@lovrozagar/honey 0.6.5 → 0.7.0

package/docs/regression-matrix/ws9-12.md

@@ -0,0 +1,266 @@
+# Regression matrix: workstreams 9–12
+
+OpenAPI and the manifest, codegen (TypeScript, type extraction, MCP, Go, Rust, Python, Go CLI), the
+client runtimes, and tooling.
+
+Most findings here were already guarded by tests written
+alongside their fixes. Each of those tests was run against `3ab88ce` on its own, and the reason for
+the failure was checked; they now carry a `// regression: <id>` comment. Findings with no such
+test got a new one in `packages/core/tests/regression/ws9-12/`:
+
+- `typescript.regression.test.ts`: generated TypeScript that must parse (H40), schema-name hash
+  collisions, trailing slashes in spec paths, and the `ctx.retry()` failure path.
+- `tooling.regression.test.ts`: generated-file writes, watch globs, stale outputs, the CLI watch
+  loop and the Node config hand-off.
+- `polyglot.regression.test.ts` (opt-in, `test:harness`): the Go, Rust, Python and Go CLI SDKs.
+  Runtime findings run the programs in `checks/` against a mock server in the test process that
+  records every request; the programs use only API that both trees generate, so one build per
+  language serves every check, and Go reaches methods through reflection so a signature that
+  differs between the trees fails one check, not the build. Compile findings generate an SDK from
+  a one-finding document and compile it with `go vet`, `cargo check`, or `compileall` plus mypy.
+  The Python half uses the harness venv (`.cache/python-venv`, see the README test section) or
+  `HONEY_PYTHON`.
+
+Abbreviations: `ts` = `regression/ws9-12/typescript.regression.test.ts`, `tooling` =
+`regression/ws9-12/tooling.regression.test.ts`, `poly` = `regression/ws9-12/polyglot.regression.test.ts`;
+other paths are relative to `packages/core/tests/`. "Yes" means the test fails on `3ab88ce` for the
+reason the finding describes; the observed failure follows.
+
+Scope: Critical, High and Medium findings, plus the Lows that were cheap. Findings in the
+realtime protocol (resume, ready, ping, long-poll, the SDK resumable connections) are deferred by
+the realtime decision and are not listed, except where a crash fix shipped.
+
+## Workstream 9: OpenAPI and manifest
+
+| Finding  | Sev | Bug                                                                                                                                       | Test                                                                                                                                                                                          | Fails on 3ab88ce?                                                           | Notes                                                        |
+| -------- | --- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------ |
+| H31      | H   | `_openApiCache` per instance: two `openapi()` calls serve one document                                                                    | unit/openapi/serve-endpoints: "an internal and a public document never share a cache, whichever is hit first"                                                                                 | Yes: the public path served `Internal`                                      |                                                              |
+| H32      | H   | A mounted sub-app's `openapi()` hijacks the gateway's spec endpoint                                                                       | unit/openapi/serve-endpoints: "the gateway serves its own document when the sub also called openapi()" (both orders)                                                                          | Yes: `Sub` served for the gateway                                           |                                                              |
+| H33      | H   | One unrepresentable Zod node replaces the whole schema                                                                                    | unit/codegen/schema-to-json-schema-io: "an unrepresentable z.custom degrades only its node", "an unrepresentable search field keeps every other parameter"                                    | Yes: vendor envelope; no parameters                                         |                                                              |
+| H34      | H   | Wildcards are not path params; `all()` emits an `all` key                                                                                 | unit/openapi/document-policy: "a named wildcard is a path parameter, an unnamed one too", "all() documents the standard methods…"                                                             | Yes: `/files/*path`, `/star/**`; `all`                                      |                                                              |
+| M        | M   | `toOpenApiPath` disagrees with the router (`openapi/collect.ts:15-27`)                                                                    | unit/openapi/document-conformance: "every operation, with its declared path parameters filled in, reaches a handler"                                                                          | Yes: `/u/{user}-id` with param `user-id`                                    |                                                              |
+| M        | M   | Several content types overwrite each other (`openapi/document.ts:375,421,438`)                                                            | unit/openapi/document-policy: "json and form bodies of one route are both documented", "two response content types of one status keep their own schemas"                                      | Yes: one content type left                                                  | The redirect + JSON half has no separate test                |
+| M        | M   | WS operations bypass `filterRoutes` and `x-internal`, and overwrite a GET (`openapi/document.ts:538-597`)                                 | unit/openapi/document-policy: "go through filterRoutes and meta.internal, and never replace an HTTP GET", "drop x-internal search fields"                                                     | Yes                                                                         |                                                              |
+| M        | M   | `/manifest.json` publishes raw meta for every route (`codegen.ts:1192-1200`)                                                              | unit/openapi/document-policy: "applies the document's visibility policy", "the /manifest.json route serves the published view"                                                                | Yes: hidden routes listed                                                   |                                                              |
+| decision | —   | `meta.internal` routes published in the served document                                                                                   | unit/openapi/meta-spec: "built-in `internal` stays hidden and does not trip totality"                                                                                                         | Yes                                                                         |                                                              |
+| M        | M   | YAML emitter writes invalid or different YAML (`src/yaml.ts`)                                                                             | unit/codegen/yaml: "skips undefined keys…", "Date becomes its ISO string…", "quotes every string a parser could read differently"                                                             | Yes: `null`, `{}`, parse error                                              |                                                              |
+| M        | M   | Standalone `spec()` emits hollow documents, leaks options into `info`, never invalidates, cannot serve two apps (`openapi/spec.ts:20-47`) | unit/openapi/document-policy: "documents bodies and parameters…", "rebuilds after routes change…"; unit/openapi/serve-endpoints: "one spec() handler mounted on two apps documents each app"  | Yes: options in `info`; stale paths; "Cannot redefine property"             |                                                              |
+| M        | M   | Spec routes not mounted behind an earlier `/:slug` or `/*rest` GET (`index.ts:1020-1032`)                                                 | unit/openapi/serve-endpoints: "a root /:slug or /*rest route does not shadow the spec routes"                                                                                                 | Yes: `openapi({ docs })` throws "cannot mount at /docs: already registered" | The old code mistakes the catch-all for a registered `/docs` |
+| M        | M   | `invalidate` selectors never validated (`meta-spec.ts:182`)                                                                               | unit/openapi/document-policy: "an invalidate selector that names no route fails generation"                                                                                                   | Yes: resolves                                                               |                                                              |
+| M        | M   | `anyOf` becomes `oneOf`; recursive `$ref: "#"` after hoisting (`codegen-sanitize.ts:34-36`)                                               | unit/openapi/document-policy: "unions stay anyOf…", "a recursive schema's self-reference points at its component…"                                                                            | Yes                                                                         |                                                              |
+| M        | M   | Valibot converter gaps (`codegen.ts:87-149`)                                                                                              | unit/codegen/valibot-json-schema: "nullish and exactOptional entries are optional", "strictObject forbids extra keys…", "variant is a union; lazy resolves…"                                  | Yes                                                                         |                                                              |
