@fleetless/contracts 1.0.0 → 1.0.3

package/dist/audit.js

@@ -2,13 +2,13 @@
 import { z } from 'zod';
 import { wireSeqCursor, wireTimestampMs } from './common.js';
 /**
- * Audit (spec §16). Every state-changing interaction is recorded and **every
- * entry carries its actor — never anonymous** (§16.2). Reads are not audited.
+/**
+ * Audit. Every state-changing interaction is recorded and **every entry carries
+ * its actor — never anonymous**. Reads are not audited.
  *
- * W3 writes the events that exist once identities do: logins, failed logins,
- * end-user management, config publishes, bridge connect/disconnect. The view
- * with filters, CSV export and the 90-day retention window is W6 (André,
- * 2026-08-10) — same shape of work as the history API.
+ * What is written: logins, failed logins, user management, configuration
+ * publishes, bridge connect and disconnect. The log is filterable, exportable
+ * as CSV, and kept for ninety days.
  */
 /**
  * The kinds of actor the platform knows. `label` is what a human reads in the
@@ -16,7 +16,7 @@ import { wireSeqCursor, wireTimestampMs } from './common.js';
  * resolve four different id kinds to render a row.
  *
  * **`end_user` stays, and it stays for the rows already written.** The
- * two-space cut (2026-09-05, D1) replaced the org's one user pool with
+ * split into two identity spaces replaced the org's one user pool with
  * Fleetless users and per-app app users; every new row an app user writes
  * carries `app_user`. But an audit log is the one thing this platform must
  * never rewrite, and there are stored rows whose `kind` is `end_user`. Dropping
@@ -24,9 +24,8 @@ import { wireSeqCursor, wireTimestampMs } from './common.js';
  * cannot be read back is worse than one carrying a retired word.
  *
  * So this enum is deliberately **wider than what any producer emits**: nothing
- * writes `end_user` any more, and nothing may start again. That is the kind of
- * claim this repository has been wrong about before by leaving it unsaid, so it
- * is said here rather than inferred from a `grep` somebody runs in a year.
+ * writes `end_user` any more, and nothing may start again. That is said here
+ * rather than left to be inferred from a search somebody runs in a year.
  *
  * `developer` is a Fleetless user. It kept its name through both redesigns
  * because it was always right about what it named: the person who configures
@@ -42,8 +41,7 @@ export const auditEvent = z.object({
     org_id: z.uuid(),
     at: z.iso.datetime(),
     /**
-     * A monotonic counter, ascending in write order, unique across the log
-     * (W6b).
+     * A monotonic counter, ascending in write order, unique across the log.
      *
      * `at` is not a total order. Two events written in the same millisecond —
      * a login and the config publish it enables, a cascade writing several
@@ -55,11 +53,7 @@ export const auditEvent = z.object({
      *
      * It is also the only correct **cursor** for paging this log, for the same
      * reason: a cursor that is not unique either skips rows or repeats them at
-     * every page boundary. No cursor parameter exists on `GET /api/audit` yet —
-     * the route returns the whole log — and that is stated here rather than
-     * implied, because a contract that describes a capability the API does not
-     * have is the defect this project keeps finding. When paging is added it
-     * uses this field; nothing else in this shape can carry it.
+     * every page boundary. Nothing else in this shape can carry one.
      *
      * Required, not optional: an event without a sequence cannot be ordered
      * against one that has it, and a log with two orderings has none.
@@ -94,12 +88,7 @@ export const auditEvent = z.object({
     details: z.record(z.string(), z.unknown()).nullable(),
 });
 /**
- * **How this log is read (W9d, DEF-078 and DEF-123).**
- *
- * Until now `GET /api/audit` returned the **whole** log — no filters, no
- * cursor. `auditEvent.seq`'s own comment has said so plainly since W6b rather
- * than describing a capability the API does not have; this shape builds
- * exactly what that comment announced.
+ * **How this log is read.**
  *
  * **The cursor is `seq`, and no other field can be.** `at` is not a total
  * order: two events written in the same millisecond sort differently on every
@@ -109,10 +98,6 @@ export const auditEvent = z.object({
  *
  * `before_seq` rather than `after_seq`, because this log is read **newest
  * first**: the next page is older, not newer.
