docs(issuing): document card control responses

[armando-rodriguez-cko]

Summary
Documents the issuing card control responses against the API reference and fixes the return documentation of the card control methods, which all described a card response.

Changes

• src/api/issuing/controls.js: JSDoc typedefs for the control response (base fields, the velocity, mcc and mid subtypes, amount_remaining, is_editable), the list and the delete responses; @return corrected on the five card control methods
• test/issuing/controls/controls-unit.js: one unit test per update subtype (velocity, mcc, mid) with the API reference example, asserting every field

API Reference

• PUT /issuing/controls/{controlId} (update-control-response and its subtypes)
• GET /issuing/controls/{controlId}, GET /issuing/controls, POST /issuing/controls, DELETE /issuing/controls/{controlId}

Breaking changes
None.

README
No change needed.

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:The diff contains only JSDoc type definitions and corrected @return annotations in existing source files, plus new unit tests — no runtime logic, endpoints, auth, persistence, or external integrations are added or changed.

Operational gates

• ✅ jira_ticket (INT-1704)
• ✅ independent_review

Files analysed: 2

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
2.2.6_logical_extension — The diff contains only JSDoc type definitions and corrected @return annotations in existing source files, plus new unit tests — no runtime logic, endpoints, auth, persistence, or external integrations are added or changed.	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• no_low_class_matched
• prod_source_modified
• 2.2.6_logical_extension:The PR only adds JSDoc typedefs and corrects @return annotations in existing source files plus adds unit tests, introducing no new code paths, endpoints, persisted data, auth changes, or external integrations.

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}