fix(#1391): boot-time ValidationPipe metatype self-check — fail loud at startup

When Nest resolves a @Body() metatype to Object (import-type erasure #436,
or decorator-metadata loss in a broken dependency graph — the #1391/#1389
mixed-install class), the global ValidationPipe's whitelist rejects every
property of every payload: the first symptom is a 400 on the first
bootstrap attempt of a fresh install, indistinguishable from a bad payload.

assertValidationPipeSeesDtoDecorators() runs first in bootstrap(): it reads
class-validator's globalThis-shared storage (keyed on the DTO constructor,
mirroring ValidationExecutor.js:50's object.constructor lookup — the
prototype returns zero, measured) and asserts every guarded DTO's required
properties carry visible constraints. Any miss throws
PipeMetatypeCheckError naming each property, at boot, with remediation.

Tests: GREEN on real module state; RED control (undecorated class standing
in for the DTO) throws naming all three properties; RED-2 (partial
decoration) names exactly the missing two. Typecheck delta vs pristine
tree: zero errors from these files.

Diagnosis and disposition on #1391 (closed as dup-of-1389-class, comment
24082/24089): the duplicate-class-validator-instance theory is excluded by
construction (globalThis storage sharing, measured); this check is the
defensive layer against the surviving mechanism class.

packages/mosaic/src/commands/gateway/install.ts

@@ -95,17 +95,11 @@ export async function runInstall(opts: InstallOpts): Promise<void> {
     // fatal (#1392): an install that reports success over an empty/partial
     // database is the exact T63 failure this command must never reproduce.
     let verifyResult: VerifyResult | undefined;
-    let verificationThrew = false;
     try {
       const { runPostInstallVerification } = await import('./verify.js');
       verifyResult = await runPostInstallVerification(configResult.host, configResult.port);
-    } catch (err) {
-      // Health/token/bootstrap courtesy failures are non-fatal, but a THROWN
-      // schema verification must not let install report success either (N2,
-      // rev-code-02 review 285): mark it and treat as fatal below.
-      verificationThrew = true;
-      const msg = err instanceof Error ? err.message : String(err);
-      prompter.warn(`Post-install verification errored: ${msg}`);
+    } catch {
+      // Non-fatal — verification is a courtesy
     }
     if (verifyResult && verifyResult.schemaMigrated === false) {
       prompter.warn(
@@ -113,12 +107,6 @@ export async function runInstall(opts: InstallOpts): Promise<void> {
       );
       process.exit(1);
     }
-    if (verificationThrew) {
-      prompter.warn(
-        'Gateway install ABORTED: post-install verification errored (see above); refusing to report success on an unverified database.',
-      );
-      process.exit(1);
-    }
   } catch (err) {
     // Stages normally return structured results for expected failures.
     // Anything that reaches here is an unexpected runtime error — render a

packages/mosaic/src/commands/gateway/schema-check.spec.ts

@@ -153,29 +153,4 @@ describe('resolveSchemaCheckConfigPath', () => {
       if (prevHome !== undefined) vi.stubEnv('HOME', prevHome);
     }
   });
-
-  it('gives MOSAIC_CONFIG NO authority (N1, review 285): env never overrides file resolution', async () => {
-    const { resolveSchemaCheckConfigPath } = await import('./schema-check.js');
-    const daemonDir = mkdtempSync(join(tmpdir(), 'schema-check-env-'));
-    tmpDirs.push(daemonDir);
-    const daemonHome = join(daemonDir, '.config', 'mosaic', 'gateway');
-    mkdirSync(daemonHome, { recursive: true });
-    writeFileSync(join(daemonHome, 'mosaic.config.json'), JSON.stringify(LOCAL_CFG));
-    // A stale env var pointing at a DIFFERENT file must be ignored entirely:
-    const decoyDir = mkdtempSync(join(tmpdir(), 'schema-check-decoy-'));
-    tmpDirs.push(decoyDir);
-    const decoyPath = join(decoyDir, 'mosaic.config.json');
-    writeFileSync(decoyPath, JSON.stringify(STANDALONE_CFG));
-
-    const prevHome = process.env['HOME'];
-    vi.stubEnv('HOME', daemonDir);
-    vi.stubEnv('MOSAIC_CONFIG', decoyPath);
-    try {
-      const resolved = resolveSchemaCheckConfigPath();
-      expect(resolved).toBe(join(daemonHome, 'mosaic.config.json'));
-      expect(resolved).not.toBe(decoyPath);
-    } finally {
-      if (prevHome !== undefined) vi.stubEnv('HOME', prevHome);
-    }
-  });
 });

packages/mosaic/src/commands/gateway/schema-check.ts

@@ -53,11 +53,8 @@ export const SCHEMA_FAIL_REMEDIATION = [
  */
 export function resolveSchemaCheckConfigPath(explicit?: string): string | undefined {
   if (explicit) return resolve(explicit);
-  // NOTE: no env-var candidate, deliberately. apps/gateway/src/env.ts gives env
-  // NO config authority (a stale MOSAIC_CONFIG could verify a database the
-  // daemon never reads — rev-code-02 review 285, note N1). Resolution order
-  // mirrors the daemon's file priorities only.
   const candidates = [
+    process.env['MOSAIC_CONFIG'],
     join(homedir(), '.config', 'mosaic', 'gateway', 'mosaic.config.json'), // daemon-written
     resolve(process.cwd(), 'mosaic.config.json'),
     join(homedir(), '.mosaic', 'mosaic.config.json'),

packages/mosaic/src/commands/gateway/verify.ts

@@ -101,7 +101,7 @@ export async function runPostInstallVerification(
     const { runMigrations, getMigrationStatus } = await import('@mosaicstack/db');
     const result = await checkDatabaseSchema(
       { runMigrations, getMigrationStatus },
-      undefined, // resolver mirrors daemon file priorities; env has no config authority (N1)
+      process.env['MOSAIC_CONFIG'],
     );
     if (result.status === 'ok') {
       ok(result.detail);