Summary
The status recorder proves that every status the gateway emits is declared, but it only ever observes one configuration, so the proof covers less than it looks like.
The recorder lives behind MEDKIT_STATUS_RECORDER and is exercised by src/ros2_medkit_integration_tests/test/features/test_openapi_error_coverage.test.py, which launches with full_feature_gateway_params(...). Locking, triggers, scripts and the fault manager are all on.
A status the gateway returns only when a feature is off is therefore never recorded. The clearest case is the 501 a gated route answers with, but it is not the only one: a route can return a different error when a backend is absent, and that path is never walked.
The check says "every status the gateway emits is declared". What it actually proves is "every status this configuration emits is declared".
Proposed solution (optional)
Run the recorder sweep in more than one configuration and merge the results before comparing against the document. At minimum: all gates on, and all gates off. The comparison stays the same, only the set of observed statuses grows.
If running the whole sweep twice is too slow, a smaller second pass that only walks the gated routes would still close the 501 case, which is the one the document makes an explicit promise about.
Additional context (optional)
The wording of the guarantee in the design docs should follow whatever the sweep really covers, so a reader does not take it for more than it is.
Summary
The status recorder proves that every status the gateway emits is declared, but it only ever observes one configuration, so the proof covers less than it looks like.
The recorder lives behind
MEDKIT_STATUS_RECORDERand is exercised bysrc/ros2_medkit_integration_tests/test/features/test_openapi_error_coverage.test.py, which launches withfull_feature_gateway_params(...). Locking, triggers, scripts and the fault manager are all on.A status the gateway returns only when a feature is off is therefore never recorded. The clearest case is the 501 a gated route answers with, but it is not the only one: a route can return a different error when a backend is absent, and that path is never walked.
The check says "every status the gateway emits is declared". What it actually proves is "every status this configuration emits is declared".
Proposed solution (optional)
Run the recorder sweep in more than one configuration and merge the results before comparing against the document. At minimum: all gates on, and all gates off. The comparison stays the same, only the set of observed statuses grows.
If running the whole sweep twice is too slow, a smaller second pass that only walks the gated routes would still close the 501 case, which is the one the document makes an explicit promise about.
Additional context (optional)
The wording of the guarantee in the design docs should follow whatever the sweep really covers, so a reader does not take it for more than it is.