+| M        | M   | Cached spec re-serialized per request; failed generation re-runs per request (`index.ts:968`)                                             | unit/openapi/serve-endpoints: "generates and serializes once per route change, however many requests"; unit/openapi/serve: "caches a failed generation until the routes change, then retries" | Yes: 5 generations; retried every request                                   |                                                              |
+| M        | M   | A sub-app's `strict: "off"` downgrades the parent (`index.ts:1346`)                                                                       | unit/openapi/serve-endpoints: "a sub's strict: "off" does not downgrade the parent's resolved strictness" (both orders)                                                                       | Yes                                                                         |                                                              |
+| M        | M   | `normalizeSecurity` returns `[]` for object or mixed values; scheme names unchecked (`meta-spec.ts:49-64,181`)                            | unit/codegen/codegen: the five "normalizeSecurity …" tests; unit/openapi/document-policy: "a security scheme missing from securitySchemes fails generation"                                   | Yes                                                                         |                                                              |
+| L        | L   | Invalidate check: profile without `x-invalidate`; entity with no tagged reader                                                            | unit/openapi/document-policy: the two "invalidate check" tests                                                                                                                                | Yes                                                                         |                                                              |
+| L        | L   | `route(sub)` before `metaSpec()` throws                                                                                                   | unit/openapi/serve-endpoints: "metaSpec() after route(sub) merges instead of throwing"                                                                                                        | Yes: "already declared"                                                     |                                                              |
+| L        | L   | Docs HTML misses `stripPrefix`                                                                                                            | unit/openapi/serve-endpoints: "the docs UI points at the stripped prefix the browser sees"                                                                                                    | Yes                                                                         |                                                              |
+| L        | L   | `trailingSlash("enforce")` paths lose the slash                                                                                           | ts: "L (trailing slash): with trailingSlash(enforce) spec paths keep the slash clients must send"                                                                                             | Yes: `/users/{id}`                                                          |                                                              |
+| L        | L   | `filterRoutes` gets `meta: null`                                                                                                          | unit/openapi/document-policy: "receives an object for meta, never null"                                                                                                                       | Yes: TypeError                                                              |                                                              |
+| L        | L   | Duplicate detection ignores `on`/`profiles`; duplicate `operationId`s emitted                                                             | unit/openapi/document-policy: "entries for different targets or disjoint profiles are not duplicates", "two routes declaring the same operationId fail generation"                            | Yes                                                                         |                                                              |
+| L        | L   | Non-`x-` top-level `_generated` key                                                                                                       | tooling: "L (plugin.ts:332,342): generated OpenAPI and manifest carry no non-x- top-level `_generated` key"                                                                                   | Yes                                                                         |                                                              |
+| L        | L   | Spec and manifest served with no gating, cache headers or ETag                                                                            | unit/openapi/serve-endpoints: "sends a strong ETag with no-cache…", "enabled: false mounts nothing"                                                                                           | Yes                                                                         |                                                              |
+
+## Workstream 10: codegen
+
+### TypeScript, MCP and type extraction
+
+| Finding     | Sev | Bug                                                                                                         | Test                                                                                                                                           | Fails on 3ab88ce?                                             | Notes                                                                                                                      |
+| ----------- | --- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| M (was H39) | M   | `declare module "honey"` never augments the real package                                                    | unit/codegen/invalidate-meta: "emits declare module with HoneyCodegen routeSelector"                                                           | Yes                                                           |                                                                                                                            |
+| H40         | H   | Raw string interpolation in generated TypeScript                                                            | ts: the four "H40: …" tests (literals, hyphenated param, error keys, meta key into `routes.gen.ts`)                                            | Yes: each output fails to parse                               |                                                                                                                            |
+| H37b        | H   | Generated client drops the body on SSE operations                                                           | unit/sdk/generated-runtime-fixes: "a POST SSE operation sends its JSON body and runs onRequest/onResponse hooks"                               | Yes: no body                                                  |                                                                                                                            |
+| H35b        | H   | Generated SDK lets `..`/`.` collapse segments                                                               | conformance/generated-sdk: "dot-dot param rejected", "dot param rejected", "empty param rejected"                                              | Yes: the request is sent                                      |                                                                                                                            |
+| M           | M   | Routes expanding to several operations share one `operationId` (`codegen.ts:295-317`)                       | unit/openapi/document-policy: "one route expanded into several operations gets method and variant suffixes"                                    | Yes                                                           |                                                                                                                            |
+| M           | M   | Wildcard routes unusable in OpenAPI and the SDK                                                             | unit/openapi/document-policy (H34 rows); conformance/generated-sdk: "wildcard spans segments"                                                  | Yes                                                           |                                                                                                                            |
+| M           | M   | Resource names collide with client members and `Object.prototype`                                           | unit/sdk/generated-runtime-fixes: "renames colliding resources…", "keeps state, dispose and String(sdk) working…"                              | Yes                                                           |                                                                                                                            |
+| M           | M   | Stream request bodies: no `duplex: "half"`, `new Request` over a consumed stream                            | unit/sdk/generated-runtime-fixes: "send with duplex: half, and an onResponse hook still gets a Request"                                        | Yes: "Response body object should not be disturbed or locked" |                                                                                                                            |
