diff --git a/.dev-loop/INGEST_REPORT.md b/.dev-loop/INGEST_REPORT.md
index 55ccfd1..dede5d6 100644
--- a/.dev-loop/INGEST_REPORT.md
+++ b/.dev-loop/INGEST_REPORT.md
@@ -1,53 +1,254 @@
-# Knowledge consolidation — 15 open PRs (#17–#40) → one reconciled state
+# Knowledge flush — 3 insight(s)
 
-The 15 open `knowledge/*` PRs (created 2026-08-04 → 2026-08-05, before the
-harvest processed-store dedupe fix in #41) contained 123 file-versions of ~75
-unique pages, with the same insight landing at up to 3 different paths across
-up to 8 PRs. Per-PR review would re-import those duplicates, so — as with the
-#6–#13 consolidation — this branch carries the reconciled end-state and the 15
-PRs are closed in its favor.
+2 ingested here, 1 folded into open PR #52 (no sibling duplicate opened).
 
 ## Verified best-practice
 
-Every adopted page's sources were carried from its originating PR's flush, where
-they were live-verified at flush time; no new URLs were introduced during
-consolidation (checked mechanically: every `http(s)` URL in every merged page
-appears in a source PR's diff; every added body line in amended pages traces to
-a source PR hunk — orphan-line verification). Confidence fields were kept as the
-originating flushes set them, except client-side-rate-limiting where the union
-of provider-doc citations (Okta, Auth0, GitHub, OpenAI, RFC 6585) supports
-`verified` for the load-bearing claims. One subagent's fabricated content (12
-files matching neither main nor any PR, with invented source URLs) was detected
-by the same verification and replaced with true PR content.
+### I1 — an adapter's required-field set comes from running the consumer, not from its docstring
+
+**Claim.** When mapping one module's records into a second module's payload, call the
+real consumer once with a mapped record before writing the rest of the adapter, then
+split the fields it reads into *loud* (presence check / direct subscript → raises on
+the first record) and *silent* (read with a default → no error, wrong value), and give
+every silent field its own two-run assertion.
+
+**Sources checked (opened this session).**
+
+- https://docs.pact.io/ — "The contract is generated during the execution of the
+  automated consumer tests"; contract tests "check that all the calls to your test
+  doubles return the same results as a call to the real application would"; and
+  "unlike a schema or specification (eg. OAS), which is a static artefact that
+  describes all possible states of a resource, a Pact contract is enforced by
+  executing a collection of test cases, each of which describes a single concrete
+  request/response pair." This is the source for preferring an execution over the
+  documented shape.
+- https://json-schema.org/understanding-json-schema/reference/object — "By default,
+  the properties defined by the `properties` keyword are not required." An example
+  payload therefore carries no required/optional information at all.
+
+**Verification.** Reproduced the loud/silent asymmetry locally (Python 3, 12-line
+script): one consumer read `assignee_id` via `if "assignee_id" not in item: raise
+ValueError` and `desc` via `item.get("desc", "")`. Dropping `assignee_id` raised on
+the first record; dropping `desc` raised nothing and moved the returned score from
+21.0 to 1.0. Field evidence from the harvest: the same mapping produced 100%
+`ValueError` for the missing `assignee_id` and a silent 5.3x under-estimate
+(1.63 → 0.31) for the missing `desc`.
+
+**Not verified, and excluded from the page.** I attempted to cite the Python docs for
+`dict.get` never raising `KeyError`; both fetches of
+`docs.python.org/3/library/stdtypes.html` (with and without the `#dict.get` anchor)
+returned content truncated before the Mapping Types section, so no quote was
+available. The local reproduction stands in for it and no Python-docs URL is cited.
+
+**Confidence: verified** (two official docs quoted + local reproduction).
+
+### I2 — the cooldown mark belongs after a send that reported success
+
+**Claim.** Write a notification-suppression mark only on a send whose status was
+success; give the send its own exit status; make the send path injectable; assert the
+succeeding-sender and failing-sender worlds as two separate tests.
+
+**Sources checked (opened this session).**
+
+- https://pkg.go.dev/github.com/prometheus/alertmanager/notify — the pipeline ordering
+  is stated in the stage doc comments: `RetryStage` "notifies via passed integration
+  with exponential backoff until it succeeds. It aborts if the context is canceled or
+  timed out."; `SetNotifiesStage` "sets the notification information about passed
+  alerts. **The passed alerts should have already been sent to the receivers.**";
+  `DedupStage` "filters alerts. Filtering happens based on a notification log." So the
+  log that suppression reads is written only after delivery — a production system
+  stating exactly this ordering.
+- https://runbooks.prometheus-operator.dev/runbooks/general/watchdog/ — the Watchdog is
+  "an alert meant to ensure that the entire alerting pipeline is functional", "always
+  firing", and "if not firing then it should alert external systems that this alerting
+  system is no longer working." Supports the external-heartbeat step, not the ordering.
+- https://prometheus.io/docs/alerting/latest/configuration/ — `repeat_interval` is
+  keyed to a prior *notification*, not to a prior attempt.
+
+**Not verified, and excluded from the page.** I tried to source the "the alerting
+pipeline must not fail together with what it monitors" argument from
+https://sre.google/sre-book/monitoring-distributed-systems/. The chapter does not say
+it: it argues for monitoring being "kept simple and comprehensible" and for "distinct
+systems with clear, simple, loosely coupled points of integration" between monitoring
+and *other inspection tools*, which is a different claim. The correlated-failure point
+is therefore stated in the page only as an Edge-cases row whose remedy is the Watchdog
+heartbeat (which *is* sourced), and the SRE book is not cited for it.
