Description
A contract audit found four manual-guide claims that disagree with runtime: Zenarmor family aliases that the parser rejects, an unlimited flow-log default that is actually 10000 per minute, a flow-log gate omitting exporter.disable-flow, and derived-counter scope overstated as every Zenarmor document.
Acceptance Criteria
- #1 Zenarmor family selection documents only the accepted wire tokens unless runtime normalization is intentionally added
- #2 The flow guide reports the actual 10000-per-minute default
- #3 Flow-log enablement names exporter.disable-flow as a required gate
- #4 Derived-counter scope matches family filtering, self-traffic filtering, parse-failure and exclusion order
Definition of Done
- #1 just check
- #2 just gen (if any generated artifact changed) and the diff committed
Implementation Plan
Correct only the four manual documentation claims, run doc lint or the repository gate, and skip code tests because runtime behavior is unchanged.
Implementation Notes
Documentation-only contract repair committed at 2389ac3b. just docs-check and final just check passed; CodeRabbit was skipped for this docs-only lane.
Final Summary
Corrected at 2389ac3b. The manuals now name only accepted Zenarmor wire tokens, the real 10000-per-minute flow-log default, the exporter.disable-flow gate, and the actual derived-counter admission order. Generated-doc and full repository gates passed.