+| M           | M   | Idempotency key written into the caller's input                                                             | unit/sdk/generated-runtime-fixes: "are never written into the caller's input…"                                                                 | Yes                                                           | The `randomUUID` fallback half has no test                                                                                 |
+| M           | M   | Output order depends on locale (`localeCompare`)                                                            | unit/codegen/ts-type-emitter: "fields are ordered by code unit, not locale"                                                                    | Yes                                                           | One call site; the rest are covered by snapshot determinism, not by a locale switch                                        |
+| H (was M)   | H   | Several content types share one schema name; dangling `$ref` (`codegen.ts:580-596`)                         | unit/openapi/document-policy: "deduplicateSchemas keys slots by content type…", "an existing component is never overwritten by a derived name" | Yes                                                           |                                                                                                                            |
+| M           | M   | `allOf` over a union, typed `additionalProperties`, unresolved `$ref`, depth cut-off (`ts-type-emitter.ts`) | unit/codegen/ts-type-emitter: the four precedence/maps/depth tests                                                                             | Yes                                                           |                                                                                                                            |
+| L           | L   | Prototype pollution from `operationId: "__proto__.polluted"`                                                | unit/sdk/generated-runtime-fixes: "an operationId of **proto**.x never reaches Object.prototype during generation"                             | Yes                                                           | On 3ab88ce it pollutes the test process: later tests in that file fail with `Invalid option … "polluted"` unless run alone |
+| L           | L   | `default` response key parsed as `NaN`                                                                      | unit/openapi/document-policy and unit/sdk/generated-runtime-fixes: "…`default` response…"                                                      | Yes                                                           |                                                                                                                            |
+| L           | L   | Fallback Zod converters (`codegen.ts:1000-1018`)                                                            | —                                                                                                                                              | —                                                             | Not covered: only reached for a Zod schema without `toJSONSchema`                                                          |
+| L           | L   | 24-bit name hash collisions                                                                                 | ts: "L (codegen-hash.ts:2-8): two shapes whose 24-bit name hashes collide keep their own schemas"                                              | Yes: `text/plain` resolves to `aR`                            | The old `unit/openapi/document-policy` hash test passes on `3ab88ce` (no collision path) and is kept only as a HEAD check  |
+| L           | L   | Header/cookie params missing; SDK name and stem unvalidated                                                 | unit/sdk/generated-runtime-fixes: "header and cookie params reach the input type…", "rejects an SDK name or stem…"                             | Yes                                                           | Orphan components have no test                                                                                             |
+| L           | L   | MCP: injection through `operationId` and `projectName`; tool names                                          | unit/codegen/codegen-mcp-hardening: "an operationId with quotes … do not inject code", "tool names are sanitized…"                             | Yes: the generated source fails to parse                      |                                                                                                                            |
+| M           | M   | MCP: a `$ref` cycle hangs generation                                                                        | unit/codegen/codegen-mcp-hardening: "a pure $ref cycle is an error, not a hang", "shared $refs are expanded once each"                         | Yes: stack overflow; no result within 60 s                    | "a self-referential $ref terminates" passes on `3ab88ce` and is not a guard                                                |
+| M           | M   | MCP: base URL guessed as `https://api.<project>.com`                                                        | unit/codegen/codegen-mcp-hardening: "server.ts requires an explicit base URL"                                                                  | Yes                                                           |                                                                                                                            |
+| M           | M   | MCP: tool arguments reach the SDK unvalidated                                                               | unit/codegen/codegen-mcp-hardening: "credential headers are never tool arguments"                                                              | Yes                                                           | The `callTool` validation tests use API that did not exist at `3ab88ce`                                                    |
+| H71         | H   | Middleware ctx types keyed without basePath                                                                 | unit/codegen/type-extractor-hardening: both "(H71)" tests                                                                                      | Yes                                                           |                                                                                                                            |
+| H72         | H   | Emitted `import()` references do not resolve                                                                | unit/codegen/type-extractor-hardening: "(H72)" test                                                                                            | Yes                                                           |                                                                                                                            |
+| H73         | H   | `serialize()` writes wrong types                                                                            | unit/codegen/type-extractor-hardening: both "(H73)" tests                                                                                      | Yes                                                           |                                                                                                                            |
+| M           | M   | Stack overflow on Zod 4 getter recursion                                                                    | unit/codegen/type-emitter-hardening: "Zod 4 getter recursion becomes a named alias…"                                                           | Yes: stack overflow                                           |                                                                                                                            |
+| M           | M   | Numeric enums, bigint, intersection, tuple rest, map/set (`type-emitter.ts`)                                | unit/codegen/type-emitter-hardening: the four literal/shape tests                                                                              | Yes                                                           |                                                                                                                            |
+| L           | L   | Types need a top-level `const app`                                                                          | unit/codegen/type-extractor-hardening: "accepts `export default honey()`"                                                                      | Yes                                                           |                                                                                                                            |
+
+### Go, Rust, Python and Go CLI emitters
+
+| Finding   | Sev | Bug                                                                                                             | Test                                                                                                                                                   | Fails on 3ab88ce?                                                 | Notes                                                                                |
+| --------- | --- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| H41       | H   | Rust SSE never attaches method, query, body, headers; an integer query does not compile                         | poly: "Rust runtime H41: an SSE operation sends its method, query, body and auth"; compile "H41 (an integer query param on an SSE operation compiles)" | Yes: `GET`; E0308                                                 |                                                                                      |
+| H42       | H   | SSE on non-GET: Go sends GET, Python drops the body, the CLI does not compile                                   | poly: Go and Python "H42: …" runtime tests; compile "H42 (the CLI compiles a POST SSE operation with a body)"                                          | Yes: `GET`; empty body; `bodyBytes` unused                        |                                                                                      |
