From 1d2c4f5257c6357a86936ecd4f38077742f8c102 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 6 Aug 2026 05:19:34 +0000
Subject: [PATCH 1/4] =?UTF-8?q?test(rest):=20getDiscovery=20=E6=9B=BF?=
 =?UTF-8?q?=E8=BA=AB=E5=8F=91=20`routes`,=E4=B8=8D=E5=86=8D=E5=8F=91?=
 =?UTF-8?q?=E5=B7=B2=E9=80=80=E5=BD=B9=E7=9A=84=20`endpoints`=20(#5674)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`packages/rest/src` 下 15 个测试文件的 `getDiscovery` 替身返回
`endpoints: { data, metadata, ui, auth }`,但真实生产者
(`packages/metadata-protocol/src/protocol.ts` 的 `getDiscovery()`)发的是
`routes`(`ApiRoutesSchema`,`DiscoverySchema` 里是必填键),从来没有发过
`endpoints`。`endpoints` 只在 dispatcher 那条路径上作为 `routes` 的逐字副本
存在过,#4828 已按 ADR-0049 删除,并在
`discovery-schema-conformance.test.ts` 钉死「no `features`, no `endpoints`」。

按键名(`data`/`metadata`/`ui`/`auth`)可知这些替身本意就是 `routes`,只是
拼错了对象;纯键名翻正,值保持作者原样(handler 每次请求都会用服务端配置
覆写 `data`/`metadata`/`ui`,这些槽位按构造就是占位符)。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DWUR56YsttL5sTF72Q75TQ
---
 packages/rest/src/meta-app-area-nav-gate.test.ts            | 2 +-
 packages/rest/src/meta-audience-plural.test.ts              | 2 +-
 packages/rest/src/meta-public-book-grant.test.ts            | 2 +-
 packages/rest/src/request-schema-gate.conformance.test.ts   | 2 +-
 packages/rest/src/rest-4xx-message-truncation.test.ts       | 2 +-
 packages/rest/src/rest-5xx-message-sanitization.test.ts     | 2 +-
 packages/rest/src/rest-batch-size-cap.test.ts               | 2 +-
 packages/rest/src/rest-bulk-path-object.test.ts             | 2 +-
 packages/rest/src/rest-delete-many-ingress.test.ts          | 2 +-
 .../rest/src/rest-endpoint-surfaces-served-only.test.ts     | 2 +-
 packages/rest/src/rest-expected-error-logging.test.ts       | 2 +-
 packages/rest/src/rest-meta-outage-vs-miss.test.ts          | 2 +-
 packages/rest/src/rest-unclassified-fault-status.test.ts    | 2 +-
 packages/rest/src/rest-unknown-object-heuristic.test.ts     | 4 ++--
 packages/rest/src/rest.test.ts                              | 6 +++++-
 15 files changed, 20 insertions(+), 16 deletions(-)

diff --git a/packages/rest/src/meta-app-area-nav-gate.test.ts b/packages/rest/src/meta-app-area-nav-gate.test.ts
index 3f75125385..7614dc2564 100644
--- a/packages/rest/src/meta-app-area-nav-gate.test.ts
+++ b/packages/rest/src/meta-app-area-nav-gate.test.ts
@@ -65,7 +65,7 @@ function makeRes() {
  */
 function setup(perms: string[], services: string[] = ['org-scoping']) {
     const protocol: any = {
-        getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' } }),
+        getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' } }),
         getMetaTypes: vi.fn().mockResolvedValue([]),
         // Deep-clone per call: the filter must never mutate stored metadata, and
         // a shared object would hide that by carrying a prior call's damage.
diff --git a/packages/rest/src/meta-audience-plural.test.ts b/packages/rest/src/meta-audience-plural.test.ts
index 2f5d1227b5..3a4997441e 100644
--- a/packages/rest/src/meta-audience-plural.test.ts
+++ b/packages/rest/src/meta-audience-plural.test.ts
@@ -30,7 +30,7 @@ function makeRes() {
 
