docs(changeset): drop the retired discard-overlay route from the pending 22719 refusal-sentence note (#22932)

Part of #15204
Clause-②: no

**This PR corrects one cell in a pending release note. The maintainer
authorized the edit, and the PR changes no shipped code.** It edits the
first cell of line 16 in
`.changeset/22719-rest-write-hook-refusal-sentence.md`. The maintainer
authorized exactly this edit, and the seat recorded the ruling and the
claim amendment in comment 6117174845 on #15204 (item (e), point 2).

### The note, and what changed under it

- **The note.** `.changeset/22719-rest-write-hook-refusal-sentence.md`
is still pending. `.changeset/pre.json` is `pre` / `next` and lists no
consumed changeset, and `packages/rest/CHANGELOG.md` has no entry for
it. Line 16 lists `POST /security/permission-sets/:id/discard-overlay`
among the routes that now answer a sandboxed hook's refusal with `400
VALIDATION_ERROR` and the hook's own sentence.
- **What changed under it.** The note landed with #22763 (`9859e4ec`,
2026-10-11T04:22Z), while that route was still live. Then #22776
(`60bcfe72`, 2026-10-11T09:03Z, ADR-0131 cutover stage 7-pre) retired
the route. Its own pending changeset,
`.changeset/15204-s7pre-overlay-discard-retired.md`, lists the route as
removed. If both notes publish unchanged, they contradict each other:
one says the route now answers `400`, and the other says the route is
gone.
- **Evidence that no live route serves it on `main`** (`85b4ac63`):
- `packages/rest/src/rest-route-ledger.ts:421-425` reads: "RETIRED
(ADR-0131 cutover): `POST
/api/v1/security/permission-sets/:id/discard-overlay` left with the
"Discard Overlay" Setup action. [...] no row, no route."
- `rest-route-ledger.conformance.test.ts` boots `RestServer` the way
production does (`registerRoutes()` plus `mountAndRecordDirectRoutes`).
It fails on any mounted route that has no ledger row, and the ledger has
no row for this route. Run on this branch: `Test Files 2 passed (2)`,
`Tests 584 passed (584)`, together with
`rest-write-route-hook-refusal-sentence.ledger.test.ts`. That second
test pins "names exactly the nineteen repaired rows" and carries the
comment "the overlay-discard row retired with its route".
- Outside markdown, `git grep -i discard-overlay` finds only two places:
that ledger comment and the migration entry
`packages/spec/src/migrations/entries/semantic/18.security-permission-set-overlay-discard-retired.ts`.
The dispatcher's `/security` domain
(`packages/runtime/src/domains/security.ts`) serves one route under
`permission-sets`, which is `POST
/security/permission-sets/:name/clone`, and
`packages/runtime/src/route-ledger.ts` has no discard-overlay row.

### The edit

Line 16, first cell only:

- before: `POST /security/suggested-bindings/:id/confirm` and
`/dismiss`, `POST /security/permission-sets/:id/discard-overlay`
- after: `POST /security/suggested-bindings/:id/confirm` and `/dismiss`

The frontmatter, the rest of the row and every other line of the file
are unchanged byte for byte. A line-by-line comparison against the base
finds line 16 as the only difference, and the old row with the new cell
swapped in equals the new row. This PR adds no changeset and changes no
other one. It does not touch `CHANGELOG.md` or `content/docs/releases/`.

### `Check Changeset` stays red, by design

This PR changes a changeset it did not add. That puts it in the
DELIBERATE CORRECTION class of the foreign changeset rule (rule 2 of
`scripts/check-empty-changeset.mjs`, #17712). The PR also adds no
changeset of its own, so `Require a changeset` (route 0) goes red first.
`skip-changeset` is deliberately not applied: that label would declare
that this PR releases nothing, but the note it corrects is still a
pending release. `Check Changeset` is not a required context.

This section is the written confirmation that route 0 asks for. It names
the note and what changed under it (above), and the authorization is the
maintainer's, recorded in comment 6117174845. One difference from the
usual shape: the behaviour change that made the sentence false came from
an earlier PR (#22776), not from this one.