- *
- * **Filters are part of the same work, not a later garnish.** A console view
- * without them is a page with nothing to filter by — the register row says
- * exactly that, which is why the two rows are one piece of work.
  */
 /**
  * A unix-millisecond bound a Postgres `timestamptz` can actually hold.
@@ -129,7 +114,7 @@ export const auditQuery = z.object({
     /** Only events with a smaller `seq` — the next, older page. */
     before_seq: wireSeqCursor.optional(),
     /**
-     * Same shape as DEF-059's `historyQuery.limit`: a union whose input branch
+     * The same shape as `historyQuery.limit`: a union whose input branch
      * **is the wire**. A `z.coerce` cannot be published — zod renders the
      * coercion's result in either `io` direction, so the artifact would describe
      * a shape a query string can never carry.
@@ -162,36 +147,25 @@ export const auditQuery = z.object({
     /**
      * Only events by this actor.
      *
-     * **`z.uuid()`, because the column is one (Argus-W9, W9 review).** This was
-     * `z.string().min(1).max(200)`, so any non-uuid value reached Postgres as a
-     * uuid parameter and threw: `?actor_id=not-a-uuid` answered **500
-     * `internal_error`**, on the list route and the export alike.
-     *
-     * Not a SQL-injection finding — Drizzle parameterises, and `' or 1=1--`
-     * failed at the same cast. It is a **500 where a 400 belongs**, and a 500 is
-     * the answer that explains nothing.
+     * **`z.uuid()`, because the column is one.** A looser string type lets any
+     * non-uuid value reach the database as a uuid parameter, where the cast
+     * throws: `?actor_id=not-a-uuid` then answers **500 `internal_error`** rather
+     * than refusing the value.
      *
-     * The place is the part worth keeping: **this same wave pulled
-     * `refuseIfNotUuid` through ~15 call sites** so a typo could be told from a
-     * deletion — and the brand-new filter, whose field has exactly that shape,
-     * is the one that did not get it. A rule applied to the sites in front of
-     * you is not a rule applied to the class.
+     * Not an injection question — the query is parameterised either way. It is a
+     * **500 where a 400 belongs**, and a 500 is the answer that explains nothing.
      */
     actor_id: z.uuid().optional(),
     /** Only events about this kind of target, e.g. `robot`. */
     target_kind: z.string().min(1).max(40).optional(),
     /**
      * Absolute bounds in unix milliseconds, **half-open `[from, to)`** — the
-     * same rule the history shapes follow (DEF-062).
+     * same rule the history shapes follow.
      *
-     * **Bounded to years 1..9999, and the bound is borrowed rather than
-     * invented.** `nonnegative()` alone let `253402300800000` (year 10000)
-     * through, where the Postgres bind path has no representation and the route
-     * answered 500 — measured either side of the edge: `253402300799000` → 200,
-     * `253402300800000` → 500 (Argus-W9). `history-query.ts`'s `parseTimeExprMs`
-     * already carries exactly this range, with M3's reasoning for why
-     * `Number.isSafeInteger` is wider than what a timestamp can be; this is that
-     * same number, not a second one that happens to agree.
+     * **Bounded to years 1..9999.** `nonnegative()` alone admits instants a
+     * timestamp column has no representation for, and the route answers 500
+     * rather than refusing the value. `Number.isSafeInteger` is wider than what a
+     * timestamp can be, so the bound is stated rather than inherited.
      */
     from_ms: auditTimestampMs.optional(),
     to_ms: auditTimestampMs.optional(),
@@ -216,7 +190,7 @@ export const auditListResponse = z.object({
     next_cursor: z.number().int().positive().nullable(),
 });
 /**
- * **What a CSV export of this log looks like (DEF-123, spec §16.3).**
+ * **What a CSV export of this log looks like.**
  *
  * The column order lives here because otherwise the cloud and the console
  * would each carry their own, and nobody would notice them drifting apart
@@ -229,10 +203,9 @@ export const auditListResponse = z.object({
  */
 export const AUDIT_CSV_COLUMNS = ['seq', 'at', 'actor_kind', 'actor_id', 'action', 'target_kind', 'target_id', 'target_label', 'details'];
 /**
- * Spec §16.3: the audit log is kept for **90 days**.
