Description
Read-only live witness comparing JSON GET /loki/api/v1/config/limits/applied with the existing /config/tenant/v1/limits body for otlp_config, discover_service_name, discover_log_levels, allow_structured_metadata, volume_enabled and max_label_names_per_series, across the staff stacks (D-LBL10). Choose the route that needs no new YAML parser features; loki_config.py parses only flat retention_stream today.
Acceptance Criteria
- #1 Witness recorded in docs/traps.md naming the stack slug or slugs, with the chosen route and field shapes
- #2 Route added to the AGENTS.md labelling section, GET only
- #3 Any read scope added under D-LBL11 is recorded with its object ID and reflected in CAPABILITIES.md, or the route is Parked with the reason
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Plan
Compare both approved GET applied-limits routes on live staff coordinates with sanitized shapes and expected field availability; root handles status/scope complements and witness-doc publication.
Implementation Notes
loop14:read-only witness,0 implementation attempts. Exact status/scope complements and guarded witness docs accepted at072121c with composed gate and exact CI green. Admin-only write-scoped self-serve limits and unavailable Tempo overrides remain excluded; bounded/empty results are not completeness claims. No policy scope or credential change.