+
+**Verification.** Field measurement from the harvest, re-read against the code:
+`rtb-mac-server-k8s bin/gitops-deploy.sh` wrote the `alert-main-fetch` marker after a
+send whose webhook lookup had failed, so the next invocation suppressed the alert as
+"in cooldown". Applying `notify "$@" || return 1` before the marker, in a copy outside
+the repo, turned three existing tests red — the always-failing stub had fixed the
+pre-send ordering as the expected contract.
+
+**Confidence: verified** (Alertmanager stage contracts quoted from the package docs +
+reproduced field measurement).
+
+### I3 — source-text assertions must be made against code with comments removed (folded, see below)
+
+**Claim as queued.** Strip comments from the source before asserting on it, using
+`src.replace(/\/\*[\s\S]*?\*\//g,'').replace(/\/\/.*$/gm,'')`.
+
+**Sources checked (opened this session).**
+
+- https://eslint.org/docs/latest/extend/custom-rules — "While comments are not
+  technically part of the AST, ESLint provides the `sourceCode.getAllComments()`..."
+  and rules visit "nodes while traversing the abstract syntax tree (AST as defined by
+  ESTree)". This is the mechanism: a structural check runs over a tree comments do not
+  appear in, a text check runs over the file where they do.
+- https://docs.semgrep.dev/writing-rules/pattern-syntax — "Semgrep automatically
+  searches for code that is semantically equivalent" (constant propagation, AC
+  matching). Supports "match the structure, not the characters"; it does **not** state
+  anything explicit about comments, and the page does not claim it does.
+
+**Verification — and a correction to the queued directive.** Measured 2026-08-10 in
+Node against a fixture containing a JSDoc block, a line comment, and a URL string:
+
+| Assertion | Raw source | After the queued strip regex |
+|---|---|---|
+| `<BlockDetailPanel` occurrence count (true value 1) | 2 | 1 |
+| `/Number\.isFinite/` present (true value false) | true | false |
+
+So the queued insight's premise reproduces exactly. But the same run showed the
+queued regex is itself defective: it truncated
+`const endpoint = "https://api.example.com//v2/items"` to `const endpoint = "https:`,
+because `//` inside a string literal is consumed as a comment start. A string-aware
+alternation variant fixed the URL and still truncated a regex literal containing `//`
+(`const re = /a//b/` → `const re = /a`). The page therefore takes comment removal from
+the language's own tokenizer/parser plus a control run, and records the regex form only
+as an `Instead of` row with this measurement as the reason — shipping the queued
+one-liner would have replaced a false-positive class with a silent-corruption class.
+
+**Confidence: verified** (official ESLint docs quoted + reproducible Node measurement,
+including the counter-measurement against the queued directive).
 
 ## Existing-layer check
 
-- Merged-main near-dup scan before consolidation: pairwise Jaccard over
-  title + "When this applies" across all 141 merged pages → **0 flagged pairs**;
-  previously merged content carries no duplication.
-- Cross-PR dedup during consolidation: 10 duplicate clusters collapsed to one
-  canonical page each (rate limiting 8→1, call-site enumeration 7→folded into
-  the canonical merged in #20, stderr/exit-0 diagnostics 4→1, sysroot 2→1,
-  env-off-switch 2→1, completion predicates 2→1, robots.txt 2→1,
-  harness-mediated results 2→1, leaked artifacts 2→1, orchestration category
-  naming unified). Three near-pairs kept distinct after trigger comparison,
-  with mutual `related:` links (differential setup vs interpretation; expansion
-  semantics vs off-switch design; import-time tactics vs level choice).
-- 24 existing pages received union-merged amendments; additions already present
-  in main (from #16/#20) were skipped, and all non-canonical `related:` ids
-  were remapped to canonical page ids (post-merge broken-link scan: 0).
+Routed via `INDEX.md` → domain `index.md` for backend, infrastructure and testing, then
+read every page whose "load when" line overlapped.
+
+Pages read: backend-common-change-impact-call-site-enumeration,
+backend-common-integrations-externally-owned-defaults,
+backend-common-api-design-unenforced-declarations,
+infrastructure-observability-alerting,
+infrastructure-observability-logs-metrics-signals,
+testing-quality-tests-that-cannot-fail, testing-quality-harness-reverse-controls,
+testing-quality-guard-shape-vs-consequence, testing-quality-spec-artifact-checks,
+testing-quality-behavior-not-implementation, testing-quality-minimum-case-set
+
+Findings:
+
+- **I1 vs `backend-common-change-impact-call-site-enumeration`** — adjacent but
+  reversed. That page enumerates the call sites of a callee *you own and are changing*;
+  I1 is about discovering the required inputs of a consumer *you do not own and are
+  feeding*. Different trigger, so a new page, with a forward link from I1 and a
+  "when you own the callee" pointer in its `When this applies`. I deliberately did not
+  add the reciprocal `related:` id to that page: five open PRs (#68, #58, #52, #51,
+  #50) already edit it, and a one-line frontmatter change there would be a pure
+  conflict for the owner. The link is one-way by choice.
+- **I1 vs `backend-common-integrations-externally-owned-defaults`** — same family
+  (a name/shape the repo does not own), different failure. Cross-linked both ways;
+  I1's step 5 hands off to it for the version-upgrade case.
+- **I1 vs `testing-quality-unasserted-return-fields` (open PR #49)** — same mechanism
+  on the opposite side of the call: #49 is about returned fields no assertion reads,
+  I1 about input fields the consumer silently defaults. Kept distinct; see Open-PR
+  check.
