ballistics_engine/

solve_json.rs

//! Versioned, binding-neutral JSON data-transfer objects for trajectory solves.
//!
//! These types deliberately do not expose [`crate::BallisticInputs`]. The public JSON contract
//! has its own names, units, defaults, and compatibility policy so engine internals can evolve
//! without silently changing requests produced by language bindings.

use serde::{
    de::{self, Visitor},
    ser::SerializeStruct,
    Deserialize, Deserializer, Serialize, Serializer,
};
use serde_json::{Map, Value};
use std::{fmt, num::NonZeroUsize};

/// The only solve-json schema version understood by this module.
pub const SOLVE_JSON_SCHEMA_VERSION_V1: u32 = 1;

/// Exact, case-sensitive wire names accepted for solve-json v1 reference drag models.
///
/// Kept as the single metadata source for protocol validation and the MCP schema/engine-info
/// mirrors so those public surfaces cannot drift apart when the engine gains a model.
pub const DRAG_MODEL_WIRE_NAMES_V1: [&str; 9] =
    ["G1", "G2", "G5", "G6", "G7", "G8", "GI", "GS", "RA4"];

/// Maximum number of trajectory observations in one solve-json v1 success response.
///
/// Service implementations must reject a response above this limit with
/// [`SolveSuccessV1::validate_for_serialization`] instead of truncating it.
pub const MAX_SOLVE_JSON_SAMPLES_V1: usize = 10_000;

/// Deserialize a request member that may be omitted but may not be JSON `null`.
///
/// Serde supplies [`Option::None`] from the field's `default` only when the member is absent.
/// When the member is present, deserialize `T` directly so `null` is rejected for scalar,
/// enum, object, and array values alike.
fn deserialize_present<'de, D, T>(deserializer: D) -> Result<Option<T>, D::Error>
where
    D: Deserializer<'de>,
    T: Deserialize<'de>,
{
    T::deserialize(deserializer).map(Some)
}

/// An invariant solve-json v1 schema discriminator.
///
/// This unit type has no invalid public state: it always serializes as the JSON integer `1` and
/// deserializes only from that integer.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash)]
pub struct SchemaVersionV1;

impl SchemaVersionV1 {
    /// Return the integer represented on the wire.
    pub const fn get(self) -> u32 {
        SOLVE_JSON_SCHEMA_VERSION_V1
    }
}

impl Serialize for SchemaVersionV1 {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: Serializer,
    {
        serializer.serialize_u32(SOLVE_JSON_SCHEMA_VERSION_V1)
    }
}

impl<'de> Deserialize<'de> for SchemaVersionV1 {
    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
    where
        D: Deserializer<'de>,
    {
        struct SchemaVersionVisitor;

        impl<'de> Visitor<'de> for SchemaVersionVisitor {
            type Value = SchemaVersionV1;

            fn expecting(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
                formatter.write_str("the integer 1")
            }

            fn visit_u64<E>(self, value: u64) -> Result<Self::Value, E>
            where
                E: de::Error,
            {
                if value == u64::from(SOLVE_JSON_SCHEMA_VERSION_V1) {
                    Ok(SchemaVersionV1)
                } else {
                    Err(E::custom(format!(
                        "unsupported schema_version {value}; expected {SOLVE_JSON_SCHEMA_VERSION_V1}"
                    )))
                }
            }

            fn visit_i64<E>(self, value: i64) -> Result<Self::Value, E>
            where
                E: de::Error,
            {
                if value == i64::from(SOLVE_JSON_SCHEMA_VERSION_V1) {
                    Ok(SchemaVersionV1)
                } else {
                    Err(E::custom(format!(
                        "unsupported schema_version {value}; expected {SOLVE_JSON_SCHEMA_VERSION_V1}"
                    )))
                }
            }
        }

        deserializer.deserialize_any(SchemaVersionVisitor)
    }
}

/// A complete v1 trajectory-solve request.
///
/// All dimensional values use SI units named in the field. Every section is mandatory, even
/// when all fields in a section have defaults; this keeps the top-level request shape explicit.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct SolveRequestV1 {
    /// Must be exactly [`SOLVE_JSON_SCHEMA_VERSION_V1`].
    pub schema_version: SchemaVersionV1,
    pub projectile: ProjectileV1,
    pub rifle: RifleV1,
    pub shot: ShotV1,
    pub atmosphere: AtmosphereV1,
    pub wind: WindV1,
    pub solver: SolverV1,
    pub effects: EffectsV1,
    pub sampling: SamplingV1,
    /// Optional reticle hold-point request (MBA-1361). Absent (the historical shape) leaves
    /// both the solve and the response byte-identical; present adds
    /// [`SolveSuccessV1::reticle_hold`] and echoes itself at
    /// [`ResolvedSolveRequestV1::reticle`] (0.33.0 decision-support Task 1), and nothing
    /// else. It is a pure post-processing read of the solved samples — it cannot change
    /// the trajectory.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub reticle: Option<ReticleRequestV1>,
    /// Optional offline correction sources applied before the solve. Absent (the
    /// historical shape) is byte-identical to every request from before the block
    /// existed; present it is echoed at [`ResolvedSolveRequestV1::corrections`] so a
    /// resolved request remains a complete description of the solve (the perturbation
    /// kernel re-solves from it).
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub corrections: Option<CorrectionsV1>,
}

/// Offline correction sources for a solve (additive-optional).
///
/// `bc5d_table_path` names a caliber-specific BC5D correction table on the LOCAL
/// filesystem (`bc5d_<caliber>.bin`, the exact dual-CRC binary format the CLI's
/// `--bc-table-dir` consumes; mobile apps download tables themselves and hand the
/// engine a path). The service CRC-verifies the file, generates the same
/// velocity-keyed BC segment ladder the CLI does for this load, applies the table's
/// muzzle correction to the scalar BC as the interior-gap fallback, and solves BOTH
/// the zero search and the trajectory with that schedule. A table that carries no
/// correction for the load (every sampled cell ~= 1.0) leaves the request's constant
/// BC in place. On builds without filesystem access (wasm32) supplying the field is
/// a structured `invalid_value` error, never a silent no-op.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct CorrectionsV1 {
    /// Path to a BC5D `.bin` correction table on the local filesystem.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub bc5d_table_path: Option<String>,
}

/// Ask for a reticle hold point alongside the trajectory (MBA-1361).
///
/// `description` is the shared [`crate::reticle::ReticleDescription`] schema — the very same
/// JSON `ballistics reticle generate -o json` emits — so a service and a CLI user exchange
/// one representation. It is deliberately permissive about extra keys inside the
/// description (front ends carry render metadata there); the envelope around it stays
/// strict.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ReticleRequestV1 {
    /// Range at which the hold is evaluated, meters. Must be inside the sampled trajectory.
    pub range_m: f64,
    /// The optic's magnification in use. Must be finite and greater than zero on both
    /// focal planes.
    pub magnification: f64,
    pub description: crate::reticle::ReticleDescription,
}