+| H43       | H   | Python `types.py` writes raw keys as attributes                                                                 | poly compile: "H43 (JSON keys that are not identifiers)"                                                                                               | Yes: SyntaxError at `2fa`                                         |                                                                                      |
+| H44       | H   | Sync Python SDK raises `NameError` for a namespace with only streaming ops                                      | poly compile: "H44 (a root namespace with only streaming operations)"                                                                                  | Yes: `_SyncEventsResource`                                        |                                                                                      |
+| H45       | H   | Python query params named like SDK arguments                                                                    | poly compile: "H45 (query params named like the SDK's arguments)"                                                                                      | Yes: duplicate argument `timeout`                                 |                                                                                      |
+| H46       | H   | Go receiver collides with `q`                                                                                   | poly compile: "H46 (a namespace starting with q)"                                                                                                      | Yes                                                               |                                                                                      |
+| H47       | H   | Path params emitted as raw identifiers                                                                          | poly compile: "H47 …" (Go, Rust)                                                                                                                       | Yes: `type`                                                       |                                                                                      |
+| H48       | H   | Multi-line descriptions escape comments; docstrings break                                                       | poly compile: "H48 …" (Go, Rust, Python)                                                                                                               | Yes                                                               |                                                                                      |
+| H49       | H   | Enum values become identifiers without sanitizing                                                               | poly compile: "H49 …" (Go, Rust)                                                                                                                       | Yes: `-created_at`; `Self`                                        |                                                                                      |
+| H50       | H   | Go and Python send no multipart or urlencoded body                                                              | poly: Go "H50: an urlencoded body is sent", "H50: a multipart body is sent"; Python "H50: an urlencoded body is sent"                                  | Yes: the methods take no body                                     | Python multipart fixed after the matrix (see below) (see below); its test is skipped |
+| H51       | H   | Go array/nullable/bracketed/`headers` params do not compile; Rust `timeout`/`headers`; Rust arrays sent as JSON | poly compile: "H51 …" (Go, Rust); "Rust runtime H51: an array query param repeats its key"                                                             | Yes: compile errors; `ids=["a","b"]`                              |                                                                                      |
+| H52       | H   | Schemas named like runtime types: Go `Config` dropped, Rust `Error`/`Option`/`Result`, Python `NotFoundError`   | poly compile: the three "H52 …" cases                                                                                                                  | Yes: `Config.Get` returns the SDK config; E0107; not an exception |                                                                                      |
+| H53       | H   | Rust sync client references an undefined `…ResourceSync`                                                        | poly compile: "H53 (a namespace with only nested methods)"                                                                                             | Yes: unresolved import                                            |                                                                                      |
+| H54       | H   | CLI flag and variable collisions                                                                                | poly compile: "H54 (CLI flags and variables never collide)"                                                                                            | Yes: redeclared vars                                              |                                                                                      |
+| M         | M   | Rust hoisted names collide silently                                                                             | poly compile: "M (rust-type-emitter.ts:138-140): hoisted names never merge"                                                                            | Yes: no field `b`                                                 | Compiles on `3ab88ce`; the test reads both fields                                    |
+| M         | M   | Only direct self-reference boxed (Rust); recursive structs (Go)                                                 | poly compile: "M (rust-type-emitter.ts:271,403): mutual recursion compiles" (Go, Rust)                                                                 | Yes: E0072; invalid recursive type                                |                                                                                      |
+| M         | M   | Unions: Go loses variant data; Rust tagged unions with inline variants do not compile                           | poly: "Go runtime M (go-type-emitter.ts:315-323)…"; compile "M (rust-type-emitter.ts:326-368)…"                                                        | Yes: `payload: null`; `Variant` defined twice                     |                                                                                      |
+| M         | M   | Go `additionalProperties` beside fields is a no-op                                                              | poly: "Go runtime M (go-type-emitter.ts:363-388)…"                                                                                                     | Yes: extra key lost                                               |                                                                                      |
+| M         | M   | `text/plain` 2xx bodies JSON-decoded (Go, Rust)                                                                 | poly: Go and Rust "…a text/plain 2xx body is not JSON-decoded"                                                                                         | Yes: decode error                                                 |                                                                                      |
+| M         | M   | Inline array responses lose their hoisted item type                                                             | poly compile: "M (codegen-rust.ts:107; codegen-go.ts:161)…" [rust]                                                                                     | Yes: `BodyItem` undefined                                         | The [go] case compiles on `3ab88ce` too: the Go half did not reproduce               |
+| M         | M   | Field identifiers and struct tags not sanitized                                                                 | poly compile: "M (go-type-emitter.ts:33-35,50-52,347)…" (Go, Rust)                                                                                     | Yes                                                               |                                                                                      |
+| M         | M   | Auth differs per language: the CLI always sends Bearer                                                          | poly: "Go CLI runtime M (codegen-go-cli.ts:918,948)…"                                                                                                  | Yes: no `x-api-key`                                               | Go/Rust WS dial auth has no test                                                     |
+| NEW       | M   | Rust sends nullable query strings JSON-quoted                                                                   | poly: "Rust runtime NEW (M): a nullable query string is sent without JSON quotes"                                                                      | Yes: `maybe=%22foo%22`                                            |                                                                                      |
+| NEW       | L   | Python return annotations are `TypedDict(...)` calls                                                            | poly compile: "NEW (L): return annotations are valid for type checkers"                                                                                | Yes: mypy `valid-type`                                            |                                                                                      |