+ * The audit log is kept for **90 days**.
  *
- * A constant here so the cloud does not derive it a second time — the same
- * reasoning as `ASSET_UPLOAD_MAX_BYTES`, and the same register row that found
- * there is no purge touching audit rows at all.
+ * A constant here so no consumer derives it a second time — the same reasoning
+ * as `ASSET_UPLOAD_MAX_BYTES`.
  */
 export const AUDIT_RETENTION_DAYS = 90;

package/dist/client-auth.d.ts

@@ -1,9 +1,9 @@
+// SPDX-License-Identifier: Apache-2.0
 import { z } from 'zod';
 /**
- * **The client auth API: the whole of what an app user's browser talks to**
- * (spec `2026-09-05-app-user-auth`, §4).
+ * **The client auth API: the whole of what an app user's browser talks to.**
  *
- * Fleetless shows an app user **no page** (D2). The developer's own UI owns
+ * Fleetless shows an app user **no page**. The developer's own UI owns
  * every screen — login, registration, verification, invitation acceptance,
  * password reset, the provider buttons, the MCP consent — and calls these
  * routes as JSON. The hosted, app-branded login and consent pages this file
@@ -23,7 +23,7 @@ import { z } from 'zod';
  * anything else is parsed as a JWT. That rule is written down once, here, so
  * the SDK and the cloud cannot drift into disagreeing about it.
  *
- * **The enumeration discipline is the design's, not a preference** (§4):
+ * **The enumeration discipline is deliberate, not a preference:**
  * `register`, `resend-verification` and `password/reset` answer `202` for every
  * policy-allowed request whether or not the address exists, and `login` answers
  * the identical `invalid_credentials` for a wrong password, a `blocked` account
@@ -61,7 +61,7 @@ export declare const clientLogoutRequest: z.ZodObject<{
 }, z.core.$strip>;
 export type ClientLogoutRequest = z.infer<typeof clientLogoutRequest>;
 /**
- * **Self-registration** (D6) — and the account it creates cannot log in yet.
+ * **Self-registration** — and the account it creates cannot log in yet.
  *
  * `register` writes the user as `pending_verification` and mails the app's
  * `verify_url`. Without that step the domain whitelist would prove nothing:
@@ -221,7 +221,7 @@ export type ClientOidcStartQuery = z.infer<typeof clientOidcStartQuery>;
  * `state` is the one required field because it is the one Fleetless minted: it
  * resolves the `oidc_interactions` row that holds the app's `redirect_uri`,
  * and without it there is nowhere to send any answer, success or failure. That
- * is the single case where the cloud renders a page of its own (D2).
+ * is the single case where the cloud renders a page of its own.
  *
  * It exists as a schema rather than as four parameters read by hand because
  * the manifest forbids the second: a documented route whose prose names a
@@ -244,7 +244,7 @@ export type ClientOidcExchangeRequest = z.infer<typeof clientOidcExchangeRequest
 /**
  * **Why a federated sign-in ended without a session, in a code the app can
  * branch on** — carried back to the app's own `redirect_uri` as `error`, not
- * rendered by Fleetless (D2). The only Fleetless-rendered page in this flow is
+ * rendered by Fleetless. The only Fleetless-rendered page in this flow is
  * the one for a state that can no longer be resolved to a redirect URI, because
  * then there is nowhere to send the answer.
  *
@@ -293,7 +293,7 @@ export declare const clientOidcErrorCode: z.ZodEnum<{
 export type ClientOidcErrorCode = z.infer<typeof clientOidcErrorCode>;
 /**
  * **A pending MCP authorization, as the app's own consent screen reads it**
- * (D7). Fleetless renders no page here either: `authorize` redirects to the
+ * Fleetless renders no page here either: `authorize` redirects to the
  * app's `mcp_login_url` with an interaction id, the app authenticates the user
  * with its normal UI, shows this, and approves or denies through the API.
