---
id: review-002-gw16-status-drift
name: Unify INVALID_INPUT status on hand-rolled publish/batch paths + sink-deadline decision (GW-16, GW-17)
status: pending
depends_on: [review-002-gw15-publish-body-cap]
scope: narrow
risk: low
impact: component
level: implementation
tags: [gateway, review-002]
---

## Description

Two review-002 gateway status/deadline findings, same files
(`routes.rs`, `dispatch.rs`), sequenced after the GW-15 body-cap task
because GW-15 adds one more hand-rolled status site:

- **GW-16**: the documented mapping is `INVALID_INPUT → 422`
  (http-server.md:361), and mid-stream publish validation correctly
  emits 422. But the new pre-dispatch paths hand-build
  `CallError::invalid_input`-shaped responses with
  `StatusCode::BAD_REQUEST`: empty body, missing `operation`, missing
  `chunk`, invalid first-line JSON (:257-278), the line-cap error
  (:459-464), and the `/batch` over-cap reject (:173-184). Same error
  class, two statuses depending on where it fires — the GW-03 drift
  class one table row down.
- **GW-17**: the documented 30 s deadline includes "the `/publish`
  final envelope" (http-server.md:381-384) but `invoke_sink` has no
  timeout (`dispatch.rs:132-145`) — the module doc justifies it as
  "bounded by the client's upload," which bounds chunk arrival, not
  the handler's final await. A hung sink handler parks the HTTP
  connection forever.

## Acceptance Criteria

- [ ] Decide + implement the body-shape-fault status: either (a) route
      all hand-rolled `INVALID_INPUT` responses through
      `call_error_to_http_response_with_identity` (making them 422
      like the documented mapping), or (b) sanction 400-for-body-shape
      in http-server.md's table explicitly (documenting which paths
      are "request shape" vs "per-chunk shape"). Implementer's choice;
      whichever it is, `/publish` and `/batch` agree and the doc table
      names both statuses' trigger conditions.
- [ ] GW-17: decide + implement: (a) wrap the sink handler's
      completion in the same 30 s `tokio::time::timeout` family the
      Once-op invoke uses (new error envelope on trip), or (b) amend
      http-server.md to exclude the final envelope from the deadline
      contract. Prefer (a) — the documented contract is the older
      decision and hung-forever requests are the failure mode review
      001 filed twice.
- [ ] Tests: each hand-rolled path's status asserted (publish
      first-line/empty/line-cap/batch-cap); sink-deadline test with a
      hung sink handler (mirroring dispatch.rs's hung-handler test)
      if (a)
- [ ] http-server.md error/deadline tables updated to match the
      implemented choice
- [ ] `cargo test`, `cargo clippy --all-targets -- -D warnings`,
      `cargo fmt --check` pass

## References

- docs/reviews/002-post-remediation-review.md (Part C', GW-16, GW-17)
- src/gateway/routes.rs:173-184, 257-278, 459-464 (the hand-rolled 400s), dispatch.rs:132-145 (the sink await), error.rs:51 (the 422 mapping)
- docs/architecture/http-server.md:361 (the error table), :381-388 (the deadline contract)
- tasks/gateway/review-002-gw15-publish-body-cap.md (lands the line-cap error this task then normalizes)

## Notes

Do this after GW-15 so the line-cap path's final status is chosen once
(avoid two commits churning the same lines). ADR-023 governs the
error-code discipline — if (b) is chosen for GW-16, note the
body-shape-vs-chunk-shape distinction there or in http-server.md so
the next projection refresh captures it.