@@ -2136,7 +2136,7 @@
       "source": [
         "packages/spec/liveness/crud_endpoints.json (the ADR-0049 ledger this item answers: five live `operations.*` switches + `dataPrefix`, two dead keys)",
         "packages/spec/src/api/rest-server.zod.ts#CrudEndpointsConfigSchema (the declared contract, its defaults and the two retiredKey tombstones)",
-        "packages/rest/src/rest-server.ts#registerCrudEndpoints (the six mounts and their five gates), (normalizeConfig — the parsed sub-config every consumer reads), (parseDeclaredSubConfig — the construction-time refusal), (registerDiscoveryEndpoints — discovery.routes.data built from dataPrefix), (getRoutes — the route table the mount clauses read)",
+        "packages/rest/src/rest-server.ts#registerCrudEndpoints (the six mounts and their five gates), (normalizeConfig — the parsed sub-config every consumer reads), (parseDeclaredSubConfig — the construction-time refusal), (getRoutes — the route table the mount clauses read) + packages/rest/src/discovery-routes.ts#registerDiscoveryEndpoints (discovery.routes.data built from dataPrefix)",
         "#14691 (the ADR-0049 retirement of patterns/objectParamStyle) · #11984 (parse-and-consume instead of cast) · ADR-0122 (author state) · ADR-0076 D12 (advertise only what is mounted)",
         "sibling clause: api-backend.api-methods-verb-gate (the per-OBJECT exposure gate this config-level switch must stay distinguishable from) · api-backend.route-ledger-live-parity (the routing-404 control technique)"
       ],
@@ -2383,7 +2383,7 @@
       "source": [
         "packages/spec/liveness/metadata_endpoints.json (the ADR-0049 ledger this item answers: prefix, enableCache, maskObjectFields and three endpoints.* live, cacheTtl and endpoints.schema dead)",
         "packages/spec/src/api/rest-server.zod.ts#MetadataEndpointsConfigSchema (the declared contract — four endpoints.* switches whose describe() strings enumerate every mount they gate since #15542/#15854, the ADR-0106 D8 docblock and the two retiredKey tombstones)",
-        "packages/rest/src/rest-server.ts#registerMetadataEndpointsInner (metaPath, the four endpoint gates and registerPerItemRoute — the per-item switch spelled as a call so the later members of that face carry it), (resolveObjectMasker — the metaType/maskObjectFields fork), (normalizeConfig — isObjectSchemaMaskingEnabled and the OS_ALLOW_UNMASKED_OBJECT_METADATA escape hatch), (registerDiscoveryEndpoints — discovery.routes.metadata built from prefix), (getRoutes)",
+        "packages/rest/src/rest-server.ts#registerMetadataEndpointsInner (metaPath, the four endpoint gates and registerPerItemRoute — the per-item switch spelled as a call so the later members of that face carry it), (resolveObjectMasker — the metaType/maskObjectFields fork), (normalizeConfig — isObjectSchemaMaskingEnabled and the OS_ALLOW_UNMASKED_OBJECT_METADATA escape hatch), (getRoutes) + packages/rest/src/discovery-routes.ts#registerDiscoveryEndpoints (discovery.routes.metadata built from prefix)",
         "ADR-0106 D8 (per-caller field masking of served object schemas) · #14691 (the two retirements) · #7526 (the /meta/types ordering fix the `types` switch takes with it) · ADR-0076 D12 · #15542 / #15854 (the switch-radius ruling that created `maintenance` and gave `item` its own writes) · #15543 (why the measured blast radius of that move is zero: no shipped boot path authors a RestServerConfig)",
         "sibling clause: platform-core.metadata-registry-serving (it drives the served REGISTRY on the default config; this item covers the config that decides what is served and to whom) · platform-core.docs-audience-gate (the audience-gated types that are a cache carve-out here)"
       ],
 
@@ -295,7 +295,7 @@ export const AUTHZ_CONFORMANCE: AuthzPrimitive[] = [
   // #22430 — the API-description endpoints, under the ruling recorded on #22146
   // (the API-description endpoints refuse an anonymous caller with 401).