  *
@@ -388,7 +388,7 @@ export type McpConsentGrantListResponse = z.infer<typeof mcpConsentGrantListResp
  * quietest way for a cut like this to go wrong.
  *
  * **`act` is gone.** It named the org admin behind an impersonation (the RFC
- * 8693 pattern). Impersonation is deleted with no successor (D1), so a field
+ * 8693 pattern). Impersonation is deleted with no successor, so a field
  * that could still arrive would describe a delegation nothing can mint — and a
  * client rendering "you are acting as …" from it would be showing a state the
  * platform cannot enter.

package/dist/client-auth.js

@@ -4,10 +4,9 @@ import { appIdentifier } from './apps.js';
 import { APP_USER_DISPLAY_NAME_MAX, providerSlug } from './app-users.js';
 import { password } from './identity.js';
 /**
- * **The client auth API: the whole of what an app user's browser talks to**
- * (spec `2026-09-05-app-user-auth`, §4).
+ * **The client auth API: the whole of what an app user's browser talks to.**
  *
- * Fleetless shows an app user **no page** (D2). The developer's own UI owns
+ * Fleetless shows an app user **no page**. The developer's own UI owns
  * every screen — login, registration, verification, invitation acceptance,
  * password reset, the provider buttons, the MCP consent — and calls these
  * routes as JSON. The hosted, app-branded login and consent pages this file
@@ -27,7 +26,7 @@ import { password } from './identity.js';
  * anything else is parsed as a JWT. That rule is written down once, here, so
  * the SDK and the cloud cannot drift into disagreeing about it.
  *
- * **The enumeration discipline is the design's, not a preference** (§4):
+ * **The enumeration discipline is deliberate, not a preference:**
  * `register`, `resend-verification` and `password/reset` answer `202` for every
  * policy-allowed request whether or not the address exists, and `login` answers
  * the identical `invalid_credentials` for a wrong password, a `blocked` account
@@ -74,7 +73,7 @@ export const clientLogoutRequest = z.object({
 });
 /* ---------------------------------------------- registration and mails -- */
 /**
- * **Self-registration** (D6) — and the account it creates cannot log in yet.
+ * **Self-registration** — and the account it creates cannot log in yet.
  *
  * `register` writes the user as `pending_verification` and mails the app's
  * `verify_url`. Without that step the domain whitelist would prove nothing:
@@ -272,7 +271,7 @@ export const clientOidcStartQuery = z.object({
  * `state` is the one required field because it is the one Fleetless minted: it
  * resolves the `oidc_interactions` row that holds the app's `redirect_uri`,
  * and without it there is nowhere to send any answer, success or failure. That
- * is the single case where the cloud renders a page of its own (D2).
+ * is the single case where the cloud renders a page of its own.
  *
  * It exists as a schema rather than as four parameters read by hand because
  * the manifest forbids the second: a documented route whose prose names a
@@ -307,7 +306,7 @@ export const clientOidcExchangeRequest = z
 /**
  * **Why a federated sign-in ended without a session, in a code the app can
  * branch on** — carried back to the app's own `redirect_uri` as `error`, not
- * rendered by Fleetless (D2). The only Fleetless-rendered page in this flow is
+ * rendered by Fleetless. The only Fleetless-rendered page in this flow is
  * the one for a state that can no longer be resolved to a redirect URI, because
  * then there is nowhere to send the answer.
  *
@@ -356,7 +355,7 @@ export const clientOidcErrorCode = z.enum([
 /* ------------------------------------------------ MCP, delegated login -- */
 /**
  * **A pending MCP authorization, as the app's own consent screen reads it**
- * (D7). Fleetless renders no page here either: `authorize` redirects to the
+ * Fleetless renders no page here either: `authorize` redirects to the
  * app's `mcp_login_url` with an interaction id, the app authenticates the user
  * with its normal UI, shows this, and approves or denies through the API.
  *
@@ -457,7 +456,7 @@ export const mcpConsentGrantListResponse = z.object({
  * quietest way for a cut like this to go wrong.