### Gates (local, at head `02ad7dcc`, merge base `85b4ac63`)

The set is derived by `node scripts/pm/dispatch-gates.mjs --commands`:
20 commands, all run, and `--ran` reconciles 20 of 20.

| command | exit |
| --- | --- |
| `node scripts/check-empty-changeset.mjs --base origin/main` | 1. The
foreign changeset rule, DELIBERATE CORRECTION class, red by design. Its
empty-frontmatter half prints `✓ No empty-frontmatter changeset
introduced by this diff`. |
| `node scripts/check-empty-changeset.mjs --self-test` | 0 |
| `pnpm check:nul-bytes` (the control-byte gate) | 0, `OK (scanned 10963
text file(s) [...] no raw ASCII control bytes)` |
| `node scripts/check-adr-0087-registration.mjs --base origin/main` /
`--self-test` | 0 / 0 |
| `node scripts/check-changeset-no-major.mjs --base origin/main` /
`--self-test` | 0 / 0 |
| `pnpm check:changeset-gate-self-tests` | 0 |
| `pnpm check:objectui-changeset`, `check:pm-changeset-deadline-census`,
`check:published-files`, `check:gitlink-declared`,
`check:driver-memory-census`, `check:refd-timer-probe`,
`check:watch-hint-literal` | 0 each |
| `node scripts/check-closing-keyword-parity.mjs` / `--self-test`,
`check-comment-mask-corpus.mjs`, `pm/release-rehearsal-clone.mjs
--self-test`, `release-pending-publish.mjs --self-test` | 0 each |

### Acceptance notes

The same retirement made two more fragments of this note inaccurate. The
authorization covers one cell, so this PR leaves both unchanged and
names them for a decision:

1. **Line 16's before cell** still reads "`500 SUGGESTION_*_FAILED` /
`500 INTERNAL`, the wrapper". `500 INTERNAL` was the retired route's
answer: its handler ended in `handleError(err, res, 'INTERNAL')`
(`60bcfe72^:packages/rest/src/rest-server.ts`). The two routes left in
the row answer `500 SUGGESTION_CONFIRM_FAILED` and `500
SUGGESTION_DISMISS_FAILED` (`rest-server.ts:12441`, `:12459`), so
neither of them produces the `500 INTERNAL` the cell still names.
2. **The counts.** The title (line 5) says "twenty more REST write
routes", and line 9 says "Twenty write routes" and "Sixteen of them".
The table now lists nineteen routes, and fifteen of them show a `500`
before. The refusal ledger test on `main` already pins nineteen.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Rerax7QTjKMPCUZxQUtPFR)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/22719-rest-write-hook-refusal-sentence.md

@@ -13,7 +13,7 @@ Clause-②: no
 | routes | before | after |
 | --- | --- | --- |
 | `POST /sharing/rules`, `DELETE /sharing/rules/:idOrName`, `POST /sharing/rules/:idOrName/evaluate` | `500 RULE_*_FAILED`, flat `{ code, error }`, the wrapper | `400 VALIDATION_ERROR`, nested `{ success: false, error: { code, message } }`, the sentence |
-| `POST /security/suggested-bindings/:id/confirm` and `/dismiss`, `POST /security/permission-sets/:id/discard-overlay` | `500 SUGGESTION_*_FAILED` / `500 INTERNAL`, the wrapper | `400 VALIDATION_ERROR`, same nested `{ error: { code, message } }` shape, the sentence |
+| `POST /security/suggested-bindings/:id/confirm` and `/dismiss` | `500 SUGGESTION_*_FAILED` / `500 INTERNAL`, the wrapper | `400 VALIDATION_ERROR`, same nested `{ error: { code, message } }` shape, the sentence |
 | the nine `POST /approvals/requests/:id/*` writes (`approve`, `reject`, `recall`, `revise`, `resubmit`, `reassign`, `remind`, `request-info`, `comment`) | `500 APPROVAL_*_FAILED`, flat `{ code, error }`, the wrapper | `400 VALIDATION_ERROR`, nested, the sentence |
 | `POST /packages/publish` | `500 INTERNAL_ERROR`, the wrapper | `400 VALIDATION_ERROR`, the sentence |
 | `POST /datasources/:name/external/tables/:remote/draft` and `/import`, `/external/refresh-catalog`, `/external/validate` | `400 EXTERNAL_DATASOURCE_ERROR` / `400 EXTERNAL_IMPORT_ERROR`, the wrapper | the same status and code, the sentence |