   { id: 'anonymous-deny-api-description', summary: 'anonymous-deny on the API-description endpoints (the document and its viewer)', state: 'enforced',
-    enforcement: 'rest/rest-server.ts registerOpenApiEndpoints — BOTH handlers (the document and its viewer page, on every base the server mounts) open with enforceAuth (→ shouldDenyAnonymous) as their first act, ahead of the bundled-artifact load and the protocol resolution, so a refused request does no work and does not reveal whether a document is bundled; an anonymous caller gets the REST seam\'s flat 401 UNAUTHENTICATED, a signed-in caller is served as before, and a session held by the ADR-0069 auth-policy gate gets that gate\'s 403',
+    enforcement: 'rest/discovery-routes.ts registerOpenApiEndpoints — BOTH handlers (the document and its viewer page, on every base the server mounts) open with enforceAuth (→ shouldDenyAnonymous) as their first act, ahead of the bundled-artifact load and the protocol resolution, so a refused request does no work and does not reveal whether a document is bundled; an anonymous caller gets the REST seam\'s flat 401 UNAUTHENTICATED, a signed-in caller is served as before, and a session held by the ADR-0069 auth-policy gate gets that gate\'s 403',
     proof: 'showcase-anonymous-deny-surfaces.dogfood.test.ts',
     // The REST family at ledger granularity. The family is exactly these two
     // routes and both handlers open with the floor, which is the property a
 
@@ -1628,7 +1628,8 @@ describe('#9084 — the rest-server.ts transport tripwire keys off mechanics', (
     // [#23050 slice 4] Length 4 → 5 (`sharing-routes.ts`), still 0 over it.
     // [#23050 slice 5] Length 5 → 6 (`analytics-routes.ts`), still 0 over it.
     // [#23050 slice 6] Length 6 → 7 (`security-routes.ts`), still 0 over it.
-    expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(7);
+    // [#23050 slice 7] Length 7 → 8 (`discovery-routes.ts`), still 0 over it.
+    expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(8);
     expect(REST_SERVER_REGISTRAR_PATHS[0]).toBe(REST_SERVER);
     const listed = REST_SERVER_REGISTRAR_PATHS.map((file) => readFileSync(join(REPO_ROOT, file), 'utf8'));
     for (const probe of [MECHANICS, ROUTES]) {
 
@@ -520,10 +520,11 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
       'terminator spelling), PLUS `registerPerItemRoute(` call sites; counted over this file AND every ' +
       'module on the registrar list (`packages/rest/src/rest-server-registrar-files.ts`) — ' +
       '`data-action-routes.ts`, `batch-routes.ts`, `approvals-routes.ts`, `sharing-routes.ts`, ' +
-      '`analytics-routes.ts` and `security-routes.ts`, the modules the bodies of `registerDataActionEndpoints`, ' +
-      '`registerBatchEndpoints`, `registerApprovalsEndpoints`, `registerSharingEndpoints`, ' +
-      '`registerSharingRuleEndpoints`, `registerAnalyticsEndpoints`, `registerSecurityExplainEndpoints` and ' +
-      '`registerSecurityEndpoints` moved to; ' +
+      '`analytics-routes.ts`, `security-routes.ts` and `discovery-routes.ts`, the modules the bodies of ' +
+      '`registerDataActionEndpoints`, `registerBatchEndpoints`, `registerApprovalsEndpoints`, ' +
+      '`registerSharingEndpoints`, `registerSharingRuleEndpoints`, `registerAnalyticsEndpoints`, ' +
+      '`registerSecurityExplainEndpoints`, `registerSecurityEndpoints`, `registerDiscoveryEndpoints` and ' +
+      '`registerOpenApiEndpoints` moved to; ' +
       'reachable = those inside registerMetadataEndpoints',
     // [#15542 / #15854] ⭐ THE POPULATION RULE LEARNED A SECOND SPELLING, and
     // the numbers it produces did NOT move: 80 / 19 / 61, exactly as before.
@@ -717,24 +718,40 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
     // slice's seam, the same two spellings TWICE, because the module carries
     // two registrars (two host literals' forwarders, four; two host
     // interfaces' members, four). No call site was added.
