Domain-model input validation: prototype keys, invalid Date, fractional timeoutMs, lone surrogates, frozen getAll (#76)

[Wahbeh-Mohammad]

Closes #76. Milestone 4 of the audit-#67 remediation umbrella; implements ledger decision D14
(docs/audit-67-decisions.md:311-333). Base audit/remediation-67.

Every bullet of the issue is one commit, written test-first. No new error class, no changeset (D1),
no docs/deviations.md row (outside #76's partition — see "For the supervisor" below).

What changed

Bullet	Fix	Files
Prototype keys satisfy a path placeholder	Object.hasOwn(pathParams, name) gates the read, so {constructor} against {} is OperationAssemblyError instead of /users/function%20Object%28%29…	seams/operation.ts
Invalid Date goes on the wire	ifModifiedSince / ifUnmodifiedSince reject Number.isNaN(date.getTime()) with RequestConditionsValidationError, naming the header	http/request-conditions.ts
Fractional timeoutMs throws at send	the setter requires an integer in 1 .. 2**32 - 1 — AbortSignal.timeout()'s own range; the TSDoc paragraph arguing the other way is rewritten and the test that pinned 1.5 is flipped. composeSignal gains its first @throws	http/request-options.ts, seams/transport.ts
Lone surrogate throws URIError	rfc3986.ts single-sources the rule as hasLoneSurrogate() / toWellFormed(); QueryParamsBuilder.add rejects with UrlConstructionError, substitutePathParams with OperationAssemblyError, and QueryParams.parse substitutes U+FFFD because HTTP-31 forbids throwing	http/rfc3986.ts, http/query-params.ts, seams/operation.ts
getAll on an absent name returns an unfrozen array	one frozen EMPTY_VALUE_LIST per model	http/headers.ts, http/query-params.ts
Headers.equals has no direct test	nine direct cases	http/headers.test.ts
TeeSink accepts a fractional tapLimit	Number.isInteger(tapLimit) || tapLimit === Infinity, same InvariantViolation the constructor already threw	io/tee-sink.ts

Two decisions worth reading

QueryParams.parse is lenient, add is strict. D14 says to reject an unpaired surrogate at the
call site that supplied it. parse is a call site that MUST NOT throw — HTTP-31 is MUST-level
("lenient … falls back to raw text rather than throwing"), and parse feeds the strict add. So the
model draws the same outbound/inbound split Headers already draws for HTTP-18 against HTTP-19:
add throws, parse substitutes U+FFFD. Replacement is what the platform does with the same input —
new URL('https://x/?a=\uD800').search is ?a=%EF%BF%BD, measured 2026-09-05.

Deviation from D14's letter: /\p{Surrogate}/u, not String.prototype.isWellFormed(). The method
exists on the engines.node >= 20.3 runtime but is ES2024, and this repo's declared lib is ES2023
(tsconfig.base.json:5-11), so it does not type-check; raising lib is a repo-wide change outside the
partition. In u mode a well-formed surrogate pair is one non-surrogate code point, so the pattern
matches lone surrogates only — verified equivalent to isWellFormed()/toWellFormed().

Tests added

File	Rows
packages/core/src/seams/operation.test.ts	5 prototype-key names (constructor, toString, hasOwnProperty, valueOf, __proto__) against {}; the error names the placeholder; an own property named like a prototype member still resolves; a null-prototype pathParams still resolves; 3 lone-surrogate values; a surrogate pair encodes; the query projection from both the builder and parse; a property — no URIError escapes buildRequest
packages/core/src/http/request-conditions.test.ts	invalid Date on both setters, 2 spellings each; the message names the header; nothing invalid can reach applyTo
packages/core/src/http/request-options.test.ts	the flipped fractional case; above 2**32 - 1; the inclusive ceiling; a property — every admitted timeout is an integer in range, everything else is RequestOptionsValidationError
packages/core/src/seams/transport.test.ts	every timeout the builder admits composes; every one it rejects never reaches composeSignal
packages/core/src/http/query-params.test.ts	4 lone-surrogate add() rows; a surrogate pair; parse substitutes on value and on name; 2 properties — nothing escapes encode()/equals(), nothing escapes parse(); getAll frozen on both paths
packages/core/src/http/headers.test.ts	getAll frozen on both paths and shared on the miss; 9 direct Headers.equals cases
packages/core/src/io/tee-sink.test.ts	5 rejected tapLimits, 4 accepted, the message names tapLimit, the Infinity default
tests/node-conformance/seams.test.mjs	2 rows — see below

One file outside the literal partition, and why

tests/node-conformance/seams.test.mjs. AbortSignal.timeout() is runtime-divergent, measured
2026-09-05: Node raises RangeError for 1.5, for 2**32 and for -1; Bun accepts 1.5 and
2**32 and raises TypeError for -1. So bun test cannot assert either half of the behaviour
this bullet is about, and CLAUDE.md's membership rule ("a phase that touches a runtime-divergent
surface adds a case there, not only to bun run test") applies. The file already owns composeSignal;
the README needs no edit (it says to ls the directory), and neither #73 nor #77 owns it.