 function setup() {
   const protocol: any = {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' } }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     // The real implementation normalizes singular↔plural, so BOTH spellings
     // resolve to the same items.
diff --git a/packages/rest/src/meta-public-book-grant.test.ts b/packages/rest/src/meta-public-book-grant.test.ts
index 7674d64f4e..a9764ceeeb 100644
--- a/packages/rest/src/meta-public-book-grant.test.ts
+++ b/packages/rest/src/meta-public-book-grant.test.ts
@@ -36,7 +36,7 @@ function makeRes() {
 /** Secure-by-default: `requireAuth` is ON for every case below. */
 function setup() {
   const protocol: any = {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' } }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn(async ({ type }: any) => {
       const t = RestServerTypes.singular(String(type ?? ''));
diff --git a/packages/rest/src/request-schema-gate.conformance.test.ts b/packages/rest/src/request-schema-gate.conformance.test.ts
index 88fde01faa..5d18cd58a3 100644
--- a/packages/rest/src/request-schema-gate.conformance.test.ts
+++ b/packages/rest/src/request-schema-gate.conformance.test.ts
@@ -60,7 +60,7 @@ function setup() {
     deleteManyData: vi.fn().mockResolvedValue({ success: true, total: 0, succeeded: 0, failed: 0, results: [] }),
   };
   const protocol: any = {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' } }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue([{ name: 'invoice' }]),
     getMetaItem: vi.fn().mockResolvedValue({}),
diff --git a/packages/rest/src/rest-4xx-message-truncation.test.ts b/packages/rest/src/rest-4xx-message-truncation.test.ts
index 579610f9ff..5949bd9826 100644
--- a/packages/rest/src/rest-4xx-message-truncation.test.ts
+++ b/packages/rest/src/rest-4xx-message-truncation.test.ts
@@ -189,7 +189,7 @@ function makeRes() {
 function setup(protocolOverrides: Record<string, unknown> = {}) {
     const protocol: any = {
         getDiscovery: vi.fn().mockResolvedValue({
-            version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' },
+            version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' },
         }),
         getMetaTypes: vi.fn().mockResolvedValue([]),
         getMetaItems: vi.fn().mockResolvedValue([]),
diff --git a/packages/rest/src/rest-5xx-message-sanitization.test.ts b/packages/rest/src/rest-5xx-message-sanitization.test.ts
index 2f189ef881..9a60dc830b 100644
--- a/packages/rest/src/rest-5xx-message-sanitization.test.ts
+++ b/packages/rest/src/rest-5xx-message-sanitization.test.ts
@@ -104,7 +104,7 @@ function mountRest(protocol: any) {
 function setup(protocolOverrides: Record<string, unknown> = {}) {
     const protocol: any = {
         getDiscovery: vi.fn().mockResolvedValue({
-            version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' },
+            version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' },
         }),
         getMetaTypes: vi.fn().mockResolvedValue([]),
         getMetaItems: vi.fn().mockResolvedValue([]),
diff --git a/packages/rest/src/rest-batch-size-cap.test.ts b/packages/rest/src/rest-batch-size-cap.test.ts
index 546e3e2513..1522ece21f 100644
--- a/packages/rest/src/rest-batch-size-cap.test.ts
+++ b/packages/rest/src/rest-batch-size-cap.test.ts
@@ -35,7 +35,7 @@ function setup(maxBatchSize?: number) {
     batchData: vi.fn().mockResolvedValue({ success: true, total: 0, succeeded: 0, failed: 0, results: [] }),
   };
   const protocol: any = {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' } }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue([{ name: 'invoice' }]),
     getMetaItem: vi.fn().mockResolvedValue({}),
diff --git a/packages/rest/src/rest-bulk-path-object.test.ts b/packages/rest/src/rest-bulk-path-object.test.ts
index 7319c161c8..af6d62b296 100644
--- a/packages/rest/src/rest-bulk-path-object.test.ts
+++ b/packages/rest/src/rest-bulk-path-object.test.ts
@@ -41,7 +41,7 @@ function setup() {
     success: true, operation: 'delete', total: 1, succeeded: 1, failed: 0, results: [],
   });
   const protocol: any = {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' } }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue([
       { name: 'open' },
diff --git a/packages/rest/src/rest-delete-many-ingress.test.ts b/packages/rest/src/rest-delete-many-ingress.test.ts
index c8e1d48b05..1ed0a6666d 100644
--- a/packages/rest/src/rest-delete-many-ingress.test.ts
+++ b/packages/rest/src/rest-delete-many-ingress.test.ts
@@ -33,7 +33,7 @@ function setup() {
     success: true, operation: 'delete', total: 1, succeeded: 1, failed: 0, results: [],
   });
   const protocol: any = {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' } }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue([{ name: 'invoice' }]),
     getMetaItem: vi.fn().mockResolvedValue({}),
diff --git a/packages/rest/src/rest-endpoint-surfaces-served-only.test.ts b/packages/rest/src/rest-endpoint-surfaces-served-only.test.ts
index 6ce7d627be..089283a93b 100644