+| M         | M   | Python class-name collisions (`sync.contacts` vs `contacts`)                                                    | poly compile: "M (codegen-python.ts:219-227,740)…"                                                                                                     | Yes: the nested resource calls the wrong class                    |                                                                                      |
+| M         | M   | Rust `throwOnError: false` does nothing                                                                         | poly compile: "M (codegen-rust.ts:176-197; runtime.rs:357-370): safe mode returns an API error inside SdkResult"                                       | Yes: the 404 is an `Err`                                          |                                                                                      |
+| M         | M   | Path params `..`, `.`, `""` not rejected in Go, Python, Rust                                                    | poly: the three "…path params are refused before sending" runtime tests                                                                                | Yes: requests sent                                                |                                                                                      |
+| M         | M   | CLI enum values raw in `fmt.Errorf`; query params shadow global flags                                           | poly compile: "M (codegen-go-cli.ts:800,812)…", "M (codegen-go-cli.ts:395-400)…"                                                                       | Yes: syntax error; redeclared                                     |                                                                                      |
+| H (was M) | H   | CLI resource `root` overwrites `cmd/root.go`                                                                    | poly compile: "H (codegen-go-cli.ts:372,1170-1172)…"                                                                                                   | Yes: `configFromCtx` undefined                                    |                                                                                      |
+| M         | M   | Python `types.py` aliases are `NewType(Any)`                                                                    | poly compile: "M (codegen-python.ts:622-628)…"                                                                                                         | Yes: mypy `valid-newtype`                                         |                                                                                      |
+| L         | L   | Rust literal escapes (`\b`, `\f`)                                                                               | poly compile: "L (rust-type-emitter.ts:105,314)…"                                                                                                      | Yes: unknown character escape                                     | The `allOf` field half has no test                                                   |
+| L         | L   | Nullable + optional cannot send `null`                                                                          | tests/integration/sdk-harness/nullable-tri-state.test.ts                                                                                               | Old API cannot express                                            | The tri-state types are new                                                          |
+
+Not covered: the Python `x-realtime` URL braces and the Rust `x-realtime` branch (realtime decision);
+the L items `usedSchemas` regex, dead Rust SSE/WS emitters, and `unwrap_or_default`.
+
+## Workstream 11: client runtimes
+
+### TypeScript (`client/*`, MCP runtime)
+
+| Finding | Sev | Bug                                                                     | Test                                                                                                                                                                                | Fails on 3ab88ce?                      | Notes                                                                                                      |
+| ------- | --- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
+| H35     | H   | `..`, `.`, `""` path params collapse or swap the host                   | unit/client/client-behavior-spec: "URL building (H35)…"; conformance/url-building: the "…rejected" vectors                                                                          | Yes: the request is sent               |                                                                                                            |
+| H36     | H   | Safe mode returns a falsy `error` for non-JSON error bodies             | unit/client/client-behavior-spec: "Errors (H36) safe mode…"; unit/sdk/sdk-runtime-characterization: "error body that is not JSON still returns a truthy error…"                     | Yes: `undefined`                       |                                                                                                            |
+| H37     | H   | SSE drops the body and skips hooks                                      | unit/client/client-behavior-spec: "Streams (H37) … a streamed POST carries its body…"                                                                                               | Yes                                    |                                                                                                            |
+| H38     | H   | `onAuthExpired` never called                                            | unit/client/client-behavior-spec: "Auth refresh (H38)…" (four tests)                                                                                                                | Yes                                    |                                                                                                            |
+| M       | M   | No per-call `timeout`; README error subclasses missing                  | unit/client/client-behavior-spec: "per-call timeout overrides the config", "throw mode: per-status subclasses"                                                                      | Yes                                    |                                                                                                            |
+| M       | M   | `cleanup()` before `_parseBody`: timeouts and aborts miss the body read | unit/client/client-behavior-spec: "the timeout covers reading the body", "a user abort after headers still cancels the body read…"                                                  | Yes                                    |                                                                                                            |
+| M       | M   | The lazy dual-mode return is a real Promise                             | unit/client/client-behavior-spec: "awaiting an SSE call resolves to an iterable…", "await then for-await reuses the one request"                                                    | Yes                                    |                                                                                                            |
+| M       | M   | Empty 2xx bodies: raw `SyntaxError`, wrong types                        | unit/client/client-behavior-spec: "empty or invalid 2xx bodies keep the status"                                                                                                     | Yes                                    |                                                                                                            |
+| M       | M   | `ctx.retry()` failure paths                                             | ts: "M (client/http.ts:359-365): an unguarded retry hook on a persistent 401 ends with the 401"; unit/client/client-behavior-spec: "a guarded hook in safe mode returns { error }…" | Yes: "Max 1 retry per request"; throws | The behavior-spec version needs the new `UnauthorizedError` export, so `ts` holds the old-compatible guard |
+| M       | M   | Partially resolvable invalidation targets dropped                       | unit/client/client-behavior-spec: "partially resolvable invalidation targets mark the narrower pattern"; unit/client/http-r6-phase-g: the two R6-12 tests                           | Yes                                    |                                                                                                            |
+| M       | M   | One concrete read clears a pattern mark for all instances               | unit/sdk/sdk-invalidation: "each instance reads stale once; a concrete read never clears the others"                                                                                | Yes                                    |                                                                                                            |
+| M       | M   | Form arrays encoded inconsistently                                      | unit/client/client-behavior-spec: "arrays repeat the key in both encodings…"                                                                                                        | Yes: `tags=a%2Cb`                      |                                                                                                            |
+| L       | L   | SSE parser: truncated final event, sticky id, `retry`                   | conformance/sse: "truncated final event discarded", "id is sticky", "retry digits only"                                                                                             | Yes                                    |                                                                                                            |
+| L       | L   | `/users/{user-id}` and `/ops/{id}:cancel`                               | unit/client/client-behavior-spec: "SDK paths: hyphenated braces and `{id}:action` interpolate"                                                                                      | Yes                                    |                                                                                                            |