  *
  * **`act` is gone.** It named the org admin behind an impersonation (the RFC
- * 8693 pattern). Impersonation is deleted with no successor (D1), so a field
+ * 8693 pattern). Impersonation is deleted with no successor, so a field
  * that could still arrive would describe a delegation nothing can mint — and a
  * client rendering "you are acting as …" from it would be showing a state the
  * platform cannot enter.

package/dist/common.d.ts

@@ -1,7 +1,8 @@
+// SPDX-License-Identifier: Apache-2.0
 import { z } from 'zod';
 /**
  * Names shared by every layer: the Fleetless slug and the ROS names it is
- * deliberately decoupled from (spec §4.1).
+ * deliberately decoupled from.
  *
  * They live here rather than in `protocol.ts` so the exposure model
  * (`config.ts`) and the bridge protocol can both use them without importing
@@ -18,16 +19,11 @@ import { z } from 'zod';
  * Each is used **twice**: as the message zod itself produces, here, and as
  * `patternErrorMessage` in `config.ts`'s exported JSON Schema, which is a
  * published artifact that other tools validate against and that a person
- * reads. Under FL-005 D3 nothing will consume `patternErrorMessage` at runtime
- * **once wave 3 lands** — `useMonacoYaml.ts` still passes `validate: true`
- * today, so until then this sentence IS the live diagnostic in the editor and
- * zod's is the live one on the server. Either way it is a second spelling of a
- * live rule, and an unwatched one would drift word for word,
- * forever and invisibly — the shape that had `buildAcceptUrl` mailing one URL
- * three ways. They are therefore one constant with two readers rather than two
- * strings that happen to agree, and `config-zod-messages.test.ts` asserts the
- * two readings are the same string at all 24 pattern positions the document
- * has.
+ * reads. Either way it is a second spelling of a live rule, and an unwatched
+ * second spelling drifts word for word, forever and invisibly. They are
+ * therefore one constant with two readers rather than two strings that happen
+ * to agree, and `config-zod-messages.test.ts` asserts the two readings are the
+ * same string at every pattern position the document has.
  *
  * **They are exported because the pattern and its sentence must not be able to
  * move apart**, and the pattern is here while the schema annotation is in
@@ -35,15 +31,13 @@ import { z } from 'zod';
  * document — the two URL schemes and the capture-device path — are constants in
  * `config.ts` beside their own patterns, on the same rule.
  *
- * **The blast radius of putting the sentence here was measured, and it is
- * zero artifacts.** A `.meta()` on `slug` would reach 42 of the 159 published
- * schema artifacts, the bridge's vendored protocol frames among them — which is
- * why `mapKey` in `config.ts` carries the annotation and `slug` does not. A
- * message on a `.regex()` check is a different thing: zod renders no error
- * message into JSON Schema at all, so every artifact is byte-identical either
- * way (measured across all 278 barrel schemas under both `io` modes,
- * 2026-09-03). What it does reach is the sentence a *parser* produces, in every
- * layer that parses one of these names — which is the improvement, not a cost.
+ * **Putting the sentence here changes no published artifact.** A `.meta()` on
+ * `slug` would reach dozens of the published schemas — which is why `mapKey` in
+ * `config.ts` carries the annotation and `slug` does not. A message on a
+ * `.regex()` check is a different thing: zod renders no error message into JSON
+ * Schema at all, so every artifact is byte-identical either way. What it does
+ * reach is the sentence a *parser* produces, in every layer that parses one of
+ * these names — which is the improvement, not a cost.
  */
 export declare const SLUG_RULE = "A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore \u2014 `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.";
 /**
@@ -51,7 +45,7 @@ export declare const SLUG_RULE = "A name is lower-case: it starts with a letter,
  * message name. Lowercase, underscore-separated, letter-initial, 2..63
  * characters, no leading/trailing/doubled underscores.
  *
- * Names are stable and decoupled from ROS names (spec §4.1) — renaming a
+ * Names are stable and decoupled from ROS names — renaming a
  * topic on the robot must never break a client app. The reverse also holds
  * and costs more: changing a name breaks every client, role grant and MCP
  * tool name that uses it.
