_REGISTRAR_FILES].sort());
         expect(CENSUS.filter(({ file }) => REGISTRAR_SOURCES.has(file)).map(({ file }) => file))
             .toEqual([...REST_SERVER_REGISTRAR_FILES]);

packages/rest/src/rest-server-docblock-position.test.ts

@@ -153,13 +153,21 @@ describe('rest-server.ts docblock position', () => {
  * approval modules do: the module header, the host interface's block and the
  * function's. The analytics body held no TSDoc block of its own, so
  * `rest-server.ts` keeps every block it had.
+ *
+ * [#23050 slice 6] `security-routes.ts` carries eight: the module header, two
+ * host interfaces' blocks and two functions' (it holds two registrars' bodies),
+ * plus the three blocks that moved with those bodies (the explain family's
+ * `respondError` and `delegableHandler` blocks, and the suggested-binding
+ * family's `respondError` block), which `rest-server.ts` therefore no longer
+ * holds (167 → 164 there, still far above its floor).
  */
 const MOVED_FILE_FLOORS: Readonly<Record<Exclude<RestServerRegistrarFile, typeof FILE>, number>> = {
     'data-action-routes.ts': 4,
     'batch-routes.ts': 3,
     'approvals-routes.ts': 3,
     'sharing-routes.ts': 8,
     'analytics-routes.ts': 3,
+    'security-routes.ts': 8,
 };
 const MOVED_FILES: ReadonlyArray<{ file: string; minBlocks: number }> = REST_SERVER_REGISTRAR_FILES
     .filter((file): file is Exclude<RestServerRegistrarFile, typeof FILE> => file !== FILE)
@@ -189,9 +197,10 @@ describe('[#23050 slice 3] the registrar list this pin reads', () => {
         // widening unnoticed: 4 + 3 + 3 = 10 blocks over the three modules.
         // [#23050 slice 4] 4 + 3 + 3 + 8 = 18 over four, length 4 → 5.
         // [#23050 slice 5] 4 + 3 + 3 + 8 + 3 = 21 over five, length 5 → 6.
-        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(6);
+        // [#23050 slice 6] 4 + 3 + 3 + 8 + 3 + 8 = 29 over six, length 6 → 7.
+        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(7);
         expect(Object.keys(MOVED_FILE_FLOORS).sort())
             .toEqual(REST_SERVER_REGISTRAR_FILES.filter((file) => file !== FILE).sort());
-        expect(MOVED_FILES.reduce((n, { minBlocks }) => n + minBlocks, 0)).toBe(21);
+        expect(MOVED_FILES.reduce((n, { minBlocks }) => n + minBlocks, 0)).toBe(29);
     });
 });

packages/rest/src/rest-server-query-number-census.test.ts

@@ -321,7 +321,9 @@ describe('#20139 census — every numeric coercion in rest-server.ts is classifi
         // record-sharing bodies (`sharing-routes.ts`): 9 = 8 + 1 + 0 + 0 + 0,
         // length 4 → 5. [#23050 slice 5] Nor does the analytics dataset body
         // (`analytics-routes.ts`): 9 = 8 + 1 + 0 + 0 + 0 + 0, length 5 → 6.
-        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(6);
+        // [#23050 slice 6] Nor do the two security bodies (`security-routes.ts`):
+        // 9 = 8 + 1 + 0 + 0 + 0 + 0 + 0, length 6 → 7.
+        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(7);
         expect(SOURCES.map(([file]) => file)).toEqual([...REST_SERVER_REGISTRAR_FILES]);
         expect(sites).toHaveLength(9);
     });

packages/rest/src/ui-view-route-identity.measurement.test.ts

@@ -346,7 +346,9 @@ describe('[#13214] §1 the REST seam — absent context vs entitled context', ()
         // (50 and 65 before, +1 each per new host-literal forwarder).
         // [#23050 slice 5] 5 → 6 (`analytics-routes.ts`): 53 and 68, +1 each
         // for that slice's forwarder.
-        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(6);
+        // [#23050 slice 6] 6 → 7 (`security-routes.ts`): 55 and 70, +1 each
+        // per new host-literal forwarder (two registrars, two forwarders).
+        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(7);
         expect(REGISTRAR_SOURCES.split('this.enforceAuth(').length - 1).toBeGreaterThan(40);
         expect(REGISTRAR_SOURCES.split('this.resolveExecCtx(').length - 1).toBeGreaterThan(40);
     });

packages/rest/src/ui-view-route-tenancy.measurement.test.ts

@@ -1113,7 +1113,10 @@ describe('[#13214] §4 preconditions', () => {
         // new host-literal forwarder) and the ownership guard stays at 1.
         // [#23050 slice 5] 5 → 6 (`analytics-routes.ts`): 53 and 68, +1 each
         // for that slice's forwarder; the ownership guard still 1.
-        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(6);
+        // [#23050 slice 6] 6 → 7 (`security-routes.ts`): 55 and 70, +1 each
+        // per new host-literal forwarder (two registrars, two forwarders); the
+        // ownership guard still 1.
+        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(7);
         expect(REGISTRAR_SOURCES.split('this.enforceAuth(').length - 1).toBeGreaterThan(40);
         expect(REGISTRAR_SOURCES.split('this.resolveExecCtx(').length - 1).toBeGreaterThan(40);
         // ...and the ownership guard is NOT sprayed across the file — it is a