--- a/packages/rest/src/rest-endpoint-surfaces-served-only.test.ts
+++ b/packages/rest/src/rest-endpoint-surfaces-served-only.test.ts
@@ -140,7 +140,7 @@ async function managerHolding(items: Array<Record<string, unknown>>): Promise<Me
 function mountRest(enumerated: Array<Record<string, unknown>>, authority: unknown | undefined) {
   const protocol: any = {
     getDiscovery: vi.fn().mockResolvedValue({
-      version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' },
+      version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' },
     }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn(async ({ type }: any) => {
diff --git a/packages/rest/src/rest-expected-error-logging.test.ts b/packages/rest/src/rest-expected-error-logging.test.ts
index 3dea0373be..58f322dcea 100644
--- a/packages/rest/src/rest-expected-error-logging.test.ts
+++ b/packages/rest/src/rest-expected-error-logging.test.ts
@@ -66,7 +66,7 @@ function noDraftError(target: string) {
 function setup(protocolOverrides: Record<string, unknown> = {}) {
     const protocol: any = {
         getDiscovery: vi.fn().mockResolvedValue({
-            version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' },
+            version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' },
         }),
         getMetaTypes: vi.fn().mockResolvedValue([]),
         getMetaItems: vi.fn().mockResolvedValue([{ name: 'showcase_account' }]),
diff --git a/packages/rest/src/rest-meta-outage-vs-miss.test.ts b/packages/rest/src/rest-meta-outage-vs-miss.test.ts
index c681276cb0..259864803c 100644
--- a/packages/rest/src/rest-meta-outage-vs-miss.test.ts
+++ b/packages/rest/src/rest-meta-outage-vs-miss.test.ts
@@ -42,7 +42,7 @@ function makeRes() {
 function setup(protocolOverrides: Record<string, unknown> = {}) {
     const protocol: any = {
         getDiscovery: vi.fn().mockResolvedValue({
-            version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' },
+            version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' },
         }),
         getMetaTypes: vi.fn().mockResolvedValue([]),
         getMetaItems: vi.fn().mockResolvedValue([]),
diff --git a/packages/rest/src/rest-unclassified-fault-status.test.ts b/packages/rest/src/rest-unclassified-fault-status.test.ts
index 632a547fed..3d2c0e3c3a 100644
--- a/packages/rest/src/rest-unclassified-fault-status.test.ts
+++ b/packages/rest/src/rest-unclassified-fault-status.test.ts
@@ -87,7 +87,7 @@ function makeRes() {
 function setup(protocolOverrides: Record<string, unknown> = {}) {
     const protocol: any = {
         getDiscovery: vi.fn().mockResolvedValue({
-            version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' },
+            version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' },
         }),
         getMetaTypes: vi.fn().mockResolvedValue([]),
         getMetaItems: vi.fn().mockResolvedValue([]),
diff --git a/packages/rest/src/rest-unknown-object-heuristic.test.ts b/packages/rest/src/rest-unknown-object-heuristic.test.ts
index 00fc325cfc..364fd23c7b 100644
--- a/packages/rest/src/rest-unknown-object-heuristic.test.ts
+++ b/packages/rest/src/rest-unknown-object-heuristic.test.ts
@@ -384,7 +384,7 @@ describe('[#5462] a real unknown object is still 404 OBJECT_NOT_FOUND, still sil
         // trace per request (#4886).
         const rest = mountRest({
             getDiscovery: vi.fn().mockResolvedValue({
-                version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' },
+                version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' },
             }),
             getMetaTypes: vi.fn().mockResolvedValue([]),
             findData: vi.fn().mockRejectedValue(driverError('no such table: ghost')),
@@ -416,7 +416,7 @@ describe('[#5462] the declared-status band is untouched', () => {
         );
         const rest = mountRest({
             getDiscovery: vi.fn().mockResolvedValue({
-                version: 'v0', endpoints: { data: '', metadata: '', ui: '', auth: '/auth' },
+                version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' },
             }),
             getMetaTypes: vi.fn().mockResolvedValue([]),
             saveMetaItem: vi.fn().mockRejectedValue(err),
diff --git a/packages/rest/src/rest.test.ts b/packages/rest/src/rest.test.ts
index d34d4d7858..7483723ef0 100644
--- a/packages/rest/src/rest.test.ts
+++ b/packages/rest/src/rest.test.ts
@@ -30,7 +30,11 @@ function createMockProtocol() {
   return {
     getDiscovery: vi.fn().mockResolvedValue({
       version: 'v0',
-      endpoints: { data: '', metadata: '', ui: '', auth: '/auth' },
+      // The producer's key is `routes` (`ApiRoutesSchema`, required by
+      // `DiscoverySchema`). `endpoints` was a dispatcher-only verbatim copy of
+      // it, retired in #4828 — a double that spells it is teaching a shape no
+      // producer ever emitted (#5674). Copy this mock, not that one.
+      routes: { data: '', metadata: '', ui: '', auth: '/auth' },
     }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue([]),

