docs(qa): reword the #2567 Phase 2 comment to stop naming a fixed route list (#9027) (#9145)

The `#2567 Phase 2` comment (and two sibling mentions of the same claim in
this file) described discover()'s static enumeration as covering
data/meta/graphql HTTP entry points only. PROBES has grown to 15 probes over
11 named source files across 7 route families (meta, actions, automation,
packages, data, realtime, mcp) since that comment was written, and no
`graphql` probe exists in the table today — the old wording was already
inaccurate on that front too.

Reworded generically (HTTP/transport entry points named in the curated
PROBES table) rather than re-enumerating the current families, per the
issue's own reasoning: an enumerated list is what drifted in the first
place, so replacing one fixed list with another just re-creates the
mechanism that caused this finding. discover() itself is unchanged and
correctly enumerates all 15 surfaces; this is a prose-only fix.


Claude-Session: https://claude.ai/code/session_01Y26DJEHSBhhAQ6wwfsHNza

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager

packages/qa/dogfood/test/authz-conformance.test.ts

@@ -10,10 +10,11 @@
 // deleted proof, breaks the build.
 //
 // #2567 Phase 2 — the anonymous-deny SURFACES are additionally pinned by the
-// `discover()` ratchet: this test STATICALLY enumerates the data/meta/graphql
-// HTTP entry points from source and asserts each is classified by a matrix row.
-// A new ungated `/data` route (or a removed/stale `covers` key) then fails CI as
-// UNCLASSIFIED / STALE — the surface can't silently regress.
+// `discover()` ratchet: this test STATICALLY enumerates the HTTP/transport
+// entry points named in the curated `PROBES` table below and asserts each is
+// classified by a matrix row. A new ungated route (or a removed/stale
+// `covers` key) then fails CI as UNCLASSIFIED / STALE — the surface can't
+// silently regress.
 
 import { describe, expect, it } from 'vitest';
 import { fileURLToPath } from 'node:url';
@@ -43,13 +44,14 @@ const ATTRIBUTION = { marker: ATTRIBUTION_MARKER, scan: scanProofCandidates } as
 
 // ── #2567 ratchet — static enumeration of anonymous-deny HTTP entry points ──
 //
-// A CURATED per-file probe table (not a blind repo grep): scoped to the four
-// source files and to data/meta/graphql segments only, so control-plane routes
-// (/health, /auth, /ready, /discovery) are never enumerated as data surfaces.
-// But each probe is pattern-based WITHIN its file, so a genuinely new `/data`
-// route (or a new graphql/meta handler) is auto-discovered → new key → a
-// missing `covers` fails CI. Keys are derived from source CONTENT (route
-// literals / handler names), never line numbers, so they don't churn on edits.
+// A CURATED per-file probe table (not a blind repo grep): scoped to the
+// source files and route families named in PROBES below, so control-plane
+// routes (/health, /auth, /ready, /discovery) are never enumerated as data
+// surfaces. But each probe is pattern-based WITHIN its file, so a genuinely
+// new route or handler matching an existing probe's pattern is auto-discovered
+// → new key → a missing `covers` fails CI. Keys are derived from source
+// CONTENT (route literals / handler names), never line numbers, so they don't
+// churn on edits.
 const PROBES: ReadonlyArray<{ file: string; re: RegExp; key: (m: RegExpExecArray) => string }> = [
   // REST /meta umbrella registrar — one guarded registrar covers all ~17 routes.
   {
@@ -222,9 +224,9 @@ describe('ADR-0056 D10 — authorization conformance matrix', () => {
     const problems = checkLedger(AUTHZ_CONFORMANCE, {
       proofRoot: HERE, // proofs are dogfood test files alongside this one
       highRisk: HIGH_RISK,
-      // The ratchet: every discovered data/meta/graphql entry point must be
-      // classified by exactly one row's `covers`, and no `covers` key may be
-      // stale (no longer in source).
+      // The ratchet: every discovered PROBES entry point must be classified
+      // by exactly one row's `covers`, and no `covers` key may be stale (no
+      // longer in source).
       discover: () => discoverAnonymousDenySurfaces(),
       // #7976 — and the cited proofs must NAME the rows they prove.
       attribution: ATTRIBUTION,