+| L       | L   | `undefined` per-call header; forced `x-request-id`                      | unit/client/client-behavior-spec: "skips undefined per-call headers…", "requestId: false sends no x-request-id…"                                                                    | Yes                                    |                                                                                                            |
+| L       | L   | MCP binary results serialize as `{}`                                    | unit/codegen/codegen-mcp-hardening: "binary results are described…"                                                                                                                 | Old API cannot express                 | `callTool` is new                                                                                          |
+
+Not covered (L): `client/ws.ts` listener map and binary frames, `invalidatedBy` growth.
+
+### Go, Python and the Go CLI
+
+| Finding       | Sev | Bug                                                                          | Test                                                                                                                                                          | Fails on 3ab88ce?                       | Notes                                                                                                    |
+| ------------- | --- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| H55           | H   | Python SSE splits on U+2028 and other separators                             | poly: "Python runtime H55…"                                                                                                                                   | Yes: `{"t":"a`                          |                                                                                                          |
+| H56           | H   | Go `ResolveReference` drops the base path                                    | poly: "Go runtime H56: the base URL's path is kept"                                                                                                           | Yes: `/users/1`                         |                                                                                                          |
+| NEW           | H   | Python `..` collapses to the parent                                          | poly: "Python runtime NEW (H, codegen-python.ts:399)…"                                                                                                        | Yes: requests sent                      |                                                                                                          |
+| H57, H58, H59 | H   | Go realtime spins, dies after reconnect, panics on close                     | tests/integration/sdk-harness/polyglot-runtime.test.ts (`runtime_test.go`)                                                                                    | Old API cannot express                  | Crash fixes shipped under the realtime decision; the checks use HEAD-only transport API                  |
+| H60           | H   | SSE cut by default request timeouts                                          | poly: "Python runtime H60: an SSE stream outlives the default read timeout"                                                                                   | Yes: `ReadTimeout`                      | The Go half needs a 30 s stream; covered on HEAD by `runtime_test.go` `TestTimeoutBoundsCallsNotStreams` |
+| H61           | H   | Python realtime stops silently                                               | polyglot-runtime.test.ts (`runtime_check.py`)                                                                                                                 | Old API cannot express                  | Realtime decision                                                                                        |
+| H62           | H   | The 401-refresh retry resends uploads with an empty body                     | poly: "Go runtime H62: a 401 never makes a raw upload go out again with an empty body"; "Python runtime H62: the 401-refresh retry resends a raw upload body" | Yes: the second body is empty           | A JSON body already survived on `3ab88ce` in Go                                                          |
+| M             | M   | Go has no `CheckRedirect`: custom headers follow other hosts                 | poly: "Go runtime M (client-go/runtime.go:270,362-372)…"                                                                                                      | Yes: `x-api-key` reached the other host |                                                                                                          |
+| M             | M   | Go `Config.Timeout` never read                                               | poly: "Go runtime M (client-go/runtime.go:55)…"                                                                                                               | Yes: no error after 2 s                 |                                                                                                          |
+| H (was M)     | H   | CLI exit codes: 404 and 500 both exit 3                                      | poly: "Go CLI runtime H (cli-go/errors.go:36-39)…"                                                                                                            | Yes: 3                                  |                                                                                                          |
+| M             | M   | Hostile server bytes printed raw by the CLI                                  | poly: "Go CLI runtime M (client-go/errors.go:156-206; cli-go/output.go:53-94)…"                                                                               | Yes: ESC in a table cell                | The error path already escaped on `3ab88ce`                                                              |
+| M             | M   | Python returns 3xx as success                                                | poly: "Python runtime M (client-python/_runtime.py:159-161)…"                                                                                                 | Yes                                     |                                                                                                          |
+| M             | M   | Python returns `response.text` for binary bodies                             | poly: "Python runtime M (client-python/_runtime.py:149-156)…"                                                                                                 | Yes: `str`                              |                                                                                                          |
+| M             | M   | Python sync `on_auth_expired` fails silently                                 | poly: "Python runtime M (client-python/_runtime.py:385-392)…"                                                                                                 | Yes: `'str' object can't be awaited`    |                                                                                                          |
+| M             | M   | Param-less mutations drop pattern targets (Go, Python); Go reads never clear | poly: Go and Python "…a param-less mutation marks the templated read stale…"                                                                                  | Yes: `[false, false, …]`                |                                                                                                          |
+| M             | M   | CLI decodes into `any`: big integers lose precision                          | poly: "Go CLI runtime M (cli-go/output.go:25,74,87)…"                                                                                                         | Yes: `1234567890123456800`              |                                                                                                          |
+| L             | L   | Go SSE delimiter priority and a dispatched partial event                     | poly: "Go runtime L (client-go/sse.go:70-90)…"                                                                                                                | Yes: `partial` dispatched               |                                                                                                          |
+| L             | L   | Python `/ops/{id}:cancel` raises                                             | poly: "Python runtime L (client-python/_invalidation.py:17,53-69)…"                                                                                           | Yes                                     |                                                                                                          |
+| L             | L   | Python header merge is case-sensitive                                        | poly: "Python runtime L (client-python/_runtime.py:116-135)…"                                                                                                 | Yes: two `authorization` headers        |                                                                                                          |
+| L             | L   | Refreshed token not kept                                                     | poly: Go and Python "L … the refreshed token is kept for later calls"                                                                                         | Yes: a second 401 round trip            |                                                                                                          |
+
+Not covered: the Go WebSocket 32 KiB read limit (M), the realtime reopen context (M, realtime), and
+the L items for unbounded reads, concrete keys with `:`, WS handlers, transport leaks, CLI version
+and config, and stale-lookup performance.
