[06/36] Add OC-060 schema round-trip validation

[cjohnsto-nz]

---

This is part 16 of 21 in a stack made with GitButler:

•  21  [22/36] Release 0.8.0 with packaged PDF.js preview #54
•  20  [21/36] Complete OC-070 protocol surface polish #56
•  19  [20/36] Record final OpenCollection supervisor acceptance #53
•  18  [19/36] Add OC-110 runtime authoring UX #52
•  17  [18/36] Add OC-080 runtime lifecycle and OC-110 task setup #51
•  16  [16/36] Record OC-050 OC-090 OC-100 supervisor audit #50
•  15  [15/36] Add OC-050 auth and transport support #49
•  14  [14/36] Add OC-100 request type UX #48
•  13  [13/36] Add OC-100 request type UX task #47
•  12  [12/36] Add OC-080 and OC-090 task tracks #46
•  11  [11/36] Record OC-010 through OC-040 supervisor audit #45
•  10  [10/36] Add OC-020 WebSocket support #44
•  9  [09/36] Add OC-010 GraphQL support #43
•  8  [08/36] Require demo server fixtures for parallel tracks #42
•  7  [07/36] Record OC-000 and OC-060 supervisor audit #41
•  6  [06/36] Add OC-060 schema round-trip validation #40 <-- current
•  5  [05/36] Add OC-040 runtime scripting support #39
•  4  [04/36] Add OC-090 gRPC streaming support #38
•  3  [03/36] Add OC-030 gRPC unary protobuf support #37
•  2  [02/36] Add OC-000 protocol dispatch foundation #36
•  1  [01/36] Add OpenCollection agent plan #35

[APKiwi]

Verdict: approve with nits. This is real round-trip fidelity work and the tests are genuinely strong (model round-trip, YAML round-trip, Ajv against the real schema, unknown-field preservation asserted directly). It also quietly fixes two prior fidelity bugs: no-op saves no longer inject a full settings block or an empty runtime object.

• Minor: the one production logic change ships uncovered. The new rows.length === 0 branch in mergeHeaders/mergeParams (schemaRoundTrip.ts:38-40, 52-54) preserves an empty headers: [] instead of collapsing to undefined, and no fixture has an empty array to exercise it. The change is correct (verified the truthy-assign path and that key-less requests stay key-less), but add the fixture.
• Minor: the actual panel wiring is untested. collectionPanel.ts:100-105 and folderPanel.ts:91-101 hand-build partial models with length > 0 ? x : undefined conditionals and pass them to applyRequestDefaultsEditorModel. Tests cover the create-from-collection path, not this one.
• Minor: edits to non-HTTP-editable requests are silently discarded. buildRequestWithSchemaMerge (requestPanel.ts:280-282) returns the clone unchanged for non-HTTP, so visual edits no-op on save with no feedback. Safer than the old force-coerce, but confirm the UI actually gates editing (see the gRPC issue on the OC-100 PR, where it doesn't).
• Nit: mergeVariables didn't get the same empty-array treatment (schemaRoundTrip.ts:67-68), so variables: [] still collapses while headers: [] survives. Inconsistent fidelity.
• Nit: the AGENT_PROGRESS ledger entry is process noise in a code PR.

Deps: none added, ajv/yaml already present.

[cjohnsto-nz]

Fixed.

• Empty-array coverage and variable fidelity: commits d34d834 and a200076 give variables: [] the same preservation semantics as headers: []/params: [], and add focused fixtures for explicit empty HTTP arrays and cleared request-default rows.
• Collection/folder panel wiring: fixed in d34d834. The panels now pass their header and variable arrays directly to applyRequestDefaultsEditorModel; the length > 0 ? value : undefined branches are removed. Clearing all rows therefore produces explicit empty arrays while preserving sibling defaults such as scripts.
• Non-HTTP visual edits: already addressed by the owning protocol branches. This PR’s clone-without-mutation guard is intentional OC-060 safety: unsupported visual editors must not damage YAML. PR [09/36] Add OC-010 GraphQL support #43 commit cc721db adds schema-native GraphQL and WebSocket editor models, and PR [19/36] Add OC-110 runtime authoring UX #52 commit 01915d7 adds schema-native gRPC editing. PR [27/36] Add OC-130 protocol first paint stability #59 commit 1dbc25d then verifies protocol-native first-paint/hydration for all four request types. Duplicating those later implementations here would conflict with their owning branches.
• AGENT_PROGRESS: not changing this. The OC-060 task explicitly required coordination and completion-ledger updates; the file is excluded from the packaged extension and has no runtime impact.

Validation is green: TypeScript compilation, the focused round-trip/validation set (3 files, 11 tests), and the full suite (26 files, 495 tests). PR #40 and immediate child PR #41 are both MERGEABLE/CLEAN, and all PR #40 checks pass.