@@ -67,9 +61,9 @@ export declare const rosName: z.ZodString;
 export declare const ROS_TYPE_NAME_RULE = "A ROS 2 type name has three segments: the package, then `msg`, `srv` or `action`, then the type \u2014 `sensor_msgs/msg/BatteryState`, `std_srvs/srv/Trigger`, `nav2_msgs/action/NavigateToPose`. The middle segment is the one usually left out. The package is lower-case with underscores; the type itself is letters and digits, conventionally CamelCase.";
 /**
  * A ROS interface type as ROS 2 spells it: `pkg/msg/Type`, `pkg/srv/Type`,
- * `pkg/action/Type`. W2 resolves field trees for `msg` only (§4.5); the
- * other two are listed by the introspection browser and get their trees in
- * W4, where action and service parameters exist.
+ * `pkg/action/Type`. Introspection resolves a field tree for each of the
+ * three; a message has one flat list, a service and an action have one tree
+ * per part.
  */
 export declare const rosTypeName: z.ZodString;
 export declare const FIELD_PATH_RULE = "A field path is dotted and lower-case, and each segment may index at most one array level \u2014 `voltage`, `pose.position.x`, `ranges[0]`. ROS 2 has no nested arrays, so a second index on one segment could name nothing that exists.";
@@ -77,15 +71,15 @@ export declare const FIELD_PATH_RULE = "A field path is dotted and lower-case, a
  * A path into a message: dot-separated field names, each carrying **at most
  * one** array index, e.g. `percentage`, `pose.position.x`, `ranges[0]`,
  * `poses[0].pose.position.x`. `null` in a datapoint config means *the whole
- * message* (spec §4.2: one field or one whole topic — never several topics).
+ * message*: one field or one whole topic, never several topics.
  *
  * One index per segment is not a preference but the shape of the target: ROS 2
  * IDL has `float64[]`, `float64[3]` and `float64[<=10]`, and no nested or
  * multi-dimensional arrays at all. A second index on one segment — `a[0][1]` —
  * could therefore denote nothing on any message that exists. The bridge has
  * always refused it (`sampling.py`'s `FieldPathError`, *"ROS has no nested
- * arrays"*); this grammar said otherwise until FL-004, so a hand-written or
- * AI-generated document could pass the cloud and then fail at the robot as a
+ * arrays"*). A grammar that said otherwise would let a hand-written or
+ * AI-generated document pass the cloud and then fail at the robot as a
  * `config_applied` error — the latest and worst place to learn it.
  */
 export declare const fieldPath: z.ZodString;
@@ -95,14 +89,12 @@ export declare const fieldPath: z.ZodString;
  *
  * The union's input branch **is the wire** — a `z.coerce` cannot be published,
  * because zod renders the coercion's result in either `io` direction, so the
- * artifact would describe a shape a query string can never carry (DEF-059).
- *
- * The year bound is borrowed rather than invented: `nonnegative()` alone let
- * `253402300800000` through, where the Postgres bind path has no representation
- * and the route answered 500 — measured either side of the edge,
- * `253402300799000` -> 200 and `253402300800000` -> 500 (Argus-W9). This moved
- * here from `audit.ts` when `jobRunQuery` needed the same guard; a second copy
- * would have been a second policy for one decision.
+ * artifact would describe a shape a query string can never carry.
+ *
+ * The year bound is not decorative. `nonnegative()` alone admits instants a
+ * timestamp column has no representation for, and the route answers 500 rather
+ * than refusing the value. It lives here, once, because more than one query
+ * needs it and a second copy would be a second policy for one decision.
  */
 /**
  * A `seq` cursor as a **query string** actually carries it.