+
+### Rust
+
+| Finding   | Sev | Bug                                                      | Test                                                                                                              | Fails on 3ab88ce?                    | Notes                                                                                                                                                            |
+| --------- | --- | -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| H63       | H   | Send errors surface as "request canceled"                | poly: "Rust runtime H63: connection refused is a transport error, not `Canceled`"                                 | **No**                               | Not reproduced: with the reqwest 0.12.28 the lockfile resolves, refused, DNS and unroutable errors all map to `Transport` on `3ab88ce` too. Kept as a HEAD guard |
+| H56b      | H   | `base.join(path)` drops the base path                    | poly: "Rust runtime H56b: the base URL's path is kept"                                                            | Yes: `/users/1`                      |                                                                                                                                                                  |
+| H64       | H   | `recv` dropped mid-reconnect leaves the connection stuck | polyglot-runtime.test.ts (`runtime_check.rs`)                                                                     | Old API cannot express               | Realtime decision                                                                                                                                                |
+| M         | M   | SSE buffer unbounded, rescanned from 0                   | poly: "Rust runtime M (sse.rs:32-44,79-93): an SSE line has a size cap…"                                          | Yes: a 3 MiB event buffered whole    | The quadratic rescan does not show in wall time once TCP coalesces chunks; the cap half is the guard                                                             |
+| M         | M   | SSE `trim()`, CR-only lines, BOM                         | poly: "Rust runtime M (sse.rs:50-51,66-67,80,110-111)…"                                                           | Yes: `first` dropped, `tok ` trimmed |                                                                                                                                                                  |
+| M         | M   | Headers merged case-sensitively and appended             | poly: "Rust runtime M (runtime.rs:394-406,445-458)…"                                                              | Yes: two `authorization`             |                                                                                                                                                                  |
+| M         | M   | Redirects replay custom headers cross-host               | poly: "Rust runtime M (runtime.rs:400-406,445-447)…"                                                              | Yes                                  |                                                                                                                                                                  |
+| M         | M   | Refreshed token discarded; N 401s refresh N times        | poly: "Rust runtime M (runtime.rs:285-338): the refreshed token is kept…", "…concurrent 401s trigger one refresh" | Yes: 2 round trips; 3 refreshes      |                                                                                                                                                                  |
+| M         | M   | Param-less mutations drop templated targets              | poly: "Rust runtime M (invalidation.rs:121-146)…"                                                                 | Yes                                  |                                                                                                                                                                  |
+| L (was M) | L   | Error message is the full raw body                       | poly: "Rust runtime L (errors.rs:184)…"                                                                           | Yes: 20 038 characters               |                                                                                                                                                                  |
+
+Not covered: the SSE transport status check, long-poll, `send_json` auth and resume (realtime
+decision), and the L items for body copies, WS handlers, the scheme swap and sync timeout mapping.
