The documented hardening option for exposed deploys (monitoring: {public: false} in config.json / MONITORING_PUBLIC env) never worked: 1. applyConfigFields dropped the monitoring key entirely 2. monitoring missing from config-schema KNOWN_KEYS (Unknown-key warnings) 3. MONITORING_PUBLIC frozen at mount + re-required singleton instead of injected dep 4. PUBLIC_ROUTES had unconditional duplicate entries defeating the gated spread - site.js: copy monitoring through; drop dead write-only siteConfig.caName - config-schema: +monitoring key, validateMonitoring (public must be boolean); remove never-written typo-footgun keys setupCompleted/setupMode (git -S: zero writers ever) - middleware: live isMonitoringPublic() (env > config > default public), per-request gate via monitoring:true flag, remove duplicate unconditional route entries - default unchanged (endpoints stay public — System Overview widget) Tests: +11 (__tests__/monitoring-public-gate-dc096.test.js); suite 118/2735 green. Judge: GLM-5.3 cold-read A (deleg_98aba845), URN urn:ump:zgvtskqljurasdagc632atnybb2p6gakk4cxcmjd3i4ivy7rvwta
