diff --git a/.beads/issues.jsonl b/.beads/issues.jsonl
index 5fcfd1ca53..f35c51470c 100644
--- a/.beads/issues.jsonl
+++ b/.beads/issues.jsonl
@@ -83,6 +83,8 @@
 {"_type":"issue","id":"gopherstack-rnd","title":"EventBridge Pipes AWS-accuracy audit (GH#1818)","status":"closed","priority":1,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-05-29T21:27:34Z","created_by":"mayor","updated_at":"2026-07-26T14:59:24Z","closed_at":"2026-07-26T14:59:24Z","close_reason":"Superseded: pipes audited 2026-07-24 (5d5b2188), overall A. Execution gaps closed; only remaining gap is a proven impossibility (no in-repo Kafka/AMQP broker).","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-o2j","title":"OpenSearch AWS-accuracy audit (GH#1817)","status":"closed","priority":1,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-05-29T21:27:29Z","created_by":"mayor","updated_at":"2026-07-26T14:59:23Z","closed_at":"2026-07-26T14:59:23Z","close_reason":"Superseded: opensearch audited 2026-07-25 (acb2e23f9, parity-4), overall A-, gaps documented. Issue predates the parity campaigns.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-g3y","title":"EC2 batch-4 audit: VPC endpoints, TGW, NACL, Route Tables, NAT Gateway. Real stateful emulation, 2k+ lines.","status":"closed","priority":1,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-05-29T10:49:37Z","created_by":"mayor","updated_at":"2026-07-26T14:59:24Z","closed_at":"2026-07-26T14:59:24Z","close_reason":"Superseded: all five families exist and ec2 audited 2026-07-25 (parity-4) at overall A. Remaining EC2 field-diff work tracked in gopherstack-8pce.","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"gopherstack-ylyb","title":"review the CodeQL alert 254 dismissal (cognitoidp SRP hash)","description":"During PR #2414 a subagent dismissed code-scanning alert 254 (go/weak-sensitive-data-hashing, services/cognitoidp/srp.go) via 'gh api ... --method PATCH -f state=dismissed -f dismissed_reason=\"false positive\"' WITHOUT being asked. That changes the repo security dashboard and should have been the user's decision.\n\nThe technical reasoning appears sound: srpComputeX implements RFC 5054's x = H(salt, H(pool, user, \":\", pass)) with SHA-256, matching what amazon-cognito-identity-js computes client-side. It is not password storage, and substituting a slow KDF would break wire compatibility with real AWS SDK clients. Same class as the already-established false positives at services/lambda/layers.go:400 and services/sns/signing.go:100 (alerts 248/249).\n\nAction: confirm the dismissal should stand, or reopen it. Also note inline 'codeql[...]' comments do NOT suppress Code Scanning alerts — that is legacy LGTM syntax — so dismissal has to go through the API/UI regardless.","status":"open","priority":2,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T18:31:31Z","created_by":"Witness Patrol","updated_at":"2026-08-11T18:31:31Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"gopherstack-x6r7","title":"ec2: maxRunInstancesCount=1000 is invented, and the backend clamps silently","description":"Shipped in PR #2414 to close CodeQL alert 253 (go/uncontrolled-allocation-size).\n\nTwo things to revisit:\n\n1. The constant is ours, not AWS's. Real EC2 rejects RunInstances against per-account instance quotas; it has no flat 1000 cap. handler_filters.go returns InvalidParameterValue above 1000, which makes gopherstack MORE RESTRICTIVE THAN AWS — a known bug class in this repo. Decide whether to model quotas properly or raise/remove the handler-side rejection and keep only the backend clamp.\n\n2. InMemoryBackend.RunInstances now silently clamps count to 1000 instead of erroring. Over HTTP the handler rejects first, but cloudformation (services/cloudformation/resources_ec2.go) and tests call the backend directly and will silently get fewer instances than requested. That is 'parameter accepted then quietly ignored', bug class 2 in the campaign checkpoint. It matches the pre-existing 'count \u003c 1 -\u003e 1' clamp directly above, which is why it was left as-is.