test(spec): app graduated to strict mid-review (#4165) — the coverage gate did its job

Merge origin/main and record the first live graduation: #4165 made the app
shell strict while this PR was in CI. The derivation adapted on its own — app
fell out of the lintable set because its parse is now loud — and the pinned
expectation list is what turned that shrink into a red test instead of a silent
one. That is the exact scenario the pin exists for: a human confirms the shrink
is a graduation, not a regression, and moves the name from the covered list to
the strict list.

Changeset and docs updated to stop hardcoding the count and the strict roster —
both now describe the rule (the strict bucket grows as tiers graduate) rather
than a snapshot of it.

7133 tests green on the merged base; all six gates PASS; the three example apps
stay clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UXGj3Z5TmwSV6RK2oGc3cb

Author: claude

.changeset/authoring-key-lint-full-coverage.md

@@ -6,15 +6,16 @@ feat(spec): the unknown-authoring-key lint covers every metadata collection, not
 
 #4148 introduced the lint for `object` and `field` — the two surfaces #4120
 caught real drift on. Those two were a sample, not the population: of the
-authorable metadata types, only four are `.strict()` (`flow` / `permission` /
-`position` / `tool`, the #4001 Tier-A set). Every other type strips an
+authorable metadata types, only a handful are `.strict()` (`flow` / `permission`
+/ `position` / `tool` from #4001 Tier-A, joined mid-review by `app` via #4165).
+Every other type strips an
 undeclared key exactly the way `field` did — an author who misspells a key on a
 `page`, an `agent` or a `dashboard` got the same parse-clean-value-gone silence,
 with no lint watching.
 
-`lintUnknownAuthoringKeys` now walks **every metadata collection** — 17 of them
-today: object, app, page, dashboard, report, dataset, action, job, agent, skill,
-hook, mapping, datasource, view, email_template, doc, book — and its coverage is
+`lintUnknownAuthoringKeys` now walks **every metadata collection** — 16 today:
+object, page, dashboard, report, dataset, action, job, agent, skill, hook,
+mapping, datasource, view, email_template, doc, book — and its coverage is
 **derived, not listed**: which collections exist comes from `PLURAL_TO_SINGULAR`
 (the same boundary map the normalizer uses), which schema judges each comes from
 the canonical type→Zod registry, and whether linting is even meaningful is read
@@ -27,7 +28,9 @@ The posture rules keep the lint from ever disagreeing with the parse:
 - **strip** (zod default) → lint: the parse drops unknown keys silently, and
   that silence is what gets reported.
 - **strict** → skip: the parse already rejects loudly with the schema's own
-  tombstone guidance; a second, possibly disagreeing voice helps nobody.
+  tombstone guidance; a second, possibly disagreeing voice helps nobody. This
+  bucket GROWS as #4001 tiers graduate schemas — `app` graduated (#4165) while
+  this change was in review, and the derivation adapted without an edit.
 - **passthrough** → skip: unknown keys survive the parse, nothing is dropped.
 - **unions** (`view`) → the union of member keys; lintable only when a member
   strips and none passes unknowns through.

content/docs/deployment/validating-metadata.mdx

@@ -211,10 +211,11 @@ another package defines.
 
 ### 9. Authoring keys the schema never declared
 
-Most metadata schemas are deliberately not strict — of the authorable types,
-only `flow`, `permission`, `position` and `tool` reject unknown keys. On every
-other type a key the schema does not declare **parses clean and is dropped** on
-the way to storage. Nothing fails; the setting simply is not there.
+Most metadata schemas are deliberately not strict — only the types the
+ADR-0049 tier programme has hardened (`flow`, `permission`, `position`, `tool`,
+`app`, …) reject unknown keys. On every other type a key the schema does not
+declare **parses clean and is dropped** on the way to storage. Nothing fails;
+the setting simply is not there.
 
 ```ts
 fields: {

packages/spec/src/kernel/metadata-authoring-lint.test.ts

@@ -31,13 +31,18 @@ describe('coverage derivation (#3786 — no third hand-written list)', () => {
     // `view` matters doubly: it is a UNION (container | ViewItem | overlay), so
     // its presence pins the union half of the posture logic — a regression that
     // silently dropped unions would shrink coverage without failing the count.
-    for (const expected of ['object', 'page', 'app', 'agent', 'dashboard', 'action', 'report', 'hook', 'view']) {
+    for (const expected of ['object', 'page', 'agent', 'dashboard', 'action', 'report', 'hook', 'view']) {
       expect(lintableTypes, `expected '${expected}' to be lint-covered`).toContain(expected);
     }
   });
 
-  it('excludes the strict Tier-A types — the parse is already loud there', () => {
-    for (const strict of ['flow', 'permission', 'position', 'tool']) {
+  it('excludes the strict types — the parse is already loud there', () => {
+    // This list GROWS as the #4001 tier programme hardens schemas, and each
+    // graduation shrinks the lint's coverage by design — the parse takes over.
+    // `app` graduated mid-flight (#4165) while this very test was in review:
+    // the derivation adapted on its own, and the pinned expectation above is
+    // what forced a human to confirm the shrink was a graduation, not a bug.
+    for (const strict of ['flow', 'permission', 'position', 'tool', 'app']) {
       expect(lintableTypes, `'${strict}' is .strict(); the lint must not double-report`).not.toContain(strict);
     }
   });