+- **I2 vs `infrastructure-observability-alerting`** — no overlap in directive. That
+  page decides *whether* a condition pages, tickets, or stays on a dashboard; it says
+  nothing about where suppression state is written. New page in the same category,
+  cross-linked both ways (`alerting`'s `related:` extended).
+- **I2 vs `backend-common-jobs-idempotent-handlers`** — related mechanism
+  (at-least-once + dedupe), different artifact; forward link only.
+- **I3 vs `testing-quality-source-text-wiring-assertions` (open PR #52)** — direct
+  overlap. See Open-PR check; folded, not duplicated.
+- **Conflicts flagged: none.** No existing directive contradicts either new page.
+  The one contradiction found this session was internal to the queue: candidate I3's
+  own directive is falsified by its verification (above), so the folded text carries
+  the corrected form and the reason.
+
+New categories: none. Both pages land in existing categories
+(`backend/common/integrations`, `infrastructure/observability`).
+
+## Open-PR check
+
+Listed via `gh pr list --repo choiyounggi/dev-loop --state open --search "head:knowledge/"`
+— 15 open heads: #69, #68, #66, #64, #62, #61, #58, #57, #56, #55, #52, #51, #50, #49, #47.
+Diffed each head's `wiki/` changes against `origin/main`; for the
+two fork-hosted heads that `git fetch` could not resolve (#52, #49) I listed and read
+the files through the GitHub API at each PR's head SHA instead.
+
+| Candidate | Overlapping open head | Verdict |
+|---|---|---|
+| I1 — consumer required fields | #49 `testing/quality/unasserted-return-fields.md` (nearest); no open head touches `backend/common/integrations/` | **new** — #49 governs *returned* fields the suite never asserts; I1 governs *input* fields the consumer silently defaults. Different artifact, different trigger, and I1's primary directive (execute the consumer to learn its required set) has no counterpart in #49 |
+| I2 — suppression mark after a successful send | none — no open head touches `infrastructure/observability/` | **new** |
+| I3 — comments contaminate source-text assertions | #52 `testing/quality/source-text-wiring-assertions.md` | **fold** — pushed to that branch; not ingested here |
+
+Fold detail for I3: #52's page already owns the trigger "a test reads a source file as
+a string and asserts by regex". Its step 5 even prescribes the control that *detects*
+this defect ("change a comment ... require green") but does not say what to do when
+that control goes red, and its step 2 ("count the anchor's occurrences before using
+it") is the step comments break — my fixture's JSDoc line took an anchor count from 1
+to 2. The additions therefore belong on that page, not on a sibling. Because I own the
+head repository (`dch0202-rsquare/dev-loop`), the commit went onto #52's branch and a
+comment on #52 records what changed and why, so the owner reviews it in one pass.
 
 ## Routing decision
 
-- New categories: `infrastructure/agent-orchestration` (5 pages; unified the
-  competing `orchestration`/`agent-orchestration` names), `databases/data-survey`
-  (1), `qa/deliverables` (1). All other pages route into existing categories.
-- Canonical-path decisions: rate limiting → `backend/common/reliability/`
-  (sits beside timeouts-and-retries; 6 of 8 variants chose it); stderr
-  diagnostics → `platforms/processes/` (concern spans beyond shells); leaked
-  artifacts → `testing/data/artifact-leakage-from-a-suite`; call-site
-  enumeration → the existing `backend/common/change-impact/` page.
-- All 38 new pages listed in their domain indexes (nearest-index rule; backend
-  routes via its python sub-index for bytecode-cache-staleness); INDEX.md domain
-  summaries updated for infrastructure/qa/databases. Full-wiki lint: frontmatter,
-  ids, related-links, index coverage, size, qualifiers, staleness → 0 findings.
+| Insight | Target | New category? |
+|---|---|---|
+| I1 | `backend` / `common/integrations` / `consumer-required-fields.md` (id `backend-common-integrations-consumer-required-fields`) | No. `integrations` is described in the domain index as consuming external-API responses and externally-owned defaults; an adapter feeding a module the repo does not own is the same boundary seen from the producing side. `change-impact` was rejected because its trigger is a callee you own and are changing; `api-design` was rejected because its pages are HTTP contract design |
+| I2 | `infrastructure` / `observability` / `suppression-state-and-delivery-failure.md` (id `infrastructure-observability-suppression-state-and-delivery-failure`) | No. Sits beside `alerting` (which decides routing, not delivery bookkeeping). `backend/common/jobs` was rejected: the artifact is a notifier's suppression state, not a queue consumer |
+| I3 | `testing` / `quality` / `source-text-wiring-assertions.md` **on open PR #52's branch** | No — fold, no new page |
+
+Plumbing updated: `wiki/backend/index.md` (+1 row), `wiki/infrastructure/index.md`
+(+1 row), reciprocal `related:` on `infrastructure/observability/alerting.md` and
+`backend/common/integrations/externally-owned-defaults.md`, `log.md` (+1 entry).
+Checked before commit: both new pages are under the 120-line body limit (76 and 78),
+carry no banned vague qualifiers, and every `related:` id and inline `[page-id]`
+reference resolves to a file in `wiki/`.
+
+## Decision Log
+
+Cross-Check: independent adversarial review (claude CLI headless, `--permission-mode plan`,
+prompted to refute and to re-fetch every cited URL) returned 1 Critical + 11 Warnings +
+4 Info; all were reproduced locally and fixed before this PR was opened — see below.
+
+**Intent.** Drain the 3 pending `~/.dev-loop/queue` candidates into reviewed wiki
+content: 2 as new pages here, 1 folded into open PR #52 because that PR already owns
+the trigger. No sibling duplicate PR was opened, and nothing is auto-merged.
