fix(actions): pin the ledger fake's update dispatch, and declare how the activation door is actually served

Two CI failures, both real.

1. `check-engine-double-contract` — the activation-ledger fake's `update()` did
   not route through ObjectQL's own dispatch predicate, so the double could
   accept call shapes the engine refuses. Opened with
   `assertEngineUpdateDispatch(data, options)` from `@objectstack/metadata-core`
   (the predicate's home since #5619; importing objectql's own re-export from
   inside objectql would be a self-import), matching the flow twin's fake. The
   new pinned coverage is recorded in the pinned ledger via the sanctioned
   `--write`; the shrink-only baseline is untouched.

2. `route-ledger-live-mount-parity` (#7526) — the activation door was
   "LEDGERED BUT NOT MOUNTED, and DISGUISED". Root-caused on a booted showcase
   rather than guessed: nothing registers `/api/v1/actions/_activation/:object/:action`,
   and a 3-segment activation path is matched by
   `/api/v1/actions/:object/:action/:recordId` with `_activation` bound to
   `:object`. It still reaches the activation arm because that mount rebuilds
   the dispatch path from its matched params, byte for byte — measured on the
   wire: the 2-segment shape answers this door's own 400 naming the required
   shape, and a 3-segment undeclared action answers its own 404 ("nothing to
   switch off"), neither of which the invocation path can produce; a 4-segment
   path resolves to nothing and 404s at the router.

   So the honest fix is the declaration, not a second mount: the ledger row
   carries `servedBy: /api/v1/actions/:object/:action/:recordId` with the
   mechanism written down. Because a `servedBy` note cannot say the arm still
   ANSWERS — and the unit suites drive the domain handler directly, which is
   why they stayed green through this — the two wire assertions are pinned
   end-to-end in the actions dogfood suite, on a boot that already exists.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KWRU3s15AJz7PGW7a7wdCh

Author: claude

packages/objectql/src/action-activation.test.ts

@@ -27,6 +27,11 @@
 //    `metadata:reloaded`, and a re-registered handler must stay switched off.
 
 import { describe, it, expect, vi } from 'vitest';
+// The engine's OWN update-dispatch predicate, so the fake below cannot be
+// looser than ObjectQL.update (`pnpm check:engine-double-contract`). Imported
+// from metadata-core rather than from `@objectstack/objectql`: this test lives
+// INSIDE objectql, and the package re-exporting it is this one.
+import { assertEngineUpdateDispatch } from '@objectstack/metadata-core';
 
 import { ObjectQL } from './engine.js';
 import {
@@ -61,6 +66,14 @@ function makeStoreEngine(rows: any[] = []) {
             return { id: 'row_new', ...data };
         }),
         update: vi.fn(async (object: string, data: any, options?: any) => {
+            // Routed through ObjectQL's OWN dispatch predicate, so this fake
+            // cannot be looser than the engine it stands in for — #4434 shipped
+            // a dead REST route with its suite green off exactly that gap.
+            // `pnpm check:engine-double-contract` is the gate; the predicate
+            // lives in metadata-core, which this package already depends on
+            // (importing objectql's own re-export from inside objectql would be
+            // a self-import). Same pin the flow twin's fake carries.
+            assertEngineUpdateDispatch(data, options);
             calls.push({ op: 'update', object, data, options });
             return data;
         }),

