fix(hydra-gates): vendor manifest schema 2.37.0 and add the update path it never had

[rubenvdlinde]

Closes #785.

What drifted

hydra-gates/scripts/schemas/app-manifest-v2.schema.json stood at 2.33.0. @conduction/nextcloud-vue 3.4.0 ships 2.37.0. Gates 22 and 53 judge every app's manifest against the vendored copy, so a manifest that is correct against the schema its own dependency publishes was rejected by the gate. On dossiq parity/round2, npm run check:manifest reported zero errors while gate 22 reported two, both savedViewPlaces, at /pages/3 and /pages/5.

savedViewPlaces was the key that got noticed. It is not the only one that had drifted. Across the four minors the published schema added:

• 7 $defs: boardView, dateAxisView, folderSidebarScope, folderSidebarScopeSort, rowIndicator, savedViewPlaces, savedViewTree
• 4 page properties: board, dateAxis, savedViewPlaces, savedViewTree
• 10 page.config properties: folderSidebar, listShortcuts, priorityField, priorityLevels, quickEditFields, rowActionField, rowIndicatorCap, rowIndicators, viewTabs, writableField
• 2 widgetEntry properties: roles, visibleWhen
• one widened index-page guard, refusing the four new index-only keys on a detail, dashboard or custom page

Any app adopting one of those would have failed the same way, with the same confusing two-instrument split, and nobody would have attributed it to the schema.

What changed

1. The vendored schema is replaced with the published 2.37.0, byte for byte. The two files were already byte-identical apart from the drift, so the diff is 393 added lines and 3 removed: the version string and two lines rewritten inside the index-page guard.
2. .github/workflows/hydra-gates-schema-sync.yml watches the registry every Monday at 04:00 UTC, an hour before fleet-shared-dep-bump, and opens a pull request when the copy falls behind. It opens one rather than pushing, because CI resolves these gates at @main.
3. hydra-gates/scripts/lib/diff_schema_strictness.js names every constraint that got stricter between two schema documents: a required list that gained an entry, an enum that lost a member, additionalProperties flipped to false, a new pattern or bound, and a property dropped from a properties block whose additionalProperties is false. That last case is the one a line diff reads as "fewer rules" and is the one that would redden a fleet. The sync workflow puts its output in the pull request it opens.
4. hydra-gates/scripts/lib/test_diff_schema_strictness.js pairs every additive case with a planted tightening of the same shape, so the differ has to be able to say no.
5. The README section says who keeps the copy current, and why it is a copy at all.

Why a copy with no update path was the real defect

The vendoring is deliberate and documented in check_manifest.js: pinned-first meant "valid against whatever generation the app happened to install". What was never decided is how the copy catches up. Nothing watched the registry, so the answer was "when somebody notices", and nobody did for four minors. An app cannot fix it either, because the schema is not in any app's repo. A dossiq lane tried and the sandbox refused the write, which is why this is an issue rather than a commit.

Blast radius, measured before merging

The bump is additive, so it can only turn red into green. Checked three ways.

Structurally. diff_schema_strictness.js on 2.33.0 against 2.37.0 prints none. The control matters: run the same two files in the other direction and it prints four findings, so the none is a measurement and not a checker that cannot speak.

Against the fleet. Every swept app's src/manifest.json and its assembled effective manifest, taken from development HEAD, validated under both schemas through the real check_manifest.js. 20 apps have a manifest (versioniq has none, so gates 22 and 53 have nothing to judge there). All 20 read 0 errors before and 0 after, on both gates. Nothing newly fails.

Against the reported failure. dossiq parity/round2 goes from 2 errors to 0 through the same gate, and the two that clear are exactly the two the issue names.

Because nothing in the fleet turns red, this does not need the warning period a stricter gate would. The sync workflow is the part that could surprise someone later, and it never fails a run over drift: it reports and opens a pull request.

Verified

• test_diff_schema_strictness.js, test_check_manifest.sh, test_check_manifest_ajv_collapse.js, test_check_manifest_crossref.js, test_build_effective_manifest.js, test_check_duplicate_index_pages.js, test_manifest_scope_filter.js: all green, with NODE_PATH set so the Ajv paths actually run rather than reporting SKIP.
• Mutation check: disabling the required-gained branch in the differ reddens the assertion a newly required key is reported with exit 0, not a setup line.
• shellcheck clean on all three run: blocks of the new workflow, with the expression placeholders substituted.

Not done here

#783, #784 and #786 were looked at and left. None is a one-line change. #783 needs descendant analysis the markup scanner does not do. #784 changes what gate 19 accepts, which is a stricter gate and wants a warning period and a fleet scan. #786 is a new gate.

🤖 Generated with Claude Code