fix: the audit reads the refusals it is given

[ShocOne]

Every entity blocked on its first create. The refusal reader took the first string-valued key it recognised, so an envelope carrying both a summary sentence and a list of per-field complaints yielded the summary:

{"detail": "There are invalid or missing fields",
 "errors": [{"field": "testName", "message": "must not be null"}]}

Nothing in the grammar matches There are invalid or missing fields, so the adjustment loop stopped with the one field it needed named in the part it never read.

What changed

• Listed complaints are read first, in string and object form, before the summary keys. An entry that names its field separately is spelled back into the <field>: <complaint> shape the grammar reads.
• Two grammars for prose-wrapped refusals: a field named mid-sentence before its complaint (Error in field roleName : must not be null), and the bare English that names only the field it wanted (The loginAccountGroup is required). Both gated on absence-words, so a complaint about the value that was sent is not "healed" by adding one.
• A dotted path reduces to its last segment — the name the request body spells, since applyAdjustment refuses a field containing a dot.
• Parent re-creation heals like any other create, and does so without recording. The fields a parent needs are facts about the parent, and its own steps record them; recorded here they would be attributed to whichever child asked for it first.

Measured

Against the live document, per run:

	before	after
adjustments	1	4
requiredByAPI observations	78	81

The new adjustments are role.roleName, user.loginAccountGroup, and alerts_rule.roundsViolatingRequired.

No vendor name appears in non-test source; the grammars are generic validation English.

🤖 Generated with Claude Code