CTC Runtime Request Log Analysis¶

Classification: OBSERVED-FACT
Captured: historical request-log analysis date not recorded in the source
Status: DATED ANALYSIS / HISTORICAL INPUT
Current owner: .agents/rules/API_CONTRACTS.md for current API/runtime contract; this document retains only the captured observations below

Purpose¶

This document captures high-level findings from runtime request logs. It is not the API source of truth. Findings that mention removed shared controllers are historical context; current contracts live in .agents/rules/API_CONTRACTS.md.

Findings¶

Finding	Implication
Shared `query.php` and `post.php` previously received important traffic	Shared controllers were removed only after direct endpoint/API v2 caller migration and smoke tests.
Historical jTable traffic justified a staged cutover	Active application list callers now use explicit API v2 routes; the bounded compatibility artifact was removed after zero-caller verification.
Page shell can render before AJAX fails	Page-level module guard must run before including page files.
Impersonation changes effective tenant	Module guard must use `getClientId()` result, not raw session `CLIENT_ID`.
API failures can strand UI promises	Frontend wrappers must reject or surface errors.

Validation Targets¶

/mk-commercial-orders
/transload-planner
/list?type=COMPANY_LIST
/admin-console
direct module endpoints under app/systems/*

Regression Checks¶

Enabled tenant page loads and data requests succeed.
Disabled tenant receives module-disabled page or HTTP 403 JSON envelope.
Super-admin impersonating disabled tenant is blocked as target tenant.
AJAX wrappers reject or recover on ERROR, 401, 403, and 500.

Source Links¶

.agents/rules/API_CONTRACTS.md
.agents/rules/ARCHITECTURE.md
.agents/rules/API_V2_CONTRACT_INVENTORY.md
docs/ROADMAP.md

---¶

Source: docs/research/runtime/CTC_RUNTIME_REQUEST_LOG_ANALYSIS.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.