From 7d5ec37aff8a9f604c9a5dc6154efa15fe66738f Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 6 Aug 2026 05:19:59 +0000
Subject: [PATCH 2/4] =?UTF-8?q?test(rest):=20=E5=90=8C=E4=B8=80=E6=89=B9?=
 =?UTF-8?q?=E9=87=8C=20`endpoints:=20{}`=20=E7=9A=84=2010=20=E4=B8=AA?=
 =?UTF-8?q?=E6=9B=BF=E8=BA=AB=E4=B8=80=E5=B9=B6=E7=BF=BB=E6=AD=A3=20(#5674?=
 =?UTF-8?q?)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

同一个已退役键的退化写法:另有 10 个文件写 `endpoints: {}`。issue 与派发单
的清单来自 `endpoints: { data:` 这个 grep,看不见它们,但它们拼的是同一个
#4828 已删除的 discovery 键,拷贝危害完全相同 —— 只修 15 个会让 issue 自己
写下的第一条理由(「唯一还在拼写已退役键的地方」)原样留存。

翻正为 `routes: { data: '', metadata: '' }`:`ApiRoutesSchema` 里
`data`/`metadata` 必填,所以 `routes: {}` 不是合法生产者形状;这个字面量与
`rest.test.ts:2601` 早已存在的正确替身(唯一真正调用 /discovery handler 的
那处)完全一致,取仓库内已有先例而非另发明一种。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DWUR56YsttL5sTF72Q75TQ
---
 packages/rest/src/analytics-dataset-dimension-gate.test.ts   | 2 +-
 packages/rest/src/analytics-dataset-refusal-envelope.test.ts | 2 +-
 packages/rest/src/analytics-dataset-where-gate.test.ts       | 2 +-
 packages/rest/src/analytics-filter-refusal-envelope.test.ts  | 2 +-
 packages/rest/src/analytics-routes.test.ts                   | 2 +-
 packages/rest/src/public-form-routes.test.ts                 | 2 +-
 packages/rest/src/rest-batch-endpoint.test.ts                | 2 +-
 packages/rest/src/rest-dropped-fields.test.ts                | 2 +-
 packages/rest/src/rest-env-resolution.test.ts                | 2 +-
 packages/rest/src/security-routes.test.ts                    | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/packages/rest/src/analytics-dataset-dimension-gate.test.ts b/packages/rest/src/analytics-dataset-dimension-gate.test.ts
index 17ca677a8a..2315e27f95 100644
--- a/packages/rest/src/analytics-dataset-dimension-gate.test.ts
+++ b/packages/rest/src/analytics-dataset-dimension-gate.test.ts
@@ -72,7 +72,7 @@ function mockServer() {
 }
 function mockProtocol() {
   return {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue([]),
   };
diff --git a/packages/rest/src/analytics-dataset-refusal-envelope.test.ts b/packages/rest/src/analytics-dataset-refusal-envelope.test.ts
index e1a3e28fb6..52bfce27d3 100644
--- a/packages/rest/src/analytics-dataset-refusal-envelope.test.ts
+++ b/packages/rest/src/analytics-dataset-refusal-envelope.test.ts
@@ -70,7 +70,7 @@ function mockServer() {
 }
 function mockProtocol() {
   return {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue([]),
   };
diff --git a/packages/rest/src/analytics-dataset-where-gate.test.ts b/packages/rest/src/analytics-dataset-where-gate.test.ts
index 1baf066f32..e0e82b7d7b 100644
--- a/packages/rest/src/analytics-dataset-where-gate.test.ts
+++ b/packages/rest/src/analytics-dataset-where-gate.test.ts
@@ -64,7 +64,7 @@ function mockServer() {
 }
 function mockProtocol() {
   return {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue([]),
   };
diff --git a/packages/rest/src/analytics-filter-refusal-envelope.test.ts b/packages/rest/src/analytics-filter-refusal-envelope.test.ts
