fix(issuing): deserialize mid_limit card controls and complete control responses

[armando-rodriguez-cko]

Summary
Fixes and completes the issuing card control responses against the API reference. A mid_limit control could not be deserialized into CardControlResponse, because only the velocity and mcc subtypes were registered. The response now also exposes is_editable and the velocity limit's amount_remaining.

Changes

• GsonSerializer: registers MidCardControlResponse for mid_limit, next to the velocity and mcc subtypes
• CardControlResponse: adds isEditable; Javadoc on every field
• VelocityLimit: adds amountRemaining (Long), read-only and outside the builder, so it is filled from responses and never sent on requests
• VelocityCardControlResponse, MccCardControlResponse, MidCardControlResponse, MccLimit, MidLimit, VelocityWindow: Javadoc completed
• IssuingClient: Javadoc on the card control methods
• CardControlResponseSerializationTest (new): each subtype from the API reference example through CardControlResponse, full roundtrip, mid_limit regression, list response with all three subtypes, amount_remaining absent on requests

API Reference

• PUT /issuing/controls/{controlId} (update-control-response and its velocity, mcc and mid subtypes)
• GET /issuing/controls/{controlId}, GET /issuing/controls, POST /issuing/controls (same response types)

Breaking changes
None.

README
No change needed.

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:The PR only registers an already-existing class (MidCardControlResponse) in the existing Gson type adapter, adds read-only response fields (isEditable, amountRemaining) to existing response models, and adds Javadoc—no new endpoints, no new persisted data, no auth changes, and no new external integrations.

Operational gates

• ✅ jira_ticket (INT-1704)
• ✅ independent_review

Files analysed: 11

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
2.2.6_logical_extension — The PR only registers an already-existing class (MidCardControlResponse) in the existing Gson type adapter, adds read-only response fields (isEditable, amountRemaining) to existing response models, and adds Javadoc—no new endpoints, no new persisted data, no auth changes, and no new external integrations.	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:All changes are non-destructive additions (registering an already-existing MidCardControlResponse subtype, adding new response fields isEditable and amountRemaining as read-only, and adding Javadoc) that extend existing serialization/deserialization paths without introducing new endpoints, external integrations, persisted data, auth changes, or background processes.

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:The PR only registers an already-existing MidCardControlResponse subtype in the serializer, adds read-only/non-persisted fields (isEditable, amountRemaining) to existing response classes, and adds Javadoc—no new endpoints, external integrations, auth changes, persisted data, or background workers are introduced.

Operational gates

• ✅ jira_ticket (INT-1704)
• ✅ independent_review

Files analysed: 11

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
2.2.6_logical_extension — The PR only registers an already-existing MidCardControlResponse subtype in the serializer, adds read-only/non-persisted fields (isEditable, amountRemaining) to existing response classes, and adds Javadoc—no new endpoints, external integrations, auth changes, persisted data, or background workers are introduced.	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud