test(dogfood): the authz census and the matrix docblock read the runtime route ledger as the 105 rows it holds (#24024)

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BVm1pAXVXQ3PjC42j1kPFf

Author: claude

packages/qa/dogfood/test/authz-conformance.matrix.ts

@@ -25,7 +25,7 @@
 // dispatcher domain files.
 //
 // The population comes from `packages/rest/src/rest-route-ledger.ts` (81 rows
-// / 18 families) and `packages/runtime/src/route-ledger.ts` (92 rows / 23
+// / 18 families) and `packages/runtime/src/route-ledger.ts` (105 rows / 23
 // domains) because those two are enumerated from a RUNNING server and guarded
 // in both directions by their own conformance tests — so a new family or
 // domain cannot be silently absent from them, and therefore cannot be silently

packages/qa/dogfood/test/authz-probe-blind-spot.census.ts

@@ -106,7 +106,7 @@
 //     `RestServer.getRoutes()` on a booted server and guarded per route by
 //     `rest-route-ledger.conformance.test.ts`. It reaches all 17 registrars;
 //     this table reaches 1.
-//   `packages/runtime/src/route-ledger.ts`: 92 rows over 23 domains. Its
+//   `packages/runtime/src/route-ledger.ts`: 105 rows over 23 domains. Its
 //     machine contract is DOMAIN-level, by live registry introspection
 //     (`domainRegistry.list()`), the per-route rows being documentation. It
 //     covers all 15 `async handle*(` methods in `http-dispatcher.ts` and all
@@ -477,11 +477,19 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [
     // `keys` stays 23 (23 distinct domains before and after, re-derived).
     // Controls moved with the rows ("route: '" and "domain: '" 88 -> 92,
     // RouteLedgerEntry unchanged at 2).
-    population: 92,
-    reachable: 92,
+    // [#24024] 92 -> 105: twelve refusal-only `/notifications` rows (the four
+    // verbs each of the three faces does not serve) and the `* /share-links/**`
+    // catch-all row arrived with their mounts (an anonymous caller is answered
+    // 401 on the standalone server). They carry `domain: '/notifications'` and
+    // `domain: '/share-links'`, EXISTING keys, so `reachable` moves with
+    // `population`, `blindSpot` stays 0 and `keys` stays 23 (23 distinct
+    // domains before and after, re-derived). Controls moved with the rows
+    // ("route: '" and "domain: '" 92 -> 105, RouteLedgerEntry unchanged at 2).
+    population: 105,
+    reachable: 105,
     blindSpot: 0,
     populationRule: 'ledger rows inside ROUTE_LEDGER; reachable = rows carrying a `domain` (each distinct value mints a key)',
-    controls: { "route: '": 92, "domain: '": 92, RouteLedgerEntry: 2 },
+    controls: { "route: '": 105, "domain: '": 105, RouteLedgerEntry: 2 },
     // [#22432] Re-derived on the merged ref: the note's two counts had stood at
     // 11 files / 5 classified / 16 baselined since before the `/analytics`
     // domain was classified (#21061), which named one more file and moved one