alkhttp/tasks/gateway/review-002-gw16-status-drift.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
review-002-gw16-status-drift	Unify INVALID_INPUT status on hand-rolled publish/batch paths + sink-deadline decision (GW-16, GW-17)	completed	review-002-gw15-publish-body-cap	narrow	low	component	implementation	gateway review-002

Description

Two review-002 gateway status/deadline findings, same files (routes.rs, dispatch.rs), sequenced after the GW-15 body-cap task because GW-15 adds one more hand-rolled status site:

• GW-16: the documented mapping is INVALID_INPUT → 422 (http-server.md:361), and mid-stream publish validation correctly emits 422. But the new pre-dispatch paths hand-build CallError::invalid_input-shaped responses with StatusCode::BAD_REQUEST: empty body, missing operation, missing chunk, invalid first-line JSON (:257-278), the line-cap error (:459-464), and the /batch over-cap reject (:173-184). Same error class, two statuses depending on where it fires — the GW-03 drift class one table row down.
• GW-17: the documented 30 s deadline includes "the /publish final envelope" (http-server.md:381-384) but invoke_sink has no timeout (dispatch.rs:132-145) — the module doc justifies it as "bounded by the client's upload," which bounds chunk arrival, not the handler's final await. A hung sink handler parks the HTTP connection forever.

Acceptance Criteria

• Decide + implement the body-shape-fault status: either (a) route all hand-rolled INVALID_INPUT responses through call_error_to_http_response_with_identity (making them 422 like the documented mapping), or (b) sanction 400-for-body-shape in http-server.md's table explicitly (documenting which paths are "request shape" vs "per-chunk shape"). Implementer's choice; whichever it is, /publish and /batch agree and the doc table names both statuses' trigger conditions.
• GW-17: decide + implement: (a) wrap the sink handler's completion in the same 30 s tokio::time::timeout family the Once-op invoke uses (new error envelope on trip), or (b) amend http-server.md to exclude the final envelope from the deadline contract. Prefer (a) — the documented contract is the older decision and hung-forever requests are the failure mode review 001 filed twice.
• Tests: each hand-rolled path's status asserted (publish first-line/empty/line-cap/batch-cap); sink-deadline test with a hung sink handler (mirroring dispatch.rs's hung-handler test) if (a)
• http-server.md error/deadline tables updated to match the implemented choice
• cargo test, cargo clippy --all-targets -- -D warnings, cargo fmt --check pass

References

• docs/reviews/002-post-remediation-review.md (Part C', GW-16, GW-17)
• src/gateway/routes.rs:173-184, 257-278, 459-464 (the hand-rolled 400s), dispatch.rs:132-145 (the sink await), error.rs:51 (the 422 mapping)
• docs/architecture/http-server.md:361 (the error table), :381-388 (the deadline contract)
• tasks/gateway/review-002-gw15-publish-body-cap.md (lands the line-cap error this task then normalizes)

Notes

Do this after GW-15 so the line-cap path's final status is chosen once (avoid two commits churning the same lines). ADR-023 governs the error-code discipline — if (b) is chosen for GW-16, note the body-shape-vs-chunk-shape distinction there or in http-server.md so the next projection refresh captures it.

Summary

GW-16: all hand-rolled INVALID_INPUT sites unified to 422 via call_error_to_http_response_with_identity (incl. /batch over-cap). GW-17 choice (a): invoke_sink wrapped in the 30s timeout - hung sink = 504 TIMEOUT envelope. gateway-spec 1.3.0 -> 1.4.0 (minor per ADR-045). Wire-visible: /publish framing faults + /batch over-cap now 422.