docs(qa): re-measure the two route-census figures #16955 left behind, and split the two moves inside one sentence (#17110)

Five sites in the tree read 76% false-ungated; two still read the pre-repair
figures, and one file carried both — `authz-probe-blind-spot.census.ts:129`
said 8 while `:147`, eighteen lines down, said 76%. Which number a reader got
depended on which line they reached first.

Carrier 1 (`authz-conformance.matrix.ts`) is arithmetic: 22 of 30 -> 22 of 29,
73% -> 76%. The five existing 76% sites are the authority; nothing new was
measured for it.

Carrier 2 is not arithmetic, which is why #16955 left it alone: the 8 carried a
ledger-grade decomposition (3 server-only / 3 public / 2 sdk) and 29 - 22 = 7
does not say how the four numbers redistribute. Measured rather than guessed,
with an AST instrument over `rest-server.ts` — the two registration spellings
the census's own population rule counts, gatedness read from the call
expression's syntax tree so comments cannot answer for code. It reproduces the
recorded 80 / 51 gated / 29 ungated and all four pinned controls at
`5abca1792e`, the commit the census anchors its own re-measurement to, and
reads identically at `f6b7c53db7` despite 78 lines of drift in that file. The
7 mounts grade 3 `server-only` / 3 `public` / 1 `sdk` — the arithmetic-looking
answer, arrived at by measurement.

A naive text scan of the same sites reads 59/21 instead: its paren matcher runs
away on an apostrophe in a comment, spanning one site from line 5244 to 10360.
That is the failure mode this file already warns about for its forwarder slice,
and it is why the reading is taken from a parser.

The same sentence also carried `sdk` 84 / `server-only` 7 / `public` 3, which
moved for an unrelated reason — #14503 took three REST package rows out of the
ledger (94 -> 91), a re-measurement this file's own probe row already records.
Both figures are corrected and the two causes are now named apart, because a
reader had no way to tell which of them moved for which reason.

The population is still 80, deriving authorization from source syntax stays
rejected, and "the single route in this whole population ever measured
unguarded" is preserved verbatim — guarding the route did not make it false.


Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

packages/qa/dogfood/test/authz-conformance.matrix.ts

@@ -31,8 +31,8 @@
 // domain cannot be silently absent from them, and therefore cannot be silently
 // absent from here. Widening a regex instead was refused: it rots on the next
 // added file, which is the mechanism this replaces. Deriving "gated" from
-// source syntax was refused too, on a measurement — 22 of 30 apparently
-// ungated `register(` sites in `rest-server.ts` are false, a 73% false-ungated
+// source syntax was refused too, on a measurement — 22 of 29 apparently
+// ungated `register(` sites in `rest-server.ts` are false, a 76% false-ungated
 // rate — because that trades a visible gap for a written-down false assurance.
 // The ledgers supply the POPULATION; the classification stays a reviewed row
 // here.

packages/qa/dogfood/test/authz-probe-blind-spot.census.ts

@@ -125,15 +125,36 @@
 //
 //  1. NO NOTION OF "GATED", and this ratchet's promise is about UNGATED
 //     routes. Ledger dispositions grade SDK expressibility, not authorization:
-//     REST reads `sdk` 84 / `server-only` 7 / `public` 3. Cross-checked
-//     directly rather than assumed — of the 8 REST route mounts measured to
+//     REST reads `sdk` 81 / `server-only` 7 / `public` 3. Cross-checked
+//     directly rather than assumed — of the 7 REST route mounts measured to
 //     carry no `enforceAuth`, the ledger grades 3 `server-only`, 3 `public`
-//     and 2 `sdk`; and one of those two `sdk` rows is
+//     and 1 `sdk`, and that one row is `GET /api/v1/discovery`.
+//
+//     ⚠️ RE-MEASURED 2026-09-09 against `f6b7c53db7`. Both halves of the
+//     sentence above moved, FOR TWO UNRELATED REASONS, and separating them is
+//     the whole value of re-recording it.
+//
+//     THE SET LOST A ROW: 8 -> 7, and the row it lost is
 //     `GET /api/v1/ui/view/:object/:type`, the single route in this whole
-//     population ever measured unguarded. Its ledger row is shape-identical to
-//     the 83 `sdk` rows that ARE gated. `public` states INTENT for 3
-//     browser-facing form routes; it is not a gate measurement and was never
-//     built as one.
+//     population ever measured unguarded. Guarding it at `cc837dbfec` is the
+//     same repair that moved 30 ungated to 29 one paragraph below, so it is
+//     gated at the call site now and leaves this set, taking the second `sdk`
+//     with it: 3 / 3 / 2 became 3 / 3 / 1. ⛔ Its LEDGER row did not move at
+//     all — still `sdk`, still shape-identical to every other `sdk` row, the
+//     79 that are gated and the 1 that is not. That is this blocker restated
+//     by a live example: the grade did not notice the gate arriving, and it
+//     would not notice one leaving either.
+//
+//     THE LEDGER TOTAL MOVED FOR A REASON THAT IS NOT ABOUT GATES AT ALL, and
+//     ⛔ must not be read as evidence about them: `sdk` 84 -> 81 when #14503
+//     took the three REST package read/delete rows out of the ledger
+//     (94 rows -> 91, already recorded on the `rest-route-ledger.ts` probe row
+//     in the PROBES table below). It is written down here only because both
+//     figures live in one sentence, where a reader has no way to tell which of
+//     them moved for which reason — the failure this whole census is named for.
+//
+//     `public` states INTENT for 3 browser-facing form routes; it is not a
+//     gate measurement and was never built as one.
 //
 //  2. DERIVING "gated" FROM SOURCE SYNTAX IS UNSAFE — measured, not assumed.
 //     Scanning each of the 80 registration sites in `rest-server.ts` for