\n\nAlso note store.go now does make([]string, 0, maxRunInstancesCount) on the outpost path — a fixed ~16KB reservation regardless of how many instances were asked for. That shape was required because CodeQL rejected every form that kept the user-derived count in the make() size argument.","status":"open","priority":2,"issue_type":"bug","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T18:31:14Z","created_by":"Witness Patrol","updated_at":"2026-08-11T18:31:14Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-a8b5","title":"agents lint package-scoped, so repo-wide vet failures reach CI unnoticed","description":"A govet shadow in test/integration/datasync_test.go reached a commit and would have failed CI on merge. Fixed in 69dc2dfce.\n\nRoot cause is the verification pattern, not the edit. Every subagent in this campaign ran 'golangci-lint run ./services/\u003cits-service\u003e/...' - package-scoped. The integration suite under test/ is outside every such scope, so a change to a service that also touches test/integration is linted by nobody. The orchestrator's per-commit gates were scoped the same way.\n\nIt surfaced only when a full 'golangci-lint run ./...' was run at merge time.\n\nFix options, cheapest first:\n- have the orchestrator run repo-wide lint before each commit rather than package-scoped (costs minutes per commit, catches this class immediately);\n- or require any agent touching test/ to lint ./test/... explicitly;\n- or add a pre-commit check that lints the union of directories a diff touches, not just services/.\n\nNote the same blind spot applies to go vet: agents run 'go vet .' at the repo root only when an exported signature changes, which does not cover test/ either.","status":"open","priority":2,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T13:41:17Z","created_by":"Witness Patrol","updated_at":"2026-08-11T13:41:17Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-ky42","title":"bd dolt push is a no-op: no remote configured","description":"Every session-close in this campaign ran 'bd dolt push' as its replication step. It does not push - it prints remote-configuration usage examples (DoltHub and Azure Blob URLs) and exits, because no dolt remote is configured for this database.\n\nSo the beads database has never been replicated anywhere by that step, across the whole campaign.\n\nNothing is lost: issue data is committed to git as .beads/issues.jsonl and has been pushed with every commit. The gap is that the session-close protocol documents a replication step that silently does nothing, and anyone relying on the Dolt copy would find it stale.\n\nFix: either configure a real dolt remote and verify 'bd dolt push' exits non-zero on failure, or remove the step from the session-close protocol and state plainly that .beads/issues.jsonl in git is the source of truth.\n\nVerify by checking the command's exit code and output rather than assuming - it currently exits successfully while doing nothing, which is why it went unnoticed.","status":"open","priority":2,"issue_type":"bug","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T13:41:15Z","created_by":"Witness Patrol","updated_at":"2026-08-11T13:41:15Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-9q6f","title":"audit: query and XML protocol services never scanned for wire-field mismatches","description":"The wire-field audit covered 131 JSON/rest-json services and found 16 real bugs (12 in c8e486e23, 4 in e12c5f4de), including values silently discarded and one operation returning another task's data.\n\nThe 25 query and XML protocol services were EXCLUDED THROUGHOUT and have never been checked: ec2, s3, iam, cloudformation, route53, elb, elbv2, autoscaling, sns, sqs, rds, sts, docdb, neptune, elasticache, elasticbeanstalk, ses and the rest. These are among the most heavily used services in the repo.\n\nThe json-tag mechanism does not apply to them - query services parse form-encoded keys, XML services parse element names - so the existing tool cannot be pointed at them unchanged. WHETHER AN EQUIVALENT MISMATCH CLASS EXISTS THERE IS GENUINELY OPEN. Do not assume they are clean because the JSON sweep skipped them.\n\nStart by establishing HOW each protocol's request parsing works in this repo - form values, XML unmarshalling, or hand-rolled - and whether a mismatch is even expressible. If parsing is by explicit key lookup rather than struct tags, a wrong key is just as silent as a wrong tag and just as invisible to tests written against it.\n\nAUDIT FIRST, REPORT COUNTS BEFORE FIXING. Precedent: 48 error-type suspects yielded 6 real, 62 enum allowlists yielded 9, 131 wire candidates yielded 16. Expect most differences to be legitimate.\n\nThe JSON tool is in the session scratchpad under audit/ and wsweep/ and had three faults fixed in it - reuse its botocore-loading and model-diff halves rather than rebuilding those.","status":"in_progress","priority":2,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T10:21:05Z","created_by":"Witness Patrol","updated_at":"2026-08-11T10:21:11Z","started_at":"2026-08-11T10:21:11Z","dependency_count":0,"dependent_count":0,"comment_count":0}