@@ -131,8 +123,8 @@ export declare const wireTimestampMs: z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z
  *
  * Lives here, not in `protocol.ts`, for the same reason `slug` and friends
  * do: `config.ts`'s `configState.applied_errors` is the REST shape the
- * console reads this same error through (spec `2026-08-21-exposure-and-revoke-design`
- * D4), and `protocol.ts` already imports from `config.ts`
+ * console reads this same error through, and `protocol.ts` already imports
+ * from `config.ts`
  * (`credentialRef`, `robotConfigDoc`) — so `config.ts` importing back from
  * `protocol.ts` would be a cycle. One definition, reachable from both
  * without either importing the other.

package/dist/common.js

@@ -2,7 +2,7 @@
 import { z } from 'zod';
 /**
  * Names shared by every layer: the Fleetless slug and the ROS names it is
- * deliberately decoupled from (spec §4.1).
+ * deliberately decoupled from.
  *
  * They live here rather than in `protocol.ts` so the exposure model
  * (`config.ts`) and the bridge protocol can both use them without importing
@@ -19,16 +19,11 @@ import { z } from 'zod';
  * Each is used **twice**: as the message zod itself produces, here, and as
  * `patternErrorMessage` in `config.ts`'s exported JSON Schema, which is a
  * published artifact that other tools validate against and that a person
- * reads. Under FL-005 D3 nothing will consume `patternErrorMessage` at runtime
- * **once wave 3 lands** — `useMonacoYaml.ts` still passes `validate: true`
- * today, so until then this sentence IS the live diagnostic in the editor and
- * zod's is the live one on the server. Either way it is a second spelling of a
- * live rule, and an unwatched one would drift word for word,
- * forever and invisibly — the shape that had `buildAcceptUrl` mailing one URL
- * three ways. They are therefore one constant with two readers rather than two
- * strings that happen to agree, and `config-zod-messages.test.ts` asserts the
- * two readings are the same string at all 24 pattern positions the document
- * has.
+ * reads. Either way it is a second spelling of a live rule, and an unwatched
+ * second spelling drifts word for word, forever and invisibly. They are
+ * therefore one constant with two readers rather than two strings that happen
+ * to agree, and `config-zod-messages.test.ts` asserts the two readings are the
+ * same string at every pattern position the document has.
  *
  * **They are exported because the pattern and its sentence must not be able to
  * move apart**, and the pattern is here while the schema annotation is in
@@ -36,15 +31,13 @@ import { z } from 'zod';
  * document — the two URL schemes and the capture-device path — are constants in
  * `config.ts` beside their own patterns, on the same rule.
  *
- * **The blast radius of putting the sentence here was measured, and it is
- * zero artifacts.** A `.meta()` on `slug` would reach 42 of the 159 published
- * schema artifacts, the bridge's vendored protocol frames among them — which is
- * why `mapKey` in `config.ts` carries the annotation and `slug` does not. A
- * message on a `.regex()` check is a different thing: zod renders no error
- * message into JSON Schema at all, so every artifact is byte-identical either
- * way (measured across all 278 barrel schemas under both `io` modes,
- * 2026-09-03). What it does reach is the sentence a *parser* produces, in every
- * layer that parses one of these names — which is the improvement, not a cost.
+ * **Putting the sentence here changes no published artifact.** A `.meta()` on
+ * `slug` would reach dozens of the published schemas — which is why `mapKey` in
+ * `config.ts` carries the annotation and `slug` does not. A message on a
+ * `.regex()` check is a different thing: zod renders no error message into JSON
+ * Schema at all, so every artifact is byte-identical either way. What it does
+ * reach is the sentence a *parser* produces, in every layer that parses one of
+ * these names — which is the improvement, not a cost.
  */
 export const SLUG_RULE = 'A name is lower-case: it starts with a letter, continues with letters and digits, and joins further words with a single underscore — `battery_voltage`. Capitals, dashes, dots, spaces, a leading digit and a doubled or trailing underscore are all refused.';
 /**
@@ -52,7 +45,7 @@ export const SLUG_RULE = 'A name is lower-case: it starts with a letter, continu
  * message name. Lowercase, underscore-separated, letter-initial, 2..63
  * characters, no leading/trailing/doubled underscores.
  *
- * Names are stable and decoupled from ROS names (spec §4.1) — renaming a
+ * Names are stable and decoupled from ROS names — renaming a
  * topic on the robot must never break a client app. The reverse also holds
  * and costs more: changing a name breaks every client, role grant and MCP
  * tool name that uses it.
