Four counters, one control question

Before you start

One control question — "list every user and whether MFA is on" — takes four wire shapes. You are handed the four machine-readable contracts (OpenAPI, WSDL, GraphQL SDL, .proto) and four real clean/broken capture pairs over the SAME eight users, and asked to LOCATE the MFA truth-field in each contract, decode the gRPC frame down to the literal bytes, recompute a SOAP credential digest, and click the single field where each broken capture breaks its control. Every value you reveal is the real parser/decoder/transform over the real artifact — the same bytes protobuf.dev verifies (a=150 → 08 96 01) and the spec grammars define. Nothing is invented; the decoder is the answer key. Start on the REST OpenAPI contract panel.