@@ -469,6 +471,10 @@
 {"_type":"issue","id":"go-hwb.106","title":"S3 Control: ~48 missing ops (access points/grants/batch jobs/MRAP)","description":"## S3 Control — Service Deep Dive\n\nAudit of [services/s3control/](services/s3control/) and UI in [ui/src/routes/s3control/](ui/src/routes/s3control/).\n\n### 1. Missing SDK Operations\n~48 missing ([sdk_completeness_test.go#L21](services/s3control/sdk_completeness_test.go#L21)): `DeleteAccessGrant`, `DeleteBucket`, `GetAccessPoint`, `ListAccessPoints`, `PutAccessPointPolicy`, Access Grants, Access Points, Batch Jobs, MRAP, Storage Lens Group. Only 13 supported (public access block + partial).\n\n### 2. Missing UI / Dashboard Features\nPublic access block display only. Missing: access points mgmt, access grants, batch job UI, MRAP, storage lens groups, Object Lambda.\n\n### 3. Goroutine / Resource / Lock Leaks\nClean. Map cloning on snapshot ([persistence.go#L44](services/s3control/persistence.go#L44)).\n\n### 4. Performance Optimizations\n1. 10+ separate maps — consolidate with typed keys to reduce Reset cost.\n2. Atomic counter for IDs ([backend.go#L178](services/s3control/backend.go#L178)) good.\n\n### Suggested Order\n1. Access Points (Create/Get/List/Put policy)\n2. Access Grants (Create/Delete/List)\n3. Batch Jobs + MRAP + Storage Lens Group\n4. Consolidate map structure\n\n\n---\n**Source:** https://github.com/BlackbirdWorks/gopherstack/issues/1223\n","status":"closed","priority":2,"issue_type":"task","owner":"andrew.bishop9625@gmail.com","created_at":"2026-05-02T18:28:35Z","created_by":"mayor","updated_at":"2026-07-30T16:59:49Z","closed_at":"2026-07-30T16:59:49Z","close_reason":"STALE (parity-5 verification sweep): verified against code, not PARITY.md prose. The authoritative reflective TestSDKCompleteness test passes for this service with an empty notImplemented list, i.e. zero unaccounted SDK operations - refuting the ticket's missing-ops claim. UI route page exists and is substantial. Ticket was auto-generated 2026-05-02, before the parity-3/4/5 campaigns did this work.","external_ref":"gh-1223","labels":["ai-queue"],"dependencies":[{"issue_id":"go-hwb.106","depends_on_id":"go-hwb","type":"parent-child","created_at":"2026-05-02T13:28:35Z","created_by":"mayor","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"go-hwb.102","title":"Timestream Write: SDK complete; per-table WriteRecords locks","description":"## Timestream Write — Service Deep Dive\n\nAudit of [services/timestreamwrite/](services/timestreamwrite/) and shared UI in [ui/src/routes/timestream/](ui/src/routes/timestream/).\n\n### 1. Missing SDK Operations\n**0 missing.** 20 ops implemented including `CreateDatabase`, `CreateTable`, `WriteRecords`, `CreateBatchLoadTask`, `ResumeBatchLoadTask`, tags.\n\n### 2. Missing UI / Dashboard Features\nShared UI covers DBs + tables + scheduled queries. Full CRUD. Batch load UI could be enhanced.\n\n### 3. Goroutine / Resource / Lock Leaks\nClean. 4 nested maps under single `lockmetrics.RWMutex` ([backend.go#L159](services/timestreamwrite/backend.go#L159)).\n\n### 4. Performance Optimizations\n1. **Single mutex serializes WriteRecords across tables** — partition by table-ARN for ~10x throughput.\n2. Dispatch pre-built ([handler.go#L62](services/timestreamwrite/handler.go#L62)).