/// The reticle hold point for a solved trajectory (MBA-1361).
///
/// Angles are milliradians from the optical center: `down_mil` positive BELOW center,
/// `right_mil` positive to the shooter's RIGHT.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ReticleHoldV1 {
    /// Echo of the requested evaluation range, meters.
    pub range_m: f64,
    /// Echo of the requested magnification.
    pub magnification: f64,
    pub down_mil: f64,
    pub right_mil: f64,
    /// The subtension scale applied to the marks (`reference_magnification / magnification`
    /// for SFP, exactly `1.0` for FFP).
    pub mark_scale: f64,
    /// Index into the request's `description.marks` of the nearest mark, in TRUE angular
    /// space.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub nearest_mark_index: Option<usize>,
    /// That mark's label, when it carries one.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub nearest_mark_label: Option<String>,
    pub nearest_mark_distance_mil: f64,
    /// True when the hold has run outside the marked area (see
    /// [`crate::reticle::ReticleHold::off_reticle`] for the exact rule).
    pub off_reticle: bool,
}

/// Projectile inputs supported by solve-json v1.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ProjectileV1 {
    pub mass_kg: f64,
    pub diameter_m: f64,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub length_m: Option<f64>,
    pub drag_model: DragModelV1,
    pub ballistic_coefficient: f64,
    /// A caller-supplied drag curve replacing `drag_model`'s (MBA-1597). See [`DragTableV1`].
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub drag_table: Option<DragTableV1>,
    /// A velocity-banded BC ladder (MBA-1598): solve-json's form of the CLI's `--bc-segment`.
    /// See [`BcSegmentV1`] for the band rules.
    ///
    /// `ballistic_coefficient` stays required and validated beside it, but flies only in an
    /// interior gap between two bands, and blended into the bands within up to 25 fps either
    /// side of a gap edge. Below the lowest band, or at or above the highest, the nearest edge
    /// band applies, so under a gapless ladder the scalar never flies. A one-band ladder's BC
    /// must match `ballistic_coefficient` (see [`ONE_BAND_BC_RELATIVE_TOLERANCE_V1`]). Band BCs are referenced to `drag_model`, and bands are selected by airspeed (speed relative to
    /// the air mass). Interior band and gap edges are smoothstep-blended
    /// (`velocity_segment_bc` in `src/bc_estimation.rs`). Refused alongside
    /// `drag_table`, which replaces the `drag_model` curve the band BCs are measured against,
    /// and alongside `corrections.bc5d_table_path`, which builds its own ladder from
    /// `ballistic_coefficient`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub bc_segments: Option<Vec<BcSegmentV1>>,
}

/// One band of a [`ProjectileV1::bc_segments`] ladder: the BC that flies while the bullet's
/// airspeed lies in `[velocity_min_mps, velocity_max_mps)`.
///
/// - Band BCs are in lb/in² and referenced to `projectile.drag_model`, exactly as the scalar
///   `ballistic_coefficient` is, and are held to the same bounds.
/// - Bands are selected by airspeed: the bullet's speed relative to the air mass, not over the
///   ground.
/// - The array runs from the fastest band to the slowest. `velocity_min_mps` strictly
///   descends, and each band ends at or below the start of the band before it: touching edges
///   and gaps are legal, overlaps are not. The order is only a validation rule; the lookup
///   itself does not depend on it.
/// - A ladder holds [`MIN_BC_SEGMENTS_V1`] to [`MAX_BC_SEGMENTS_V1`] bands.
/// - In an interior gap between two bands the scalar `ballistic_coefficient` flies. Below the
///   lowest band, or at or above the highest, the nearest edge band applies, so under a
///   gapless ladder the scalar never flies.
/// - A one-band ladder flies its band's BC at every speed, so that BC must match the scalar
///   `ballistic_coefficient` to within [`ONE_BAND_BC_RELATIVE_TOLERANCE_V1`]; the band's edges
///   then change nothing.
/// - Every interior band-to-band edge and every gap edge is blended with a smoothstep across
///   a narrow window centred on it, so the integrator never sees the drag jump in one step
///   (`velocity_segment_bc` in `src/bc_estimation.rs`).
#[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct BcSegmentV1 {
    /// Lower edge of the band, m/s, inclusive. Finite and >= 0.
    pub velocity_min_mps: f64,
    /// Upper edge of the band, m/s, exclusive. Finite and > `velocity_min_mps`; there is no
    /// upper bound.
    pub velocity_max_mps: f64,
    /// This band's BC, lb/in² against `projectile.drag_model`. Same bounds as the scalar
    /// `ballistic_coefficient`.
    pub ballistic_coefficient: f64,
}

/// The fewest points a [`DragTableV1`] may hold — two define a curve.
pub const MIN_DRAG_TABLE_POINTS_V1: usize = 2;

/// The most points a [`DragTableV1`] may hold. Matches the `.drg`/CSV loader behind the CLI's
/// `--drag-table` and the array FFI's `MAX_FFI_DRAG_TABLE_LEN`.
pub const MAX_DRAG_TABLE_POINTS_V1: usize = 4096;

/// The fewest bands a [`ProjectileV1::bc_segments`] ladder may hold. An empty array is refused
/// rather than read as "no ladder"; omit the field for that.
pub const MIN_BC_SEGMENTS_V1: usize = 1;

/// The most bands a [`ProjectileV1::bc_segments`] ladder may hold. The BC lookup scans the
/// ladder on every derivative evaluation, so the cap bounds the per-step cost; it is far past
/// the handful of bands a published multi-BC schedule lists.
pub const MAX_BC_SEGMENTS_V1: usize = 64;

/// How closely a one-band [`ProjectileV1::bc_segments`] ladder's BC must match the scalar
/// `ballistic_coefficient`, relative to the larger of the two: one part in a million. That
/// forgives rounding nobody chose, such as a BC held as an `f32` (`0.243f32` reads back as
/// `0.24300000071525574`) or converted between units and back, but not a different value: 0.172
/// against 0.1724 is still refused. Within it, the band's BC is the one that flies.
pub const ONE_BAND_BC_RELATIVE_TOLERANCE_V1: f64 = 1.0e-6;

/// A caller-supplied Cd-vs-Mach drag curve (MBA-1597): solve-json's form of the CLI's
/// `--drag-table`.
///
/// `kind` says what `ballistic_coefficient` means beside it, and has no default: the two
/// readings differ by the projectile's form factor, so a guess gives confident, wrong drops.
/// While a table is present `drag_model` does not drive drag under either kind.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct DragTableV1 {
    pub kind: DragTableKindV1,
    /// Strictly ascending in Mach, [`MIN_DRAG_TABLE_POINTS_V1`] to
    /// [`MAX_DRAG_TABLE_POINTS_V1`] points. Outside the table the nearest end value is held.
    pub points: Vec<DragPointV1>,
}

/// What a [`DragTableV1`] describes, and therefore what the request's BC means.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum DragTableKindV1 {
    /// A standard curve — an airgun pellet law such as GA2, say — that `ballistic_coefficient`
    /// was measured against. Flown exactly as a built-in model is flown with its own BC.
    Reference,
    /// This projectile's own measured Cd (Doppler radar, for instance).
    /// `ballistic_coefficient` is not used, exactly as with the CLI's `--drag-table`.
    Projectile,
}

