@@ -253,11 +253,10 @@ jobs:
         if: env.FRESHNESS == 'checked'
         run: make audit-1to1-params
       # Every route the live record mounts, held to an action that sends it
-      # or a reason none does. The findings are a report until the triage
-      # adjudicates them; it fails on a declaration that no longer describes
-      # the tree. It reads the request record the derivation commits, so it
-      # is deferred with R-GRANT.
-      - name: Check the declarations of the routes no action reaches (R-ROUTE)
+      # or a reason none does. It fails on a route nothing answers and on a
+      # declaration that no longer describes the tree. It reads the request
+      # record the derivation commits, so it is deferred with R-GRANT.
+      - name: Check that every live route is reached or answered (R-ROUTE)
         if: env.FRESHNESS == 'checked'
         run: make audit-1to1-routes
       # The Orbit twin of the record above: what GitLab.com's Orbit routes
 
@@ -2011,11 +2011,12 @@ audit-1to1-params-report:
 ## it or a reason none does (R-ROUTE): outside the API, a skip reason the closed table
 ## excludes, a slug the caller names, a deprecated /services/ alias, a decision about its
 ## client-go methods that holds without a request, or a family row of
-## cmd/audit_1to1/internal/routes/families.go. Anything else is a finding, reported with
-## the client-go methods that send it. It FAILS on a declaration that no longer describes
-## the tree: a family row that answers no route, another number than it pins, a route
-## another row answers, or that lacks what its category needs; a skip row no route
-## carries, or a reason a route carries that no row holds; a skip exception or a GraphQL
+## cmd/audit_1to1/internal/routes/family_table.go. Anything else is a finding, reported
+## with the client-go methods that send it, and it FAILS on a finding as it does on a
+## declaration that no longer describes the tree: a family row that answers no route,
+## another number than it pins, a route another row answers, or that lacks what its
+## category needs; a skip row no route carries, or a reason a route carries that no row
+## holds; a skip exception or a GraphQL
 ## actions row that answers no route; a slug rule that answers nothing. It reads the
 ## committed request record, the live record and the pinned client-go; CI runs it under
 ## the FRESHNESS deferral with R-GRANT.
 
@@ -18,7 +18,6 @@ import (
 const (
 	coveredGraphQLEpicDsc = "COVERED_GRAPHQL. Epicdiscussions pkg"
 	coveredGraphQLEpicNts = "COVERED_GRAPHQL. Epicnotes pkg"
-	skipBinaryBytes       = "INTENTIONAL_SKIP_BINARY. File bytes"
 	coveredGraphQLEpics   = "COVERED_GRAPHQL. Epics pkg"
 	coveredGenericDeprPrj = "COVERED_GENERIC. Deprecated; project variant"
 )
@@ -111,12 +110,16 @@ func buildReport(root string, gapsOnly bool) (report, error) {
 // method of a client-go service interface, called in place or handed on as a
 // method value, so it misses: RAW REST handlers (client.GL().NewRequest+Do with
 // a path string), GraphQL handlers (ADR-0006), and capabilities covered by a
-// superseding/generic variant. It also can't know which endpoints are
-// INTENTIONALLY not exposed (binary file transfer, CI-job-token self-lookup).
-// Each entry carries a category+rationale. Key = "<Service>.<Method>" (service
-// name without the ServiceInterface suffix). Methods NOT listed here and still
-// uncovered are the genuine new-tool backlog, and an entry whose method a
-// handler reaches is reported as stale.
+// superseding/generic variant. It also can't know which endpoints a personal
+// access token cannot use (a CI job token's self-lookup). Each entry carries
+// a category+rationale. Key = "<Service>.<Method>" (service name without the
+// ServiceInterface suffix). Methods NOT listed here and still uncovered are
+// the genuine new-tool backlog, and an entry whose method a handler reaches
+// is reported as stale. A route no action sends is not settled here: a
+// download, a route another one covers only generically and a deprecated
+// write GitLab still serves are actions to implement, which R-ROUTE tracks,
+// and its gate refuses a tracked route whose method this table decides
+// COVERED_GENERIC or INTENTIONAL_SKIP_*.
 var acceptedMissingMethods = map[string]string{
 	// COVERED_VARIANT — an alternative SDK binding for an endpoint another
 	// covered method already drives; one action per endpoint is the rule.
@@ -164,11 +167,6 @@ var acceptedMissingMethods = map[string]string{
 
