host: Phase 3 — strangler migration ledger + coverage, 107/107

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plans/host-on-sx.md

@@ -36,8 +36,9 @@ host — no `ocaml-on-sx` dependency.
 
 ## Status (rolling)
 
-`bash lib/host/conformance.sh` → **82/82** (5 suites: handler, middleware, sxtp,
-router, feed). Phases 1 & 2 DONE; Phase 3 (strangler ledger) next.
+`bash lib/host/conformance.sh` → **107/107** (6 suites: handler, middleware, sxtp,
+router, feed, ledger). Phases 1 & 2 DONE; Phase 3 (strangler ledger) underway —
+ledger module landed; `relations` cut-over next.
 
 ## Ground rules
 
@@ -106,9 +107,16 @@ lib/host/sxtp.sx                        subsystem APIs (feed/search/commerce/…
       non-object body -> 400. Created activity is readable back via `GET /feed`.
 
 ## Phase 3 — Strangler migration ledger
-- [ ] enumerate Quart endpoints; track migrated vs proxied
+- [x] enumerate Quart endpoints; track migrated vs proxied — `ledger.sx`: a
+      catalogue of every endpoint (domain, method, path, Quart original, status
+      `:native`/`:migrated`/`:proxied`, SX handler) + queries (by-status/by-domain,
+      `host/ledger-find`, `host/ledger-served?`, distinct domains) and
+      `host/ledger-coverage` (off-Quart % = (migrated+native)/total). Seeded with
+      the live state: feed reads+writes migrated, `/health` native, the
+      internal-only `relations`/`likes` data+action endpoints proxied.
 - [ ] golden-response harness vs the live Quart responses
-- [ ] cut over a whole domain (smallest: `likes` or `relations`) as proof
+- [ ] cut over a whole domain (`relations` — it has a real SX subsystem
+      `lib/relations`; `likes` has none so it stays proxied) as proof
 
 ## Phase 4 — Dream framework layer (gated)
 - [ ] gate: `ocaml-on-sx` Phases 1–5 + minimal stdlib green
@@ -154,6 +162,19 @@ lib/host/sxtp.sx                        subsystem APIs (feed/search/commerce/…
     and stand up a golden-response harness against the live Quart responses. Then
     cut over the smallest whole domain (`likes` or `relations`) as proof.
 
+- **Phase 3 — ledger module (DONE, 107/107).** `lib/host/ledger.sx` + a 25-test
+  suite. Enumerated the endpoint surface via the `rose-ash-services` MCP
+  (`svc_routes`/`svc_queries`/`svc_actions`): `likes` and `relations` have **no
+  public blueprint routes** — they're internal-only, exposed as
+  `/internal/data/{query}` + `/internal/actions/{action}` (HMAC-signed). The
+  ledger is a pure-data catalogue keyed by (domain, method, path) carrying each
+  endpoint's Quart original, status, and serving SX handler; coverage reports the
+  off-Quart percentage. Cut-over target chosen: **`relations`** (already has a real
+  SX subsystem `lib/relations` — children/parents reads + relate/unrelate writes
+  map straight onto its public API); `likes` stays proxied (no SX lib to dispatch
+  to). NEXT: migrate the `relations` read endpoints onto host handlers (flip their
+  ledger status to `:migrated`) with golden tests.
+
 ## Blockers
 
 - **Live wiring to the native OCaml HTTP server** (Phase 3/4): the prod server in