Tools break when strict-schema clients fill unset optional fields with [], "" or 0; add a registry-wide "filler-safe" contract #1495

Problem

Clients that use strict JSON schemas send every property, filling unused optional ones with [], "" or 0. Individual tools have been patched one at a time, but there is no guard that "filler" behaves like an omitted field, so each new optional parameter can reintroduce the failure.

Mechanism

• Arrays with minItems: 1 reject []; cross-field refinements (for example a limit cap tied to another parameter) reject instead of clamping.
• Numeric fields where 0 means "disable" turn a filler value into a behaviour change: query_timeout_ms: 0 disables the safety deadline in sql_execute, sql_materialize and sql_check (packages/drivers/src/query-timeout.ts:36-40). max_rows already treats 0 as unset (sql-materialize.ts:352), so the contract is inconsistent.
• Past instances: sql_check rejections, and a sql_execute option that rejected 14-18% of calls (212 of 1,475; 422 of 2,059; 791 of 4,368; 1,528 of 8,381 in four overlapping slices), returned only the named columns on success (1,458 of 1,495 calls, causing 448 identical re-queries and 535 s), and matched names case-sensitively (69 "Unknown column" errors).

Evidence

gpt-5.6-sol sent 0 for query_timeout_ms on 41% of its SQL calls (1,095 of 2,685; 1,215 of 2,059 in another slice), and the rejected calls appeared in every session that used the affected build. Median calls per session were 30.1 vs 19.3 and median elapsed 108 s vs 72 s.

Impact

Correctness-risk and time: filler turns safety deadlines off, and rejected calls cost a turn each.

Proposed fix

• Add a contract test iterating every registered tool schema: set each optional property to [], "", 0 and null and require behaviour identical to omission.
• Use null or a separate boolean, never 0, to mean "disable".
• Clamp limits instead of rejecting; match column names case-insensitively; never narrow the projection the SQL requested.

Acceptance check

The contract test passes for all tools in the registry and fails when a tool is changed to reject an empty optional array.