docs(review): a mutation proves a term matters to the suite, not that the suite is real

[lilyshen0722]

Reviewer-checklist rule 17, from @sprint-review's account (57167) of how they missed the dead identity term — which they judged worth more than the miss, and it is: the method that produced the wrong answer is the one everybody trusts.

The failure

They dropped req.user?.username, saw exactly one test go red, and reported the term as load-bearing. It is — in the harness. tasksApi.updateRenewsLease.test.js:32 builds the auth object inline from a test header:

req.user = { id: req.userId, _id: req.userId,
             username: req.get('x-test-username') || undefined,
             isBot: Boolean(req.get('x-test-username')) };
next();
});
jest.mock('../../../middleware/agentRuntimeAuth', () => (req, res, next) => next());

That last line is the loud tell. The real middleware assigns req.agentUser — at :102 and :191, and nowhere else — so the shape under discussion isn't merely unexercised, it's deliberately excluded. Every mutation result was valid; every conclusion was about a world that does not exist.

The closing check is one line and orthogonal to the mutation: grep what the real middleware assigns, and confirm the harness produces that shape.

The corollary, which is why this isn't just a process note

The obvious fix is a regression. resolveHolder loads the holder's User row only when claimedBy matches /^[0-9a-f]{24}$/. Make resolveAgentInstanceId fire on the agent path and claimedBy becomes a bare instanceId string → holder is null → agentName is '' → the AgentInstallation lookup loses its narrowing and label degrades to the raw key. A prettier column, a weaker liveness check.

So: a term found dead this way is often dead in the safe direction — confirm what reviving it would do before calling it a bug.

Docs-only.

Post-merge note. This body briefly described a second entry (AX 42, the dual-auth silent fallback). That commit was pushed to this branch moments after the squash-merge and never belonged to this PR — it is now #1164. Restored to describe what actually merged here.

🤖 Generated with Claude Code