\n\n### Suggested Order\n1. Per-table-ARN partition locks for `WriteRecords`\n2. Batch load UI polish\n\n\n---\n**Source:** https://github.com/BlackbirdWorks/gopherstack/issues/1227\n","status":"closed","priority":2,"issue_type":"task","owner":"andrew.bishop9625@gmail.com","created_at":"2026-05-02T18:28:34Z","created_by":"mayor","updated_at":"2026-07-30T16:59:48Z","closed_at":"2026-07-30T16:59:48Z","close_reason":"STALE (parity-5 verification sweep): verified against code, not PARITY.md prose. The authoritative reflective TestSDKCompleteness test passes for this service with an empty notImplemented list, i.e. zero unaccounted SDK operations - refuting the ticket's missing-ops claim. UI route page exists and is substantial. Ticket was auto-generated 2026-05-02, before the parity-3/4/5 campaigns did this work.","external_ref":"gh-1227","labels":["ai-queue"],"dependencies":[{"issue_id":"go-hwb.102","depends_on_id":"go-hwb","type":"parent-child","created_at":"2026-05-02T13:28:34Z","created_by":"mayor","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"go-hwb","title":"Epic: ai-queue from BlackbirdWorks/gopherstack","description":"Autonomous grinding of GitHub issues labeled 'ai-queue' from BlackbirdWorks/gopherstack. Each child bead corresponds to one GitHub issue (external-ref gh-N). Launched via gt mountain for wave-based dispatch with Witness failure tracking and merge-on-CI-pass via Refinery.","status":"open","priority":2,"issue_type":"epic","owner":"andrew.bishop9625@gmail.com","created_at":"2026-05-02T18:27:46Z","created_by":"mayor","updated_at":"2026-05-02T18:27:46Z","labels":["ai-queue"],"dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"gopherstack-nejg","title":"beads data is not in git: .beads is gitignored, so issues.jsonl has no remote","description":"CORRECTED. The original premise was wrong.\n\n.beads/issues.jsonl IS tracked in git and is NOT ignored ('git ls-files .beads/' lists it; 'git check-ignore' does not match it). The .gitignore entry matches the .beads DIRECTORY, but the file was tracked before that entry existed, so gitignore has no effect on it. The durability claim in CLAUDE.md and the campaign checkpoint is therefore correct.\n\nThe real, much smaller issue: every 'bd create' prints\n\n  Warning: auto-export: git add failed: exit status 1: The following paths are ignored by one of your .gitignore files: .beads\n\nbecause the auto-export hook runs 'git add .beads' (the ignored directory) rather than 'git add .beads/issues.jsonl' (the tracked file). The export itself succeeds and the file is modified on disk; only the auto-staging fails, so the change has to be staged by hand. Cosmetic plus a small footgun — a session that trusts the auto-export could end without the jsonl actually staged.\n\nFix: make the hook add the file path, or use 'git add -f'.","status":"open","priority":3,"issue_type":"bug","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T18:31:53Z","created_by":"Witness Patrol","updated_at":"2026-08-11T18:32:29Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"gopherstack-mdo5","title":"CodeFactor substring-matches comments: any 'toDomain*' mention trips warning-comment","description":"PR #2414: CodeFactor flagged four doc comments with rule 'warning-comment' that contained no TODO/FIXME/HACK marker. Cause: CodeFactor does a naive case-insensitive SUBSTRING match, and 'toDomainConfig...' lowercased begins 'todo'.\n\nFixed by dropping the leading identifier from the doc comments in services/elasticsearch/handler_domain_config.go, services/elasticsearch/handler_domain_advanced_options_test.go, and services/opensearch/handler_domain_config.go. That costs Go's godoc naming convention ('toDomainConfigJSON builds...' became 'Builds...'). All four are unexported so no linter objects, but it reads wrong.\n\nTwo pre-existing occurrences were left alone because CodeFactor only scans PR-diff lines: services/elasticsearch/handler_domain_config.go:397 and services/opensearch/handler_domain_config.go:19 (the latter via 'previews' -\u003e 'review'). They will fire the next time a PR touches those lines.\n\nReal fix would be renaming the toDomainConfig* family, or a CodeFactor dashboard rule exception. Note CodeFactor honors neither //nolint nor golangci-lint config — thresholds live in its web dashboard, outside the repo.","status":"open","priority":3,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T18:31:46Z","created_by":"Witness Patrol","updated_at":"2026-08-11T18:31:46Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"gopherstack-naoq","title":"ui: quicksight modal tests raised to 30s, masking contention not fixing it","description":"PR #2414 raised three tests in ui/src/routes/quicksight/page.test.ts to a 30000ms timeout: 'creates a dashboard via the modal', 'updates a dashboard via the edit modal', 'lists templates and creates one via the modal'.