/// One point of a [`DragTableV1`]: Mach (finite, >= 0) and drag coefficient (finite, > 0).
#[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct DragPointV1 {
    pub mach: f64,
    pub cd: f64,
}

/// Check a [`DragTableV1`]'s values: the point count, then each point in order, naming the
/// exact entry at fault. The same rules `DragTable::try_new` enforces for `--drag-table`.
///
/// Called from both the decoder and the solve service, so a Rust caller that builds a request
/// without [`decode_solve_request_v1`] hears about a bad table at the same path.
pub(crate) fn validate_drag_table_v1(table: &DragTableV1) -> Result<(), SolveErrorEnvelopeV1> {
    let points_path = "$.projectile.drag_table.points";
    let count = table.points.len();
    if !(MIN_DRAG_TABLE_POINTS_V1..=MAX_DRAG_TABLE_POINTS_V1).contains(&count) {
        return Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            format!(
                "drag_table must have {MIN_DRAG_TABLE_POINTS_V1} to \
                 {MAX_DRAG_TABLE_POINTS_V1} points, got {count}"
            ),
            points_path,
        ));
    }
    let mut previous_mach: Option<f64> = None;
    for (index, point) in table.points.iter().enumerate() {
        let mach_path = format!("{points_path}[{index}].mach");
        if !point.mach.is_finite() || point.mach < 0.0 {
            return Err(protocol_error(
                SolveErrorCodeV1::InvalidValue,
                format!("mach must be finite and >= 0, got {}", point.mach),
                mach_path,
            ));
        }
        if let Some(previous) = previous_mach.filter(|previous| point.mach <= *previous) {
            return Err(protocol_error(
                SolveErrorCodeV1::InvalidValue,
                format!(
                    "mach must strictly ascend; {} follows {previous} at points[{}]",
                    point.mach,
                    index - 1
                ),
                mach_path,
            ));
        }
        if !point.cd.is_finite() || point.cd <= 0.0 {
            return Err(protocol_error(
                SolveErrorCodeV1::InvalidValue,
                format!("cd must be finite and > 0, got {}", point.cd),
                format!("{points_path}[{index}].cd"),
            ));
        }
        previous_mach = Some(point.mach);
    }
    Ok(())
}

/// Built-in reference-projectile drag models supported by solve-json v1.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum DragModelV1 {
    #[serde(rename = "G1")]
    G1,
    #[serde(rename = "G6")]
    G6,
    #[serde(rename = "G7")]
    G7,
    #[serde(rename = "G8")]
    G8,
    #[serde(rename = "G2")]
    G2,
    #[serde(rename = "G5")]
    G5,
    #[serde(rename = "GI")]
    GI,
    #[serde(rename = "GS")]
    GS,
    #[serde(rename = "RA4")]
    RA4,
}

/// Rifle and sight geometry.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct RifleV1 {
    pub muzzle_velocity_mps: f64,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub sight_height_m: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub muzzle_height_m: Option<f64>,
    /// Rifling travel per full turn, meters.
    ///
    /// Optional, which reads like "leave the twist out of it" — it is not. `None` defaults to
    /// 0.3048 m, exactly 1:12 inches, raises a `default_applied` assumption, and materializes
    /// that value at [`ResolvedRifleV1::twist_rate_m_per_turn`], after which nothing
    /// downstream can tell an assumed barrel from a stated one.
    ///
    /// Omitting it is never free. `summary.stability_factor` is a function of the twist and is
    /// computed on EVERY solve, so an omitted field reports the Sg of a 1:12 barrel — 1.665 on
    /// a .308 175 gr against 3.746 at a stated 1:8, with no effect enabled — and raises
    /// `stability_factor_assumed_twist_rate`. What the omission does not move, absent a
    /// spin-driven effect, is the trajectory: `drop_m` and `windage_m` are bit-identical for
    /// every twist rate.
    ///
    /// `effects.magnus`, `effects.enhanced_spin_drift` and `effects.aerodynamic_jump` each
    /// read it as well, and each raises its own assumed-barrel warning when it is absent
    /// (MBA-1484). The codes are distinct so that each names its own consumer; they are not
    /// mutually exclusive, and one omitted twist can raise three of them at once.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub twist_rate_m_per_turn: Option<f64>,
    /// Rifling hand, viewed from the breech toward the muzzle. `None` defaults to `Right`
    /// with a `default_applied` assumption. It flips the SIGN of the gyroscopic spin drift
    /// rather than its magnitude, so an assumed hand on a left-twist barrel puts the drift on
    /// the wrong side of the target.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub twist_direction: Option<TwistDirectionV1>,
    /// Lateral offset between the sight axis and the bore axis, meters (MBA-1396,
    /// offset-mounted optics): positive = the sight sits RIGHT of the bore. The bore
    /// starts that far left of the line of sight, and a solved zero adds the windage
    /// convergence (`offset / zero_distance`) so the trajectory crosses the LOS laterally
    /// at the zero range. Omitted (the default) is byte-identical to pre-MBA-1396
    /// behavior. Echoed at [`ResolvedRifleV1::sight_offset_lateral_m`] when supplied
    /// (0.33.0 decision-support Task 1).
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub sight_offset_lateral_m: Option<f64>,
}

/// Direction of rifling twist as viewed from the breech toward the muzzle.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum TwistDirectionV1 {
    Left,
    #[default]
    Right,
}

/// Shot geometry and termination range.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ShotV1 {
    pub max_range_m: f64,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub zero_distance_m: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub muzzle_angle_rad: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub aim_azimuth_rad: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub shot_azimuth_rad: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub shooting_angle_rad: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub cant_angle_rad: Option<f64>,
    /// World-vertical height above the local ground datum that the elevation search converges
    /// the bullet to at `zero_distance_m`.
    ///
    /// Omitting it while the search runs (`zero_distance_m` present, `muzzle_angle_rad` absent)
    /// defaults it to the LINE OF SIGHT of a level rifle — [`RifleV1::muzzle_height_m`] plus
    /// [`RifleV1::sight_height_m`] — so a level shot's solved trajectory crosses the line of
    /// sight at the zero distance, which is what a stated zero means and what the CLI and C ABI
    /// zero surfaces already did (MBA-1537). A supplied value always wins, `0.0` included: that
    /// is how a caller asks for a zero against the ground datum instead. The default raises a
    /// `default_applied` assumption naming the height it used.
    ///
    /// The default is a LEVEL line of sight in a world-vertical field, so an inclined zero
    /// still needs this stated — see `docs/SOLVE_JSON_V1.md` for the projection to supply.
    ///
    /// With no elevation search this still defaults to `0`, where it feeds only the
    /// `drops_reference: "target"` sampler datum — which references `max_range_m`, not
    /// `zero_distance_m`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub target_height_m: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub ground_threshold_m: Option<f64>,
    /// Deliberate vertical POI offset AT the zero range, meters (MBA-1359, Kestrel "zero
    /// height"): positive = the rifle is deliberately zeroed to impact HIGH by this much at
    /// `zero_distance_m`. Meaningful only when `zero_distance_m` is supplied. Omitted (the
    /// default) is byte-identical to pre-MBA-1359 behavior. Echoed at
    /// [`ResolvedShotV1::zero_poi_up_m`] when supplied (0.33.0 decision-support Task 1).
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub zero_poi_up_m: Option<f64>,
    /// Deliberate horizontal POI offset AT the zero range, meters (MBA-1359, Kestrel "zero
    /// offset"): positive = impacts RIGHT by this much at `zero_distance_m`. Same contract
    /// as `zero_poi_up_m`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub zero_poi_right_m: Option<f64>,
    /// Which plane sampled `drop_m` values are referenced to (MBA-1403). `"los"` (the
    /// default when omitted) keeps the historical LOS-perpendicular drop byte-identically;
    /// `"target"` reports drop as vertical in the target plane — the LOS-perpendicular
    /// drop scaled by `1 / cos(shooting_angle_rad)` (JBM's "target plane" reference).
    /// Output-mode toggle only: the solved trajectory, `windage_m`, the summary block and
    /// zeroing semantics are unchanged. Echoed at [`ResolvedShotV1::drops_reference`]
    /// when supplied (0.33.0 decision-support Task 1).
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub drops_reference: Option<DropsReferenceV1>,
}

