docs: converge #689 exchange locked-reader authority

[seonghobae]

Documentation authority gap

Protected #689 source is merged at GitHub-verified main@620b29fae9a5dad5d463aff83dd6adb6b67f9305, but canonical CHANGELOG/product-gap authority did not record the locked/non-stream-readable public /exchange request-body reader-acquisition repair.

Test-first RED

Test-only exact f43269b9dd9409e7ad2f06fa6dd66d9134266b6a requires canonical documentation to retain #689 source exact b838c352a7cd0f7f58a905857537a3a9675a56f2, protected merge 620b29fa..., stable 400 / ERR_VALIDATION_INPUT / unreadable behavior before credential egress, immutable-release separation, and existing foreign-owner authority boundaries. Hosted application CI 34713414109 passed checkout, exact-head verification, toolchain, live-base/lockfile controls, install and typecheck, then failed at release tests as intended.

Repair findings

The first documentation repair introduced two unrelated historical CHANGELOG wording drifts (#650 unit spelling and an older undici audit sentence); both were restored so base→head CHANGELOG is now exactly +1/-0 for #689.

A later exact 284407d8d7952dd2e80caa22e432d14772662624 failed hosted application CI 34713989253 at release tests because the baseline rewrote the protected existing contract Dated protected observation for this repair는 \main@`into a differentprotected mainsentence. Existing executable documentation tests correctly rejected that authority drift. Final exactab934fcrestores the canonicalmain@...sentence and retains the separateprotected main` wording required by the new #689 contract.

Exact-head GREEN

Final exact ab934fc35928ca3ec82ac3a79851dc5eedf3a45a changes only CHANGELOG.md, docs/product-technical-gap-baseline.md, and the executable documentation contract. Runtime source is unchanged. Base→head is CHANGELOG +1/-0, baseline +5/-3, and one 37-line test.

On this unchanged exact, application CI 34714192986, reviewer-ci 34714193045, required Security Scan 34714193023, and patch-validator-image 34714193028 are terminal SUCCESS. Reviewer-ci retained the 100% line+branch and docstring gates and real no-network CodeGraph sandbox; patch-validator verified exact source/image, non-root read-only no-network smoke, SBOM and vulnerability receipts.

The documentation records the existing 8,192-byte/10-second/media-type/JSON/cancellation/reader-lock semantics, the locked-reader 400 / ERR_VALIDATION_INPUT / unreadable contract before credential egress, and explicitly keeps provider/model routing, destination/outbound policy, credential, quarantine/security, release/deployment, and foreign-domain authority with their existing owners. Source integration is not promoted to immutable release, production deployment, recovery rehearsal, or deployed p95/heap evidence.

[coderabbitai]

Warning

Review limit reached

Next included review available in 36 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8b468b90-b4ac-4019-883f-ad306278ef94

📥 Commits

Reviewing files that changed from the base of the PR and between 620b29f and ab934fc.

📒 Files selected for processing (3)

• CHANGELOG.md
• docs/product-technical-gap-baseline.md
• test/documentation-exchange-locked-reader-current.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[seonghobae]

Exact-head review on ab934fc35928ca3ec82ac3a79851dc5eedf3a45a: verified the three-file diff is limited to #689 documentation authority plus its executable regression. The earlier unrelated CHANGELOG drift is absent, the existing canonical Dated protected observation ... main@<sha> contract is preserved, and the new protected-main/source lineage is recorded without promoting source integration to immutable release/deployment/recovery/performance evidence or importing foreign-owner authority. Application CI 34714192986, reviewer-ci 34714193045, required Security Scan 34714193023, and patch-validator-image 34714193028 are terminal SUCCESS on this exact head; reviewer-ci retained 100% line+branch/docstring gates and the real no-network CodeGraph sandbox. No unresolved inline threads exist. CodeRabbit was requested on the exact diff but is rate-limited for 36 minutes; that unavailability is not treated as approval. COMMENT only; no self-approval.

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Exact-head review on ab934fc35928ca3ec82ac3a79851dc5eedf3a45a: independently reviewed the three-file documentation-only diff against merged #689 source authority. No actionable repair finding remains. The four required workflows are terminal SUCCESS on this exact head, review threads are empty, and CodeRabbit's rate-limit notice is not being treated as approval. The diff preserves the main@620b29fa... dated authority, records #689 source/merge lineage and stable 400/ERR_VALIDATION_INPUT/unreadable contract before credential egress, and keeps immutable release plus foreign-owner authorities explicitly separate.