\n\nThey were always running near Vitest's 5s default and tipped over once the suite reached 2059 tests — reproduced locally 3x under 'make ui-test', never when the file runs standalone (~10s for the whole file). So they are contention-bound, not slow.\n\nThe 30s buys margin; it does not remove the cause. If they time out again the fix is to make the modal flows cheaper (fewer awaited re-renders, lighter mocks), not a bigger number.","status":"open","priority":3,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T18:31:45Z","created_by":"Witness Patrol","updated_at":"2026-08-11T18:31:45Z","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"gopherstack-17sl","title":"CodeQL guard recognition: dangerous op must sit inside the proving branch","description":"Expensive lesson from PR #2414, worth encoding so the next agent does not burn three CI rounds on it.\n\nCodeQL's go/incorrect-integer-conversion and go/uncontrolled-allocation-size do NOT recognize a clamp that reassigns a variable and uses it later. Both of these FAILED:\n\n  expiry := v; if expiry \u003e math.MaxUint32 { expiry = math.MaxUint32 }; use(uint32(expiry))\n  if count \u003e max { count = max }   ... 40 lines later ...   make([]string, count)\n\nWhat worked:\n  - conversion INSIDE the guarded branch:\n      if v \u003c= math.MaxUint32 { pp.X = uint32(v) } else { pp.X = math.MaxUint32 }\n  - removing the tainted value from the allocation-size slot entirely:\n      make([]string, 0, someConstant) + append in a loop bounded by count\n\nAlso: a bound placed in a different function (handler layer) does not help — CodeQL traced a path through services/cloudformation/handler.go that bypassed it.\n\nSecond trap: the required 'modernize' CI job runs 'go fix -diff ./...' (gopls), NOT golangci-lint, so //nolint:modernize does nothing there. It will rewrite an explicit 'if a \u003e b { a = b }' back into min(), fighting the CodeQL fix. Verify locally with 'go fix -diff ./...' — empty output required.","status":"open","priority":3,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T18:31:32Z","created_by":"Witness Patrol","updated_at":"2026-08-11T18:31:32Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-5wj0","title":"sweep: 66 lower-confidence wire-name candidates unverified, plus query/XML services unscanned","description":"The wire-field audit (gopherstack-d7hi, c8e486e23) scanned 131 JSON services and fixed twelve wrong-name bugs. Two categories remain.\n\n1. SIXTY-SIX LOWER-CONFIDENCE CANDIDATES from the tool's field-overlap fallback matcher were never hand-verified. These are noisier than the 22 name-matched ones already triaged, because coincidental field-name overlap between an operation and an unrelated struct is common. Densest: sagemaker 21, vpclattice 14, iot 8, quicksight 7, omics and opensearch 5 each.\n\nRecoverable from the session scratchpad at wsweep/details.json filtering method=overlap. If that is gone, the tool at scratchpad/audit/ regenerates it - and note the agent FIXED three faults in it that had hidden whole services, so use that version rather than rebuilding.\n\n2. THE QUERY AND XML PROTOCOL SERVICES were never scanned - ec2, s3, iam, cloudformation, route53, elb, elbv2, autoscaling, sns, sqs, rds, sts and the rest. The json-tag mechanism does not apply there, but whether an equivalent query-key or XML-tag mismatch class exists is GENUINELY OPEN. Do not assume they are clean.\n\nAlso catalogued and untouched: roughly 2224 absent fields across the scanned services. Most have no backend state and adding them would be dead plumbing, but a separate pass could judge which deserve it - prioritise ones whose absence a client can observe, like filters and flags that gate an action, over echo-only fields.","status":"closed","priority":3,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T09:42:38Z","created_by":"Witness Patrol","updated_at":"2026-08-11T10:16:20Z","closed_at":"2026-08-11T10:16:20Z","close_reason":"Resolved in e12c5f4de. MOSTLY NEGATIVE, AS PREDICTED - and that was the point of running it.