test(rest): the execctx census reads /audit as refusing on its own reading

With the umbrella isolated, /audit now refuses an absent context at its
own authoring-door gate, like /meta/_drafts. The audit door's caller
resolution keeps its catch on the invocation line and adds no prose
mention, so the census's site and mention counts do not move.

Claude-Session: https://claude.ai/code/session_local_1d2a197c-c20e-4e90-9be8-413d4d432289
Co-authored-by: Claude <noreply@anthropic.com>

Author: hotlong

packages/rest/src/execctx-consumer-census.test.ts

@@ -542,7 +542,7 @@ describe('[#13160] §4 the 20 locally-caught sites — the half with no shared f
         }
     }, 180_000);
 
-    it('⭐ with the umbrella ISOLATED, six of the inner sites do NOT refuse on their own reading', async () => {
+    it('⭐ with the umbrella ISOLATED, four of the inner sites do NOT refuse on their own reading', async () => {
         // ⛔ Counterfactual, not a production posture — production mounts the
         // umbrella, and section 4's first case measures that it refuses. What
         // this separates is DOUBLE-guarded from SINGLE-guarded: an absent
@@ -560,12 +560,16 @@ describe('[#13160] §4 the 20 locally-caught sites — the half with no shared f
             'DELETE /api/v1/meta/:type/:name',
             'POST /api/v1/meta/:type/:name/publish',
             'POST /api/v1/meta/:type/:name/rollback',
+            // [#20441] An authoring door now, like `_drafts`: the authoring
+            // capability is asked at its head, so an absent context is refused
+            // there even with the umbrella isolated. It moved from the list
+            // below, whose length the title states.
+            'GET /api/v1/meta/:type/:name/audit',
         ];
         const SERVES_ON_ITS_OWN = [
             'GET /api/v1/meta/:type',                      // list — org scope only
             'GET /api/v1/meta/:type/:name',                // item read — org scope only
             'GET /api/v1/meta/:type/:name/layers',
-            'GET /api/v1/meta/:type/:name/audit',
             'GET /api/v1/meta/:type/:name/published',
         ];
 

packages/rest/src/rest-server.ts

@@ -7605,8 +7605,7 @@ export class RestServer {
                     //
                     // `auditCtx` is this door's one caller resolution; the org
                     // scope below reads the same value.
-                    const auditCtx = await this.resolveExecCtx(environmentId, req)
-                        .catch(rethrowAuthzStoreUnavailable);
+                    const auditCtx = await this.resolveExecCtx(environmentId, req).catch(rethrowAuthzStoreUnavailable);
                     if (refuseNonAuthoringCaller(auditCtx, res, 'Reading a metadata item\'s audit trail')) return;
                     const p = await this.resolveProtocol(environmentId, req);
                     if (typeof p.auditMetaItem !== 'function') {
@@ -7719,8 +7718,7 @@ export class RestServer {
                     // read on the two lines that need it.
                     //
                     // `auditCtx` is the caller resolved at the head of this door
-                    // (#20441), not a second resolution — `resolveExecCtx` is
-                    // memoised per request (WeakMap keyed by `req`) anyway.
+                    // (#20441), not a second resolution.
                     //
                     // The `(p as any)` casts this door carried came off when
                     // `MetadataProtocol` declared `auditMetaItem` (the #11006