docs(test): the guest-leftovers header cites the measured middleware path

[os-sales]

Fixes #1516

test/case-guest-branch-leftovers.test.ts's header still said the plugin-security middleware path was unmeasured, and used that to instruct a reader how to read a failure of the cases below it. The premise had been answered — PR #1515 retired the identical sentence from src/objects/case.hook.ts after measuring the path — and this file was the surviving twin. Located by text (git grep -n "nobody has measured"), one hit, in the header docblock.

Which route this took, stated up front

Route 2 of the card: cite the measurement, do not re-take it. No server was started for this PR and none of the six anonymous routes was replayed. The header says so in its own words — the readings are marked INHERITED from PR #1515 and explicitly "NOT re-run when this paragraph was rewritten" — because a header that reads as a fresh measurement when nobody re-took it is the exact defect this card exists to fix.

The header also points at src/objects/case.hook.ts, which carries the full route table at the branch these cases exercise, rather than keeping a second copy of that table here. One producer, one consumer; a copy is a thing that can drift.

The one reading that WAS taken here is web_to_case's declared field list, read off src/views/case.view.ts on 9f59f6a7: subject, description, type, priority. The header marks that asymmetry explicitly rather than blurring it into the inherited half.

Why the rewrite is per-column

The suggested one-line summary — "every anonymous write route returns 401 except the form submit, which filters against declared fields" — is true, but flattening it into "so a guest does not reach these columns in production" would have been false of one of the two columns this file pins:

column	in web_to_case's declared list?	so, in production
escalation_reason	no	dropped before ObjectQL and before the hook — a guest does not reach it
priority	yes	the form ASKS the guest for it — a guest does reach it, by design

priority is the column item 2 of the file is about, and src/views/case.view.ts says so in its own comment ("this form asks the guest for it"). Writing the reassuring version would have put a false sentence directly above the case that measures the opposite.

What the rewrite deliberately keeps

• The #1133 boundary is untouched — that sentence is carried over verbatim, and nothing here widens or narrows it.
• The original's epistemic care, pointed the same way. These cases call ObjectQL directly with a guest context and make no HTTP request, so a red below is still a statement about the hook branch and nothing else. The old paragraph's instruction survives; only its premise was replaced.
• The nuance from the grading comment. What holds today is the form's declared field list — a product decision, not a security declaration — measured as such in fix(case): a guest submission cannot plant its own satisfaction rating #1515 by widening the form by one field, after which the same anonymous POST stored the planted value. A rewrite saying "measured, REST blocks it, nothing to worry about" would be worse than the stale hedge, and this one says the opposite in as many words.

Verification

pnpm verify (validate && typecheck && lint && lint:i18n-gate && hygiene && hygiene:tokens && build && test) green on the tree that is now f0ee484f:

Test Files  158 passed (158)
     Tests  3309 passed | 1 skipped (3310)
✓ source hygiene clean
✓ source token ratchet clean

The suite is identical before and after, measured rather than asserted. Comment-stripped (via the token ratchet's own stripComments) and blank-stripped, both revisions of the file are 132 lines with the same digest:

sha256 BEFORE = e7cd06ef49c80e610787a26708c7e5dc1cc1009f797af76e2f65b939fa757641
sha256 AFTER  = e7cd06ef49c80e610787a26708c7e5dc1cc1009f797af76e2f65b939fa757641
EXECUTABLE CODE IDENTICAL = true

The target file on its own was green before the edit too (1 passed / 4 tests), and is inside the 158-file run above.

Changeset

.changeset/guest-leftovers-header-cites-the-measurement.md, empty frontmatter — the sanctioned "this PR releases nothing" declaration that .github/workflows/changeset-check.yml documents, on par with the skip-changeset label. Justification: the diff is one docblock in a test file plus this changeset; nothing under src/ moved, so no object, field, view, label, page or hook reaches a user. 68 of the 121 changesets on main use this form for the same reason, so no skip-changeset label is needed or applied.

🤖 Generated with Claude Code

https://claude.ai/code/session_019hUuCQStzXGMFSX4dzww5t

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
hotcrm	Ignored		Sep 3, 2026 8:22am UTC