feat(httpapi): declare the part-id mismatch as a 400 on the typed channel (E9)

[nikomatt69]

PATCH /session/:sessionID/message/:messageID/part/:partID compared the
decoded body's ids against the three path parameters and raised the
disagreement with throw new Error(...) inside Effect.gen. The endpoint
declared 404 and 409 only, and since E5 the group's boundary is a single
Effect.catch(asSessionError) that ends in Effect.die — so unlike the pty
case, no defect arm was compensating. A caller that sent a mismatched part
body got a 500 and never saw the detail string the throw carried.

The mismatch is now a declared 400 in the same { name, data } shape as the
other two errors, raised with Effect.fail on a PartMismatchError tagged
class. The mapping lives in its own combinator rather than a third arm on
asSessionError: widening DeclaredError would give every handler in the
group a failure type only this endpoint declares.

E8 named this site in writing and left it, because fixing it changes the
wire and needs regenerated clients. Those are included.

• route test pins the 400 status and body; service-level test asserts
  Cause.hasDies === false on handlers.partUpdate
• restoring the throw turns exactly those two tests red, nothing else
• typecheck clean; check:routes --strict unchanged at 338 / 315 / 23
• specs/ROADMAP.md records E9 and corrects two stale claims: the Windows
  CI OOM was fixed on 2026-08-30, and the two pre-existing test/server
  failures are an incomplete-install artifact, not H9's

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01XM1kMwBZhqQskTDZP2ECfo

---

Note

Low Risk
Wire behavior change is intentional and narrowly scoped to malformed part-update requests; existing successful updates and other session routes are unchanged.

Overview
PATCH .../part/:partID now treats a request body whose id, messageID, or sessionID disagrees with the URL as a declared 400 (PartMismatchError in the usual { name, data } shape), instead of an undeclared throw that surfaced as 500.

The handler raises Effect.fail(PartMismatchError) and uses a dedicated partUpdateErrors boundary so only this endpoint’s contract gains the extra error—other session handlers keep declaredErrors unchanged. Generated JS SDK clients include 400 in partUpdate’s declared statuses and add SessionPartMismatchError.

Tests pin the HTTP 400 body and assert Cause.hasDies === false on the handler failure. specs/ROADMAP.md records E9 as landed.

^{Reviewed by Cursor Bugbot for commit 6733fed. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_8a938ebf-3fd9-4cde-9b8a-a46a10f30316)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[nikomatt69]

@cursoragent review it

[cursor]

You need to increase your spend limit or enable usage-based billing to run background agents. Go to Cursor

[nikomatt69]

@claude Review it