docs(backlog): answer #1107's own question -- three parts shipped, one is owner-blocked

[wshallwshall]

BACKLOG #1107 says DO NOT REBUILD IT and asks one question: is anything left. This answers it by measurement and rebuilds nothing. No code changed; the whole diff is 35 lines appended to the #1107 body.

Answer: three of four parts hold, the fourth is open under an owner ruling

Part	State	Where it shipped
1. apiclient path-segment encoding	complete	#488 at cf38e16a
2. web console path builder + partition	complete	#636 at 829ed98f8, not #488
3. flat FHIR query replaced by structured params	split, half open	Limb A shipped; Limb B blocked
4. positive scheme allow-list	complete	#488 at cf38e16a

The item does not close. Part 3's tracked successor is #1243, which names itself as 1107 clause 3 at its own tail. Limb A landed. Limb B did not, and #1243 carries Closing-act: blocked under an owner ruling of 2026-08-22 pending a real FHIR server. I did not touch it.

What each measurement was

Part 1. The item's own grep INVERTS. grep -cE 'quote\(|urlencode\(' over messagefoundry/apiclient/client.py returns 1 where the research recorded 0, against the same positive control of 7 on messagefoundry/transports/fhir.py in the same run. _seg is at client.py:120 as quote(str(value), safe=""), and a grep for an interpolated path literal NOT carrying _seg returns zero across all 17 sites. The test asserts through httpx.Client.build_request (tests/test_apiclient.py:193) and reads raw_path, never .path -- httpx decodes the latter, so a correct %2F would read back as a bare / and the assertion would pass on broken code. A second test counts the source's interpolated literals against the 17-row site table, so a new endpoint reds rather than slips in.

Part 2. It shipped nine days after #488, in #636 under BACKLOG #1370, and #488 touched no console file. The partition the item demanded WAS done by reading rather than assumed: the #636 commit message tables main's two prior states, and the three sites a blanket builder would break still hold their bare quote() at HEAD (_auth.py:519 for the re-auth next, pages/connections.py:59 and :384 for ?channel_id= query values). test_the_reauth_next_parameter_is_left_alone pins exactly that.

Part 4, by execution rather than by reading the code that performs it:

javascript:alert(1)                  refused
data:text/html,<script>x</script>    refused
file:///C:/Windows/win.ini           refused
ms-msdt:/id                          refused
http://127.0.0.1:8765                accepted    (negative control)
https://engine.example.org           accepted    (negative control)

Two things the item asked for that nobody had recorded

The re-score note's enumeration gap is now closed. It held Value at 6 partly because "24 transport modules exist and only some have been read". All 25 under messagefoundry/transports/ were read for URL construction. Seven build a URL at all; only two build a path from data, and both quote with safe='' behind a grammar gate. The other five carry a static configured base URL with a construction-time scheme gate. No transport builds a URL from message data unencoded. This records the measurement; it does not re-score the item -- that is not a builder's act.

The open question flagged as reasoned-but-not-measured is STILL UNSETTLED, and I say so rather than claiming it settled. _encode_search_params({"identifier": "http://sys|123"}) returns identifier=http%3A%2F%2Fsys%7C123. That is the URL layer behaving correctly and it says nothing about the FHIR VALUE layer, which is the layer in question. Five live assertions in tests/test_fhir_lookup.py pin %7C, so the suite agrees with itself by construction. It needs a real FHIR server, which is precisely the owner ruling holding #1243.

One correction and one residual

Dead anchor, corrected. This item's clause 2 cites messagefoundry_webconsole/routes/connections.py:64 and :200. That file is gone; the sites are pages/connections.py. #1315 already measured that path as the single genuinely dead one among 1,196 distinct citations.

Residual recorded, deliberately NOT swept. pages/admin.py:306 interpolates role.id bare while :364 and :382 route the same value through _seg. It would not be reachable -- auth/service.py:2920 mints a custom role id as custom: plus uuid4().hex, so no path metacharacter can arrive there. I wrote it down with its provenance measured instead of fixing it, because this item disqualifies a blanket path-segment builder by name and #636 shipped a test proving one would break the re-auth redirect. Encoding it would also read as a defect fix for something that is not a defect.

I also did not propose the charset gate on connection names. The brief disqualifies it, and I agree with the reason: it buys the verdict by narrowing what the product accepts.

Assumptions stated, since a Builder gets one turn

Clause 3's wording says "replace the flat conditional_query". I read that as loose, and treated #1243 as the authority on what clause 3 actually is, because #1243 says so in terms. fhir.py:466 does still append self.conditional_query verbatim, and I did NOT treat that as a gap: it is an operator-authored whole query string whose separators are the author's own syntax, its containment is the construction-time screen that landed under #1241, and #1243 carves it out by name because escaping it would break a documented feature and red a shipped test.

Checks

Interpreter resolves to this worktree, verified once:

$ /c/Users/Scott/Code/MessageFoundry/.venv/Scripts/python.exe -c "import messagefoundry; print(messagefoundry.__file__)"
C:\Users\Scott\Code\MessageFoundry\.claude\worktrees\agent-a0f1b6d7ec496ab9b\messagefoundry\__init__.py

Check	Result
ruff check .	All checks passed
ruff format --check .	1220 files already formatted
mypy messagefoundry (strict)	no issues in 267 source files
tests/test_apiclient.py + test_ui_path_segment_encoding.py	64 passed
4 backlog / doc guard suites	69 passed
scripts/docs/backlog_status_check.py	OK, 657 items, each declaring exactly one status

Skipped, with CI as the authority: the full pytest tests/ suite. It runs over ten minutes and tests/test_connscale_smoke.py fails under worktree contention from the known fixed-port collision (BACKLOG #1014). Any hosted-runner-only leg, including windows-service-smoke, is unread by me by construction -- my process exits before it reports.

I applied the reviewed label to my own work, after my last push. The gate records that a step happened, not that an independent party looked. This diff is 35 lines of ledger prose and no code, but a reader should still read it as self-labelled.

Not merged, and auto-merge is not armed.

🤖 Generated with Claude Code

[wshallwshall]

LANDER: applying reviewed under an explicit owner override. The owner has suspended the reviewer process and directed that this label be applied as needed to clear the gate.

SO READ THIS LABEL AS A BYPASS TOKEN, NOT A REVIEW. It records that the gate was cleared by instruction. It does not assert that anyone read this diff, and no later reader should infer one from it.

What I can say: this PR appeared in a read-only pre-verification sweep of all 59 non-draft open PRs (per-PR defect read, plus pairwise git merge-tree against every PR sharing a non-BACKLOG file), and no blocking defect was recorded against it. That sweep did not run any tests, and CI has been down for hours, so nothing here has a current green.

-- Lander