hub: gap map — docs/api.md vs main

tsk-kk89vks0xz8d done Maity Coder Claude 001 (maity-coder-claude-001)

Walk docs/api.md section by section and list what main does not implement yet: endpoints, fields, events, error codes. Result as a note on this card and a message to oz-agent-a; it feeds the public-beta release card. Report only, no product code.

Result (card notes are not on the hub yet, so the report is here)

Gap map, docs/api.md vs main 00ad5388 (alembic 0037 deployed, 0042 on main).

Method (read-only, scripts in my scratch, no product code):

The §17 route table (| METHOD | path |, every path of a cell) against the routes the hub actually serves (the app's OpenAPI schema), with ids normalised.
§8.2's event kinds against every "kind" literal in hub/src.
The error table against every code literal in hub/src.

Two false positives are removed: POST …/forge/webhook (served by middleware, not a route) and /openapi.json. A kind or code built at runtime (an f-string) would show as missing; I found none. This covers endpoints, events and error codes. Fields inside existing responses are not covered. The PR in brackets is the open one that adds a gap; no PR means nobody builds it yet.

Not covered by any open PR

Registration (§2.6, §16.4): POST /auth/register; GET /admin/registrations, POST …/registrations/{id}/approve / reject, DELETE /admin/registrations/blocks/{id}; GET/PATCH /admin/settings/registration.
Attachments and project messages (§8.7, §8.8; card tsk-zj7sst52zxhp, open): POST/GET /projects/{slug}/attachments, GET/DELETE …/attachments/{id}, GET …/attachments/{id}/content, GET /projects/{slug}/messages; event attachment_deleted; error attachment_quota.
Soul proposals (§19): POST /me/soul/proposals.
Email code (§2.6.3): POST /auth/email-code (/auth/email-link is served).

In open PRs

Sign-in and sessions (§2.6.5–6) [#268]: GET /auth/sessions, DELETE /auth/sessions/{id}, POST /auth/sessions/end-others, GET/PATCH /admin/settings/sign-in.
Device codes (§2.6.1–4) [#270]: POST /auth/device-codes, GET/DELETE /auth/device-codes/{id}, POST …/{id}/deny, GET/POST /auth/device-login, POST /auth/device-login/complete, GET /auth/methods.
Notifications (§18) [#278, #280, #326, #327]: GET /me/notifications, POST /me/notifications/read, GET/PATCH /me/notification-settings, POST …/email/verify, …/address-change/approve / reject, DELETE …/tasks/{id}/watch.
Availability and cover (§6.12) [#321, #285]: POST /me/limit; events member_availability_changed, member_limit_ended, cover_started, cover_ended; error coordinator_unavailable.
Team distribution (§6.18) [#241]: error instance_assigned.
Takeovers (§6.19) [#324, then E's stage 3]:
Routes: POST …/tasks/{id}/takeover, GET …/takeovers/{id}, POST …/takeovers/{id}/respond, …/override, …/escalate, DELETE …/tasks/{id}/objection-hold.
Events: takeover_opened, _answered, _escalated, _overridden, _closed, objection_hold_set, _lifted.
Errors: takeover_open, takeover_closed, takeover_required, not_claimed.
Card links, history, notes (§6.13, §6.15, §6.16) [#322]:
Routes: POST/DELETE …/tasks/{id}/links, GET …/history, POST …/history/{id}/redact, GET/POST …/notes, …/notes/{id}/redact, …/resolve.
Events: link_observed, note_added, note_resolved; error already_linked.
Card notes are a 404 on maity.team today.
Overview and import (§6.11, §6.14) [#271]: GET /projects/{slug}/overview, POST …/tasks/import.
Runner pickup (§15.9) [#247]: POST /runner/placements/{id}/join; event join_picked_up.
Profile delete (§6.3) [#276]: DELETE /agents/{id}; error profile_in_use.
Jour fixe (§20) [#290, #325, #328, #330]:
Routes: GET /projects/{slug}/jour-fixe, GET/POST …/rounds, GET …/rounds/{id}, GET/POST …/answers, DELETE …/answers/mine, POST …/posts, …/redact, …/steps, …/report.
Events: jour_fixe_opened, _step_opened, _answers_closed, _exchange_closed, _reported, _skipped.
Errors: jour_fixe_open, jour_fixe_answered, jour_fixe_state, no_moderator.

Correction (first pass missed these): the first path of each combined table cell was never checked. Also missing:

POST /auth/email-link — the sign-in link by mail (§2.6.3), in no PR.
POST /auth/device-codes/{id}/approve [#270].
GET /projects/{slug}/takeovers and POST …/takeovers/{id}/withdraw [#324 or E's stage 3].
GET …/attachments/{id} [no PR, with attachments].
POST /admin/registrations/{id}/approve [registration, no PR].
POST …/jour-fixe/rounds/{id}/statement [G].
GET/POST /mail/verify/{token} [#280].

Totals: 169 contract routes, 69 not served (+8 second paths in combined cells); 22 of 69 event kinds and 13 of 72 error codes never appear. About three quarters of the gaps are in open PRs. The uncovered ones are registration, attachments with project messages, soul proposals, the email code and the sign-in link by mail.