@@ -75,9 +68,9 @@ export const rosName = z
 export const ROS_TYPE_NAME_RULE = 'A ROS 2 type name has three segments: the package, then `msg`, `srv` or `action`, then the type — `sensor_msgs/msg/BatteryState`, `std_srvs/srv/Trigger`, `nav2_msgs/action/NavigateToPose`. The middle segment is the one usually left out. The package is lower-case with underscores; the type itself is letters and digits, conventionally CamelCase.';
 /**
  * A ROS interface type as ROS 2 spells it: `pkg/msg/Type`, `pkg/srv/Type`,
- * `pkg/action/Type`. W2 resolves field trees for `msg` only (§4.5); the
- * other two are listed by the introspection browser and get their trees in
- * W4, where action and service parameters exist.
+ * `pkg/action/Type`. Introspection resolves a field tree for each of the
+ * three; a message has one flat list, a service and an action have one tree
+ * per part.
  */
 export const rosTypeName = z
     .string()
@@ -88,15 +81,15 @@ export const FIELD_PATH_RULE = 'A field path is dotted and lower-case, and each
  * A path into a message: dot-separated field names, each carrying **at most
  * one** array index, e.g. `percentage`, `pose.position.x`, `ranges[0]`,
  * `poses[0].pose.position.x`. `null` in a datapoint config means *the whole
- * message* (spec §4.2: one field or one whole topic — never several topics).
+ * message*: one field or one whole topic, never several topics.
  *
  * One index per segment is not a preference but the shape of the target: ROS 2
  * IDL has `float64[]`, `float64[3]` and `float64[<=10]`, and no nested or
  * multi-dimensional arrays at all. A second index on one segment — `a[0][1]` —
  * could therefore denote nothing on any message that exists. The bridge has
  * always refused it (`sampling.py`'s `FieldPathError`, *"ROS has no nested
- * arrays"*); this grammar said otherwise until FL-004, so a hand-written or
- * AI-generated document could pass the cloud and then fail at the robot as a
+ * arrays"*). A grammar that said otherwise would let a hand-written or
+ * AI-generated document pass the cloud and then fail at the robot as a
  * `config_applied` error — the latest and worst place to learn it.
  */
 export const fieldPath = z
@@ -109,14 +102,12 @@ export const fieldPath = z
  *
  * The union's input branch **is the wire** — a `z.coerce` cannot be published,
  * because zod renders the coercion's result in either `io` direction, so the
- * artifact would describe a shape a query string can never carry (DEF-059).
- *
- * The year bound is borrowed rather than invented: `nonnegative()` alone let
- * `253402300800000` through, where the Postgres bind path has no representation
- * and the route answered 500 — measured either side of the edge,
- * `253402300799000` -> 200 and `253402300800000` -> 500 (Argus-W9). This moved
- * here from `audit.ts` when `jobRunQuery` needed the same guard; a second copy
- * would have been a second policy for one decision.
+ * artifact would describe a shape a query string can never carry.
+ *
+ * The year bound is not decorative. `nonnegative()` alone admits instants a
+ * timestamp column has no representation for, and the route answers 500 rather
+ * than refusing the value. It lives here, once, because more than one query
+ * needs it and a second copy would be a second policy for one decision.
  */
 /**
  * A `seq` cursor as a **query string** actually carries it.
@@ -158,8 +149,8 @@ export const wireTimestampMs = z
  *
  * Lives here, not in `protocol.ts`, for the same reason `slug` and friends
  * do: `config.ts`'s `configState.applied_errors` is the REST shape the
- * console reads this same error through (spec `2026-08-21-exposure-and-revoke-design`
- * D4), and `protocol.ts` already imports from `config.ts`
+ * console reads this same error through, and `protocol.ts` already imports
+ * from `config.ts`
  * (`credentialRef`, `robotConfigDoc`) — so `config.ts` importing back from
  * `protocol.ts` would be a cycle. One definition, reachable from both
  * without either importing the other.