docs(spec): re-measure the ./api weight row after the split (replaces the pre-split reading)

Claude-Session: https://claude.ai/code/session_019c3Hi6ZMU1p6m6aA6Bz45d
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/spec/browser-reachable-entries.json

@@ -33,19 +33,19 @@
     "_comment": "Entries measured for WEIGHT and left in `unjudged` on purpose, each with the reading that decided it. `unjudged` is a flat list of subpaths, so a member has nowhere to carry a reason — without this map a deliberate non-promotion and a never-examined entry are the same silence, which is the state #17535 was filed against. ⛔ An entry here is NOT a lesser `browserReachable`: this gate still asserts nothing about it. ⛔ An entry NOT here has not been measured, and its absence says nothing about its weight. ⛔ A reading here is a count plus the tree it was taken against — re-measuring REPLACES a row, it never appends to one.",
     "./api": {
       "verdict": "measured, and stays unjudged",
-      "why": "`browserReachable` is a SCHEMA-FREE PROMISE, not a byte budget. `./api`'s vocabulary IS the zod graph — the symbols a consumer reaches there are request/response schemas — so the promotion #17535 offers is not a threshold anyone can set: declared browser-reachable, this entry reds rule 1 on the same commit. Measured by ablation on f962be9d08: 4 problems, `dist/api/index.mjs` and `dist/api/index.js` each linking 'zod' and the undeclared external 'pg-connection-string'. Promotion would first require the entry to stop linking zod — a redesign of a published export surface, not a ledger edit — and `_unjudgedComment` above already reserves promotion to a maintainer decision plus a passing gate. So the honest record is this one.",
+      "why": "`browserReachable` is a SCHEMA-FREE PROMISE, not a byte budget. `./api`'s vocabulary IS the zod graph — the symbols a consumer reaches there are request/response schemas — so promotion is not a threshold anyone can set: declared browser-reachable, this entry reds rule 1 on the same commit. Re-measured by ablation after the #18576 split, at 5f845af5c4: 2 problems, `dist/api/index.mjs` and `dist/api/index.js` each linking 'zod'. The 'pg-connection-string' link the pre-split ablation (f962be9d08, 4 problems) also found is gone with the split, and `./api` no longer carries a `browser` condition. Promotion would still first require the entry to stop linking zod — a redesign of a published export surface, not a ledger edit — and `_unjudgedComment` above reserves promotion to a maintainer decision plus a passing gate. So the honest record is still this one.",
       "measured": {
-        "what": "the growth #17535 reports, re-derived in isolation: parent 0aa88eb6b0 vs the #17517 merge 9165d5cd4c, both built from source; `./contracts` and `./meta-spelling` measured byte-identical across the pair as controls",
-        "entryBundleRaw": "1433893 -> 1867678 bytes (+433785)",
-        "entryBundleGzip": "418675 -> 546266 bytes (+127591, +30.5%)",
-        "browserBundleOfWholeNamespaceGzip": "273904 -> 330104 bytes (+56200, +20.5%) — this is the axis #17535's +19.4% reproduces on",
-        "sourceGraphInputs": "110 -> 159 (+49) — #17535 reports 188 -> 237, a different absolute base and the same delta",
-        "narrowestRealConsumerImportGzip": "132121 -> 261221 bytes (+129100, +97.7%) — a browser bundle whose ONLY use of this entry is the two string constants `@object-ui/core` re-exports. The narrower the import, the WORSE the ratio: tree-shaking recovers proportionally less of the new graph than of the old one, so the headline percentage understates what the real consumers pay by roughly 5x.",
-        "onMainToday": "f962be9d08: 1914896 raw / 560968 gzip (node condition), 1912968 / 560390 (browser condition), 160 source graph inputs"
+        "what": "the #18576 split (maintainer ruling, letter B: the assembled-package declarations leave `./api` for `./api-assembled`), measured across its own branch: base fc6ddb87a4 vs head 5f845af5c4, both built from source in one worktree; bundles by esbuild 0.28.2, platform browser, conditions browser+import, minified, gzip -9",
+        "entryBundleRaw": "2082098 -> 1597172 bytes (esm)",
+        "entryBundleGzip": "612813 -> 469795 bytes (esm, -23.3%) — one bundle now serves both conditions",