index c35cdac19a..de105c51e0 100644
--- a/packages/rest/src/analytics-filter-refusal-envelope.test.ts
+++ b/packages/rest/src/analytics-filter-refusal-envelope.test.ts
@@ -58,7 +58,7 @@ function mockServer() {
 }
 function mockProtocol() {
   return {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue([]),
   };
diff --git a/packages/rest/src/analytics-routes.test.ts b/packages/rest/src/analytics-routes.test.ts
index 867970becf..d533503f6e 100644
--- a/packages/rest/src/analytics-routes.test.ts
+++ b/packages/rest/src/analytics-routes.test.ts
@@ -12,7 +12,7 @@ function mockServer() {
   };
 }
 function mockProtocol() {
-  return { getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }), getMetaTypes: vi.fn().mockResolvedValue([]), getMetaItems: vi.fn().mockResolvedValue([]) };
+  return { getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }), getMetaTypes: vi.fn().mockResolvedValue([]), getMetaItems: vi.fn().mockResolvedValue([]) };
 }
 function mockRes() {
   const res: any = { statusCode: 200, body: undefined };
diff --git a/packages/rest/src/public-form-routes.test.ts b/packages/rest/src/public-form-routes.test.ts
index 69cf29f2b9..6826962134 100644
--- a/packages/rest/src/public-form-routes.test.ts
+++ b/packages/rest/src/public-form-routes.test.ts
@@ -59,7 +59,7 @@ const ticketObject = {
 function buildServer(sections: any[]) {
   const createData = vi.fn().mockResolvedValue({ object: 'ticket', id: 'rec_1', record: {} });
   const protocol: any = {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn(async ({ type }: { type: string }) => {
       if (type === 'view') return [formView(sections)];
diff --git a/packages/rest/src/rest-batch-endpoint.test.ts b/packages/rest/src/rest-batch-endpoint.test.ts
index 5006070dd2..5d4e650b32 100644
--- a/packages/rest/src/rest-batch-endpoint.test.ts
+++ b/packages/rest/src/rest-batch-endpoint.test.ts
@@ -72,7 +72,7 @@ function makeCreateData(ql: any, opts: { readonlyFields?: string[] } = {}) {
 function buildServer(opts: { ql?: any; objects?: any[]; readonlyFields?: string[] } = {}) {
   const server = mockServer();
   const protocol: any = {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue(opts.objects ?? []),
     createData: opts.ql
diff --git a/packages/rest/src/rest-dropped-fields.test.ts b/packages/rest/src/rest-dropped-fields.test.ts
index b72ca28300..081669fac9 100644
--- a/packages/rest/src/rest-dropped-fields.test.ts
+++ b/packages/rest/src/rest-dropped-fields.test.ts
@@ -29,7 +29,7 @@ function mockRes() {
 
 function buildServer(protocolOverrides: Record<string, any>) {
   const protocol: any = {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     // No object registered → enforceApiAccess default-allows and the handler
     // proceeds straight to the (mocked) write method.
diff --git a/packages/rest/src/rest-env-resolution.test.ts b/packages/rest/src/rest-env-resolution.test.ts
index f62166dc9c..c50479af45 100644
--- a/packages/rest/src/rest-env-resolution.test.ts
+++ b/packages/rest/src/rest-env-resolution.test.ts
@@ -34,7 +34,7 @@ function createMockServer() {
 