+
+**What the cross-check changed (nothing here is the queued text as harvested).**
+
+| # | Finding | Fix applied |
+|---|---------|-------------|
+| Critical 1 | The suppression page prescribed `notify "$@" \|\| return 1` before the marker. Reproduced: at a script's top level `return` errors, execution **falls through to the marker write**, and the script exits 0 — the page's own snippet reproduced the defect the page exists to prevent. The cited repo ships `if slack "$@"; then …; fi` (`bin/gitops-deploy.sh:91`) | Prescribe the shipped shape; add a 3-row table covering top-level, in-function, and `set -e` propagation |
+| Warning 3 | The notify package docs state the stages' **contracts**, not their order | Present the ordering as following from `SetNotifiesStage`'s precondition + `DedupStage`'s notification log, not as stated by the page |
+| Warning 4 | Current `repeat_interval` docs no longer carry the attempt-vs-delivery wording | Dropped that clause; the distinction now rests only on the notify citation |
+| Warning 6 | `ts.createSourceFile` was named as the stripper. Verified against TypeScript 5: `sourceFile.comments === undefined`, no comment node in the AST — a silent no-op, the exact failure class the page is about | Name `ts.getLeadingCommentRanges`, `espree.parse(…, {comment:true})`, `@babel/parser` `parse(src).comments` |
+| Warning 8 | "green by construction" was claimed for the whole step-6 control, but its reformat half still reddens a bounded pattern with no comment involved (reproduced) | Scoped to the comment-only half; the reformat half tests N |
+| Warning 9 | The no-parser fallback filtered whole comment lines, which misses **trailing** comments — the leak that motivates the page (reproduced: count 2 vs 1) | Cut each line to EOL |
+| Warning 11 | The two-run differ assertion passes vacuously on a non-deterministic consumer (LLM scorer, sampling) — a class the page explicitly invites | Added the edge row: pin seed/temperature or stub before comparing |
+| Warnings 2, 5, 10, 12; Info 13–15 | prose/table count mismatch; a measurement labelled "parser-equivalent" when a regex was run; N's subject unstated; index "load when" clauses absent from "When this applies"; unverifiable line-count and version pins; one prohibition outside `Instead of` | All applied |
+
+**Where the reviewer was wrong, and how I checked.** Info 14 claimed the loud/silent
+split was not reproducible because a sibling copy reads `it["desc"]` by subscript. I
+opened the actual engine: `manday-sp/engine.py:399` is `d = it.get("desc") or ""`
+(silent) and `check_assignee_ids` at 511 enforces key presence (loud). The measurement
+stands; the reviewer's underlying point — that the split is a property of the read
+site, so pin file:line — was right and is now in the page.
+
+**Alternatives rejected.** (a) Ingesting I3 as its own page — rejected: #52 owns the
+trigger, and a sibling page is the pile-up this skill exists to prevent (#39). (b)
+Only commenting on #52 instead of pushing — rejected: the change is a new step plus
+six table rows, which is a diff to review, not a note. (c) Shipping the queued
+strip-regex directive verbatim — rejected: measured, it corrupts string and regex
+literals, so it would have traded a false-positive class for a silent-corruption one.
+(d) Adding the reciprocal `related:` id to `call-site-enumeration` — rejected: five
+open PRs already edit that file and the backlink would be a pure conflict.
+
+**Where a reviewer should look.** The suppression page's step-2 shell table (the
+Critical); the folded page's step 2 API list (a wrong API there is undetectable at
+runtime); and whether `backend/common/integrations` is the right home for I1 versus a
+`change-impact` sibling — that routing call is the least certain thing in this PR.
+
+**Not done deliberately.** No `gh pr merge`; both branches are pushed for your review.
diff --git a/log.md b/log.md
index c930fc2..3afd1ef 100644
--- a/log.md
+++ b/log.md
@@ -43,3 +43,5 @@ Append-only. Format: `## [YYYY-MM-DD] <ingest|revise|lint|gap|contradiction|drif
 ## [2026-08-06] revise | Union-merged amendments from the same 15 PRs into 24 existing pages (largest: tests-that-cannot-fail — 7 PRs: per-assertion mutation granularity, restore-mechanism-by-commit-state, suite-total-drop detection; portable-shell-scripts — 8 PRs: POSIX inline set-- reordering, ${VAR:-} vs ${VAR-} colon semantics, quote-by-what-the-text-is; test-data-and-isolation — 6 PRs: env-derived write paths, absent-variable cases, exec-bit fixtures, leak attribution; change-impact/call-site-enumeration — 8 unique additions from 7 path-variants: rename-in-place, same-type reorder, *args forwarding, two-searches-agree fallacy, codemod, coverage completion check). All non-canonical cross-page ids remapped to canonical pages; every added line traced to its source PR hunk (fabricated worker output was detected by orphan-line verification and replaced with true PR content).
 ## [2026-08-06] dedup | Cross-PR duplicate clusters collapsed: client-side rate limiting (8 PR versions at 3 paths → 1), call-site enumeration (7 versions at 7 paths → additions folded into the already-merged canonical page), stderr/exit-0 diagnostics (4 versions at 4 paths → 1), macOS sysroot (2→1), env-var off switch (2→1), completion predicates (2→1), robots.txt (2→1), harness-mediated results (2→1), leaked test artifacts (2→1), orchestration category naming (orchestration vs agent-orchestration → agent-orchestration). Kept distinct after trigger comparison: differential-testing vs differential-run-agreement (setup vs interpretation), unset-versus-empty-parameters vs env-var-off-switches (semantics vs design, cross-linked), import-time-side-effects vs test-level-choice edge (tactics vs level choice, cross-linked). Merged-main near-dup scan (Jaccard over title+trigger, 141 pages): 0 pairs — no duplication among previously merged content.
