docs(specs): record that the artifact delete gate has cleared

Summary

monolith/S14 and monolith/S06 both defer their row-menu delete actions to S17 Phase 4 and describe that gate as still closed. S14 lists the dependency as Planned; S06 lists it as In progress and says a registered arm answers 501 until its handler lands. Phase 4 is complete, and every delete handler ships in AR v1.423.0 and later, so a reader planning this work concludes it is blocked upstream when it is not.

The delete actions stay Phase 2 of both specs. Phase 1 is being implemented and its acceptance criteria do not move. What changes is the recorded reason the deletes are deferred: each spec's own sequencing, rather than a missing endpoint.

Per spec:

• The ### Cross-spec S17 Phase 4 rows carry a compound state, separating the served delete endpoints from the tag writes that are still missing. Both tables already use the compound form elsewhere.
• The Phase 2 tables split the write-actions row, so the delete half names the cleared gate and the tag half keeps the per-manifest tags field and the undeclared npm dist-tag upsert route it genuinely waits on.
• Both Phase 2 intros said every row is blocked on a named AR gap, which an unblocked row would contradict, so each now says most are.
• Three prose sites claimed the delete items have no endpoint or are unreachable in any state. They are reachable, so that reason no longer carries them: S14's row-actions paragraph, S06's delete-file row, and S06's header kebab bullet.
• The ## Resolutions entries keep their original reasoning, including S06's corrected 500-versus-501 note, and gain an Update: recording what has landed and what the posture now rests on.

Unchanged on purpose: the npm dist-tag create-or-move route is still not declared in the contract, so npm tag management stays removal-only and the add-and-move deferral stands. No artifact download route is declared either, and that deferral stands too.

Version claims are pinned to v1.423.0 rather than written as bare present tense, per "A Claim Time Will Falsify Names What It Is True At" in AGENTS.md.

Review updates

Two rounds of review landed after the first push.

e8a423ad applied the two Duo suggestions and pasted both of them badly: monolith/S06's Phase 2 intro gained a duplicated half-sentence and lost the Compatibility clause its own Compatibility section relies on, and S14's read-surface paragraph gained a dangling and the plus a second copy of the "no download route" claim. 92cc157f restores both to the single intended sentence.

92cc157f also finishes what this MR set out to do, per maintainer review. Four sites still gave the pre-MR cause, "no artifact write route answers yet", which is the exact misreading this MR exists to remove:

• S14 ## Summary, ## GraphQL surface, and the ## Resolutions Row-action ownership bullet. Each now says Phase 1 defines no mutation because the surface's own phasing puts every write in Phase 2, and names what is served (v1.423.0 deletes) against what is absent.
• S06 ## GraphQL surface, which carried the identical claim and was not in the first diff. Same defect in the sibling file, so it is corrected here rather than left to contradict S06's own Cross-spec row.

S14's ## Resolutions Row actions bullet said every other row item "has none in any state", contradicting the paragraph it summarizes. It now separates the tag and download items, which have no endpoint, from the delete items, which have one this slice defers.

Two changes beyond what review raised, both found while checking the reviewed text:

• S14's Cross-spec S17 Phase 4 row was stale on the tag half. It read tag-write endpoints, partly missing | Planned (tag writes). Container tag upsert and untag are declared and served — internal/managementapi/container_tag_upsert.go from v1.337.0 and container_tag_delete.go from v1.307.0 — so the only tag-write gap is the npm dist-tag create-or-move route the contract does not declare. The row now carries the same compound state S06's already does, and the paragraph above it says the Tags column is held back by a read, the per-manifest tags field.
• S14's Summary no longer claims the contract "exposes none of" the design's Phase 2 asks. That was already false for the npm version size, which the Resolutions section records as serialized. The sentence does not need the claim to make its point, so it is gone rather than qualified.

e1a07184 drops a trailing clause from S14's ## Summary: "…not because no write route answers." Restating the false cause in order to deny it left the spec grepping to the wording review had flagged, and a reader clipping the clause carries off the claim it refuses. The paragraph already names the deletes as served as of AR v1.423.0 two lines up.

The ### Phase 2 (deferred, gated on AR contract extensions) heading keeps its wording. monolith/S05 and S14 carry 16 anchors to it, and the intro's carve-out already names the exception, so the rename buys a heading that would still need the intro to say which rows are which.

Governing ADRs

• ADR-009 API design: the delete routes this change describes are the format-specific artifact APIs ADR-009 defines, and both specs already cite "per ADR-009 / S17" on their endpoint tables. Conforms; no contract shape changes here.
• ADR-014 frontend to Artifact Registry: these are monolith specs, so the boundary ADR-014 sets (AR exposes REST, the monolith owns GraphQL) governs them. Conforms; the change records which REST routes are served and does not move the boundary.

No deviation, so no handbook ADR amendment is needed. This MR changes no contract, only the recorded state of one.

Testing

Docs-only. No code paths change.

• markdownlint-cli2 on both files: 0 errors.
• vale --minAlertLevel error on both files: 0 errors.
• lychee --offline --include-fragments on both files: 0 errors, 98 OK, so the new and existing anchors all resolve.
• Baseline confirmed clean on both files before editing, so the results above are attributable to this change rather than inherited.

The claims themselves were checked against origin/main of this repo rather than a local branch: S17 Phase 4 is closed and workflow::complete, the seven delete handler files carry no 501 stubs, and git tag --contains on the last of them (container_manifest_delete.go) gives v1.423.0 as the earliest release.

The 92cc157f round ran the full pre-commit chain on both files with no skips, lychee included, and every hook passed. The lychee hook failure noted on the first round did not recur, which supports it having been environmental.

Related to gitlab-org/gitlab#627172