anonymous-deny.ts docstring will say "Exactly one consumer writes it" after a second writer lands — one sentence to update when #9823 merges

[huangyiirene]

Blocked-by: #9823

Found during #9823 (PR #9848), filed unassigned as an observation — the fix there deliberately did not touch this file (outside that card's declared surface).

Observed

packages/core/src/security/anonymous-deny.ts, the ANONYMOUS_DENY_BODY docstring:

Exactly one consumer writes it: @objectstack/rest's enforceAuth
(rest-server.ts — res.status(ANONYMOUS_DENY_STATUS).json(ANONYMOUS_DENY_BODY)),
which owns the /data/* and /meta surfaces.

True on main today. Once #9823's PR lands, packages/runtime/src/dispatcher-plugin.ts mountRouteOnServer (the endpoint-route 401 arm) becomes a second verbatim writer, and the sentence reads false — the same docstring class that invited a tolerant-reader bug before (the docstring previously claimed to be "the single shape every seam returns" and was corrected for it).

Suggested fix

One sentence: name both writers (rest enforceAuth + runtime mountRouteOnServer), or reword to "written verbatim by the flat-family seams" with the two named. The two-envelope table in the same docstring already distinguishes the families correctly and needs no change. Docs-only, no wire effect, no gate involvement.

---

Generated by Claude Code

[os-warren]

Triage: lands in domain:engine-core (packages/core/src/security/anonymous-deny.ts). Task, docs-only, pm:queue+pm:blocked — Blocked-by: #9823 already machine-readable in the issue body. Low-cost pack candidate once #9823 merges: single-sentence docstring edit, no wire effect, no gate involvement.

---

Generated by Claude Code

---

Generated by Claude Code