 ## [2026-08-06] ingest | Reconciled post-consolidation flush PRs #42–#43 (created against pre-#44 main). Folded unique content: platforms/filesystems/permissions-and-exec-bits (+`sh "$SCRIPT"` interpreter-invocation rows — stubs need no exec bit, avoids EDR chmod+x heuristics), platforms/shells/command-text-inspected-before-execution (+gate-AUTHOR step 8: parse all three POSIX quoting forms, expand only ~/$HOME/${HOME}; red-then-green bats evidence), testing/quality/checks-that-cannot-pass (+vacuously-green pre-implementation test row), platforms/processes/tool-diagnostics-without-a-failing-exit-code (+repeat-suppression edge, +clang reproduction source), infrastructure/ci-cd/secrets-handling (+independent credential channels row: gh token vs git SSH vs API token, git push --dry-run / author:@me probes), testing/mocking/what-to-mock (+ESM read-only-bindings DI rows, +PATH-emptied tripwire negative-proof). Dropped as duplicates of the #44 state: #42's rate-limit row (already in timeouts-and-retries + client-side-rate-limiting), #42's warning-only-diagnostics page (same trigger as tool-diagnostics-without-a-failing-exit-code), #42's leak-attribution row (already in test-data-and-isolation).
+
+## [2026-08-10] ingest | knowledge-flush of 3 queued insights → 2 new pages, 1 folded into open PR #52. New: backend/common/integrations/consumer-required-fields (an adapter built from the consumer's docstring cannot tell required from optional — call the real consumer once with a mapped record, split the fields it reads into loud (presence check / subscript → raises on record 1) and silent (read with a default → wrong value, no error), and give each silent field a two-run assertion that drops it and requires the output to differ; sources: docs.pact.io "check that all the calls to your test doubles return the same results as a call to the real application would" + "unlike a schema or specification (eg. OAS), which is a static artefact"; json-schema.org "By default, the properties defined by the `properties` keyword are not required"; Python reproduction 2026-08-10 — missing `assignee_id` raised ValueError, missing `desc` moved the score 21.0 → 1.0 silently). New: infrastructure/observability/suppression-state-and-delivery-failure (write the cooldown/sent mark only after a send that reported success, give the send its own exit status, make it injectable, and assert the succeeding-sender and failing-sender worlds as two tests; sources: Alertmanager `RetryStage` "notifies via passed integration with exponential backoff until it succeeds" then `SetNotifiesStage` "sets the notification information about passed alerts. The passed alerts should have already been sent to the receivers." with `DedupStage` filtering "based on a notification log"; prometheus-operator Watchdog runbook "an alert meant to ensure that the entire alerting pipeline is functional" for the external heartbeat; field measurement rtb-mac-server-k8s bin/gitops-deploy.sh where the always-failing stub had fixed the pre-send ordering as the expected contract — the correct fix turned 3 tests red). Folded (not re-ingested): the comment-vs-code source-assertion insight went to open PR #52's testing/quality/source-text-wiring-assertions rather than a sibling page; verification there found the queued directive's own strip regex defective — measured 2026-08-10 in Node, `s.replace(/\/\*[\s\S]*?\*\//g,'').replace(/\/\/.*$/gm,'')` truncates `"https://api.example.com//v2/items"` to `"https:` and a string-aware variant still truncates a regex literal containing `//`, so the page takes comment removal from the language's tokenizer with a control, not from a regex.
diff --git a/wiki/backend/common/integrations/consumer-required-fields.md b/wiki/backend/common/integrations/consumer-required-fields.md
new file mode 100644
index 0000000..be25f37
--- /dev/null
+++ b/wiki/backend/common/integrations/consumer-required-fields.md
@@ -0,0 +1,97 @@
+---
+id: backend-common-integrations-consumer-required-fields
+domain: backend
+category: integrations
+applies_to: [general]
+confidence: verified
+sources:
+  - https://docs.pact.io/
+  - https://json-schema.org/understanding-json-schema/reference/object
+last_verified: 2026-08-10
+related:
+  [
+    backend-common-change-impact-call-site-enumeration,
+    backend-common-integrations-externally-owned-defaults,
+    backend-common-llm-completion-response-validation,
+    testing-quality-tests-that-cannot-fail,
+    testing-quality-minimum-case-set,
+  ]
+---
+
+# Building a Payload for a Consumer Whose Required Fields You Inferred
+
+## When this applies
+
+You are writing an adapter that maps one module's records (a selection query, a
+repository row, a scraped item) into the shape a second module consumes — a
+scoring engine, a plugin, an external API client — and you took that shape from
+the consumer's docstring, README example, or a sample payload. Also when such an
+adapter runs end to end with no error and the downstream numbers look low, and
+when deciding which mapped fields need an assertion of their own.
+
+Enumerating call sites when *you* own the callee →
+[backend-common-change-impact-call-site-enumeration].
+
+## Do this
+
+1. **Call the real consumer once with a mapped record before writing the rest of
+   the adapter.** An example payload is an instance, not a specification: in JSON
+   Schema terms "the properties defined by the `properties` keyword are not
+   required" unless a `required` list says so, so a sample cannot tell you which
+   keys the consumer depends on. Pact makes the same distinction — "unlike a
+   schema or specification (eg. OAS), which is a static artefact", a contract is
+   "enforced by executing a collection of test cases", and a test double is
+   trusted only when its calls "return the same results as a call to the real
+   application would".
