docs(changeset): drop the retired discard-overlay route from the pending 22719 refusal-sentence note

[objectstack-fleet]

Part of #15204
Clause-②: no

This PR corrects one cell in a pending release note. The maintainer authorized the edit, and the PR changes no shipped code. It edits the first cell of line 16 in .changeset/22719-rest-write-hook-refusal-sentence.md. The maintainer authorized exactly this edit, and the seat recorded the ruling and the claim amendment in comment 6117174845 on #15204 (item (e), point 2).

The note, and what changed under it

• The note. .changeset/22719-rest-write-hook-refusal-sentence.md is still pending. .changeset/pre.json is pre / next and lists no consumed changeset, and packages/rest/CHANGELOG.md has no entry for it. Line 16 lists POST /security/permission-sets/:id/discard-overlay among the routes that now answer a sandboxed hook's refusal with 400 VALIDATION_ERROR and the hook's own sentence.
• What changed under it. The note landed with rest: the 20 REST write routes answer a sandboxed hook's refusal in the hook's own words #22763 (9859e4ec, 2026-10-11T04:22Z), while that route was still live. Then feat(plugin-security,rest,spec)!: retire the permission-set overlay discard (ADR-0131 cutover stage 7-pre) #22776 (60bcfe72, 2026-10-11T09:03Z, ADR-0131 cutover stage 7-pre) retired the route. Its own pending changeset, .changeset/15204-s7pre-overlay-discard-retired.md, lists the route as removed. If both notes publish unchanged, they contradict each other: one says the route now answers 400, and the other says the route is gone.
• Evidence that no live route serves it on main (85b4ac63):
  • packages/rest/src/rest-route-ledger.ts:421-425 reads: "RETIRED (ADR-0131 cutover): POST /api/v1/security/permission-sets/:id/discard-overlay left with the "Discard Overlay" Setup action. [...] no row, no route."
  • rest-route-ledger.conformance.test.ts boots RestServer the way production does (registerRoutes() plus mountAndRecordDirectRoutes). It fails on any mounted route that has no ledger row, and the ledger has no row for this route. Run on this branch: Test Files 2 passed (2), Tests 584 passed (584), together with rest-write-route-hook-refusal-sentence.ledger.test.ts. That second test pins "names exactly the nineteen repaired rows" and carries the comment "the overlay-discard row retired with its route".
  • Outside markdown, git grep -i discard-overlay finds only two places: that ledger comment and the migration entry packages/spec/src/migrations/entries/semantic/18.security-permission-set-overlay-discard-retired.ts. The dispatcher's /security domain (packages/runtime/src/domains/security.ts) serves one route under permission-sets, which is POST /security/permission-sets/:name/clone, and packages/runtime/src/route-ledger.ts has no discard-overlay row.

The edit

Line 16, first cell only:

• before: POST /security/suggested-bindings/:id/confirm and /dismiss, POST /security/permission-sets/:id/discard-overlay
• after: POST /security/suggested-bindings/:id/confirm and /dismiss

The frontmatter, the rest of the row and every other line of the file are unchanged byte for byte. A line-by-line comparison against the base finds line 16 as the only difference, and the old row with the new cell swapped in equals the new row. This PR adds no changeset and changes no other one. It does not touch CHANGELOG.md or content/docs/releases/.

Check Changeset stays red, by design

This PR changes a changeset it did not add. That puts it in the DELIBERATE CORRECTION class of the foreign changeset rule (rule 2 of scripts/check-empty-changeset.mjs, #17712). The PR also adds no changeset of its own, so Require a changeset (route 0) goes red first. skip-changeset is deliberately not applied: that label would declare that this PR releases nothing, but the note it corrects is still a pending release. Check Changeset is not a required context.

This section is the written confirmation that route 0 asks for. It names the note and what changed under it (above), and the authorization is the maintainer's, recorded in comment 6117174845. One difference from the usual shape: the behaviour change that made the sentence false came from an earlier PR (#22776), not from this one.

