feat(extract): validator.array bounds are enforced, in every port

An array field's validator.array (@min/@max) was declared and ignored: the
extract engine never saw it and the TypeScript generated parse schema emitted a
bare z.array(...). Two cold agent sessions both declared "exactly three tags" in
the model and then re-checked the count by hand.

The bound now travels on FieldSpec (minItems/maxItems) in TS, Java, Python and
C# (Kotlin drives the Java engine), built from the field's array validator by
each port's metadata-driven schema builder. Semantics, identical everywhere:
- more than @max: NORMAL/LOOSE keep the first @max and record a "truncate"
  coercion, the array analogue of a numeric clamp; STRICT is MALFORMED;
- fewer than @min: MALFORMED under every tolerance, so orThrow fails on a
  @required one and malformedRequired() names it.
The TypeScript generated parse/safeParse schema carries the same bounds.

The extract-conformance corpus gains three cases (48), a minItems/maxItems key,
scalar arrays in the runners, and an optional per-case tolerance; every port's
runner reads them. Each port also has a metadata-driven test (validator.array ->
schema -> extract -> strict gate). Local CI green: gates, ts, java-fast, python,
csharp.

This is a behaviour change: a reply outside the bounds that used to pass now
truncates or fails. The CHANGELOG says so up front.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M1mRRB1K2WdYy82kntMQdx

Author: dmealing

CHANGELOG.md

@@ -12,6 +12,16 @@ here.**
 
 ### Changed
 
+- **Behaviour change in `extract`, every port: `validator.array` bounds are enforced.** An
+  array field's `validator.array` (`@min`/`@max`) now reaches the extract engine. A reply with
+  more elements than `@max` keeps the first `@max` (a `truncate` coercion, like a numeric clamp)
+  under the default tolerance and is `MALFORMED` under `STRICT`; a reply with fewer than `@min`
+  is `MALFORMED` under every tolerance, so `orThrow` fails on a `@required` one and
+  `malformedRequired()` names it. The TypeScript generated `parse<Name>` / `safeParse<Name>`
+  Zod schema carries the same bounds (`z.array(…).min(n).max(m)`). Before, the bounds were
+  declared and ignored, so code re-checked the count by hand. The extract-conformance corpus
+  gains three cases (48 in all), a `minItems`/`maxItems` schema key and an optional per-case
+  `tolerance`, run by every port.
 - **SQLite: projection views that use `origin.collect` now open on SQLite 3.35.** They used an
   in-aggregate `ORDER BY` (`json_group_array(x ORDER BY …)`), which needs 3.44, so a database
   holding one could not be opened by Ubuntu 22.04's SQLite 3.37 or Python 3.10's stdlib. A

docs/CONFORMANCE.md

@@ -31,7 +31,7 @@ regenerate with `ls -d fixtures/<corpus>/*/ | wc -l` for directory-shaped corpor
 | [`fixtures/verify-conformance/`](../fixtures/verify-conformance/) | 31 | ✓ | ✓ | inherits via Java | ✓ | ✓ |
 | [`fixtures/verify-strict-conformance/`](../fixtures/verify-strict-conformance/) | 1 | ✓ | — | — | — | ✓ |
 | [`fixtures/render-conformance/`](../fixtures/render-conformance/) | 15 | ✓ | ✓ | inherits via Java | ✓ | ✓ |
-| [`fixtures/extract-conformance/`](../fixtures/extract-conformance/) | 45 | ✓ | ✓ | inherits the shared JVM engine | ✓ | ✓ |
+| [`fixtures/extract-conformance/`](../fixtures/extract-conformance/) | 48 | ✓ | ✓ | inherits the shared JVM engine | ✓ | ✓ |
 | [`fixtures/output-prompt-conformance/`](../fixtures/output-prompt-conformance/) | 17 | ✓ | ✓ | ✓ | ✓ | ✓ |
 | [`fixtures/persistence-conformance/`](../fixtures/persistence-conformance/) | 33 (27 query + 6 migration) | all 33 | 27 query (migrations TS-only, ADR-0015) | 27 query (via Exposed) | 27 query | 27 query |
 | [`fixtures/api-contract-conformance/`](../fixtures/api-contract-conformance/) | 61 (31 core + 10 tph + 9 m2m + 2 jsonb + 2 write-through + 7 projection) | ✓ (Fastify reference + generated lane) | ✓ (embedded HTTP + JDBC) | ✓ (embedded HTTP + Exposed) | ✓ (HttpListener + Npgsql) | ✓ (FastAPI + pg8000) |

fixtures/extract-conformance/README.md

@@ -40,6 +40,14 @@ Each `fields[]` entry: `name`, `kind` (`STRING|INT|LONG|DOUBLE|BOOLEAN|ENUM|OBJE
 > and the gate fails if one appears.
 
