`testing.guard-derives-population-from-source`: when a guard's scope mirrors an
authoritative source, the mirror needs its own check or it goes stale silently.
`_request_reachable` mirrors two properties of the OpenAPI document, both true
today and guaranteed by nothing:
1. Request bodies are declared inline on the operation. If ASP.NET emits a
`components.requestBodies` bucket and operations `$ref` into it, the seed walk
finds no `#/components/schemas/` name at all and every schema behind that
shared body drops out of the population — silently, with the guard still green.
2. Every `$ref` points into `#/components/schemas/`. `_schema_refs` matches that
prefix, so a ref into any other bucket is invisible to it.
Both are now asserted, with a failure message that says what to fix rather than
just that a fact changed. Neither was asserted anywhere else, so a change in the
emitter would have shrunk this guard's reach without failing anything — the
"complete within a scope that has silently gone stale" case.
880 passed, 2 skipped.
timothy
f878831e8f