feat(suppress): pic suppress ls --app + dangling-suppress warning (§11 tail S4)

Visibility + typo guard.

- `pic suppress ls --app <a>` — read-only (kind, reference):
  ApplyService::suppression_report(App) → GET /apps/{id}/suppressions
  (viewer-tier AppRead), client + cmd + main.rs wiring.
- Dangling-suppress warning: at apply, a suppress reference that matches no
  inherited template on the app's chain (no ancestor-group trigger bound to
  that script name / no ancestor-group route at that path) emits an
  ApplyReport warning — the suppression silently does nothing otherwise.
  Soft (never fails the apply), reusing the existing warnings channel.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/src/apply_api.rs

@@ -18,8 +18,8 @@ use serde_json::json;
 use crate::app_repo::AppRepository;
 use crate::apply_service::{
     ApplyError, ApplyOwner, ApplyReport, ApplyService, Bundle, BundleTrigger, CollectionInfo,
-    ExtensionPointInfo, NodeKind, PlanResult, RouteTemplateInfo, TreeBundle, TreePlanResult,
-    TriggerTemplateInfo,
+    ExtensionPointInfo, NodeKind, PlanResult, RouteTemplateInfo, SuppressionInfo, TreeBundle,
+    TreePlanResult, TriggerTemplateInfo,
 };
 use crate::authz::{require, AuthzDenied, Capability};
 use crate::group_repo::GroupRepository;
@@ -44,9 +44,26 @@ pub fn apply_router(service: ApplyService) -> Router {
         .route("/groups/{id}/collections", get(group_collections_handler))
         .route("/groups/{id}/triggers", get(group_triggers_handler))
         .route("/groups/{id}/routes", get(group_routes_handler))
+        .route("/apps/{id}/suppressions", get(app_suppressions_handler))
         .with_state(service)
 }
 
+/// Read-only §11 tail suppression report for an app: the inherited templates it
+/// declines (`target_kind`, `reference`). Viewer-tier `AppRead`. Backs
+/// `pic suppress ls --app`.
+async fn app_suppressions_handler(
+    State(svc): State<ApplyService>,
+    Extension(principal): Extension<Principal>,
+    Path(id_or_slug): Path<String>,
+) -> Result<Json<Vec<SuppressionInfo>>, ApplyError> {
+    let app_id = resolve_app_id(svc.apps.as_ref(), &id_or_slug).await?;
+    require(svc.authz.as_ref(), &principal, Capability::AppRead(app_id))
+        .await
+        .map_err(map_authz)?;
+    let report = svc.suppression_report(ApplyOwner::App(app_id)).await?;
+    Ok(Json(report))
+}
+
 /// Read-only §11 tail route-template report for a group: its own declared route
 /// templates (method, host, path, handler script, dispatch, enabled). Viewer-
 /// tier read. Backs `pic routes ls --group`.

crates/manager-core/src/apply_service.rs

@@ -41,6 +41,7 @@ use sqlx::PgPool;
 use crate::app_domain_repo::AppDomainRepository;
 use crate::app_repo::AppRepository;
 use crate::authz::AuthzRepo;
+use crate::config_resolver::CHAIN_LEVELS_CTE;
 use crate::repo::{
     delete_script_tx, insert_script_tx, update_script_tx, NewScript, ScriptPatch, ScriptRepository,
     ScriptRepositoryError,
@@ -475,6 +476,15 @@ pub struct CollectionInfo {
     pub kind: String,
 }
 
+/// One row of the read-only §11 tail suppression report (`pic suppress ls
+/// --app`). `target_kind` is `trigger` | `route`; `reference` is the handler
+/// script name (trigger) or path (route) the app declines.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SuppressionInfo {
+    pub target_kind: String,
+    pub reference: String,
+}
+
 /// One row of the read-only §11 tail trigger-template report (`pic triggers ls
 /// --group`). `target` is the kind-specific identity bit (collection glob or
 /// topic pattern); `script` is the handler script's name.
@@ -1220,10 +1230,15 @@ impl ApplyService {
         // A group endpoint is reached by *inheritance* (a descendant app binds
         // it by name), never by its own route, so the "no route/trigger"
         // warning is noise for every group script — emit it for apps only.
-        if matches!(owner, ApplyOwner::App(_)) {
+        if let ApplyOwner::App(app_id) = owner {
             report
                 .warnings
                 .extend(unreachable_endpoint_warnings(bundle));
+            // §11 tail: a suppress reference that matches no inherited template
+            // silently does nothing — warn (typo guard), don't fail.
+            report
+                .warnings
+                .extend(self.dangling_suppress_warnings(app_id, bundle).await?);
         }
 
