feat(devx): add the ruled vendor-wire state to check-route-envelope's surface-3 grammar (#10554)

[os-elon]

Fixes #10554

Maintainer ruling implemented (2026-08-21, verbatim, untranslated)

A：新增 vendor 状态 — surface 3 增设第四状态「vendor wire format」——surface 2 已裁 kind 3 的对应物。仍被计数（封闭在 N 条）、note 强制点名 vendor/读者/契约伙伴、增改 MAINTAINER-ONLY，并把 const 提升规避具名写进门禁散文。

Full escalation that produced the fork: PR #10352, comment 5364581437.

What landed — scripts/check-route-envelope.mjs only, machinery + prose + self-test, zero entries

New surface-3 state vendorWire in the shared surface-3/4 grammar (auditPluginRouteModule serves both tables — one grammar, two receiver dialects, per the gate's own #9937 argument, so the state is available to EXPRESS_RESPONSE_MODULES under the same rules):

• Stays counted exactly like this surface's exempt: same counters, closed at exactly N bodies in exactly these files; a new vendor-shaped body fails until declared (widening diagnostic), and a vanished one fails in the shrink direction ("fewer than pinned").
• note mandatory and structured: must carry the labelled fields vendor: / reader: / partner:. Labels rather than free prose so the triple stays greppable and re-verifiable; a missing note and a label-less note are distinct diagnostics.
• Pairwise exclusive with ratchet (a conversion that can never happen is not tracked drift) and with exempt (one body sits on exactly one ruled boundary), each with its own diagnostic.
• Widening/adding is ⛔ MAINTAINER-ONLY — same RATCHET_AUTHORITY_MARKER path as exempt-widening (check:engine-double-contract fires at CI time, not authoring time — four independent PRs tripped it on brand-new test files in one shift, and a pre-warning in the brief did not prevent it #8435), asserted by self-test.
• A vendorWire declaration over nothing is refused, mirroring the empty-exempt refusal (no standing waivers).
• Summary output now reports vendor-wire counts and closed-at lines for surfaces 3 and 4 (0 entries on main; conformant arithmetic subtracts the new state so a future entry cannot print as conformant).

Const-hoisting evasion named in prose (ruling clause): a new header section "The const hoist is the named forbidden move, not a fix" records that hoisting a built body literal into a const turns the gate green with zero wire change and is the exact state the gate exists to prevent; the honest paths are vendorWire (maintainer's) or a byte-clean stop-and-report. The NOT-DECLARED and vendor-widening diagnostics both point at it, so the next agent hitting this class of red finds the prohibition before rediscovering the evasion.

Boundary prose keeps the three ruled directions distinct in one block: #9389 exempt (pre-auth, our own shells, no credential — opposite population), #9436 (SDK-read discovery bodies, repo-owned shape, one-key migration → enveloped), vendorWire (vendor owns the shape, vendor client reads it). WHO owns and WHO reads decide.

Self-test (existing idiom, driven through the pure auditPluginRouteModule): accepted with conforming note · rejected without note · rejected with label-less note · rejected beside ratchet · rejected beside exempt · ⛔ MAINTAINER-ONLY + hoist-naming asserted on widening · shrink direction red · empty declaration refused · negative control that #9389 exempt diagnostics are unchanged.

Mechanism assumption measured (PM question)

A dormant table entry for an undiscovered file is a hard ERROR, not tolerated. Probe: injected a vendorWire entry for packages/plugins/plugin-auth/src/DORMANT-PROBE-does-not-exist.ts (injection confirmed on disk: grep -c = 1), ran the audit → exit 1, diagnostic "declared in PLUGIN_ROUTE_MODULES but no longer writes a Hono response — moved, deleted, or converted? Update the table." Restored from the committed branch (grep = 0, git status clean, audit exit 0). So this PR ships zero entries, and PR #10352's branch adds the admin-impersonate-endpoint.ts entry after merging main — the ruling authorizes exactly that one entry. A placeholder comment section in PLUGIN_ROUTE_MODULES records this so the empty state reads as deliberate.

Gates (all at 41ba7bf, the head this PR proposes; exit codes captured before any pipe)

• node scripts/check-route-envelope.mjs --self-test → exit 0, "✓ check-route-envelope self-test passed"
• node scripts/check-route-envelope.mjs → exit 0; main's population unmoved — 7/2/1 on surface 1, dispatcher domains unchanged, surface 3 "8 conformant, 0 ratcheted, 3 exempt, 0 vendor-wire", surface 4 "2 conformant, 2 ratcheted, 0 exempt, 0 vendor-wire"
• pnpm check:route-envelope (the lint.yml family entry) → exit 0
• node scripts/check-ratchet-remedy-authority.mjs → exit 0, "OK … 105 scripts swept … 7 mark … 3 turn it down … Control corpus: 19 hand-classified scripts"; --list confirms check-route-envelope.mjs stays in the excluded set (no new offer-with-testimony reach, so the sibling's CONTROL corpus needs no edit)
• node scripts/check-nul-bytes.mjs → exit 0 ("no raw ASCII control bytes"), plus a targeted control-byte grep of the edited file (0 hits — the ⛔ marker is multi-byte UTF-8, not a control byte)
• pnpm check:cross-package-test-inputs → exit 0, "All 60 self-test cases passed. OK: 12 package(s)…"
• node scripts/pm/dispatch-gates.mjs (no paths — change set derived from merge base) → exit 0; named exactly check:route-envelope and check:cross-package-test-inputs for this diff, both run above

CI-tooling-only change (no published package touched) → skip-changeset label, per repo convention (measured: scripts-only #10506 landed the same way).

⛔ Draft on purpose: landing order and review are the PM's. Do not flip ready; do not arm auto-merge.

🤖 Generated with Claude Code

Generated by Claude Code

---

Generated by Claude Code