+
+2. **Split the fields the consumer reads into loud and silent by how it reads
+   them**, and drive the split from the consumer's source, not its prose:
+
+| How the consumer reads the field | Class | Missing-field symptom |
+|---|---|---|
+| Presence check or direct subscript (`if k not in d`, `d[k]`, required-field validation) | Loud | Raises on the first record; the run stops |
+| Read with a default (`d.get(k, …)`, `??`, `COALESCE`, optional destructuring) | Silent | No error; the computed value is wrong for every record |
+| Used only for logging or display | Cosmetic | No error; output text is thinner |
+
+3. **Let the loud fields be found by one end-to-end run, and write an explicit
+   assertion for every silent field.** The loud ones announce themselves; the
+   silent ones cannot fail any test that only checks "the pipeline completed"
+   ([testing-quality-tests-that-cannot-fail]).
+
+4. **Make each silent-field assertion compare two runs of the real consumer —
+   one with the field populated, one with it dropped — and require the outputs
+   to differ.** Asserting only "the key is present in the mapped dict" passes on
+   a key the consumer never reads and on a value that never reaches the formula.
+
+5. **Record the discovered required-field list next to the mapping code**, with
+   the consumer version or commit you probed. The list is the adapter's real
+   contract, and step 1 is re-run against it when the consumer is upgraded
+   ([backend-common-integrations-externally-owned-defaults]).
+
+## Edge cases
+
+| Case | Then |
+|------|------|
+| The consumer is expensive or has side effects | Probe it once in a test with a single record and cache the field list — the probe is required even then, and the cache is what keeps it cheap |
+| The consumer accepts the record but ignores unknown keys | The unknown key is not evidence of anything — keep the step-4 two-run comparison as the only proof a field is consumed |
+| The consumer validates with a machine-readable schema (pydantic model, JSON Schema, protobuf) | Read `required`/non-default fields from the schema instead of probing, and still run step 4 for the defaulted ones |
+| A silent field's absence changes the output by less than the assertion's tolerance | Choose the probe record that maximizes the field's contribution (longest text, largest count) so the two runs separate |
+| The consumer defaults a missing field to a neutral value that looks plausible | Treat it as silent, not absent — a plausible default is what lets the defect reach production |
+| Several silent fields feed one output number | Drop them one at a time; dropping all of them at once cannot attribute the difference |
+| The consumer is non-deterministic (LLM scorer, sampling, clock-dependent) | Pin the seed/temperature or stub the non-deterministic part before comparing — otherwise the two runs differ for every field, including ones the consumer never reads, and step 4 passes vacuously |
+
+## Instead of
+
+| If you are about to | Do this instead | Why |
+|---------------------|-----------------|-----|
+| Map fields from the consumer's docstring schema and move on | Call the consumer with one mapped record first, then map the rest | The docstring lists the shape, not which keys are load-bearing; the run tells you |
+| Treat "the pipeline finished with no exception" as evidence the mapping is complete | Assert each silent field changes the output when dropped | The loud fields are the only ones an exception-free run proves |
+| Assert `"desc" in payload` for each field the consumer reads | Run the consumer twice, with and without the field, and assert the outputs differ | Key presence is satisfied by a key the consumer ignores or reads from a different name |
+| Add a default in the adapter for a field you are unsure the consumer needs | Probe first, then map the field or leave it out deliberately | A speculative default converts a loud failure into a silent one — the class that survives to production |
+
+## Sources
+
+- https://docs.pact.io/ — "The contract is generated during the execution of the automated consumer tests"; contract tests "check that all the calls to your test doubles return the same results as a call to the real application would"; and "unlike a schema or specification (eg. OAS), which is a static artefact that describes all possible states of a resource, a Pact contract is enforced by executing a collection of test cases, each of which describes a single concrete request/response pair" — the basis for step 1 preferring an execution over the documented shape
+- https://json-schema.org/understanding-json-schema/reference/object — "By default, the properties defined by the `properties` keyword are not required"; an example payload therefore carries no required/optional distinction
+- Reproduction 2026-08-10 (Python 3): a consumer that reads `assignee_id` with `if "assignee_id" not in item: raise ValueError` and computes `1.0 + 0.5 * len(item.get("desc", ""))`. Dropping `assignee_id` raised on the first record; dropping `desc` raised nothing and moved the returned score from 21.0 (`desc` of length 40) to 1.0 — same adapter output, one failure visible in the first run and one visible only to an assertion
+- Field measurement 2026-08-10 (manday estimation engine, `manday-sp/engine.py`): the two read sites are `check_assignee_ids(items)` at line 511, whose contract is "키 존재 + 값 형식" (key presence, not just value shape), and `d = it.get("desc") or ""` at line 399 — loud and silent respectively. The split is a property of the read site, not of the field, so record the file:line (a sibling copy of the same scorer reads `it["desc"]` by subscript, which makes the same field loud). A mapping built from the engine's docstring schema produced `ValueError` on 100% of records for the missing `assignee_id` key, while the missing `desc` key produced no error and scored 0.31 against 1.63 for the same item — a 5.3x under-estimate that the end-to-end run reported as success
diff --git a/wiki/backend/common/integrations/externally-owned-defaults.md b/wiki/backend/common/integrations/externally-owned-defaults.md
index 6ab1abf..8617871 100644
--- a/wiki/backend/common/integrations/externally-owned-defaults.md
+++ b/wiki/backend/common/integrations/externally-owned-defaults.md
@@ -9,7 +9,7 @@ sources:
   - https://developers.openai.com/api/docs/api-reference/models/list
   - https://docs.litellm.ai/docs/proxy/model_discovery
 last_verified: 2026-07-31
-related: [backend-common-llm-completion-response-validation, infrastructure-config-environment-config, qa-process-release-gates]
+related: [backend-common-llm-completion-response-validation, infrastructure-config-environment-config, qa-process-release-gates, backend-common-integrations-consumer-required-fields]
 ---
 
 # Defaults That Name a Resource Owned Outside the Repository
diff --git a/wiki/backend/index.md b/wiki/backend/index.md
index cee0276..8a0065c 100644
--- a/wiki/backend/index.md
+++ b/wiki/backend/index.md
@@ -91,6 +91,7 @@ Match your situation to a "load when" line; load only matching pages.