+    // [#23050 slice 7] 70 / 19 / 51 UNCHANGED, the same measurement again:
+    // `registerDiscoveryEndpoints`' and `registerOpenApiEndpoints`' bodies
+    // (four registration sites, two and two — the API root and `/discovery`,
+    // `/openapi.json` and `/docs` — all outside `registerMetadataEndpoints`, so
+    // all four in the blind spot) moved to `discovery-routes.ts`, which joins
+    // the list (length 7 -> 8) with its own control.
+    // `this.routeManager.register(` stays 63 over the eight files
+    // (23 here + 9 + 5 + 7 + 8 + 1 + 6 + 4), `private register*Endpoints(`
+    // stays 16 (both registrars are still declared here), and `enforceAuth`
+    // 92 -> 96 is RE-ANCHORED, not relaxed: the OpenAPI pair's two call sites
+    // moved with their routes and are counted in both readings; the four new
+    // occurrences are this slice's seam, the two spellings ONCE, because only
+    // the OpenAPI body reads `enforceAuth` (its host literal's forwarder, two;
+    // its host interface's member, two) — the discovery document is served to
+    // anyone, so its literal forwards no `enforceAuth`. No call site was added.
     controls: {
       'private register*Endpoints(': 16,
       'this.routeManager.register(': 63,
-      'registrar list length': 7,
+      'registrar list length': 8,
       'data-action-routes.ts: this.routeManager.register(': 9,
       'batch-routes.ts: this.routeManager.register(': 5,
       'approvals-routes.ts: this.routeManager.register(': 7,
       'sharing-routes.ts: this.routeManager.register(': 8,
       'analytics-routes.ts: this.routeManager.register(': 1,
       'security-routes.ts: this.routeManager.register(': 6,
+      'discovery-routes.ts: this.routeManager.register(': 4,
       // Both halves of the new rule carry their own control, so neither can go
       // silently to zero: a helper deleted and its routes inlined back would
       // still read population 80, and only these two controls would notice the
       // shape moved and force this provenance to be re-read.
       'registerPerItemRoute(': 8,
       'const registerPerItemRoute =': 1,
       'forwarder slice: this.routeManager.register(': 1,
-      enforceAuth: 92,
+      enforceAuth: 96,
     },
     note:
       'The single non-tripwire probe names ONE registrar of 16. The other 15 can never mint a key: ' +
 
@@ -97,6 +97,12 @@ const SOURCE = readFileSync(resolve(HERE, 'rest-server.ts'), 'utf8');
  * [#23050 slice 6] …and `registerSecurityExplainEndpoints`' and
  * `registerSecurityEndpoints`' bodies to `security-routes.ts`, with their five
  * (two and three) — the second module on the list to carry TWO registrars.
+ *
+ * [#23050 slice 7] …and `registerDiscoveryEndpoints`' and
+ * `registerOpenApiEndpoints`' bodies to `discovery-routes.ts`, with their two
+ * (none and two) — the third module to carry TWO registrars, and the first
+ * moved registrar whose body reads no `resolveExecCtx` at all (the discovery
+ * document resolves no caller).
  */
 const SITE_FILES = REST_SERVER_REGISTRAR_FILES;
 const SOURCES = new Map<string, string>(SITE_FILES.map((file) => [
@@ -109,14 +115,16 @@ const siteKey = (file: string, line: number) => `${file}:${line}`;
  * moved registrar (`registerDataActionEndpoints`, `registerBatchEndpoints`,
  * `registerApprovalsEndpoints`, `registerSharingEndpoints`,
  * `registerSharingRuleEndpoints`, `registerAnalyticsEndpoints`,
- * `registerSecurityExplainEndpoints`, `registerSecurityEndpoints`) hands
- * its moved body forwards each member to the server with
- * `(...a) => this.<member>(...a)`, so a moved site's stack shows that forwarder
- * above the site itself. The site is the first censused frame that is not one.