 function createMockProtocol() {
   return {
-    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }),
+    getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }),
     getMetaTypes: vi.fn().mockResolvedValue([]),
     getMetaItems: vi.fn().mockResolvedValue([]),
     getMetaItem: vi.fn().mockResolvedValue({}),
diff --git a/packages/rest/src/security-routes.test.ts b/packages/rest/src/security-routes.test.ts
index 2f0f9bc9ca..82d1362259 100644
--- a/packages/rest/src/security-routes.test.ts
+++ b/packages/rest/src/security-routes.test.ts
@@ -13,7 +13,7 @@ function mockServer() {
   };
 }
 function mockProtocol() {
-  return { getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', endpoints: {} }), getMetaTypes: vi.fn().mockResolvedValue([]), getMetaItems: vi.fn().mockResolvedValue([]) };
+  return { getDiscovery: vi.fn().mockResolvedValue({ version: 'v0', routes: { data: '', metadata: '' } }), getMetaTypes: vi.fn().mockResolvedValue([]), getMetaItems: vi.fn().mockResolvedValue([]) };
 }
 function mockRes() {
   const res: any = { statusCode: 200, body: undefined };

From 8b92c51e7d985167f5a5c024d2b1ecd2fd64c109 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 6 Aug 2026 05:27:45 +0000
Subject: [PATCH 3/4] =?UTF-8?q?test(rest):=20=E9=92=89=E6=AD=BB=E3=80=8Cge?=
 =?UTF-8?q?tDiscovery=20=E6=9B=BF=E8=BA=AB=E4=B8=8D=E5=BE=97=E6=8B=BC=20`e?=
 =?UTF-8?q?ndpoints`=E3=80=8D(#5674)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

前两个 commit 把 25 个替身翻正了,但没有任何东西阻止它回来:生产面的
`discovery-schema-conformance.test.ts` 只看真实 producer 发出的 body,fixture
层它看不见 —— 而 issue 记这一笔的第一条理由就是「下一个写 rest 测试的人照抄
这个替身,退役键就在 fixture 层复活」。

新增 pin 扫描 `packages/rest/src/*.test.ts` 里 `mockResolvedValue({ … })` 形态的
getDiscovery 替身(当前 28 处 / 27 个文件,含两处本来就没拼错的),断言没有一处
带 `endpoints` 键,并带一条 anti-vacuity 下限(#4642 的教训:扫不到东西的扫描器
会以「全部干净」的样子通过)。

只断言否定面,不要求必须有 `routes`:`rest-server` 的 handler 是
`if (discovery.routes)`,将来有测试要驱动这条假分支是正当的。

反向验证(方向为事前预测的 RED):把 rest-batch-size-cap.test.ts 改回
`endpoints` → pin 立即失败并点名该文件
（expected [ 'rest-batch-size-cap.test.ts' ] to deeply equal []），改回后转绿。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DWUR56YsttL5sTF72Q75TQ
---
 .../src/discovery-double-retired-key.test.ts  | 123 ++++++++++++++++++
 1 file changed, 123 insertions(+)
 create mode 100644 packages/rest/src/discovery-double-retired-key.test.ts