 - `INT|LONG|DOUBLE` — optional `min` / `max` (clamp range).
+- any kind with `array: true` — optional `minItems` / `maxItems`, the `validator.array`
+  element-count bounds. A list longer than `maxItems` keeps its first `maxItems` elements under
+  NORMAL/LOOSE tolerance (a `truncate` coercion, like a numeric clamp) and is `MALFORMED` under
+  STRICT; a list shorter than `minItems` is `MALFORMED` under every tolerance. A scalar kind
+  (`STRING`, `INT`, …) with `array: true` is a scalar array: each element is coerced to `kind`.
+
+A schema may also carry a top-level `tolerance` (`STRICT|NORMAL|LOOSE`, default `NORMAL`);
+every runner passes it to the engine.
 - `ENUM` — `enumValues` (member symbols) plus the FR-011 coercion-pipeline keys:
   - `enumAlias` — `{ synonym: MEMBER }` (FR-010); keys matched under the field's mode.
   - `normalize` — `none | collapse | strip` (default `strip`). `strip` = ASCII case-fold +
@@ -70,3 +78,7 @@ line comment or a `/* */` block comment outside a string literal is skipped, inc
 that holds a brace or a quote (`json-comment-line`), so no field after it is lost; comment
 markers INSIDE a string literal are kept verbatim (`json-comment-markers-in-string`). The
 strict parser does not change: only the tolerant recovery reads past comments.
+
+The three `json-array-*-items-*` cases pin `validator.array` bounds: too many elements truncated
+under NORMAL, too many rejected under STRICT, too few rejected (and listed in
+`malformedRequired`) under any tolerance.

fixtures/extract-conformance/json-array-max-items-strict/expected.json

@@ -0,0 +1,4 @@
+{ "empty": false,
+  "states": { "tags": "MALFORMED", "note": "EXTRACTED" },
+  "malformedRequired": ["tags"],
+  "data": { "tags[0]": "fantasy", "tags[1]": "epic", "tags[2]": "dragons", "tags[3]": "magic", "note": "four" } }

fixtures/extract-conformance/json-array-max-items-strict/input.txt

@@ -0,0 +1 @@
+{"tags": ["fantasy", "epic", "dragons", "magic"], "note": "four"}

fixtures/extract-conformance/json-array-max-items-strict/schema.json

@@ -0,0 +1,3 @@
+{ "format": "JSON", "rootName": "suggestion", "tolerance": "STRICT", "fields": [
+  { "name": "tags", "kind": "STRING", "required": true, "array": true, "maxItems": 3 },
+  { "name": "note", "kind": "STRING", "required": false } ] }

fixtures/extract-conformance/json-array-max-items-truncate/expected.json

@@ -0,0 +1,3 @@
+{ "empty": false,
+  "states": { "tags": "EXTRACTED", "note": "EXTRACTED" },
+  "data": { "tags[0]": "fantasy", "tags[1]": "epic", "tags[2]": "dragons", "note": "five" } }

fixtures/extract-conformance/json-array-max-items-truncate/input.txt

@@ -0,0 +1,4 @@
+Here are some tags:
+```json
+{"tags": ["fantasy", "epic", "dragons", "magic", "quest"], "note": "five"}
+```

fixtures/extract-conformance/json-array-max-items-truncate/schema.json

@@ -0,0 +1,3 @@
+{ "format": "JSON", "rootName": "suggestion", "fields": [
+  { "name": "tags", "kind": "STRING", "required": true, "array": true, "minItems": 3, "maxItems": 3 },
+  { "name": "note", "kind": "STRING", "required": false } ] }

fixtures/extract-conformance/json-array-min-items-malformed/expected.json

@@ -0,0 +1,4 @@
+{ "empty": false,
+  "states": { "tags": "MALFORMED", "note": "EXTRACTED" },
+  "malformedRequired": ["tags"],
+  "data": { "tags[0]": "fantasy", "tags[1]": "epic", "note": "two" } }