[14/36] Add OC-100 request type UX

[cjohnsto-nz]

---

This is part 8 of 21 in a stack made with GitButler:

•  21  [22/36] Release 0.8.0 with packaged PDF.js preview #54
•  20  [21/36] Complete OC-070 protocol surface polish #56
•  19  [20/36] Record final OpenCollection supervisor acceptance #53
•  18  [19/36] Add OC-110 runtime authoring UX #52
•  17  [18/36] Add OC-080 runtime lifecycle and OC-110 task setup #51
•  16  [16/36] Record OC-050 OC-090 OC-100 supervisor audit #50
•  15  [15/36] Add OC-050 auth and transport support #49
•  14  [14/36] Add OC-100 request type UX #48 <-- current
•  13  [13/36] Add OC-100 request type UX task #47
•  12  [12/36] Add OC-080 and OC-090 task tracks #46
•  11  [11/36] Record OC-010 through OC-040 supervisor audit #45
•  10  [10/36] Add OC-020 WebSocket support #44
•  9  [09/36] Add OC-010 GraphQL support #43
•  8  [08/36] Require demo server fixtures for parallel tracks #42
•  7  [07/36] Record OC-000 and OC-060 supervisor audit #41
•  6  [06/36] Add OC-060 schema round-trip validation #40
•  5  [05/36] Add OC-040 runtime scripting support #39
•  4  [04/36] Add OC-090 gRPC streaming support #38
•  3  [03/36] Add OC-030 gRPC unary protobuf support #37
•  2  [02/36] Add OC-000 protocol dispatch foundation #36
•  1  [01/36] Add OpenCollection agent plan #35

[APKiwi]

Verdict: approve with nits, but the first item is borderline request-changes and I'd fix it before merge.

• Major, data integrity: gRPC edits are silently discarded behind a false "saved" toast. The webview renders gRPC with an editable URL field, editable message body and an Invoke button, but the save path is a hard no-op: isVisualEditableRequest excludes grpc (schemaRoundTrip.ts:156-157), buildRequestWithSchemaMerge returns the unchanged clone (webview/requestPanel.ts:1131-1133), applyRequestEditorModel early-returns too (schemaRoundTrip.ts:616-618), and _canApplyRequestEdit(grpc, grpc) is true (panels/requestPanel.ts:147) so saveDocument writes the unchanged request and posts success. The read-only banner only fires on protocol mismatch, which never happens here. Edit a gRPC URL, save, see "saved", file unchanged. This is worse than before, when gRPC mis-rendered as an empty HTTP editor and was obviously broken. Either render gRPC fields read-only or make grpc visual-editable in the merge.
• Minor: streaming message sequences display only the first message. loadRequest's array branch does findIndex(v => v.selected), sequences have no .selected, index falls back to 0.
• Nit: the four new protocol colors duplicate the existing method colors for HTTP/GraphQL.

Tests: good on the creation path (all four starters subschema-validated, real command flow, slug edges, identity guard). The gap is exactly where the bug is: nothing drives edit-then-save for gRPC through the webview build path, and the round-trip test asserts the no-op as if it were desired.

Deps: none added, package.json changes are the color contributions only.

[cjohnsto-nz]

Already addressed for the major finding. The false-success save path is real on this PR snapshot, but gRPC visual editing is implemented downstream in PR #52 (feature/oc-110-runtime-authoring-ux). Commit 01915d784e784d9e216d0c2cd8cad4ca70deac08 adds gRPC to isVisualEditableRequest and adds the gRPC merge path for URL, metadata, message, auth, and runtime in src/models/schemaRoundTrip.ts; PR #52 is currently at eac73cfdff9b9769b9a27fadcc0a5cc3a003fcb5 and is MERGEABLE. I have not duplicated that implementation onto PR #48 because doing so would put the same ownership on two stack layers and create avoidable descendant conflicts.

Fixed for streaming sequences. On the topmost review-rework branch fix/open-collection-pr-rework, commit 2b50626915aae4c2671fce67f565f8ba5c6a4f38 adds an explicit message selector for client-streaming and bidirectional-streaming requests. Switching messages first merges the current textarea value, then loads the selected entry; saving preserves every sequence sibling and its description. The test drives the actual webview Ctrl+S path for both streaming modes, not only the model helper.

Not changing the protocol color contributions. missio.protocolHttp / Graphql / Websocket / Grpc are semantic protocol-icon theme tokens, while missio.methodGet / Post / etc. are HTTP-method tokens. Some default hues intentionally match for visual consistency, but keeping distinct token IDs lets themes override protocol identity independently from HTTP verbs. Reusing method tokens would couple unrelated UI semantics.

Validation after the rework: 494 tests pass, TypeScript compilation passes, and the production build passes. PR #48 and its immediate child PR #49 both remain MERGEABLE; neither branch was rewritten for this response.