         self.reconcile_node_tx(
@@ -2064,6 +2079,87 @@ impl ApplyService {
             .collect())
     }
 
+    /// §11 tail typo guard: a suppress reference that matches **no** inherited
+    /// template on the app's chain does nothing — return a warning for each such
+    /// dangling reference (soft; never fails the apply). Trigger refs match an
+    /// ancestor-group trigger's handler script name (case-insensitive); route
+    /// refs match an ancestor-group route's path.
+    async fn dangling_suppress_warnings(
+        &self,
+        app_id: AppId,
+        bundle: &Bundle,
+    ) -> Result<Vec<String>, ApplyError> {
+        if bundle.suppress_triggers.is_empty() && bundle.suppress_routes.is_empty() {
+            return Ok(Vec::new());
+        }
+        // Inherited (ancestor-group) trigger handler names + route paths.
+        let trig_names: Vec<(String,)> = sqlx::query_as(&format!(
+            "{CHAIN_LEVELS_CTE} \
+             SELECT DISTINCT LOWER(s.name) FROM triggers t \
+             JOIN scripts s ON s.id = t.script_id \
+             JOIN chain c ON t.group_id = c.group_owner \
+             WHERE t.group_id IS NOT NULL",
+        ))
+        .bind(app_id.into_inner())
+        .fetch_all(&self.pool)
+        .await
+        .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        let inherited_handlers: HashSet<String> = trig_names.into_iter().map(|(n,)| n).collect();
+
+        let route_paths: Vec<(String,)> = sqlx::query_as(&format!(
+            "{CHAIN_LEVELS_CTE} \
+             SELECT DISTINCT r.path FROM routes r \
+             JOIN chain c ON r.group_id = c.group_owner \
+             WHERE r.group_id IS NOT NULL",
+        ))
+        .bind(app_id.into_inner())
+        .fetch_all(&self.pool)
+        .await
+        .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        let inherited_paths: HashSet<String> = route_paths.into_iter().map(|(p,)| p).collect();
+
+        let mut out = Vec::new();
+        for r in &bundle.suppress_triggers {
+            if !inherited_handlers.contains(&r.to_lowercase()) {
+                out.push(format!(
+                    "suppress: no inherited trigger bound to script `{r}` — the \
+                     suppression has no effect"
+                ));
+            }
+        }
+        for r in &bundle.suppress_routes {
+            if !inherited_paths.contains(r) {
+                out.push(format!(
+                    "suppress: no inherited route at path `{r}` — the \
+                     suppression has no effect"
+                ));
+            }
+        }
+        Ok(out)
+    }
+
+    /// Read-only §11 tail report: an app's own suppression markers (the
+    /// inherited templates it declines). Group owner → empty (groups don't
+    /// suppress). Backs `pic suppress ls --app`.
+    pub async fn suppression_report(
+        &self,
+        owner: ApplyOwner,
+    ) -> Result<Vec<SuppressionInfo>, ApplyError> {
+        let ApplyOwner::App(app_id) = owner else {
+            return Ok(Vec::new());
+        };
+        let rows = crate::suppression_repo::list_for_app(&self.pool, app_id)
+            .await
+            .map_err(|e| ApplyError::Backend(e.to_string()))?;
+        Ok(rows
+            .into_iter()
+            .map(|(target_kind, reference)| SuppressionInfo {
+                target_kind,
+                reference,
+            })
+            .collect())
+    }
+
     /// §5.5 no-provider plan check (app nodes only). Every extension point
     /// visible to the app — declared in this bundle or inherited from an
     /// ancestor — must have a provider: a module of that name the app provides