fix(evidence): reject unsupported path bindings before writing

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

crates/registry-evidencectl/src/suggest/mod.rs

@@ -1026,6 +1026,28 @@ fn validate_required_inputs(
     body: Option<&types::OperationRequestBody>,
     mappings: &[RequestMapping],
 ) -> Result<()> {
+    let mut placeholders = BTreeSet::new();
+    for segment in operation.path.split('/') {
+        if !segment.contains(['{', '}']) {
+            continue;
+        }
+        let name = segment
+            .strip_prefix('{')
+            .and_then(|segment| segment.strip_suffix('}'))
+            .ok_or_else(|| anyhow!("a path placeholder must occupy one complete segment"))?;
+        registry_platform_yaml::LocalId::new(name).with_context(|| {
+            format!("path parameter `{name}` must be a Registry Stack LocalId for a path binding")
+        })?;
+        if !placeholders.insert(name) {
+            bail!("path placeholders must be unique: `{name}` is repeated");
+        }
+        if !mappings
+            .iter()
+            .any(|mapping| mapping.target == RequestTarget::Path(name.to_owned()))
+        {
+            bail!("required request input `path:{name}` has no --map-selector assignment");
+        }
+    }
     for parameter in parameters.iter().filter(|parameter| parameter.required) {
         let target = match parameter.location {
             ParameterLocation::Path => RequestTarget::Path(parameter.name.clone()),

crates/registry-evidencectl/tests/suggest_e2e.rs

@@ -237,6 +237,59 @@ fn mapped_get_and_post_projects_pass_the_offline_compiler() {
     }
 }
 
+#[test]
+fn unsupported_path_placeholders_are_refused_without_mutation() {
+    for name in [
+        "RecordId".to_owned(),
+        "1record".to_owned(),
+        "record.id".to_owned(),
+        "récord".to_owned(),
+        "r".repeat(65),
+    ] {
+        let document = request_openapi(
+            "GET",
+            &format!("/records/{{{name}}}"),
+            vec![parameter(&name, "path", true, "string")],
+            None,
+        );
+        let workspace = tempfile::tempdir().expect("tempdir");
+        let project = scaffold(workspace.path(), &document);
+        assert_mapping_failure_is_atomic(
+            &project,
+            &[format!(
+                "subject.subject-reference-v1.reference=path:{name}"
+            )],
+            "must be a Registry Stack LocalId",
+            &format!("unsupported path placeholder {name}"),
+        );
+    }
+    for (path, parameters, mapping, expected) in [
+        (
+            "/records/{record_id}/{record_id}",
+            vec![parameter("record_id", "path", true, "string")],
+            "subject.subject-reference-v1.reference=path:record_id",
+            "path placeholders must be unique",
+        ),
+        (
+            "/records/{missing}",
+            vec![parameter("reference", "query", true, "string")],
+            "subject.subject-reference-v1.reference=query:reference",
+            "path:missing",
+        ),
+        (
+            "/records/prefix-{record_id}",
+            vec![parameter("reference", "query", true, "string")],
+            "subject.subject-reference-v1.reference=query:reference",
+            "path placeholder must occupy one complete segment",
+        ),
+    ] {
+        let document = request_openapi("GET", path, parameters, None);
+        let workspace = tempfile::tempdir().expect("tempdir");
+        let project = scaffold(workspace.path(), &document);
+        assert_mapping_failure_is_atomic(&project, &[mapping.to_owned()], expected, path);
+    }
+}
+
 #[test]
 fn invalid_selector_mappings_refuse_before_mutating_the_project() {
     struct Case {

products/evidence/reference/authoring-projects/CONFIG.md

@@ -167,6 +167,8 @@ target connection.
 The planner checks effective required inputs after operation overrides; optional
 inputs are inspected only when you map them. Parameter and request-body
 references must resolve locally so their requiredness is known.
+Every path placeholder must occupy a unique complete segment, have a mapping,
+and use a Registry Stack local identifier (`[a-z][a-z0-9_-]{0,63}`).
 
 Scalar types must agree, and the selector's admitted domain must fit the
 supported string-length or integer-range constraints. Integer formats `int32`