docs(spec): apply merged change-spec blocks that never reached the canonical pages

[antstanley]

Note

Stacked PR 1 of 16 — part of stack #35, which targets main.
Base: main · Followed by: #23

This PR's diff shows only its own change. Merge the stack bottom-up; do not merge this before its base.

Why it sits at position 1: Foundation. Corrects the canonical pages to describe shipped code; every spec above is written against the post-#29 text.

Scope of this PR

This PR currently carries the change spec. It will also carry the implementation plan and the build work for that spec — plan and code land as later commits on this same branch, so the spec, its plan, and its implementation review and merge as one unit.

Review order within the PR: spec first, then plan, then implementation.

---

Applies the Proposed changes blocks from four change specs that were flipped to Merged and moved to changes/merged/ without their blocks ever reaching the canonical pages.

The gap. Change specs drafted on 2026-08-05 kept tripping over the same thing: the code shipped, the change spec is marked Merged, its plan is marked Done — but step 1 of its own merge plan ("apply each Proposed changes block to its canonical page") never happened. The canonical pages have been describing a state the code left behind. That is exactly the failure mode .specs/README.md warns about, since each page is supposed to describe what exists in the current branch.

Merged change spec	Blocks never applied
2026-07-01-complete_config_loading.md	06-configuration.md Loading order + Validation at load + [internal_api]; 04-http-api.md Bootstrap step 2, Routes → Internal, Service roles, Middleware stack; 01-ffi-core.md Responsibilities
2026-07-01-implement_lambda_runtime.md	06-configuration.md [server] base_path; 04-http-api.md Bootstrap step 6
2026-07-01-enforce_user_lifecycle_transitions.md	01-domain-model.md User status, Session, Decisions; 03-service-flows.md Admin operations; 04-http-api.md Routes → Internal, Error mapping
2026-07-01-wire_audit_event_emission.md	01-domain-model.md Session, Open questions; 03-service-flows.md exchange/refresh/revocation/admin client-context + audit-event paragraphs, Open questions; 04-http-api.md Middleware stack; 06-configuration.md [audit] + Defaults summary; 07-telemetry-and-audit.md Audit

The fourth was found while drafting the secret-leakage spec (#31) and is included here rather than in a separate PR — same defect class, same files, and splitting it would guarantee conflicts. None of the four had any of its blocks applied; each was fully unapplied, not partially.

Every claim was verified against the code before being written, not copied from the proposal:

• AppConfig::validate — crates/core/src/config.rs:45
• placeholder resolution + env overrides — crates/server/src/bootstrap.rs:108-116
• internal_api.enabled mount gate — crates/server/src/bootstrap.rs:339
• base_path strip layer — crates/server/src/bootstrap.rs:362, ServerConfig::base_path at config.rs:149
• Error::NotFound → 404 not_found — crates/core/src/error.rs:31, crates/server/src/error.rs:120
• lifecycle transition validation, revoke-on-status-change, same-status no-op, terminal Deleted — crates/core/src/service/user_admin.rs:48-165
• session client context populated at issuance — crates/core/src/service/exchange.rs:308-310
• emit_threshold pre-dispatch filter and its info default — crates/core/src/service/mod.rs:102-110, config.rs:210,219
• stdout_audit locked handles → AuditError — crates/adapters/src/stdout_audit/mod.rs:49,51,63
• sqs_audit FIFO message_group_id / dedup id — crates/adapters/src/sqs_audit/mod.rs:60-63
• admin mutation audit events incl. claims operation detail — crates/core/src/service/user_admin.rs:26,120,122,165,300-312

One correction to the original proposals. complete_config_loading listed only the two token TTLs under Validation at load; the shipped validate() also validates server.request_timeout. The page documents what shipped.

One thing deliberately not claimed. bootstrap::parse_config does call validate(), so the FFI validation sentence is accurate — but it does not resolve ${VAR} placeholders or apply env overrides. Nothing here implies it does; that gap is the subject of #23.

Two open questions resolved (both were already answered by shipped code): the Session.device_id/user_agent/ip_address wiring in 01-domain-model.md, and the Unauthorized vs UserSuspended rejection-branch question in 03-service-flows.md.

Interaction with the open spec PRs. No file overlap — #18–#27, #30 and #31 only add files under .specs/changes/, and #28 only touches .specs/README.md. This PR touches only canonical pages, so it merges independently in any order. It does complete merge-plan step 1 that #23 and #25 both call for, which shortens their eventual merge.

Spec pages only — no source changes, no change-spec files touched.