M1 — codex audit closeout: docs alias cleanup + experimental auth routes

Closes the last residual P1 items from the codex ecosystem audit (first
+ second tanda). The deeper P2/P3 work was closed in commits F–K and the
G4 contract tests landed in 94ef90f; this is the final paperwork.

- `App.Permissions` → `App.perm`, `App.Connections` → `App.connections`,
  `App.Session` → `App.session` across every doc surface (orca README,
  connection DESIGN_CONN.md, active-app docs nav.ts comment). The
  capitalised core (`App.Logger`, `App.Bus`, `App.Timers`, `App.Orca`)
  is kept by design — those are the "always present" core members,
  distinct from declared services. The audit's complaint targeted the
  service references that were still capitalised post-rename.
- `AUTH_ROUTE_PATHS` split: the constant now lists ONLY routes the
  built-in auth handler (`createAuthHttpHandlers`) actually dispatches
  (current/csrf/sign-up/sign-in/sign-out/email-verify/password-reset/
  devices). OAuth, MFA and WebAuthn paths move to a sibling
  `AUTH_EXPERIMENTAL_ROUTE_PATHS` namespace. This matches the audit's
  recommendation: "completar handlers, o retirar las APIs del cliente
  hasta estar soportadas". Splitting the namespaces makes consumer
  intent explicit instead of letting `ActiveAuth` consumers call URLs
  the dispatcher silently 404s.

No client/server code references the experimental constants today, so
the rename is API-safe — any external consumer reaching for them was
already in unsupported territory.

Suite: 1695 / 1695 passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/arts/connection/DESIGN_CONN.md

@@ -501,7 +501,7 @@ const Connections = App.createActiveConnections<AppConnections>();
 or, once integrated:
 
 ```ts
-App.Connections.connection('main');
+App.connections.connection('main');
 ```
 
 Do **not** put this under:
@@ -1516,7 +1516,7 @@ const Main = Connections.createConnection('main', {
 
 ### 20.2 Why factory on App
 
-Use an App factory, not a generic `App.Connections` baked into `ActiveApp<T>` by default.
+Use an App factory, not a generic `App.connections` baked into `ActiveApp<T>` by default.
 
 Recommended:
 

src/arts/orca/README.md

@@ -230,8 +230,8 @@ Orca.onEvent(APP_EVENT_USER_IDENTITY_CHANGED, {
 - politica de error
 - timers
 
-La accion es la que decide llamar a `App.cache`, `App.Permissions`,
-`App.Connections` o cualquier otro servicio.
+La accion es la que decide llamar a `App.cache`, `App.perm`,
+`App.connections` o cualquier otro servicio.
 
 ## Setup Tipado *(roadmap v2)*
 
@@ -1017,8 +1017,8 @@ App.Orchestration.onEvent(APP_EVENT_USER_IDENTITY_CHANGED, {
 	onError: ORCA_ON_ERROR_ABORT_RUN,
 	action: async (payload) => {
 		await App.cache.clearActorScope(payload.previousActorId);
-		App.Permissions.invalidate();
-		await App.Connections.reauthenticateAll();
+		App.perm.invalidate();
+		await App.connections.reauthenticateAll();
 		return orcaSuccess();
 	}
 });
@@ -1117,7 +1117,7 @@ Orca.onEvent(APP_EVENT_USER_IDENTITY_CHANGED, {
 	provides: [ORCA_TOKEN_PERMISSIONS_INVALIDATED],
 	onError: ORCA_ON_ERROR_ABORT_STAGE,
 	action: async () => {
-		await App.Permissions.invalidate();
+		await App.perm.invalidate();
 		return orcaSuccess({ emits: [ORCA_TOKEN_PERMISSIONS_INVALIDATED] });
 	}
 });
@@ -1129,7 +1129,7 @@ Orca.onEvent(APP_EVENT_USER_IDENTITY_CHANGED, {
 	abortOn: [ORCA_TOKEN_CACHE_ERROR],
 	onError: ORCA_ON_ERROR_CONTINUE,
 	action: async () => {
-		await App.Connections.reauthenticateAll();
+		await App.connections.reauthenticateAll();
 		return orcaSuccess({ emits: [ORCA_TOKEN_CONNECTIONS_REAUTHENTICATED] });
 	}
 });

src/libs/auth/consts.ts

@@ -6,6 +6,11 @@ export const AUTH_AAPP_KEYS = {
 	ACTIVE: 'auth.active'
 } as const;
 
+/**
+ * Routes the built-in auth handler (`createAuthHttpHandlers`) dispatches.
+ * Every entry here has an active server-side path; the public client
+ * (`ActiveAuth`) drives them through this list.
+ */
 export const AUTH_ROUTE_PATHS = {
 	BASE: '/api/auth',
 	CURRENT: '/api/auth/current',
@@ -18,12 +23,28 @@ export const AUTH_ROUTE_PATHS = {
 	EMAIL_VERIFY_COMPLETE: '/api/auth/email/verify/complete',
 	PASSWORD_RESET_REQUEST: '/api/auth/password/reset/request',
 	PASSWORD_RESET_COMPLETE: '/api/auth/password/reset/complete',
+	DEVICES: '/api/auth/devices',
+	DEVICE_REVOKE: '/api/auth/devices/revoke'
+} as const;
+
+/**
+ * Reserved paths for OAuth, MFA and WebAuthn flows. The built-in
+ * handler does NOT dispatch these — engine/server code for them is
+ * either partial or out of scope for the current release. Apps that
+ * implement those flows must wire their own SvelteKit handlers at the
+ * paths declared here so a future built-in handler stays
+ * URL-compatible.
+ *
+ * Marking them experimental, instead of leaving them next to the
+ * supported routes, prevents the situation the codex audit flagged:
+ * `ActiveAuth` consumers calling URLs that silently 404 because the
+ * generic dispatcher never routed them.
+ */
+export const AUTH_EXPERIMENTAL_ROUTE_PATHS = {
 	OAUTH_START: '/api/auth/oauth/start',
 	OAUTH_CALLBACK: '/api/auth/oauth/callback',
 	MFA_CHALLENGE: '/api/auth/mfa/challenge',
 	MFA_VERIFY: '/api/auth/mfa/verify',
-	DEVICES: '/api/auth/devices',
-	DEVICE_REVOKE: '/api/auth/devices/revoke',
 	WEBAUTHN_REGISTER_OPTIONS: '/api/auth/webauthn/register/options',
 	WEBAUTHN_REGISTER_VERIFY: '/api/auth/webauthn/register/verify',
 	WEBAUTHN_AUTH_OPTIONS: '/api/auth/webauthn/auth/options',

src/web/routes/active/_data/nav.ts

@@ -3,7 +3,7 @@
  * Single source of truth for the left rail and breadcrumbs.
  *
  * `label` is the public name a developer sees in the API
- * (`App.Session`, `App.storage`, …). `alias` is the path-alias
+ * (`App.session`, `App.storage`, …). `alias` is the path-alias
  * used to import the artifact (`$session`, `$storage`, …) and matches
  * the folder name under `src/arts/`.
  */