Gates (local, at head 02ad7dcc, merge base 85b4ac63)

The set is derived by node scripts/pm/dispatch-gates.mjs --commands: 20 commands, all run, and --ran reconciles 20 of 20.

command	exit
node scripts/check-empty-changeset.mjs --base origin/main	1. The foreign changeset rule, DELIBERATE CORRECTION class, red by design. Its empty-frontmatter half prints ✓ No empty-frontmatter changeset introduced by this diff.
node scripts/check-empty-changeset.mjs --self-test	0
pnpm check:nul-bytes (the control-byte gate)	0, OK (scanned 10963 text file(s) [...] no raw ASCII control bytes)
node scripts/check-adr-0087-registration.mjs --base origin/main / --self-test	0 / 0
node scripts/check-changeset-no-major.mjs --base origin/main / --self-test	0 / 0
pnpm check:changeset-gate-self-tests	0
pnpm check:objectui-changeset, check:pm-changeset-deadline-census, check:published-files, check:gitlink-declared, check:driver-memory-census, check:refd-timer-probe, check:watch-hint-literal	0 each
node scripts/check-closing-keyword-parity.mjs / --self-test, check-comment-mask-corpus.mjs, pm/release-rehearsal-clone.mjs --self-test, release-pending-publish.mjs --self-test	0 each

Acceptance notes

The same retirement made two more fragments of this note inaccurate. The authorization covers one cell, so this PR leaves both unchanged and names them for a decision:

1. Line 16's before cell still reads "500 SUGGESTION_*_FAILED / 500 INTERNAL, the wrapper". 500 INTERNAL was the retired route's answer: its handler ended in handleError(err, res, 'INTERNAL') (60bcfe72^:packages/rest/src/rest-server.ts). The two routes left in the row answer 500 SUGGESTION_CONFIRM_FAILED and 500 SUGGESTION_DISMISS_FAILED (rest-server.ts:12441, :12459), so neither of them produces the 500 INTERNAL the cell still names.
2. The counts. The title (line 5) says "twenty more REST write routes", and line 9 says "Twenty write routes" and "Sixteen of them". The table now lists nineteen routes, and fifteen of them show a 500 before. The refusal ledger test on main already pins nineteen.

---

Generated by Claude Code

[objectstack-fleet]

Seat ACCEPT: #22932 (item (e), one correction to a pending release note) at 02ad7dcc28; queued on green · the deliberate-correction confirmation (#18375)

Epic PM session_01Rerax7QTjKMPCUZxQUtPFR (marchtian), seat epic:#15194, 2026-10-12T03:58Z. Authorized by the maintainer in ruling record 6117174845. The developer was a subagent of this seat. Report: 6117341883.

The confirmation Check Changeset asks for. The note corrected is .changeset/22719-rest-write-hook-refusal-sentence.md (@objectstack/rest patch, from #22763).

• What changed under it: line 16's first cell drops `POST /security/permission-sets/:id/discard-overlay`. The rest of the row, the frontmatter and every other line are byte-identical.
• Why: that route is retired. rest-route-ledger.ts:421-425 carries its RETIRED note. rest-route-ledger.conformance.test.ts boots the server and fails on any mounted route without a ledger row, and the ledger has no row for this one. So the sentence would publish a route that does not exist.
• The red is by design: the check's own text says so ("if its only .changeset rows are CHANGED, not added, this PR corrects somebody else's pending release note -- do NOT apply 'skip-changeset'; write the confirmation on the PR … and leave this check red ([finding] the skip-changeset label suppresses the DELIBERATE-CORRECTION refusal whose own text says 「no label and no diff shape makes that safe」 — declared contract against enforced behaviour #18375)"). Check Changeset runs on pull_request only (pr-automation.yml), not on merge_group, and it is not a required check.

Two further inaccuracies in the same note stay, by the maintainer's choice. The developer flagged them, and the seat re-read both on main 85b4ac634e:

• The title and the "What was wrong" paragraph say twenty and sixteen routes, while the table now lists nineteen (rest-write-route-hook-refusal-sentence.ledger.test.ts:522, "names exactly the nineteen repaired rows").
• Line 16's "before" cell still names 500 INTERNAL, which only the retired route answered.

The maintainer, asked in this seat's session, answered "Leave them". So this PR lands as authorized, and neither is filed.

Checklist:

• PR form: draft, base main; line 1 Part of #15204, line 2 Clause-②: no; no closing keyword; assignee marchtian.
• Scope: 1 file, +1/−1. No CHANGELOG.md, no content/docs/releases/, no code.
• Evidence:
  • At 02ad7dcc: the two ledger suites passed (584 tests, command-exit 0); the derived gates were 20 derived, 20 run.
  • check-empty-changeset is red in exactly the deliberate-correction class. check-changeset-no-major and check-adr-0087-registration exit 0.
• CI on 02ad7dcc28: 17 success, 8 skipped by design, and one red, Check Changeset, the deliberate-correction class confirmed above. Lint & Repo Gates and TypeScript Type Check are success.

Then: flipped ready and enqueued in this same stroke. On MERGED, a Landed record on #15204. This was the last part of (e) for the first next prerelease (6117174845).

---

Generated by Claude Code