 | Page | Load when |
 |------|-----------|
 | [externally-owned-defaults](common/integrations/externally-owned-defaults.md) | A code/config default names a resource the repo does not own (model alias, endpoint, bucket, queue, index) — reviewing or merging a PR that claims that default works, adding a startup check that the name still resolves, or diagnosing a default path that broke with no code change |
+| [consumer-required-fields](common/integrations/consumer-required-fields.md) | Writing an adapter that maps one module's records into the payload a second module (scoring engine, plugin, external client) consumes, with the target shape taken from a docstring, README example, or sample payload; such an adapter runs end to end with no error and the downstream numbers come out low; deciding which mapped fields need their own assertion |
 | [robots-txt-and-source-selection](common/integrations/robots-txt-and-source-selection.md) | Choosing which site to fetch a published dataset from and reading its robots.txt to decide whether your client may crawl it; the file contains a `Disallow: /` and you are deciding whose group it belongs to; setting the crawler's User-Agent and checking that token against the file; robots.txt returned a non-200 status; the origin restricts your token and you are looking for a portal that republishes the same records |
 
 ### storage
diff --git a/wiki/infrastructure/index.md b/wiki/infrastructure/index.md
index 36a0771..3df4006 100644
--- a/wiki/infrastructure/index.md
+++ b/wiki/infrastructure/index.md
@@ -60,3 +60,4 @@ Match your situation to a "load when" line; load only matching pages.
 | [logs-metrics-signals](observability/logs-metrics-signals.md) | Instrumenting a new or existing service (logs, metrics, correlation ids); an incident revealed you couldn't see what happened; choosing between a log line and a metric; a metric label would carry unbounded values (user ids/UUIDs) |
 | [missing-container-metrics](observability/missing-container-metrics.md) | Prometheus `container_*` CPU/memory series are empty or pod dashboards blank while kubelet scrape targets all report up (common on embedded/VM Kubernetes like OrbStack); deciding between cAdvisor and kubelet `/metrics/resource` scraping |
 | [alerting](observability/alerting.md) | Creating or reviewing alerts; the team ignores a noisy pager; deciding whether a condition pages, tickets, or stays on a dashboard |
+| [suppression-state-and-delivery-failure](observability/suppression-state-and-delivery-failure.md) | Adding notification suppression to a script or service (cooldown file, "last alerted at" timestamp, sent-marker key) and choosing where the mark is written relative to the send; a condition stayed live while the channel went quiet for the whole cooldown window; writing the tests for that marker against a stub whose send always fails |
diff --git a/wiki/infrastructure/observability/alerting.md b/wiki/infrastructure/observability/alerting.md
index 13008ed..4a28926 100644
--- a/wiki/infrastructure/observability/alerting.md
+++ b/wiki/infrastructure/observability/alerting.md
@@ -8,7 +8,7 @@ sources:
   - https://sre.google/sre-book/monitoring-distributed-systems/
   - https://sre.google/workbook/alerting-on-slos/
 last_verified: 2026-07-10
-related: [infrastructure-observability-logs-metrics-signals, infrastructure-deploy-rollout-and-rollback]
+related: [infrastructure-observability-logs-metrics-signals, infrastructure-deploy-rollout-and-rollback, infrastructure-observability-suppression-state-and-delivery-failure]
 ---
 
 # Deciding What Pages a Human
diff --git a/wiki/infrastructure/observability/suppression-state-and-delivery-failure.md b/wiki/infrastructure/observability/suppression-state-and-delivery-failure.md
new file mode 100644
index 0000000..e030b77
--- /dev/null
+++ b/wiki/infrastructure/observability/suppression-state-and-delivery-failure.md
@@ -0,0 +1,109 @@
+---
+id: infrastructure-observability-suppression-state-and-delivery-failure
+domain: infrastructure
+category: observability
+applies_to: [general]
+confidence: verified
+sources:
+  - https://pkg.go.dev/github.com/prometheus/alertmanager/notify
+  - https://runbooks.prometheus-operator.dev/runbooks/general/watchdog/
+  - https://prometheus.io/docs/alerting/latest/configuration/
+last_verified: 2026-08-10
+related:
+  [
+    infrastructure-observability-alerting,
+    infrastructure-observability-logs-metrics-signals,
+    backend-common-jobs-idempotent-handlers,
+    testing-quality-tests-that-cannot-fail,
+    testing-quality-harness-reverse-controls,
+  ]
+---
+
+# Where the Cooldown Mark Is Written Relative to the Send
+
+## When this applies
+
+You are adding notification suppression to a script or service — a cooldown
+file, a "last alerted at" timestamp, a sent-marker key — so a repeating
+condition does not notify on every tick. Also when the code has such a marker
+and you are choosing where its write goes, or writing the tests for it against
+a stub whose send always fails. Also when a condition stayed live while the
+channel went quiet for the whole cooldown window.
+
+Choosing *whether* a condition notifies at all →
+[infrastructure-observability-alerting].
+
+## Do this
+
+1. **Write the suppression mark only on a send that reported success**, so a
+   failed send leaves the condition unmarked and the next tick sends again. Alertmanager
+   states the same precondition on the stage that records delivery:
+   `SetNotifiesStage` "sets the notification information about passed alerts. The
+   passed alerts should have already been sent to the receivers", while
+   `RetryStage` "notifies via passed integration with exponential backoff until it
+   succeeds". The package docs describe the stages without stating an order; the
+   ordering follows from that precondition, and from `DedupStage` filtering
+   "based on a notification log" that only a delivered notification writes.
