🐛 Sighting (T351 review, 2026-08-28 — pre-existing, not introduced by the diff)
With Admin:Enabled=false, GET /api/announcements/token answers 405, not 404. Routing's method-not-allowed endpoint carries no AdminSurfaceAttribute metadata, so SurfaceGateMiddleware (src/GenWave.Host/Api/SurfaceGateMiddleware.cs) passes it through — the path's existence (and its allowed methods, via the Allow header) leaks on a box whose admin plane is supposed to "not exist" (F61.2). Any admin-surface route hit with a method it doesn't map reproduces it.
🔧 Fix shape
Treat the framework's method-not-allowed / diagnostic endpoints the way FrameworkDiagnosticEndpointAuthorizationHandler already does for its class: when the matched route's candidates are all admin-surface and the admin plane is off, answer 404. Pin with a Story166-style fact: GET /api/announcements/token → 404 with admin off (and 405 with admin on, unchanged).
Refs: F61.2 (the kill switch), T351 / SPEC F145.6 (the one deliberate carve-out), Story166_AdminKillSwitch.
🐛 Sighting (T351 review, 2026-08-28 — pre-existing, not introduced by the diff)
With
Admin:Enabled=false,GET /api/announcements/tokenanswers 405, not 404. Routing's method-not-allowed endpoint carries noAdminSurfaceAttributemetadata, soSurfaceGateMiddleware(src/GenWave.Host/Api/SurfaceGateMiddleware.cs) passes it through — the path's existence (and its allowed methods, via theAllowheader) leaks on a box whose admin plane is supposed to "not exist" (F61.2). Any admin-surface route hit with a method it doesn't map reproduces it.🔧 Fix shape
Treat the framework's method-not-allowed / diagnostic endpoints the way
FrameworkDiagnosticEndpointAuthorizationHandleralready does for its class: when the matched route's candidates are all admin-surface and the admin plane is off, answer 404. Pin with a Story166-style fact:GET /api/announcements/token→ 404 with admin off (and 405 with admin on, unchanged).Refs: F61.2 (the kill switch), T351 / SPEC F145.6 (the one deliberate carve-out), Story166_AdminKillSwitch.