Deviation rows added

None — docs/deviations.md is explicitly not in #76's partition. Two candidates are listed below
for the supervisor to place under D0.

Deferred — release machinery

Skipped under D1:

• patch changeset for @dexpace/core. Five observable behaviour changes, all rejections that were
  previously accepted-then-failed-later or accepted-and-shipped-wrong:
  • buildRequest throws OperationAssemblyError for a {name} placeholder resolved off the
    prototype chain (previously assembled a URL from Object.prototype's member).
  • RequestConditionsBuilder.ifModifiedSince / ifUnmodifiedSince throw
    RequestConditionsValidationError for an invalid Date (previously emitted
    If-Modified-Since: Invalid Date).
  • RequestOptionsBuilder.timeoutMs throws for a non-integer and for anything above 2**32 - 1
    (previously accepted; 1.5 was pinned as accepted by a test, so this is the one row a
    consumer could be relying on).
  • QueryParamsBuilder.add throws UrlConstructionError for an unpaired surrogate;
    QueryParams.parse substitutes U+FFFD for one (previously stored it and threw URIError from
    encode()).
  • Headers.getAll / QueryParams.getAll return a frozen shared list for an absent name (previously
    a fresh mutable []).
    TeeSink is @internal, so its tapLimit change is not consumer-visible.
• .d.ts prose changed on buildRequest, OperationAssemblyError, OperationDescriptor.pathParams,
  composeSignal, RequestOptions.timeoutMs, RequestOptionsBuilder.timeoutMs, QueryParams,
  QueryParams.parse, QueryParamsBuilder.add, Headers.getAll, QueryParams.getAll,
  RequestConditions, RequestConditionsBuilder.ifModifiedSince / ifUnmodifiedSince.
• No docs/first-release.md edit, though timeoutMs(1.5) is exactly its "free before the first
  version bump" class.

packages/core/etc/core.api.md regenerated byte-identical: api-extractor records signatures and
release tags, not @throws prose, and no signature changed. bun run api passes over all nine.

For the supervisor — outside #76's partition, reported not edited (contract item 4)

1. docs/sdk-documentation/http.md:113-114 is now false. It says "A fractional timeoutMs is
   accepted — a timeout is a duration, not a count." Suggested replacement: "timeoutMs rejects zero,
   negatives, Infinity, NaN, a fractional value and anything above 2**32 - 1 (HTTP-35) — the
   range is AbortSignal.timeout()'s, the only one a transport can honor."
2. packages/core/src/http/errors.ts has two stale @public TSDoc blocks.
   RequestOptionsValidationError still reads "a non-null timeout that is zero or negative, or a
   negative max-retries" — already incomplete before this PR (non-finite, fractional maxRetries) and
   more so now. UrlConstructionError reads "when a request URL is malformed or not absolute" and is
   now also the class QueryParamsBuilder.add throws for an unpaired surrogate, per D14's instruction
   to reuse it rather than add a class.
3. The one URIError that still escapes core is in pagination/query-splice.ts — spliceQueryParam
   and readQueryParam, both @internal, reached from pagination/strategies.ts:44,79,85. The cursor
   value there is server-supplied through PageInfo, so a server can make a paginator throw a bare
   URIError outside the DexpaceError tree. D14 says to report the path rather than add a second
   mechanism; the fix belongs to Serde and pagination: deserializeFrom abort, paginator leak on malformed PageInfo, tristate null cast, SSE double-reported release failure #79 (serde and pagination). Reproduction:
   spliceQueryParam(new URL('https://h/?a=1'), 'cursor', '\uD800').
4. defaultTimeoutMs is unvalidated on both transports (fetch-transport.ts:73,205,215,
   undici-transport.ts:95,401,419). It bypasses RequestOptionsBuilder and is now the only remaining
   way an out-of-range delay reaches AbortSignal.timeout(). Documented in composeSignal's @throws;
   the fix belongs to undici transport: native header rejections, fileBody short-write detection, SOCKS proxy type #81 / fetch transport: permanent-error classification; both transports: 204/304/HEAD rows, CONTROL_BYTE regex, producer-failure race #82 or a transport pass.
5. EMPTY_VALUE_LIST is declared twice, once in headers.ts and once in query-params.ts.
   http/builder.ts is the single home and is outside Domain-model input validation: prototype keys, invalid Date, fractional timeoutMs, lone surrogates, frozen getAll #76's partition; consolidating it is one line.
6. Two candidate deviations.md rows under "Deviations recorded outside a phase", if the supervisor
   wants them:
   • HTTP-35 read wider than its letter. The rule is "MUST reject a non-null timeout that is zero or
     negative"; the port also rejects non-finite (pre-existing), non-integer and > 2**32 - 1 (this PR).
     Evidence packages/core/src/http/request-options.ts:184-196. Arguably not a deviation — it is
     strictly stricter, and the same widening already shipped unledgered for Infinity/NaN.
   • HTTP-31 satisfied by substitution rather than by raw-text fallback. The rule names malformed
     percent-encoding; an unpaired surrogate is repaired to U+FFFD instead, because the raw text is
     unencodable. Evidence packages/core/src/http/query-params.ts (parse) and
     packages/core/src/http/rfc3986.ts (toWellFormed).