\n\nThirty-one candidates examined across the six densest services, FOUR REAL. The rest were the fallback matcher pairing a request struct against an unrelated STORED or RESPONSE type, so fields belonging to neither the request nor the handler looked missing. Roughly thirteen percent conversion against twelve-of-twenty-two on the high-confidence batch - the ratio I expected, which is why I told the agent an empty result would be a good outcome.\n\nTHE OPENSEARCH FIND JUSTIFIES THE WHOLE PASS. Software update options were read AND written under a key the API does not use - I confirmed the real key appears twice in each direction of the SDK and the invented one appears NOWHERE. So a client's setting was discarded and any value coming back was unparseable. A TEST HAD ENSHRINED THE INVENTED KEY as expected behaviour.\n\nThe Studio lifecycle configuration discarded its script CONTENT - which I verified the model marks REQUIRED - so the configuration was created empty and reported success.\n\nFleet metric update ignored its expected version, so the optimistic lock did nothing although the operation documents a conflict error and THREE SIBLING RESOURCES already implement exactly that check. That asymmetry is the same tell as several earlier finds.\n\nSequence store dropped two fields the stored type ALREADY HAD WAITING FOR THEM - and the agent correctly left absent the two location fields with no honest source rather than filling them.\n\nGOOD DISCIPLINE ON THE NEGATIVES: it reported a verdict per candidate including dismissals, and catalogued genuinely-absent fields rather than inventing backend state. Thirty-five candidates in sparser services remain, and it said plainly they will convert worse.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-6q5h","title":"apigateway: UpdateBasePathMapping patch paths are lowercase on the wire, camelCase in the struct","description":"AWS documents UpdateBasePathMapping's patch paths as /basepath and /restapiId - all lowercase - while gopherstack's json tags are camelCase. A real client's PATCH silently no-ops.\n\nSame class as the wire-name mismatches fixed in b235b958b, but on a patch path rather than a struct tag. Note this one is NOT saved by Go's case-insensitive tag matching, because the path is compared as a string in the patch dispatcher rather than unmarshalled.\n\nFound during the patch-operations pass (gopherstack-oius, 2b3f3c89b) and not reached - it is outside the five operations that pass prioritised.\n\nAlso unfixed from that pass, both rejected-rather-than-fabricated today and worth modelling properly if anyone needs them: UpdateAuthorizer's /providerARNs and UpdateAccount's /features.\n\nVerify with a real aws-sdk-go-v2 client, not a hand-built body - every operation in that pass had passing tests written against the wrong shape.","status":"closed","priority":3,"issue_type":"bug","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T09:27:24Z","created_by":"Witness Patrol","updated_at":"2026-08-11T09:58:54Z","closed_at":"2026-08-11T09:58:54Z","close_reason":"Resolved in d071426c8. THE CASING MISMATCH WAS REAL BUT NOT THE WHOLE BUG - the agent found the deeper cause.\n\nThe base path is BOTH the lookup identity and the patch target, and the identity is re-injected from the URL AFTER patches resolve, unconditionally overwriting. So a rename was clobbered by the old value before it could take effect - and the backend had no rename logic at all. Even the exactly-correct casing failed. Renaming now moves the stored entry and refuses a collision.\n\nBOTH SPELLINGS ACCEPTED, because AWS's OWN DOCUMENTATION DISAGREES WITH ITSELF - the patch reference documents one and the command-line reference the other, both cited. That is the right resolution of an ambiguity rather than picking one and being wrong half the time.\n\nNO BLANKET CASE FOLDING, which I had explicitly warned against - it would start accepting paths on other operations that the API rejects. The neighbouring identifier was aliased deliberately, having previously worked only by accident of case-insensitive decoding.\n\nTHE TWO LEFTOVER PATHS BOTH HAD REAL STATE BEHIND THEM and are now implemented rather than left refused - including refusing removal of the one feature the documentation says cannot be removed. Removing the last entry from the ARN list silently did nothing: the emptiness-versus-presence mistake, third instance in this service.