Complete bot-installation drift audit

audit_bot_installations, discord://connector/installations, the audit_bot_installations prompt, get_connector_status, setup, online doctor, and smoke share one implementation that compares the exact configured guild set with the bot's complete bounded installed-guild inventory. The caller supplies no guild, application, bot, cursor, limit, write instruction, or remediation choice. Every audit requires the authenticated current application and bot to match the configured identity pins, then reads Discord's Get Current User Guilds endpoint from the zero cursor in fixed pages of 200 with with_counts=false.

The REST boundary accepts only a bounded array of unique canonical positive guild snowflakes, immediately projects every object to its ID, and discards names, icons, ownership, permissions, features, approximate member and presence counts, unknown values, and raw payloads. The audit advances only to the greatest verified ID, rejects duplicate or non-advancing evidence across pages, limits each response body to 8 MiB, and refuses to return partial results when malformed evidence, transport failure, pagination drift, an unsafe count, or more than 400 installed guilds prevents complete local proof. An exact 400-guild inventory requires an additional empty terminal page.

The result returns the verified application and bot IDs, sorted configured and installed ID sets, their exact installed-in-scope intersection, exact missing configured IDs, exact unexpected installed IDs, page and bound evidence, discarded-field counts, and a fixed privacy projection. Unexpected IDs are diagnostic visibility only: they do not enter read scope, grant any tool authority, rewrite the configuration, or trigger automatic guild departure. Missing configured IDs fail setup and online verification; unexpected IDs produce an explicit warning so the operator can remove an unintended installation in Discord or add the exact guild to policy only after a deliberate scope review. Nothing is cached, logged, journaled, exported, or persisted.

complete means the bounded pagination contract reached a short or empty terminal page without invalid evidence. Discord does not provide an atomic multi-page snapshot, so a concurrent installation or departure may invalidate a page or produce a point-in-time classification that should be rerun after membership changes settle. The audit proves installation membership only, not channel visibility, effective permissions, consent, future availability, or write authority.

Canonical source: docs/reference.md