Follow-up to #9813, filed per its dispatch instruction ("if the gate half becomes real gate-architecture work, file a domain:devx follow-up and ship the envelope flip alone"). #9813 shipped the small half: a fourth scan population in scripts/check-route-envelope.mjs for express-style res.json(...) writes on an IHttpServer, enumerated by name (IHTTP_ROUTE_MODULES, one entry: packages/runtime/src/dispatcher-plugin.ts). Filed unassigned.
What is missing
The other three populations are protected by discovery: surface 1 and surface 3 walk packages/ and refuse any response-writing module that is not declared, so a new file cannot join the repo unaudited. The express population has no walk — a brand-new module writing res.json(...) bodies on an IHttpServer is invisible to the gate until someone thinks to enumerate it, which is exactly the class of blind spot #9267 closed for Hono-context modules.
Why #9813 did not build the walk
Measured blast radius on origin/main at 45862a5: 20 non-test files under packages/ contain res.json(, and the spelling is ambiguous in a way the Hono population's is not — fetch's Response.json() is a zero-argument READ (const res = await fetch(…); await res.json()), byte-identical in receiver name to the express one-argument WRITE. A discovery walk therefore needs:
- a read/write discriminator (argument count is the obvious candidate; its false-positive surface across the 20 files is unmeasured), with self-test pins for both directions;
- a first-audit verdict (conformant
{} / ratchet / exempt) for every file the walk sweeps in — including packages/cli command servers, packages/verify's harness, and email-transport clients whose res is a fetch response; - a decision on whether
IHttpServer modules and generic express-style writers are one population or two.
That is gate-architecture work, which #9813's triage explicitly scoped out of the flip PR.
Acceptance shape
A discoverExpressRoutes() (or equivalent) walk whose undeclared-module failure text mirrors surface 3's, the read/write discriminator self-tested, and every swept-in file declared with measured counts. The enumerated IHTTP_ROUTE_MODULES table becomes the declared side of that walk rather than the whole mechanism.
Related: #9813 (the enumerated half) · #9267 (the same gap, closed for Hono-context modules) · #9936 (the one ratcheted counter in the enumerated population).
Generated by Claude Code
Follow-up to #9813, filed per its dispatch instruction ("if the gate half becomes real gate-architecture work, file a
domain:devxfollow-up and ship the envelope flip alone"). #9813 shipped the small half: a fourth scan population inscripts/check-route-envelope.mjsfor express-styleres.json(...)writes on anIHttpServer, enumerated by name (IHTTP_ROUTE_MODULES, one entry:packages/runtime/src/dispatcher-plugin.ts). Filed unassigned.What is missing
The other three populations are protected by discovery: surface 1 and surface 3 walk
packages/and refuse any response-writing module that is not declared, so a new file cannot join the repo unaudited. The express population has no walk — a brand-new module writingres.json(...)bodies on anIHttpServeris invisible to the gate until someone thinks to enumerate it, which is exactly the class of blind spot #9267 closed for Hono-context modules.Why #9813 did not build the walk
Measured blast radius on
origin/mainat 45862a5: 20 non-test files underpackages/containres.json(, and the spelling is ambiguous in a way the Hono population's is not — fetch'sResponse.json()is a zero-argument READ (const res = await fetch(…); await res.json()), byte-identical in receiver name to the express one-argument WRITE. A discovery walk therefore needs:{}/ ratchet / exempt) for every file the walk sweeps in — includingpackages/clicommand servers,packages/verify's harness, and email-transport clients whoseresis a fetch response;IHttpServermodules and generic express-style writers are one population or two.That is gate-architecture work, which #9813's triage explicitly scoped out of the flip PR.
Acceptance shape
A
discoverExpressRoutes()(or equivalent) walk whose undeclared-module failure text mirrors surface 3's, the read/write discriminator self-tested, and every swept-in file declared with measured counts. The enumeratedIHTTP_ROUTE_MODULEStable becomes the declared side of that walk rather than the whole mechanism.Related: #9813 (the enumerated half) · #9267 (the same gap, closed for Hono-context modules) · #9936 (the one ratcheted counter in the enumerated population).
Generated by Claude Code