+
+2. **Give the send its own exit status, and put the marker write inside the
+   success branch.** In a shell notifier that is `if notify "$@"; then <write
+   mark>; fi`; in a service, a send that returns an error instead of logging and
+   continuing. A notifier that always succeeds gives the marker nothing to
+   condition on.
+
+| Shell shape | Behaviour |
+|---|---|
+| `if notify "$@"; then <write mark>; fi` | The marker is unreachable on failure, at top level and inside a function alike, and the caller's status is unchanged |
+| `notify "$@" \|\| return 1` inside a function whose caller checks the status | Equivalent, and it also stops the rest of that function — under `set -e` the nonzero status propagates and aborts the caller, so use it only where aborting is the intent |
+| `notify "$@" \|\| return 1` at the top level of a script | `return` outside a function is an error; execution falls through to the marker line and the script still exits 0 — the defect this page is about, hidden behind a success code |
+
+3. **Make the send path injectable** — a command name, a function reference, or
+   an interface the test substitutes — so the suppression logic can be exercised
+   against both a succeeding and a failing sender.
+
+4. **Assert both worlds, as the three tests below:**
+
+| Test world | Assert |
+|---|---|
+| Send succeeds | The mark exists, and a second tick within the window sends nothing |
+| Send fails | No mark exists, and the next tick attempts the send again |
+| Send fails, then succeeds | Exactly one delivery total, and the mark dates from the successful attempt |
+
+5. **Keep the suppression window shorter than the time you are willing to be
+   blind**, and pair it with a heartbeat that proves the delivery path still
+   works — the Watchdog pattern is "an alert meant to ensure that the entire
+   alerting pipeline is functional", always firing, so that "if not firing then
+   it should alert external systems that this alerting system is no longer
+   working" ([infrastructure-observability-alerting]).
+
+6. **When the stub in an existing suite always fails, treat any test that
+   asserts the mark exists as a specification of the defect** and rewrite it
+   before changing the code — otherwise the correct fix arrives as a red suite
+   and reads as a regression ([testing-quality-tests-that-cannot-fail]).
+
+## Edge cases
+
+| Case | Then |
+|------|------|
+| The transport is fire-and-forget (UDP, a webhook whose 202 means "queued") | Mark on the strongest acknowledgement the transport gives, and state in the code comment what that acknowledgement does and does not prove |
+| A retry inside the send already covers transient failure | Keep the mark after the retry loop's overall result, not after the first attempt |
+| The failure is a permanent 4xx (bad webhook URL, revoked token) | Retrying every tick emits an unbounded error stream — mark it, and route the send-failure itself as its own condition so the broken channel is visible |
+| The condition and the notifier fail together (one network partition, one dead cluster) | Delivery cannot be repaired from inside the failing system; the heartbeat in step 5 is what makes the silence visible from outside |
+| The mark is a file whose write can fail | A failed mark write repeats the notification; a failed send that marks suppresses it — prefer the repeat, and log the mark-write failure |
+| Several processes share one mark | The mark is shared state; give it an atomic write (rename-into-place) so a partial write is not read as a valid recent send |
+
+## Instead of
+
+| If you are about to | Do this instead | Why |
+|---------------------|-----------------|-----|
+| Write the cooldown mark before calling the notifier | Call the notifier, check its status, write the mark on success | A delivery failure then buys silence for the whole window, at the moment the condition is live |
+| Let the notifier swallow its own error and always return 0 | Return the send's status and put the mark inside `if notify "$@"; then … fi` | With no status there is no way to distinguish "sent" from "attempted" |
+| Accept a suite that only ever runs the always-failing stub | Add the succeeding-sender world as a second harness fixture | A single-world harness reports the same verdict for correct and defective ordering ([testing-quality-harness-reverse-controls]) |
+| Widen the cooldown window because the channel is noisy | Group or route at the alert level and keep the window short | A long window and a lost send compound: the first failure hides the condition for the full window |
+
+## Sources
+
+- https://pkg.go.dev/github.com/prometheus/alertmanager/notify — stage contracts: `RetryStage` "notifies via passed integration with exponential backoff until it succeeds. It aborts if the context is canceled or timed out."; `SetNotifiesStage` "sets the notification information about passed alerts. The passed alerts should have already been sent to the receivers."; `DedupStage` "filters alerts. Filtering happens based on a notification log." — dedup reads the log that is written only after delivery
+- https://runbooks.prometheus-operator.dev/runbooks/general/watchdog/ — the Watchdog is "an alert meant to ensure that the entire alerting pipeline is functional", "always firing", and "if not firing then it should alert external systems that this alerting system is no longer working" — the external heartbeat of step 5
+- https://prometheus.io/docs/alerting/latest/configuration/ — `repeat_interval` is "How long to wait before repeating the last notification"; the suppression clock is described in terms of a notification, and the page states nothing about delivery attempts (so the attempt-vs-delivery distinction rests on the notify-package citation above, not on this one)
+- Field measurement 2026-08-07 (rtb-mac-server-k8s, `bin/gitops-deploy.sh`): the `alert-main-fetch` marker was written after a send whose webhook lookup had failed, so the following invocation suppressed the alert as "in cooldown". Moving the marker inside `if slack "$@"; then printf '%s' "$now" > "$f"; fi`, in a copy outside the repo, turned three existing tests red — the suite's always-failing stub had fixed the pre-send ordering as the expected contract