diff --git a/packages/rest/src/discovery-double-retired-key.test.ts b/packages/rest/src/discovery-double-retired-key.test.ts
new file mode 100644
index 0000000000..134b519f43
--- /dev/null
+++ b/packages/rest/src/discovery-double-retired-key.test.ts
@@ -0,0 +1,123 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#5674] No `getDiscovery` test double in this package may spell `endpoints`.
+ *
+ * ## What was wrong
+ *
+ * 25 test files in `packages/rest/src` mocked the protocol like this:
+ *
+ * ```ts
+ * getDiscovery: vi.fn().mockResolvedValue({
+ *   version: 'v0',
+ *   endpoints: { data: '', metadata: '', ui: '', auth: '/auth' },
+ * })
+ * ```
+ *
+ * The real producer (`ObjectStackProtocolImplementation.getDiscovery()` in
+ * `packages/metadata-protocol/src/protocol.ts`) emits `routes` — declared as
+ * `ApiRoutesSchema` and REQUIRED by `DiscoverySchema` — and has never emitted
+ * `endpoints`. That key existed only on the dispatcher path, as a verbatim
+ * copy of `routes`, and #4828 removed it under ADR-0049. The producer side is
+ * already pinned next door: `discovery-schema-conformance.test.ts` asserts the
+ * live `/discovery` body has no `endpoints` property.
+ *
+ * Those doubles were inert — `rest-server`'s discovery handler reads
+ * `discovery.routes`, so `if (discovery.routes)` was simply false and the
+ * route-augmentation block was skipped — which is exactly why they survived
+ * the retirement: nothing they asserted depended on the key at all.
+ *
+ * ## Why a pin, and why THIS pin
+ *
+ * The harm is authoring-time, not runtime: these were the last places in the
+ * repo still spelling a retired key, and a test double is the most-copied
+ * artifact there is. Copy one and the key is back in the fixture layer, still
+ * inert, still teaching a producer shape that never existed. A conformance
+ * test over the live producer cannot see that — no producer is involved.
+ *
+ * Scope, stated honestly:
+ *
+ * - It scans the `mockResolvedValue({ … })` form only, which is the form all
+ *   26 doubles in this package use and therefore the form that gets copied. A
+ *   double written some other way (`vi.fn(async () => ({ … }))`) is not read.
+ * - It asserts only the NEGATIVE — no `endpoints` key. It deliberately does
+ *   not require `routes`, because `rest-server` guards with
+ *   `if (discovery.routes)` and a future test is entitled to drive that guard's
+ *   falsy branch with a double that omits it.
+ * - The floor below is anti-vacuity, in the sense of #4642: a scanner that
+ *   silently stops matching would otherwise pass by finding nothing.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SRC_DIR = fileURLToPath(new URL('.', import.meta.url));
+
+/** Matches an `endpoints` key at the start of a line or after `{` / `,`. */
+const ENDPOINTS_KEY = /(^|[{,])\s*endpoints\s*:/;
+
+interface Double {
+    file: string;
+    /** The source text of the object the double resolves to, braces included. */
+    literal: string;
+}
+
+/**
+ * Capture the balanced `{ … }` that follows `getDiscovery: …mockResolvedValue(`.
+ *
+ * Brace counting is enough here: the doubles are plain data literals, and a
+ * `{` inside a string would only ever make this capture MORE text, i.e. fail
+ * loud rather than pass quiet.
+ */
+function collectDoubles(file: string, source: string): Double[] {
+    const found: Double[] = [];
+    const opener = /getDiscovery\s*:[\s\S]{0,80}?mockResolvedValue\(\s*\{/g;
+    let m: RegExpExecArray | null;
+    while ((m = opener.exec(source)) !== null) {
+        const start = m.index + m[0].length - 1; // index of the `{`
+        let depth = 0;
+        let end = -1;
+        for (let i = start; i < source.length; i++) {
+            const ch = source[i];
+            if (ch === '{') depth++;
+            else if (ch === '}') {
+                depth--;
+                if (depth === 0) { end = i; break; }
+            }
+        }
+        if (end === -1) throw new Error(`${file}: unbalanced getDiscovery double literal`);
+        found.push({ file, literal: source.slice(start, end + 1) });
+    }
+    return found;
+}
+
+const DOUBLES: Double[] = readdirSync(SRC_DIR)
+    .filter((f) => f.endsWith('.test.ts'))
+    .flatMap((f) => collectDoubles(f, readFileSync(join(SRC_DIR, f), 'utf8')));
+
+describe('[#5674] getDiscovery doubles carry the producer key, not the retired one', () => {
+    it('finds the doubles it claims to police (anti-vacuity)', () => {
+        // 26 doubles across 25 files when this pin was written. The floor is
+        // deliberately slack — it exists so a scanner that matches NOTHING
+        // fails instead of reporting a clean sweep of an empty set.
+        expect(
+            DOUBLES.length,
+            'the scanner found (almost) no getDiscovery doubles — it has drifted from how this package writes them, so its verdict below means nothing',
+        ).toBeGreaterThanOrEqual(20);
+    });
+
+    it('no double resolves to an object carrying `endpoints` (retired in #4828)', () => {
+        const offenders = DOUBLES
+            .filter((d) => ENDPOINTS_KEY.test(d.literal))
+            .map((d) => d.file);
+
+        expect(
+            Array.from(new Set(offenders)),
+            'the discovery producer emits `routes` (ApiRoutesSchema) and never emitted `endpoints`; '
+            + '`endpoints` was the dispatcher-only copy retired by #4828 (ADR-0049). A double that spells '
+            + 'it teaches a shape no producer ever had, and is the seed the next copy-paste grows from (#5674).',
+        ).toEqual([]);
+    });
+});

