verify(P57): code review — 3 P0 auto-fixed, 2 P1+ flagged

Multi-persona review of the contract surface redesign (031887e + 10b87a6).

P0-1 (auto-fixed): scripts/run_platform.sh:437 read the uptime_enabled
feature flag from the OLD top-level contract.inputs.uptime_enabled path,
which P57 removed. With the new contract shape c.get('inputs',{}) returns
{} so the flag silently always defaulted to True — a consumer setting
uptime_enabled:false under infrastructure.<module>.inputs could NOT
disable uptime monitoring. Fixed to scan
infrastructure.<module>.inputs.uptime_enabled (any module false wins).

P0-2 (auto-fixed): docs/consumer-guide.md:417,472 documented the
${contract.module} interpolation token, but P57 dropped the `module`
field. _expand_vars fails loud (D-081) on unknown tokens, so a consumer
following the documented bucket_name example
(acdl-${env.environment}-${contract.module}-...) hit a hard ValueError
at resolve time. Replaced with ${contract.id} (the surviving short
acronym field) in both the example and the interpolation reference table.

P0-3 (auto-fixed): core/regression_verify.py CAP-006 and
tests/test_consumer_guide_per_env_section.py both asserted the dropped
${contract.module} token. Updated CAP-006 to use ${contract.id} and the
doc test to assert ${contract.id} present / ${contract.module} absent.

P1+ flags (post-hoc):
- P1: _namespace_resources does not rewrite ref: targets in
  stack.outputs[].from for cross-module refs (within-module is handled;
  multi-module refs across fragments are not wired today, but no
  contract uses them yet).
- P1: _latest_version raises ValueError (not a clear message) on a
  malformed semver string in the registry; the schema pins version to
  ^\d+\.\d+\.\d+$ so this is unreachable from a contract, but registry
  authors have no guardrail.
- P2: docs/consumer-guide.md:407 example path uses .yaml extension while
  the repo-wide rename standardized on .yml (consumer-repo paths, not
  platform, so non-blocking).

---ci---
project: acdl
phase: 57
milestone: v1.10.2
status: verify
lessons:
  - P0 fix applied: uptime_enabled read path migrated to infrastructure.<module>.inputs (was stale top-level contract.inputs)
  - P0 fix applied: docs + tests migrated off dropped ${contract.module} interpolation token to ${contract.id}
---/ci---

scripts/run_platform.sh

@@ -431,10 +431,26 @@ echo ""
 echo "=== Step 9b: deploy uptime monitoring (separate state) ==="
 # The uptime stack is deployed by default after the L2 module. It uses a
 # separate terraform state ($WORK/uptime-tf). Endpoints from the L2 outputs
-# are passed as monitored_endpoints. The feature flag (inputs.uptime_enabled,
+# are passed as monitored_endpoints. The feature flag (uptime_enabled,
 # default true) controls whether this step runs.
+#
+# P57 contract shape: uptime_enabled is a per-module input under
+# infrastructure.<module>.inputs.uptime_enabled (the old top-level
+# contract.inputs.uptime_enabled was removed). Scan every module's inputs;
+# any module setting uptime_enabled=false disables the uptime step (one
+# contract = one logical stack, so a single false wins).
 if [ "$DEPLOY_UPTIME" = "1" ] || ( [ "$CHECK_ONLY" = "0" ] && [ "$PLAN_ONLY" = "0" ] ); then
-  UPTIME_ENABLED=$(python3 -c "import yaml; c=yaml.safe_load(open('$CONTRACT')); print(c.get('inputs',{}).get('uptime_enabled', True))" 2>/dev/null || echo "True")
+  UPTIME_ENABLED=$(python3 -c "
+import yaml
+c = yaml.safe_load(open('$CONTRACT'))
+infra = c.get('infrastructure', {})
+# Default true; a module may override to false.
+for m, entry in infra.items():
+    if isinstance(entry, dict) and entry.get('inputs', {}).get('uptime_enabled') is False:
+        print('False'); break
+else:
+    print('True')
+" 2>/dev/null || echo "True")
   if [ "$UPTIME_ENABLED" = "True" ] || [ "$UPTIME_ENABLED" = "true" ]; then
     echo "uptime: feature flag enabled — constructing uptime contract"
     UPTIME_DIR="$WORK/uptime-tf"