+        "sourceGraphInputs": "171 -> 120 modules (esbuild metafile over src/api/index.ts); stack.zod, the datasource declaration and all nine driver modules are gone from the graph",
+        "narrowestRealConsumerImportGzip": "311124 -> 166529 bytes (-46.5%) — objectui `@object-ui/core` utils/column-sortability.ts bundled AS-IS (its only imports are two string constants and two types from this entry). The same probe on metadata-client.ts's one value import reads 311182 -> 166616 (-46.5%). The dynamic `import()` in app-shell clientValidation.ts pulls the whole namespace and reads 391171 -> 327732 (-16.2%).",
+        "wholeNamespaceGzip": "387421 -> 324465 bytes (-16.3%)",
+        "history": "the growth #17535 reported — parent 0aa88eb6b0 vs the #17517 merge 9165d5cd4c, narrowest consumer 132121 -> 261221 gzip — is the regression this split removes; the gap between 132121 and today's 166529 is the rest of `./api` growing since, not the assembled tree"
       },
-      "objectuiLeg": "MEASURED, and it was the half #17535 could not reach. objectui at dda8f3815d — ⚠️ this session's attached checkout, NOT the pinned `.objectui-sha` 53ded82bf7, which is absent from that shallow clone and was ⛔ not fetched or bumped to take a reading — value-imports `@objectstack/spec/api` from 6 browser-shipped non-test source files: `@object-ui/core` utils/column-sortability.ts, `@object-ui/data-objectstack` metadata-client.ts, `@object-ui/app-shell` views/metadata-admin/clientValidation.ts, `@object-ui/plugin-chatbot` usePendingActions.ts, `@object-ui/react` utils/error-message.ts, `@object-ui/types` data.ts. So the bytes are paid by a real downstream browser consumer, not hypothetically. Control for the scan: `./contracts` reports 9 such files, matching the sites this file's own `browserReachable` entry already names.",
+      "objectuiLeg": "MEASURED at objectui 62597c5880, which IS the pinned `.objectui-sha` (the pre-split reading took dda8f3815d, not the pin). Six browser-shipped non-test files import `@objectstack/spec/api`: three VALUE imports — `@object-ui/core` utils/column-sortability.ts, `@object-ui/data-objectstack` metadata-client.ts, `@object-ui/app-shell` views/metadata-admin/clientValidation.ts (dynamic) — and three type-only ones that cost a bundle nothing — `@object-ui/plugin-chatbot` usePendingActions.ts, `@object-ui/react` utils/error-message.ts, `@object-ui/types` data.ts. None imports a name the split moved, so all six keep resolving from `./api` unchanged; `@object-ui/types` also re-exports this entry as a type-only `API` namespace, and nothing in objectui reads a moved name through it.",
       "cloudLeg": "NOT MEASURED. The `cloud` repo was not attached to the session that took these readings. ⛔ Its absence is not a zero — a reading that did not cover a population vouches only for the part it did cover.",
-      "notAnOutlier": "⚠️ `./api` is one of fifteen unjudged entries and the measurement does NOT single it out. By the same scan, objectui browser-shipped source value-imports twelve of the fifteen, several of them harder than this one: `./ui` 48 files, `./data` 30, `./kernel` 12, against `./api`'s 6; `./kernel` is the heavier bundle (1544209 raw / 457761 gzip on f962be9d08). Only `./marketplace`, `./qa` and `./studio` are at zero. ⛔ This row is therefore a record about `./api` alone and says NOTHING about the other fourteen — it is not a clean bill for them, and their silence is still the untested kind.",
+      "notAnOutlier": "⚠️ `./api` is one of fifteen unjudged entries and the measurement does NOT single it out. By the same scan, objectui browser-shipped source value-imports twelve of the fifteen, several of them harder than this one: `./ui` 48 files, `./data` 30, `./kernel` 12, against `./api`'s 6; `./kernel` is the heavier bundle (1544209 raw / 457761 gzip on f962be9d08). Only `./marketplace`, `./qa` and `./studio` are at zero. ⛔ This row is therefore a record about `./api` alone and says NOTHING about the other fourteen — it is not a clean bill for them, and their silence is still the untested kind. (That scan was taken at f962be9d08 / objectui dda8f3815d and was not re-taken for the split.)",
       "whatWouldChangeThis": "Nothing in this gate has a weight axis for a schema-bearing entry — there is no byte threshold in it, for any entry, judged or not. Giving `./api` one means a NEW rule, which is a different decision from the one this row records and belongs to whoever takes that decision."
     }
   },