From d51adee9f83bfae4f2030bfadb7ea3c0f17ed28a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 6 Aug 2026 05:35:25 +0000
Subject: [PATCH 4/4] =?UTF-8?q?test(rest):=20pin=20=E6=98=BE=E5=BC=8F?=
 =?UTF-8?q?=E6=8E=92=E9=99=A4=E8=87=AA=E8=BA=AB,=E4=B8=8D=E5=86=8D?=
 =?UTF-8?q?=E9=9D=A0=20docblock=20=E7=9A=84=20`*=20`=20=E5=89=8D=E7=BC=80?=
 =?UTF-8?q?=E4=BE=A5=E5=B9=B8=E8=BF=87=E5=85=B3=20(#5674)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

自查发现的自身缺陷:pin 扫描目录下所有 `*.test.ts`,**包括它自己** —— 而它的
docblock 为了说明问题,原样引用了带 `endpoints:` 的坏替身。它之所以没红,只是
因为 docblock 行把键前缀成了 `* `,而 `[{,]\s*` 这个 lead-in 不接受 `*`。也就是说
这条钉子的绿是由注释排版决定的:重排一次 docblock,它就会在自己的散文上失败。

改为显式排除自身文件名,并把理由写在常量旁边。同时把 anti-vacuity 注释里的
计数改成排除自身后的实测值:27 处 / 26 个文件(#5674 翻正的 26 处,加上
`rest-route-ledger.conformance.test.ts` —— 它 resolve 成裸 `{}`,从来没拼过退役键,
正是「只断言否定面」让它不受影响)。

反向验证(RED,事前预测)在两种拼法上都复验过:
- `rest-batch-size-cap.test.ts` 改回 `endpoints: { data: … }` → 点名该文件;
- `rest-dropped-fields.test.ts` 改回 `endpoints: {}` → 点名该文件。
两次改回后均转绿。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DWUR56YsttL5sTF72Q75TQ
---
 .../src/discovery-double-retired-key.test.ts  | 20 ++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/packages/rest/src/discovery-double-retired-key.test.ts b/packages/rest/src/discovery-double-retired-key.test.ts
index 134b519f43..7feed183bc 100644
--- a/packages/rest/src/discovery-double-retired-key.test.ts
+++ b/packages/rest/src/discovery-double-retired-key.test.ts
@@ -55,6 +55,18 @@ import { fileURLToPath } from 'node:url';
 
 const SRC_DIR = fileURLToPath(new URL('.', import.meta.url));
 
+/**
+ * This file is excluded from its own scan, EXPLICITLY.
+ *
+ * The docblock above quotes the defective double verbatim — that is the point
+ * of it — so the scanner does match a "double" here. It happens to escape the
+ * key check only because a docblock line prefixes the key with `* `, which the
+ * `[{,]\s*` lead-in does not accept. Depending on that is depending on comment
+ * formatting: re-wrap the docblock and this pin fails on its own prose. Name
+ * the exclusion instead of inheriting the luck.
+ */
+const SELF = 'discovery-double-retired-key.test.ts';
+
 /** Matches an `endpoints` key at the start of a line or after `{` / `,`. */
 const ENDPOINTS_KEY = /(^|[{,])\s*endpoints\s*:/;
 
@@ -94,13 +106,15 @@ function collectDoubles(file: string, source: string): Double[] {
 }
 
 const DOUBLES: Double[] = readdirSync(SRC_DIR)
-    .filter((f) => f.endsWith('.test.ts'))
+    .filter((f) => f.endsWith('.test.ts') && f !== SELF)
     .flatMap((f) => collectDoubles(f, readFileSync(join(SRC_DIR, f), 'utf8')));
 
 describe('[#5674] getDiscovery doubles carry the producer key, not the retired one', () => {
     it('finds the doubles it claims to police (anti-vacuity)', () => {
-        // 26 doubles across 25 files when this pin was written. The floor is
-        // deliberately slack — it exists so a scanner that matches NOTHING
+        // 27 doubles across 26 files when this pin was written (the 26 #5674
+        // corrected, plus `rest-route-ledger.conformance.test.ts`, which
+        // resolves to a bare `{}` and never spelled the retired key). The floor
+        // is deliberately slack — it exists so a scanner that matches NOTHING
         // fails instead of reporting a clean sweep of an empty set.
         expect(
             DOUBLES.length,