/// Wire values for [`ShotV1::drops_reference`] (MBA-1403).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum DropsReferenceV1 {
    /// Drop measured perpendicular to the line of sight (the historical default).
    #[default]
    Los,
    /// Drop measured vertically in the target plane: LOS-perpendicular drop scaled by
    /// `1 / cos(shooting_angle_rad)`.
    Target,
}

/// Atmospheric station conditions.
///
/// Every field is `Option` behind a presence-preserving deserializer, so omission is stated
/// directly on the wire and a SUPPLIED value is always authoritative — solve-json builds
/// through [`crate::cli_api::TrajectorySolver::new_with_resolved_station_atmosphere`] and
/// never re-interprets it (MBA-1397). In particular `temperature_k` of exactly 288.15 K or
/// `pressure_pa` of exactly 101325 Pa mean those readings, not "omitted".
///
/// The C ABI (`crate::ffi`, behind the `ffi` feature) deliberately does NOT behave this way:
/// `FFIAtmosphericConditions` is a `repr(C)` struct of plain doubles with no
/// presence channel, so it keeps the legacy default-sentinel heuristic in which those same
/// values at a nonzero altitude mean "resolve the ICAO standard here". The two surfaces
/// therefore disagree on identical nominal inputs (~0.29 MOA on a 300 m zero at 2000 m); see
/// that module's documentation for the full account.
#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AtmosphereV1 {
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub altitude_m: Option<f64>,
    /// Authoritative station temperature, or `None` to resolve ICAO standard temperature at
    /// `altitude_m`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub temperature_k: Option<f64>,
    /// Authoritative station pressure, or `None` to resolve ICAO standard pressure at
    /// `altitude_m`. Interpreted per `pressure_reference` (MBA-1397): `absolute` (the
    /// default) means this value already IS station pressure; `qnh` means it is a
    /// sea-level-corrected altimeter setting that must be reduced to station pressure at
    /// `altitude_m` before use.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub pressure_pa: Option<f64>,
    /// Whether `pressure_pa` is absolute station pressure or a sea-level-corrected altimeter
    /// setting (QNH, MBA-1397). `None` (the omitted-field default, and every request from
    /// before this field existed) means [`PressureReferenceV1::Absolute`] — byte-identical to
    /// pre-MBA-1397 behavior. Has no effect when `pressure_pa` is omitted: an omitted pressure
    /// resolves to the ICAO standard station pressure either way.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub pressure_reference: Option<PressureReferenceV1>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub relative_humidity: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub latitude_rad: Option<f64>,
}

/// Whether an `AtmosphereV1.pressure_pa` value is absolute station pressure or a sea-level-
/// corrected altimeter setting (QNH) that must be reduced to station pressure before use
/// (MBA-1397). Mirrors [`crate::atmosphere::PressureReferenceMode`].
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum PressureReferenceV1 {
    #[default]
    Absolute,
    Qnh,
}

/// Constant or downrange-segmented wind.
///
/// Omit all fields for still air. A constant wind supplies both `speed_mps` and
/// `direction_from_rad`. Segmented wind supplies `segments` and no constant-wind fields.
#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct WindV1 {
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub speed_mps: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub direction_from_rad: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub vertical_speed_mps: Option<f64>,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub segments: Option<Vec<WindSegmentV1>>,
    /// Which frame every wind direction in this request is entered in (MBA-1368).
    /// Omitted (or `"shooter"`) = shooter-relative wind-FROM radians, byte-identical to
    /// pre-1368 behavior. `"compass"` = earth-fixed bearings (0 = north) — the constant
    /// `direction_from_rad` AND every segment's — derived shooter-relative at resolve
    /// time as `bearing - shot.shot_azimuth_rad` (normalized to [0, 2π)); the RESOLVED
    /// wind echo therefore reports the converted shooter-relative direction (the QNH
    /// fold-into-resolved-value precedent). Compass mode requires an explicit
    /// `shot.shot_azimuth_rad` (a hard error otherwise, never a silent
    /// treat-as-shooter-relative). The mode itself is echoed at
    /// [`ResolvedConstantWindV1::wind_reference`] /
    /// [`ResolvedSegmentedWindV1::wind_reference`] when supplied (0.33.0
    /// decision-support Task 1).
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub wind_reference: Option<WindReferenceV1>,
}

/// Wire values for [`WindV1::wind_reference`] (MBA-1368).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum WindReferenceV1 {
    /// Shooter-relative wind-FROM directions (the historical default).
    #[default]
    Shooter,
    /// Earth-fixed compass bearings, re-referenced against `shot.shot_azimuth_rad`.
    Compass,
}

/// One wind segment, active through `until_distance_m`.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct WindSegmentV1 {
    pub until_distance_m: f64,
    pub speed_mps: f64,
    pub direction_from_rad: f64,
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub vertical_speed_mps: Option<f64>,
}

/// Numerical integration configuration.
#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct SolverV1 {
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub method: Option<SolverMethodV1>,
    /// Fixed step for RK4 and Euler. RK45 owns its adaptive step size.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub time_step_s: Option<f64>,
}

/// Integration algorithms exposed by solve-json v1.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum SolverMethodV1 {
    Euler,
    Rk4,
    #[default]
    Rk45,
}