 	// COVERED_GENERIC — superseding/generic variant covers the same capability.
 	"MergeRequests.GetMergeRequestApprovals":                      "COVERED_GENERIC. Mrapprovals config/state",
-	"MergeRequests.GetMergeRequestChanges":                        "COVERED_GENERIC. gitlab_mr_changes_get (ListMergeRequestDiffs)",
-	"ProjectMembers.ListProjectMembers":                           "COVERED_GENERIC. gitlab_project_members_list (ListAllProjectMembers)",
-	"Groups.ListGroupMembers":                                     "COVERED_GENERIC. gitlab_group_members_list (ListAllGroupMembers)",
-	"Groups.ListSubGroups":                                        "COVERED_GENERIC. gitlab_subgroups_list (ListDescendantGroups)",
-	"Groups.DeleteGroupLDAPLink":                                  "COVERED_GENERIC. Groupldap ForProvider/WithCNOrFilter variants",
 	"PersonalAccessTokens.RotatePersonalAccessTokenByID":          "COVERED_GENERIC. gitlab_personal_access_token_rotate",
 	"ExternalStatusChecks.CreateExternalStatusCheck":              coveredGenericDeprPrj,
 	"ExternalStatusChecks.DeleteExternalStatusCheck":              coveredGenericDeprPrj,
@@ -177,28 +175,9 @@ var acceptedMissingMethods = map[string]string{
 	"ExternalStatusChecks.SetExternalStatusCheckStatus":           "COVERED_GENERIC. Deprecated; SetProjectMergeRequestExternalStatusCheckStatus",
 	"ExternalStatusChecks.UpdateExternalStatusCheck":              coveredGenericDeprPrj,
 	"ErrorTracking.EnableDisableErrorTracking":                    "COVERED_GENERIC. Deprecated; gitlab_enable_disable_error_tracking",
-	"ErrorTracking.CreateErrorTrackingSettings":                   "COVERED_GENERIC. Same settings resource as UpdateErrorTrackingSettings",
-
-	// INTENTIONAL_SKIP_BINARY — raw file/archive/state bytes, unsuitable for JSON tools.
-	"GroupMarkdownUploads.DownloadGroupMarkdownUploadByID":                    skipBinaryBytes,
-	"GroupMarkdownUploads.DownloadGroupMarkdownUploadBySecretAndFilename":     skipBinaryBytes,
-	"ProjectMarkdownUploads.DownloadProjectMarkdownUploadByID":                skipBinaryBytes,
-	"ProjectMarkdownUploads.DownloadProjectMarkdownUploadBySecretAndFilename": skipBinaryBytes,
-	"GroupRelationsExport.ExportDownload":                                     "INTENTIONAL_SKIP_BINARY. Export archive bytes",
-	"SecureFiles.DownloadSecureFile":                                          "INTENTIONAL_SKIP_BINARY. Secure file bytes",
-	"TerraformStates.Download":                                                "INTENTIONAL_SKIP_BINARY. Tfstate bytes",
-	"TerraformStates.DownloadLatest":                                          "INTENTIONAL_SKIP_BINARY. Tfstate bytes",
-	"Groups.DownloadAvatar":                                                   "INTENTIONAL_SKIP_BINARY. Group avatar image bytes (*bytes.Reader); upload IS exposed",
 
 	// INTENTIONAL_SKIP_OTHER
-	"Jobs.GetJobTokensJob":       "INTENTIONAL_SKIP_OTHER. CI-job-token self-lookup; not usable with a PAT",
-	"Repositories.StreamArchive": "INTENTIONAL_SKIP_OTHER. Streaming dup of Repositories.Archive (gitlab_repository_archive)",
-	// This used to read "COVERED_RAW. gitlab_mr_approval_config", and it was
-	// the paper trail behind twenty phantom output fields: that action calls
-	// the GET at this path and never the POST, but the claim of coverage made
-	// the POST's 24-field response look like the shape the action should
-	// publish. Set approval requirements through the approval rules instead.
-	"MergeRequestApprovals.ChangeApprovalConfiguration": "INTENTIONAL_SKIP_OTHER. Deprecated in GitLab 16.0; approval rules supersede it (gitlab_mr_approval_rule_create/update)",
+	"Jobs.GetJobTokensJob": "INTENTIONAL_SKIP_OTHER. CI-job-token self-lookup; not usable with a PAT",
 }
 
 // AcceptedMissingMethods returns the adjudications acceptedMissingMethods
 
@@ -157,14 +157,30 @@ type Summary struct {
 	SkipReasonsReached []string `json:"skip_reasons_reached"`
 }
 
-// clean reports whether the gate passes: no declaration that no longer
-// describes the tree. A finding is a report, not a failure, until the
-// triage adjudicates them.
-func (s *Summary) clean() bool { return s.Stale == 0 }
+// clean reports whether the gate passes: no route left a finding, of any
+// class findingClasses names, and no declaration that no longer describes
+// the tree. A route no action reaches is answered by a rule, an inherited
+// decision or a family row, so a re-pin that brings one, or an action that
+// stops sending one, fails the gate until the change that causes it decides
+// the route.
+func (s *Summary) clean() bool {
+	counters := s.counters()
+	for class := range findingClasses {
+		if *counters[class] != 0 {
+			return false
+		}
+	}
+	return s.Stale == 0
+}
 
 // count adds one route of class to the summary.
 func (s *Summary) count(class string) {
-	counters := map[string]*int{
+	*s.counters()[class]++
+}
+
+// counters names the counter of each class.
+func (s *Summary) counters() map[string]*int {
+	return map[string]*int{
 		ClassReached:             &s.Reached,
 		ClassOutsideAPI:          &s.OutsideAPI,
 		ClassSkip:                &s.Skipped,
@@ -178,7 +194,6 @@ func (s *Summary) count(class string) {
 		ClassInternalNotExcluded: &s.InternalNotExcluded,
 		ClassContradicted:        &s.Contradicted,
 	}
-	*counters[class]++
 }
 
 // Options is what a run of this scope needs beyond the tree.