# Refactor: stub endpoints return 501 Not Implemented

**Task**: AZ-356_refactor_stub_endpoints_501
**Name**: Stub endpoints respond with HTTP 501
**Description**: Change `GetSatelliteTilesByMgrs` and `UploadImage` to return HTTP 501 with a problem-details body, and update OpenAPI metadata accordingly.
**Complexity**: 2 points
**Dependencies**: None
**Component**: Api
**Tracker**: AZ-356
**Epic**: AZ-350

## Problem

`SatelliteProvider.Api/Program.cs:177-180` (`GetSatelliteTilesByMgrs`) returns 200 OK with an empty payload. `Program.cs:182-185` (`UploadImage`) returns 200 OK with `Success=false`. Clients can't distinguish "stubbed" from "valid empty result" or "real failure".

## Outcome

- Both stub endpoints respond with HTTP 501 and a ProblemDetails body indicating "feature not implemented".
- OpenAPI document marks both endpoints as not-implemented.
- 37 unit + 5 smoke tests stay green.

## Scope

### Included
- Change handler return statements to `Results.Problem(statusCode: 501, title: "Not implemented", detail: <short description>)`.
- Update Swagger / OpenAPI annotations to reflect 501.

### Excluded
- Implementing the underlying functionality (out of scope for this run).
- Removing the endpoints (the routes are documented contract surface).

## Acceptance Criteria

**AC-1: Both stubs return 501**
Given a request to `GET /api/satellite/tiles/mgrs` or `POST /api/satellite/upload`
When the endpoint executes
Then the response is HTTP 501 with a ProblemDetails body.

**AC-2: OpenAPI marks them not-implemented**
Given the generated `swagger.json`
When inspected
Then the two endpoints declare `501` as a documented response.

**AC-3: Tests stay green**
Given the post-refactor build
When `scripts/run-tests.sh --smoke` runs
Then all 37 unit + 5 smoke scenarios pass (smoke does not exercise these endpoints).

## Constraints

- Endpoints stay registered (route shape preserved); only the response status + body change.

## Risks & Mitigation

**Risk 1: integrators may have probed the stubs and treated 200 as success**
- *Risk*: any caller that received 200 OK with empty body and proceeded as if the operation succeeded will now see 501.
- *Mitigation*: this is the fix the change exists to provide. Honest contract over polite-but-wrong success.

Full change entry: `_docs/04_refactoring/03-code-quality-refactoring/list-of-changes.md` (C05).