/// Optional physical effects supported by solve-json v1.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct EffectsV1 {
    /// Magnus side force and the yaw of repose it drives. EXPERIMENTAL: enabling it raises an
    /// `experimental_effect` warning.
    ///
    /// Driven by the spin the rifling imparts, so it reads `rifle.twist_rate_m_per_turn`.
    /// Omitting that field does not disable it — the 1:12 default is substituted and the force
    /// is computed for that barrel — so enabling this without a stated twist raises
    /// `spin_effect_assumed_twist_rate` (MBA-1484).
    ///
    /// Mutually exclusive with [`EffectsV1::enhanced_spin_drift`]: the legacy solver silently
    /// suppresses Magnus in that combination, and the decoder reports `conflicting_fields`
    /// rather than let the resolved request misstate which physics ran.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub magnus: Option<bool>,
    /// Earth-rotation (Coriolis and Eötvös) accelerations. Requires
    /// `atmosphere.latitude_rad`, which is an `invalid_value` error when absent rather than a
    /// default. Reads no barrel geometry.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub coriolis: Option<bool>,
    /// Gyroscopic spin drift via the empirical Litz model. EXPERIMENTAL: enabling it raises an
    /// `experimental_effect` warning.
    ///
    /// The drift scales with the muzzle gyroscopic stability factor, which is a function of the
    /// twist, so it reads `rifle.twist_rate_m_per_turn` (and `rifle.twist_direction`, which
    /// sets its sign). Omitting the rate does not disable the effect and does not zero it: the
    /// 1:12 default is substituted and the drift is computed for that barrel, which is why
    /// enabling this without a stated twist raises `spin_effect_assumed_twist_rate`
    /// (MBA-1484). Measured on a .308 175 gr at 800 m, `summary.spin_drift_m` is 0.183 m with
    /// the twist omitted — bit-identical to a stated 1:12 — against 0.316 m at a stated 1:8.
    ///
    /// Mutually exclusive with [`EffectsV1::magnus`]; see that field.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub enhanced_spin_drift: Option<bool>,
    /// Altitude-dependent wind shear model (0.36.0). `None` (the omitted-field default, and
    /// every request from before this field existed) means no shear at all — byte-identical
    /// to pre-0.36.0 behavior, exactly as an explicit `"none"` solves. The model is echoed at
    /// [`ResolvedEffectsV1::wind_shear_model`] whenever the raw request supplies one,
    /// including an explicit `"none"`.
    ///
    /// An unrecognized model name is an `invalid_value` error at
    /// `$.effects.wind_shear_model`, never a silent fall back to no shear: a typo'd model
    /// must not quietly produce unsheared numbers that look like sheared ones.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub wind_shear_model: Option<WindShearModelV1>,
    /// Crosswind aerodynamic (gyroscopic) jump, as a muzzle launch-angle perturbation
    /// (MBA-959). `None` — the omitted-field default, and every request from before this
    /// field existed — means no jump, byte-identical to earlier behavior.
    ///
    /// EXPERIMENTAL, and the bridge says so: enabling it raises an `experimental_effect`
    /// warning, the same as `magnus` and `enhanced_spin_drift`. The model is Bryan Litz's
    /// regression `Y = 0.01*Sg - 0.0024*L + 0.032` MOA per mph of crosswind, a fit that is
    /// best near Sg ~ 1.75 rather than a first-principles derivation.
    ///
    /// Two consequences a caller has to know, because neither is visible in the numbers:
    /// the jump is VERTICAL and is computed from the crosswind AT THE MUZZLE, so a shot with
    /// no crosswind there is unaffected however much wind it meets downrange; and its
    /// magnitude is a function of stability, so it reads `rifle.twist_rate_m_per_turn` and
    /// `projectile.length_m`. Omitting either does not disable the correction — it computes
    /// one from an assumed barrel, which is why enabling this flag without them raises
    /// `aerodynamic_jump_assumed_geometry`.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub aerodynamic_jump: Option<bool>,
}

/// Wire values for [`EffectsV1::wind_shear_model`] (0.36.0).
///
/// These are the engine's own model names (see [`crate::wind_shear`]), so a v1 request and the
/// CLI's `--wind-shear-model` name the same physics with the same spelling.
/// [`crate::wind_shear::WindShearModel::CustomLayers`] is deliberately NOT exposed: it needs a
/// caller-supplied layer table that this contract has no field for, and would silently degrade
/// to the surface wind.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum WindShearModelV1 {
    /// No altitude dependence: the request's wind is used at every height (the historical
    /// default, and what an omitted field means).
    #[default]
    None,
    /// Logarithmic boundary-layer profile, `ln(z / z0) / ln(z_ref / z0)`.
    Logarithmic,
    /// 1/7 power-law boundary-layer profile, `(z / z_ref)^(1/7)`.
    PowerLaw,
    /// Ekman spiral. Accepted for parity with the CLI and the engine's model names, but this
    /// solve path's boundary-layer evaluator has no near-ground closed form for it, so it
    /// leaves the wind at the operative value. Enabling it emits a
    /// `wind_shear_model_not_modeled` warning rather than passing silently.
    #[serde(alias = "ekman")]
    EkmanSpiral,
}

impl WindShearModelV1 {
    /// The canonical lower-snake name the engine's `wind_shear` / `cli_api` code understands.
    ///
    /// Aliases resolve to their canonical spelling here, which is also what the resolved
    /// request echoes: `"ekman"` in, `"ekman_spiral"` out.
    pub fn as_engine_str(self) -> &'static str {
        match self {
            WindShearModelV1::None => "none",
            WindShearModelV1::Logarithmic => "logarithmic",
            WindShearModelV1::PowerLaw => "power_law",
            WindShearModelV1::EkmanSpiral => "ekman_spiral",
        }
    }

    /// Whether this model asks the solver for altitude-dependent wind at all.
    ///
    /// `"none"` must map to `enable_wind_shear: false` rather than to an enabled solver
    /// holding the string `"none"`: [`crate::cli_api`]'s shear branch maps any unrecognized
    /// model name — `"none"` included — to the power law, so an enabled-but-`"none"` solve
    /// would quietly run power-law shear.
    pub fn is_enabled(self) -> bool {
        !matches!(self, WindShearModelV1::None)
    }
}

/// Regular downrange output sampling configuration.
#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct SamplingV1 {
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        deserialize_with = "deserialize_present"
    )]
    pub interval_m: Option<f64>,
}

/// A solve request after the service has applied every documented v1 default.
///
/// This is intentionally distinct from [`SolveRequestV1`]. Request DTOs retain whether a
/// defaulted field was omitted, while resolved DTOs require a concrete value for every default
/// that affected the solve. Semantically optional inputs remain optional.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedSolveRequestV1 {
    pub schema_version: SchemaVersionV1,
    pub projectile: ResolvedProjectileV1,
    pub rifle: ResolvedRifleV1,
    pub shot: ResolvedShotV1,
    pub atmosphere: ResolvedAtmosphereV1,
    pub wind: ResolvedWindV1,
    pub solver: ResolvedSolverV1,
    pub effects: ResolvedEffectsV1,
    pub sampling: ResolvedSamplingV1,
    /// Echo of the reticle hold-point request (MBA-1361), when one was supplied. Present
    /// only when the raw request supplied it — completes the resolved request as a
    /// full description of the solve.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub reticle: Option<ReticleRequestV1>,
    /// Echo of the offline-corrections block, when one was supplied. Present only when
    /// the raw request supplied it, so a resolved request re-solve (perturbation,
    /// round-trip) re-applies the same table rather than silently dropping the
    /// correction. Re-applying is idempotent: segments are always generated from the
    /// request's PUBLISHED `ballistic_coefficient`, never from an already-corrected one.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub corrections: Option<CorrectionsV1>,
}