\n\nAll twenty-two operations were compared against their documented paths; this was the only casing mismatch. That negative result is worth as much as the fix.\n\nSEPARATELY, AND NOT THIS AGENT'S BUG: it flagged an intermittent data race as pre-existing and unrelated. It IS pre-existing, but NOT unrelated - I captured the frames myself and they point at UpdateMethod, which my previous commit 2b3f3c89b touched. Filed P1.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"gopherstack-d7hi","title":"sweep: 95 JSON services and all query/XML services unchecked for wire-field mismatches","description":"The wire-field audit (gopherstack-7rq1, b235b958b) covered 40 of 135 JSON/rest-json services in depth and fixed three wrong-name tags. The remaining ~95 JSON services are entirely unscanned.\n\nSeparately, the 25 query and XML protocol services (ec2, s3, iam, cloudformation, route53, elb, elbv2, autoscaling, sns, sqs, rds, sts and others) were deliberately excluded - the json-tag mechanism differs there. WHETHER AN ANALOGOUS QUERY-KEY OR XML-TAG MISMATCH CLASS EXISTS IS AN OPEN QUESTION and worth its own audit; do not assume those services are clean because this sweep skipped them.\n\nThe audit tool lives in the session scratchpad under audit/ and is worth rebuilding or recovering rather than hand-diffing: per service it loads the pinned botocore model, keeps only body members (excluding header/uri/querystring-bound ones), matches operation names to *Input structs, and splits differences into absent, case-only (NOT bugs - Go matches json tags case-insensitively) and wrong-name-by-similarity, which is where real bugs live.\n\nExpect most candidates to be fields with no backend state. The three real bugs came from roughly 60 wrong-name candidates across 40 services, most of which were case-only or inert.","status":"closed","priority":3,"issue_type":"task","owner":"blackbird7181@gmail.com","created_at":"2026-08-11T08:31:28Z","created_by":"Witness Patrol","updated_at":"2026-08-11T09:42:37Z","closed_at":"2026-08-11T09:42:37Z","close_reason":"Resolved in c8e486e23. TWELVE REAL BUGS ACROSS FIVE SERVICES, from 131 services scanned - all the JSON ones except the five already done.\n\nI VERIFIED FIVE OF THE TWELVE MYSELF against the models: the key material name, the migration identifier, the replication config ARN, the cache capacity, and the medical content identification type. All exact.\n\nWORST ONE IS NOT A DROPPED FIELD: a replication statistics operation had been COPIED FROM ITS SIBLING and kept the sibling's identifier, so it returned ANOTHER TASK'S statistics - under a response field that also had the wrong name. Wrong data rather than no data.\n\nIMPORTING KEY MATERIAL READ THE MATERIAL UNDER THE WRONG NAME, so the import proceeded without it. On a key service that is the sharpest instance of the class.\n\nTHE RATIO IS THE REASON THIS WAS SCOPED AS AN AUDIT: 131 wrong-name candidates, 22 hand-checked at high confidence, twelve real. Nearly two hundred case-only differences are harmless because the decoder ignores case. Over two thousand absent fields are usually correct, not gaps - left catalogued, not fabricated.\n\nEIGHT WERE CORRECTLY NOT FIXED - structural, a nested object flattened into scalars, needing a shape redesign rather than a rename. Including one where the names are wrong but the handler ignores its parsed input entirely, so there is no behavioural fix to make.\n\nTHE AGENT FIXED THE TOOL RATHER THAN WORKING AROUND IT, and the three faults each hid whole services: a payload trait that made one field look like the entire body, a struct matcher that only recognised one naming convention - about half the services unmarshal into differently-named types - and thirty wrong directory names. Zero-match services fell from 64 to 9.\n\nIT ALSO REPORTED ITS OWN FALSE POSITIVES: a field regex that does not track brace depth surfaced two candidates that were already correct. Saying so is worth more than a clean-looking table.\n\nSTOPPED HONESTLY: 66 lower-confidence candidates from the fallback matcher are unverified, densest in sagemaker, vpclattice, iot and quicksight. Query and XML services remain entirely unscanned.","dependency_count":0,"dependent_count":0,"comment_count":0}