+
+## Workstream 12: tooling
+
+| Finding   | Sev | Bug                                                                      | Test                                                                                                                                                                              | Fails on 3ab88ce?      | Notes                                                                                                                                    |
+| --------- | --- | ------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| H67       | H   | `honey init` writes the unscoped `honey` dependency                      | unit/plugin/cli-init: "writes app, vite config, and package scripts"                                                                                                              | Yes                    |                                                                                                                                          |
+| H68       | H   | Watch regenerates with stale transitive modules                          | unit/plugin/cli-generate: "--watch sees edits to modules the app imports"                                                                                                         | Yes                    |                                                                                                                                          |
+| H69, H69b | H   | The package cannot load from `node_modules` on plain Node                | `bun run test:packaging` (`e2e/run-strict-consumer.ts`)                                                                                                                           | Old API cannot express | `3ab88ce` ships no `dist/` to pack                                                                                                       |
+| H70       | H   | CLI argument parser ignores and swallows flags                           | unit/plugin/cli-generate: "rejects unknown flags…", "--app=<path> overrides…", "calls a function-form Vite config"; unit/plugin/cli-init: "--cloudflare is an alias of --cf…"     | Yes                    |                                                                                                                                          |
+| H70b      | H   | `honey generate` on Node never finds the Vite config                     | tooling: "H70b: `honey generate` on plain Node finds the Vite config"                                                                                                             | Yes: "No config found" |                                                                                                                                          |
+| M         | M   | `honey init` rewrites an existing `package.json`                         | unit/plugin/cli-init: "keeps an existing package.json's scripts, type and privacy without --force"                                                                                | Yes                    |                                                                                                                                          |
+| H (was M) | H   | Generation runs the app's top-level side effects                         | unit/plugin/cli-generate: "an app that serves at top level and leaves a timer still generates and exits…"; unit/plugin/generate-and-write: "…its top-level serve() binds nothing" | Yes: EADDRINUSE        |                                                                                                                                          |
+| M         | M   | The "unchanged" check trusts only the header checksum                    | tooling: "M (plugin.ts:294-353): a truncated generated file with a matching checksum header is rewritten"                                                                         | Yes                    |                                                                                                                                          |
+| M         | M   | `virtual:honey/routes` returns TypeScript as JS                          | unit/plugin/vite-plugin: "load returns route tree for virtual module with moduleType", "virtual route tree loads in a real Vite dev server"                                       | Yes: parse failure     |                                                                                                                                          |
+| M         | M   | `hotUpdate` suppresses HMR, runs per environment, re-triggers on outputs | unit/plugin/vite-plugin: the three hotUpdate tests                                                                                                                                | Yes                    |                                                                                                                                          |
+| M         | M   | Feature detection is a regex over one file                               | unit/build/build-plugin: "finds openapi() behind a re-export entry", "ignores feature calls in comments and strings"                                                              | Yes                    |                                                                                                                                          |
+| M         | M   | The Bun build entry has no WebSocket handlers                            | unit/build/build-plugin: "bun: startHoneyServer with the runtime, env and 0.0.0.0"                                                                                                | Yes                    |                                                                                                                                          |
+| M         | M   | CLI watch loops when an SDK out dir sits under the app                   | tooling: "M (plugin.ts:544-575): CLI watch does not loop…"                                                                                                                        | **No**                 | Cannot be reached at `3ab88ce`: its CLI does not load a path-imported Vite config (H70b), and its flags have no Python port. Guards HEAD |
+| M         | M   | Stale generated files never removed                                      | tooling: "M (plugin.ts:544-601): a Go CLI resource that no longer exists leaves no ghost command file"                                                                            | Yes: `owners.go` left  |                                                                                                                                          |
+| M         | M   | The `watch` glob matcher                                                 | tooling: the four "watch pattern … regenerates" tests and "src/**/*.ts does not match a file under node_modules"                                                                  | Yes                    |                                                                                                                                          |
+| L         | L   | `virtual:honey/openapi` omits `profile`                                  | unit/plugin/vite-plugin: "virtual openapi module applies the configured profile"                                                                                                  | Yes                    |                                                                                                                                          |
+| L         | L   | `ssr.noExternal: true` for every target                                  | unit/build/build-plugin: "keeps dependencies external on node and bun, bundles them for workers"                                                                                  | Yes                    |                                                                                                                                          |
+
+Not covered (L): jiti re-transpile time, the watch in-flight guard and `_lastConfig`.
+
+## Findings that were open on HEAD (fixed after the matrix)
+
+The matrix found three findings still broken at `ba39cc7`; all three are fixed and guarded:
+
+- **H50, Python multipart.** httpx 0.28 cannot encode a list of `data` tuples beside `files` (a text
+  field raised `TypeError`, a file alone went out with an empty body). Text fields now travel as
+  `(None, value)` file parts. Guard: poly Python "H50: a multipart body is sent" (no longer skipped;
+  asserts the text field and the file bytes reach the server).
+- **Rust SDK with a bare object response** (`{ "type": "object" }`) used `HashMap` in
+  `src/resources/*.rs` without importing it (E0425). Map types are now emitted fully qualified.
+  Guard: poly compile case "NEW (H): a bare object response compiles"; fails with E0425 before the fix.
+- **Go CLI, missing required flag** exited 3 instead of 4: cobra checks required flags after
+  `PersistentPreRunE`, so the error bypassed the usage mapping. The hook now validates required
+  flags and flag groups itself, any error before it is a usage error, and an unknown subcommand under
+  a group exits 4 instead of printing help with exit 0. Guard: poly Go CLI "a missing required flag,
+  an unknown flag and a stray subcommand exit 4 (usage) and send nothing".
+
+Also fixed: `bin/honey.js` ran `dist/cli.js` under Node even in a repository checkout, so
+`honey generate` after a source change could run stale code. Guard: tooling "bin/honey.js picks the
+CLI it runs" (fails on the previous bin).
+
+## Counts
+
+148 rows. 73 are guarded by an existing test, each verified against `3ab88ce` on its own. 70 rows
+point at the 100 newly written tests in `regression/ws9-12/` (7 TypeScript, 10 tooling, 83
+polyglot, the Python multipart one skipped at `ba39cc7` and enabled with its fix), all failing on `3ab88ce`. Three
+tests were strengthened or replaced because the version that existed passed on `3ab88ce`: the hash
+collision, the `ctx.retry()` failure path, and Go H62 (a JSON body already survived the retry).
+
+Nine findings use API that did not exist at `3ab88ce` and are guarded on HEAD only: H57, H58, H59,
+H61, H64, H69, H69b, nullable + optional, and the MCP binary result. Three did not reproduce on
+`3ab88ce` and stay as HEAD guards: H63, the CLI watch loop, and the Go half of the inline-array
+item type.