/// Resolved projectile inputs.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedProjectileV1 {
    pub mass_kg: f64,
    pub diameter_m: f64,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub length_m: Option<f64>,
    pub drag_model: DragModelV1,
    pub ballistic_coefficient: f64,
    /// Verbatim echo of the request's table (MBA-1597). It is carried rather than summarized
    /// because the perturbation kernels re-solve from this resolved request: dropping it would
    /// silently fly their re-solves on `drag_model`'s curve instead.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub drag_table: Option<DragTableV1>,
    /// Verbatim echo of the request's BC ladder (MBA-1598), omitted when none was supplied. It
    /// is carried for the same reason as `drag_table`: the perturbation kernels re-solve from
    /// this resolved request, and dropping it would fly their re-solves on the scalar BC.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub bc_segments: Option<Vec<BcSegmentV1>>,
}

/// Resolved rifle and sight geometry.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedRifleV1 {
    pub muzzle_velocity_mps: f64,
    pub sight_height_m: f64,
    pub muzzle_height_m: f64,
    pub twist_rate_m_per_turn: f64,
    pub twist_direction: TwistDirectionV1,
    /// Lateral sight offset for offset-mounted optics. Echoed so the resolved request
    /// is a complete description of the solve (required for counterfactual re-solve).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub sight_offset_lateral_m: Option<f64>,
}

/// Resolved shot geometry.
///
/// `zero_distance_m` records caller zeroing intent, while `muzzle_angle_rad` is always the
/// effective angle used by the engine. A zero-distance solve therefore populates both fields.
/// A raw request may also supply both together (0.33.0 decision-support Task 2's
/// `From<&ResolvedSolveRequestV1> for SolveRequestV1` always does, to round-trip a resolved
/// request): `muzzle_angle_rad` then wins outright for elevation and no elevation search
/// runs, but `zero_distance_m` is not otherwise inert -- it still drives the
/// windage-convergence bias (`sight_offset_lateral_m` / `zero_poi_right_m`), still gates
/// `equivalent_horizontal_range_m`, and still widens the required wind coverage. A
/// `zero_distance_elevation_not_resolved` warning names this whenever both are supplied.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedShotV1 {
    pub max_range_m: f64,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub zero_distance_m: Option<f64>,
    pub muzzle_angle_rad: f64,
    pub aim_azimuth_rad: f64,
    pub shot_azimuth_rad: f64,
    pub shooting_angle_rad: f64,
    pub cant_angle_rad: f64,
    pub target_height_m: f64,
    pub ground_threshold_m: f64,
    /// Echo of the requested deliberate vertical POI offset at the zero range, meters
    /// (MBA-1359). Present only when the raw request supplied it.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub zero_poi_up_m: Option<f64>,
    /// Echo of the requested deliberate horizontal POI offset at the zero range, meters
    /// (MBA-1359). Present only when the raw request supplied it.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub zero_poi_right_m: Option<f64>,
    /// Echo of the requested drops-reference plane (MBA-1403). Present only when the raw
    /// request supplied it.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub drops_reference: Option<DropsReferenceV1>,
}

/// Resolved station conditions.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedAtmosphereV1 {
    pub altitude_m: f64,
    pub temperature_k: f64,
    pub pressure_pa: f64,
    pub relative_humidity: f64,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub latitude_rad: Option<f64>,
    /// Echo of the requested pressure reference mode (MBA-1397). Present only when the raw
    /// request supplied it.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub pressure_reference: Option<PressureReferenceV1>,
}

/// Resolved constant or segmented wind.
///
/// The untagged representation retains the request's object shape while making the selected wind
/// variant explicit in Rust. Still air is a constant wind with three zero values.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(untagged)]
pub enum ResolvedWindV1 {
    Constant(ResolvedConstantWindV1),
    Segmented(ResolvedSegmentedWindV1),
}

/// Resolved still-air or constant-wind values.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedConstantWindV1 {
    pub speed_mps: f64,
    pub direction_from_rad: f64,
    pub vertical_speed_mps: f64,
    /// Echo of the requested wind-direction reference frame (MBA-1368). Present only when
    /// the raw request supplied it. `direction_from_rad` above is always already converted
    /// to shooter-relative, regardless of this value.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub wind_reference: Option<WindReferenceV1>,
}

/// Resolved downrange wind segments.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedSegmentedWindV1 {
    pub segments: Vec<ResolvedWindSegmentV1>,
    /// Echo of the requested wind-direction reference frame (MBA-1368). Present only when
    /// the raw request supplied it. Each segment's `direction_from_rad` above is always
    /// already converted to shooter-relative, regardless of this value.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub wind_reference: Option<WindReferenceV1>,
}

/// One resolved wind segment.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedWindSegmentV1 {
    pub until_distance_m: f64,
    pub speed_mps: f64,
    pub direction_from_rad: f64,
    pub vertical_speed_mps: f64,
}

/// Resolved numerical integration configuration.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedSolverV1 {
    pub method: SolverMethodV1,
    pub time_step_s: f64,
}

/// Resolved physical-effect switches.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedEffectsV1 {
    pub magnus: bool,
    pub coriolis: bool,
    pub enhanced_spin_drift: bool,
    /// Echo of the wind shear model that was actually applied (0.36.0), in its canonical
    /// spelling. Present only when the raw request supplied one — an omitted field leaves
    /// this absent, so responses to pre-0.36.0 requests serialize byte-identically.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub wind_shear_model: Option<WindShearModelV1>,
    /// Echo of the aerodynamic-jump switch (MBA-959). Present only when the raw request
    /// supplied one, so a response to a request written before this field existed serializes
    /// byte-identically.
    ///
    /// `Option<bool>` rather than the bare `bool` its three older siblings use, and
    /// deliberately: those are always echoed, so a `false` on them is indistinguishable from
    /// a default, whereas this field keeps supplied-`false` and omitted apart. That is the
    /// same additive-echo shape `wind_shear_model` above it uses, and it is the one that lets
    /// an echo round-trip back into an identical request.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aerodynamic_jump: Option<bool>,
}

/// Resolved result-sampling configuration.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct ResolvedSamplingV1 {
    pub interval_m: f64,
}