packages/qa/dogfood/test/action-params-contract.dogfood.test.ts

@@ -69,4 +69,48 @@ describe('dogfood: action param contract enforced at dispatch (ADR-0104 D2)', ()
       delete process.env.OS_ALLOW_LAX_ACTION_PARAMS;
     }
   });
+
+  // ── [#12160] The ADR-0126 §8 activation door, on the REAL mount ───────────
+  //
+  // `POST /actions/_activation/:object/:action` is NOT a registered pattern.
+  // Nothing mounts it: a 3-segment activation path is matched by
+  // `/api/v1/actions/:object/:action/:recordId` with `_activation` bound to
+  // `:object`, and it only reaches the activation arm because that mount
+  // rebuilds the dispatch path from its matched params, byte for byte. The
+  // route ledger says so with `servedBy`, and #7526's parity gate holds that
+  // declaration to the live router.
+  //
+  // What the ledger row CANNOT say is that the arm still answers, and that is
+  // the half worth pinning here: the unit suites drive `handleActionsRequest`
+  // directly, so they would stay green if the mount ever stopped forwarding
+  // the path faithfully (passing structured params instead, say) and every
+  // activation call started being served as an INVOCATION of an action named
+  // after the object segment. These two assertions fail the moment that
+  // happens, because both messages are ones only the activation arm produces.
+  describe('[#12160] the reserved `_activation` segment survives the real mount', () => {
+    it('the 2-segment shape answers the activation door, not an invocation', async () => {
+      const res = await stack.apiAs(token, 'POST', '/actions/_activation/showcase_mark_done', {});
+      const text = await res.text();
+
+      // The invocation path's answer for this URL would be a 404 naming a
+      // missing DECLARATION (`add \`defineAction\``) for action
+      // `showcase_mark_done` on object `_activation`.
+      expect(res.status, text).toBe(400);
+      expect(text).toContain('/actions/_activation/:object/:action');
+    });
+
+    it('the 3-segment shape reaches the activation door for a real object', async () => {
+      const res = await stack.apiAs(
+        token, 'POST', '/actions/_activation/showcase_task/no_such_action', { enabled: false },
+      );
+      const text = await res.text();
+
+      expect(res.status, text).toBe(404);
+      // The activation door's own wording — the invocation door's 404 for an
+      // undeclared action says `add \`defineAction\`` instead, so this
+      // distinguishes "my arm ran" from "swallowed by the sibling".
+      expect(text).toContain('nothing to switch off');
+      expect(text).not.toContain('defineAction');
+    });
+  });
 });

packages/runtime/src/route-ledger.ts

@@ -384,7 +384,18 @@ export const ROUTE_LEDGER: readonly RouteLedgerEntry[] = [
   { route: 'POST /actions//:action', domain: '/actions', disposition: 'sdk', client: 'actions.invokeGlobal',
     note: 'the object-less spelling of the global-action call (#3913) — same handler and same `global` key as the row above, reached without naming an object' },
   { route: 'POST /actions/_activation/:object/:action', domain: '/actions', disposition: 'server-only',
+    servedBy: '/api/v1/actions/:object/:action/:recordId',
     note: '[#12160] ADR-0126 §8 item 2 — enable/disable ONE packaged action, the only non-invocation shape this domain serves. '
+      + '⚠️ `servedBy`, and MEASURED on a real boot (#7526 caught it): no pattern of this spelling is registered. The '
+      + 'dispatcher mounts three `/actions` patterns, and a 3-segment activation path is matched by the LAST of them with '
+      + '`_activation` bound to `:object` — but that mount rebuilds the dispatch path from the matched params '
+      + '(`/actions/${object}/${action}/${recordId}`), so the path `handleActionsRequest` parses is byte-identical to the '
+      + 'one the caller sent and the `_activation` arm still fires. Probed against a booted showcase: the 2-segment shape '
+      + 'answers this door\'s own 400 (`Path must be /actions/_activation/:object/:action`) and a 3-segment undeclared '
+      + 'action answers this door\'s own 404 (`nothing to switch off`), neither of which the invocation path can produce. '
+      + 'A 4-segment path resolves to NOTHING and 404s at the router. Pinned end-to-end through the real mount in '
+      + '`qa/dogfood/test/action-params-contract.dogfood.test.ts`, so if that reconstruction ever stops being faithful the '
+      + 'pin reddens rather than this note going quietly stale. '
       + 'Body `{ enabled?: boolean }`; it writes a `sys_metadata_activation` row and nothing else (⛔ no definition write, ⛔ no clone: '
       + 'the action-clone half is unchartered). Two authority tiers, the same pair `POST /automation/:name/toggle` carries: '
       + '`manage_metadata`, then the ADR-0126 §5 posture rule requiring the platform operator in `group`/`isolated` — one shared '

scripts/engine-double-contract.pinned.json

@@ -951,6 +951,11 @@
       "verb": "update",
       "pinned": 1
     },
+    {
+      "file": "packages/objectql/src/action-activation.test.ts",
+      "verb": "update",
+      "pinned": 1
+    },
     {
       "file": "packages/objectql/src/layered-overlay-integration.test.ts",
       "verb": "delete",