feat(tooling): gate the route-ledger row census so a silent deletion reds (#17155)

`packages/runtime/src/route-ledger.ts` is census-shaped: its value is the
completeness of a list, and nothing in this tree read its row COUNT. An
index-slice edit meant to add two rows removed 105 lines -- route rows plus the
whole `/actions` section -- and exited 0, caught only because an unrelated gate
happened to redden.

Measured before writing anything:

  * The file's own suite (route-ledger.conformance.test.ts) is domain-level --
    "every registered dispatcher domain has at least one ledger entry" -- which
    a shorter list satisfies. Positive control: deleting a whole live-registry
    domain's rows DOES redden it, so "no count gate" is a reading and not an
    artefact of the search.
  * The cross-ledger guards (live-mount parity, client-url-conformance) compare
    against the UNION of five ledgers, which absorbs deletions: 26 of
    ROUTE_LEDGER's 82 rows have their wire pattern declared by another ledger,
    by the `* /mcp/**` wildcard, or via `servedBy` -- including two rows in the
    very `/actions` section the incident removed.
  * 10 of the 11 `*-route-ledger.ts` files carry a per-route completeness pair
    in their own package suite; this one is the only member of the family that
    does not. So the gate carries one occurrence, measured rather than assumed.

The count is GENERATED (`--fix` writes the digits, nobody's memory does), the
anchor must resolve to exactly one match or report ROTTED_ANCHOR, and the shape
is check-lockstep-package-count.mjs's. Deliberately a deletion detector and not
a route-granularity cross-check against the dispatcher registry -- that question
is open in #17041 and a census stays correct whichever way it is ruled.


Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-trump

.github/workflows/lint.yml

@@ -3042,6 +3042,21 @@ jobs:
       - name: Lockstep package-count guard
         run: pnpm check:lockstep-package-count
 
+      # Route-ledger census guard (#16758). `packages/runtime/src/route-ledger.ts`
+      # is census-shaped: its value is the completeness of a list, and nothing in
+      # this tree read its row COUNT. An index-slice edit meant to add two rows
+      # removed 105 lines — route rows plus the whole `/actions` section — and
+      # exited 0; it was caught only because an unrelated gate happened to redden.
+      # The file's own package suite is domain-level ("every registered dispatcher
+      # domain has at least one ledger entry"), which a shorter list satisfies, and
+      # the cross-ledger guards compare against a UNION that still holds 26 of the
+      # 82 rows' wire patterns from other ledgers. This gate holds the GENERATED
+      # census sentence above the array to the array's real length, so a deletion
+      # reds and a deliberate change shows its digits moving in the same diff.
+      # Full-repo state, not diff-shaped, so it runs its real check unconditionally.
+      - name: Route-ledger census guard
+        run: pnpm check:route-ledger-census
+
       # Release-notes drift guard: the platform is one version-locked train, so
       # every released @objectstack/spec major must have a curated, navigable
       # release page at content/docs/releases/v<major>.mdx. Catches the gap that

package.json

@@ -128,6 +128,7 @@
     "check:adr-0087-registration": "node scripts/check-adr-0087-registration.mjs --self-test && node scripts/check-adr-0087-registration.mjs",
     "check:changeset-gate-self-tests": "node scripts/check-empty-changeset.mjs --self-test && node scripts/check-adr-0087-registration.mjs --self-test && node scripts/check-changeset-no-major.mjs --self-test",
     "check:lockstep-package-count": "node scripts/check-lockstep-package-count.mjs --self-test && node scripts/check-lockstep-package-count.mjs",
+    "check:route-ledger-census": "node scripts/check-route-ledger-census.mjs --self-test && node scripts/check-route-ledger-census.mjs",
     "check:override-consistency": "node scripts/check-override-consistency.mjs --self-test && node scripts/check-override-consistency.mjs",
     "check:vendor-export-contract": "node scripts/check-vendor-export-contract.mjs --self-test && node scripts/check-vendor-export-contract.mjs",
     "check:vendor-export-contract-resolve": "node scripts/check-vendor-export-contract.mjs --self-test && node scripts/check-vendor-export-contract.mjs --resolve",

packages/runtime/src/route-ledger.ts

@@ -270,6 +270,32 @@ export const NON_DISPATCH_MOUNT_PREFIXES = [
   '/.well-known/objectstack',
 ] as const;
 
+/**
+ * The ledger.
+ *
+ * CENSUS (generated): this list holds 82 rows.
+ *
+ * ⛔ THAT NUMBER IS WRITTEN BY A TOOL — never by hand.
+ * `pnpm check:route-ledger-census` counts the rows below and fails when the two
+ * disagree; `node scripts/check-route-ledger-census.mjs --fix` rewrites the
+ * digits and nothing else. It exists because this list is CENSUS-SHAPED: its
+ * value is its completeness, and a WRONG row fails a gate that reads rows while
+ * a MISSING row fails only a gate that knows how many rows there should be.
+ * #16758 filed the second kind, after an index-slice edit meant to add two rows
+ * removed 105 lines — route rows plus the whole `/actions` section — and exited
+ * 0, caught only because an unrelated gate happened to redden.
+ *
+ * So a PR that really adds two rows moves this number by two, in the same diff
+ * as the rows; one that claims to and removes twenty-six cannot. ⛔ Do not
+ * "correct" the digits to make a build green — regenerate them, and read what
+ * they moved by.
+ *
+ * It is a DELETION detector and deliberately NOT a route-granularity check
+ * against what the dispatcher registers: whether this ledger should be checked
+ * per route, given `DomainHandlerRegistry.list()` exposes domains and not
+ * routes, is an open maintainer decision in #17041. A census stays correct
+ * whichever way that is ruled.
+ */
 export const ROUTE_LEDGER: readonly RouteLedgerEntry[] = [
   // ── well-known ────────────────────────────────────────────────────────────
   { route: 'GET /.well-known/objectstack', domain: '/.well-known/objectstack', absolute: true,