/// A successful solve-json v1 response.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct SolveSuccessV1 {
    pub schema_version: SchemaVersionV1,
    pub engine_version: String,
    pub status: SuccessStatusV1,
    pub resolved_request: ResolvedSolveRequestV1,
    #[serde(default)]
    pub assumptions: Vec<SolveNoticeV1>,
    #[serde(default)]
    pub warnings: Vec<SolveNoticeV1>,
    pub summary: SolveSummaryV1,
    #[serde(default, serialize_with = "serialize_solve_samples_v1")]
    pub samples: Vec<TrajectorySampleV1>,
    /// The reticle hold point (MBA-1361), present only when the request carried a
    /// `reticle` block. Every response that predates the field, and every request without
    /// one, is byte-identical.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub reticle_hold: Option<ReticleHoldV1>,
}

fn serialize_solve_samples_v1<S>(
    samples: &[TrajectorySampleV1],
    serializer: S,
) -> Result<S::Ok, S::Error>
where
    S: Serializer,
{
    if samples.len() > MAX_SOLVE_JSON_SAMPLES_V1 {
        return Err(serde::ser::Error::custom(format_args!(
            "solve-json v1 response sample limit of {MAX_SOLVE_JSON_SAMPLES_V1} exceeded: response has {} samples",
            samples.len()
        )));
    }
    samples.serialize(serializer)
}

impl SolveSuccessV1 {
    /// Validate service-level response limits immediately before serialization.
    ///
    /// The exact limit is accepted. A response with more samples returns a structured
    /// [`SolveErrorCodeV1::ResourceLimit`] error at the sampling interval that requested the
    /// oversized result. The response is never silently truncated.
    pub fn validate_for_serialization(&self) -> Result<(), SolveErrorEnvelopeV1> {
        if self.samples.len() <= MAX_SOLVE_JSON_SAMPLES_V1 {
            return Ok(());
        }

        Err(SolveErrorEnvelopeV1::new(
            SolveErrorV1::new(
                SolveErrorCodeV1::ResourceLimit,
                format!(
                    "solve-json v1 response sample limit of {MAX_SOLVE_JSON_SAMPLES_V1} exceeded: response has {} samples",
                    self.samples.len()
                ),
            )
            .at_path("$.sampling.interval_m"),
        ))
    }
}

/// The success discriminator serialized in a response envelope.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum SuccessStatusV1 {
    Ok,
}

/// A machine-readable assumption or warning.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct SolveNoticeV1 {
    pub code: String,
    pub message: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
}

/// Aggregate observations for a completed solve.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct SolveSummaryV1 {
    pub actual_range_m: f64,
    /// Greatest world-vertical projectile height above the request's local ground/reference
    /// datum. This is not shot-frame Y and is not height above the line of sight.
    pub maximum_height_m: f64,
    pub time_of_flight_s: f64,
    pub terminal_speed_mps: f64,
    pub terminal_energy_j: f64,
    /// Muzzle gyroscopic stability factor Sg evaluated with the resolved projectile, muzzle
    /// velocity, twist, and station atmosphere; absent only when it cannot be calculated.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub stability_factor: Option<f64>,
    /// Signed gyroscopic spin-drift contribution at the terminal sample, positive to the
    /// shooter's right. This excludes wind drift and is absent when the effect is disabled or
    /// cannot be calculated.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub spin_drift_m: Option<f64>,
    /// Equivalent horizontal range for an inclined shot (MBA-1395): the flat-fire range
    /// whose angular elevation correction against the same zero matches the inclined
    /// solution's at the terminal range — the BDC "shoot-to" range (SIG AMR / Leica EHR
    /// style, angular-match inversion, not the rifleman's-rule cosine). Present only when
    /// `shot.shooting_angle_rad != 0`, a `zero_distance_m` was solved, and the inverse is
    /// well-defined (terminal past the zero range, positive correction); absent otherwise
    /// — responses that predate the field, and every flat solve, are byte-identical.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub equivalent_horizontal_range_m: Option<f64>,
    /// Vertical crosswind aerodynamic jump actually applied at the muzzle, in MOA, positive
    /// up (MBA-959). Present only when `effects.aerodynamic_jump` was enabled AND the solver
    /// produced components; absent otherwise, so every response that predates the field is
    /// byte-identical.
    ///
    /// This exists because the jump is otherwise unobservable from the response. It is a
    /// fixed launch-angle offset, so it does not appear as its own column anywhere — it is
    /// folded into every drop in the table, and a caller comparing two solves cannot tell a
    /// jump that applied from one that silently came out at zero. A present `0.0` says the
    /// flag took effect and the muzzle crosswind was nil; an absent field says the effect
    /// never ran.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aerodynamic_jump_moa: Option<f64>,
    pub termination: TerminationReasonV1,
}

/// Why the trajectory ended.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum TerminationReasonV1 {
    MaxRange,
    GroundThreshold,
    TimeLimit,
    VelocityFloor,
}

/// One regularly sampled trajectory observation.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct TrajectorySampleV1 {
    pub distance_m: f64,
    pub time_s: f64,
    pub speed_mps: f64,
    pub energy_j: f64,
    /// Positive means below the line of sight.
    pub drop_m: f64,
    /// Positive means right of the line of sight from the shooter's perspective.
    pub windage_m: f64,
    pub mach: f64,
    #[serde(default)]
    pub flags: Vec<SampleFlagV1>,
}

/// Stable annotations for trajectory samples.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum SampleFlagV1 {
    Transonic,
    Subsonic,
    Terminal,
    GroundThreshold,
}

/// A failed solve-json v1 response.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct SolveErrorEnvelopeV1 {
    pub schema_version: SchemaVersionV1,
    pub status: ErrorStatusV1,
    pub error: SolveErrorV1,
}

impl SolveErrorEnvelopeV1 {
    /// Wrap a protocol error in a v1 envelope.
    pub fn new(error: SolveErrorV1) -> Self {
        Self {
            schema_version: SchemaVersionV1,
            status: ErrorStatusV1::Error,
            error,
        }
    }
}

/// The error discriminator serialized in a response envelope.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum ErrorStatusV1 {
    Error,
}

/// A stable, machine-readable protocol error.
///
/// Location state is private so callers cannot construct a path together with a source location,
/// a partial line/column pair, or a zero source coordinate. The JSON representation retains the
/// flat `path`, `line`, and `column` fields.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct SolveErrorV1 {
    pub code: SolveErrorCodeV1,
    pub message: String,
    location: SolveErrorLocationV1,
}

#[derive(Debug, Clone, PartialEq, Eq)]
enum SolveErrorLocationV1 {
    None,
    Path(String),
    Source {
        line: NonZeroUsize,
        column: NonZeroUsize,
    },
}

/// Why a source location could not be attached to a protocol error.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum SolveErrorLocationErrorV1 {
    ZeroLine,
    ZeroColumn,
}

impl fmt::Display for SolveErrorLocationErrorV1 {
    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::ZeroLine => formatter.write_str("error line must be one-based"),
            Self::ZeroColumn => formatter.write_str("error column must be one-based"),
        }
    }
}

impl std::error::Error for SolveErrorLocationErrorV1 {}

impl SolveErrorV1 {
    /// Construct an error without input-location information.
    pub fn new(code: SolveErrorCodeV1, message: impl Into<String>) -> Self {
        Self {
            code,
            message: message.into(),
            location: SolveErrorLocationV1::None,
        }
    }

    /// Attach a JSONPath-like input location, replacing any source location.
    pub fn at_path(mut self, path: impl Into<String>) -> Self {
        self.location = SolveErrorLocationV1::Path(path.into());
        self
    }