- * Found by their spelling, and §2 pins ONE per moved REGISTRAR — one per moved
- * module, plus {@link EXTRA_MOVED_REGISTRARS} — so a respelt forwarder — or a
- * module moved without joining `SITE_FILES` — is a control failure there rather
- * than every moved site silently attributed to it.
+ * `registerSecurityExplainEndpoints`, `registerSecurityEndpoints`,
+ * `registerOpenApiEndpoints`) hands its moved body forwards each member to the
+ * server with `(...a) => this.<member>(...a)`, so a moved site's stack shows
+ * that forwarder above the site itself. The site is the first censused frame
+ * that is not one. Found by their spelling, and §2 pins ONE per moved REGISTRAR
+ * whose body reads the seam — one per moved module, plus
+ * {@link EXTRA_MOVED_REGISTRARS}, less {@link MOVED_REGISTRARS_READING_NO_EXECCTX}
+ * — so a respelt forwarder — or a module moved without joining `SITE_FILES` —
+ * is a control failure there rather than every moved site silently attributed
+ * to it.
  */
 const FORWARDER_LINES = SOURCE.split('\n').flatMap((l, i) =>
     l.includes('resolveExecCtx: (...a) => this.resolveExecCtx(...a),') ? [i + 1] : []);
@@ -127,10 +135,28 @@ const FORWARDERS = new Set(FORWARDER_LINES.map((line) => siteKey('rest-server.ts
  * own host literal and so through its own forwarder.
  *
  * [#23050 slice 6] `security-routes.ts` carries two as well, on the same terms.
+ *
+ * [#23050 slice 7] So does `discovery-routes.ts` (the discovery and OpenAPI
+ * bodies), each handed over by its own host literal — but see
+ * {@link MOVED_REGISTRARS_READING_NO_EXECCTX}: only one of its two literals
+ * carries the forwarder.
  */
 const EXTRA_MOVED_REGISTRARS: Readonly<Partial<Record<(typeof SITE_FILES)[number], number>>> = {
     'sharing-routes.ts': 1,
     'security-routes.ts': 1,
+    'discovery-routes.ts': 1,
+};
+/**
+ * [#23050 slice 7] The moved registrars whose bodies read no `resolveExecCtx`,
+ * so whose host literals hand over no forwarder — measured by the AST walk of
+ * the body, not assumed. `registerDiscoveryEndpoints`' body resolves no caller
+ * (the discovery document is served to anyone), so its host literal names no
+ * `resolveExecCtx` member; its module's other registrar, the OpenAPI pair,
+ * reads it twice and carries the forwarder. A body that starts reading the
+ * seam gains a forwarder, and §2's exact count reds until this entry goes.
+ */
+const MOVED_REGISTRARS_READING_NO_EXECCTX: Readonly<Partial<Record<(typeof SITE_FILES)[number], number>>> = {
+    'discovery-routes.ts': 1,
 };
 
 /** A stack frame in any censused file, as `<file>:<line>:<column>`. */
@@ -616,13 +642,27 @@ describe('[#13160] §2 the consumer surface, counted from the tree', () => {
         // members, four). Eight forwarders now, one per moved registrar:
         // (7 - 1) + 2, the second module carrying two registrars counted in
         // `EXTRA_MOVED_REGISTRARS`.
-        expect(SITE_FILES).toHaveLength(7);
+        //
+        // [#23050 slice 7] 62 sites UNCHANGED / 109 → 113 mentions — the same MOVE.
+        // `registerOpenApiEndpoints`' body left for `discovery-routes.ts` with its
+        // two BARE sites (the document and its viewer), and
+        // `registerDiscoveryEndpoints`' with none: 25 + 9 + 5 + 7 + 8 + 1 + 5 + 2
+        // = 62 sites. The four new mentions are this slice's seam, the two
+        // spellings ONCE (one host literal's forwarder, two; one host
+        // interface's member, two): `rest-server.ts` stays at 57 (two sites
+        // out, one forwarder's two mentions in). Nine forwarders now:
+        // (8 - 1) + 3 - 1 — the third module carrying two registrars counted in
+        // `EXTRA_MOVED_REGISTRARS`, and the discovery registrar, which reads no
+        // `resolveExecCtx`, in `MOVED_REGISTRARS_READING_NO_EXECCTX`.
+        expect(SITE_FILES).toHaveLength(8);
         expect(SITES.length).toBe(62);
-        expect([...SOURCES.values()].reduce((n, text) => n + text.split('resolveExecCtx').length - 1, 0)).toBe(109);
+        expect([...SOURCES.values()].reduce((n, text) => n + text.split('resolveExecCtx').length - 1, 0)).toBe(113);
         const extraMovedRegistrars = Object.values(EXTRA_MOVED_REGISTRARS).reduce((n, k) => n + (k ?? 0), 0);
-        expect(extraMovedRegistrars).toBe(2);
-        expect(FORWARDER_LINES, 'one host-literal resolveExecCtx forwarder per moved registrar: one was respelt or removed, or a module moved without joining SITE_FILES')
-            .toHaveLength(SITE_FILES.length - 1 + extraMovedRegistrars);
+        expect(extraMovedRegistrars).toBe(3);
+        const registrarsReadingNoExecCtx = Object.values(MOVED_REGISTRARS_READING_NO_EXECCTX).reduce((n, k) => n + (k ?? 0), 0);
+        expect(registrarsReadingNoExecCtx).toBe(1);
+        expect(FORWARDER_LINES, 'one host-literal resolveExecCtx forwarder per moved registrar whose body reads it: one was respelt or removed, or a module moved without joining SITE_FILES')
+            .toHaveLength(SITE_FILES.length - 1 + extraMovedRegistrars - registrarsReadingNoExecCtx);
     });
 
     it('the split is 16 locally caught / 46 bare — NOT 12 / 46, which does not add to 62', () => {
 
@@ -248,8 +248,9 @@ describe('[#20338] census: every draft switch in rest-server.ts is ledgered', ()
         // never its file, so no ledger row changed: 8 = 6 + 0 + 0 + 0 + 0 + 2,
         // length 5 → 6. [#23050 slice 6] The two security bodies
         // (`security-routes.ts`) read no draft: 8 = 6 + 0 + 0 + 0 + 0 + 2 + 0,
-        // length 6 → 7.
-        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(7);
+        // length 6 → 7. [#23050 slice 7] Nor do the discovery and OpenAPI bodies
+        // (`discovery-routes.ts`): 8 = 6 + 0 + 0 + 0 + 0 + 2 + 0 + 0, length 7 → 8.
+        expect(REST_SERVER_REGISTRAR_FILES).toHaveLength(8);
         expect(SOURCE_FILES.map((file) => file.fileName)).toEqual([...REST_SERVER_REGISTRAR_FILES]);
         expect(SITES).toHaveLength(8);
     });
 
@@ -29,8 +29,9 @@
  * owns — `components.schemas`, `info`, `securitySchemes`.
  *
  * This module is the rest half. It reads the routes the server has actually
- * mounted and returns the `paths` section for them; `rest-server.ts` installs
- * it in place of whatever the static artifact carried, so the stale section
+ * mounted and returns the `paths` section for them; the OpenAPI document's
+ * handler (`discovery-routes.ts` since #23050 slice 7, `rest-server.ts` before)
+ * installs it in place of whatever the static artifact carried, so the stale section
  * cannot leak through even while the spec-side generation is still there
  * (leg 2 = #5744, blocked by this one). Discarding rather than merging is the
  * point: a serve-time merge with a wrong static section republishes the wrong
@@ -236,8 +237,9 @@ export interface BuiltinPathsResult {
 /**
  * Build the built-in section for one base path from the routes mounted under it.
  *
- * Pure: no clock, no I/O, no server. `rest-server.ts` hands it
- * `routeManager.getAll()` at request time; the tests hand it fixtures.
+ * Pure: no clock, no I/O, no server. The OpenAPI document's handler
+ * (`discovery-routes.ts` since #23050 slice 7, `rest-server.ts` before) hands
+ * it `routeManager.getAll()` at request time; the tests hand it fixtures.
  */
 export function buildBuiltinPaths(
   routes: readonly BuiltinRouteFact[],