    /// Attach a one-based malformed-JSON source location, replacing any JSON path.
    pub fn at_location(
        mut self,
        line: usize,
        column: usize,
    ) -> Result<Self, SolveErrorLocationErrorV1> {
        let line = NonZeroUsize::new(line).ok_or(SolveErrorLocationErrorV1::ZeroLine)?;
        let column = NonZeroUsize::new(column).ok_or(SolveErrorLocationErrorV1::ZeroColumn)?;
        self.location = SolveErrorLocationV1::Source { line, column };
        Ok(self)
    }

    /// Attach a parser location while keeping the public wire coordinates one-based.
    ///
    /// `serde_json` reports column zero for some end-of-file errors. Normalize either zero
    /// coordinate to one instead of allowing malformed input to trigger a panic.
    fn at_parser_location(mut self, line: usize, column: usize) -> Self {
        self.location = SolveErrorLocationV1::Source {
            line: NonZeroUsize::new(line).unwrap_or(NonZeroUsize::MIN),
            column: NonZeroUsize::new(column).unwrap_or(NonZeroUsize::MIN),
        };
        self
    }

    /// Return the JSONPath-like input location, when present.
    pub fn path(&self) -> Option<&str> {
        match &self.location {
            SolveErrorLocationV1::Path(path) => Some(path),
            SolveErrorLocationV1::None | SolveErrorLocationV1::Source { .. } => None,
        }
    }

    /// Return the one-based malformed-JSON source line, when present.
    pub fn line(&self) -> Option<usize> {
        match &self.location {
            SolveErrorLocationV1::Source { line, .. } => Some(line.get()),
            SolveErrorLocationV1::None | SolveErrorLocationV1::Path(_) => None,
        }
    }

    /// Return the one-based malformed-JSON source column, when present.
    pub fn column(&self) -> Option<usize> {
        match &self.location {
            SolveErrorLocationV1::Source { column, .. } => Some(column.get()),
            SolveErrorLocationV1::None | SolveErrorLocationV1::Path(_) => None,
        }
    }
}

impl Serialize for SolveErrorV1 {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: Serializer,
    {
        let mut state = serializer.serialize_struct("SolveErrorV1", 5)?;
        state.serialize_field("code", &self.code)?;
        state.serialize_field("message", &self.message)?;
        state.serialize_field("path", &self.path())?;
        state.serialize_field("line", &self.line())?;
        state.serialize_field("column", &self.column())?;
        state.end()
    }
}

impl<'de> Deserialize<'de> for SolveErrorV1 {
    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
    where
        D: Deserializer<'de>,
    {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct SolveErrorWireV1 {
            code: SolveErrorCodeV1,
            message: String,
            path: Option<String>,
            line: Option<usize>,
            column: Option<usize>,
        }

        let wire = SolveErrorWireV1::deserialize(deserializer)?;
        let location = match (wire.path, wire.line, wire.column) {
            (None, None, None) => SolveErrorLocationV1::None,
            (Some(path), None, None) => SolveErrorLocationV1::Path(path),
            (None, Some(line), Some(column)) => {
                let line = NonZeroUsize::new(line)
                    .ok_or_else(|| de::Error::custom("error line must be one-based"))?;
                let column = NonZeroUsize::new(column)
                    .ok_or_else(|| de::Error::custom("error column must be one-based"))?;
                SolveErrorLocationV1::Source { line, column }
            }
            _ => {
                return Err(de::Error::custom(
                    "error location must contain either path or both line and column",
                ));
            }
        };

        Ok(Self {
            code: wire.code,
            message: wire.message,
            location,
        })
    }
}

/// Stable solve-json v1 error categories.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum SolveErrorCodeV1 {
    InvalidJson,
    UnsupportedSchemaVersion,
    UnknownField,
    MissingField,
    InvalidValue,
    ConflictingFields,
    ResourceLimit,
    SolveFailed,
    IoError,
    InternalError,
}

/// Decode and structurally validate one solve-json v1 request.
///
/// In addition to Serde's `deny_unknown_fields` enforcement, this entry point attaches exact
/// JSONPath-like locations to unknown fields, missing required fields, invalid enums, and an
/// unsupported schema version. Transport implementations should use this function rather than
/// deserializing [`SolveRequestV1`] directly when they need a protocol error envelope.
pub fn decode_solve_request_v1(input: &str) -> Result<SolveRequestV1, SolveErrorEnvelopeV1> {
    let value: Value = serde_json::from_str(input).map_err(|error| {
        let error = SolveErrorV1::new(SolveErrorCodeV1::InvalidJson, error.to_string())
            .at_parser_location(error.line(), error.column());
        envelope(error)
    })?;

    validate_request_shape(&value)?;

    let request: SolveRequestV1 = serde_json::from_value(value).map_err(|error| {
        envelope(SolveErrorV1::new(SolveErrorCodeV1::InvalidValue, error.to_string()).at_path("$"))
    })?;

    validate_request_ranges(&request)?;

    Ok(request)
}

/// Physically meaningful bounds for solve-json v1's numeric inputs (MBA-1413).
///
/// Deliberately enormous — the point is to exclude values that are not projectiles at all, not
/// to police calibers. Every bound below admits everything from an airgun pellet to naval
/// artillery, so a request rejected here was never going to produce a meaningful answer.
///
/// Found by fuzzing, which reached a request declaring a `mass_kg` of 1.1e-66 — about
/// 10^40 times lighter than a proton. The engine accepted it and solved. The visible symptom was
/// narrower: at that magnitude `serde_json`'s float parser is a bit off re-reading its own
/// output, so the request did not survive a JSON round trip and broke the protocol's stability
/// invariant. Tightening the float handling would have addressed the symptom; the actual defect
/// is that a number no projectile could have was accepted as a projectile.
///
/// Also bounds each `card.*` `bc_segments` band BC (MBA-1600).
pub(crate) mod limits {
    /// 1 mg to 100 kg. A .17 cal pellet is ~500 mg; a 16-inch naval shell is ~1200 kg, so the
    /// upper bound is the one a caller might conceivably reach — it is set past small artillery
    /// on purpose and can be raised without ceremony.
    pub const MASS_KG: (f64, f64) = (1.0e-6, 100.0);
    /// 0.1 mm to 1 m.
    pub const DIAMETER_M: (f64, f64) = (1.0e-4, 1.0);
    /// 0.1 mm to 10 m. Only checked when supplied.
    pub const LENGTH_M: (f64, f64) = (1.0e-4, 10.0);
    /// Ballistic coefficient, lb/in². Real values run ~0.1–1.5; the bound is far past both ends.
    pub const BALLISTIC_COEFFICIENT: (f64, f64) = (1.0e-4, 100.0);

    // Deliberately NOT bounded here: muzzle_velocity_mps and max_range_m. The MCP server
    // documents — and tests — a split where a structurally valid request the engine cannot
    // solve returns a tool error rather than a protocol error, and an absurd muzzle velocity is
    // its worked example of that case. Bounding those two fields here would reclassify that
    // example as invalid params and change a contract MCP clients may rely on, which is a
    // separate decision from rejecting values that cannot describe a projectile.
}

fn require_range(
    value: f64,
    (min, max): (f64, f64),
    path: &str,
) -> Result<(), SolveErrorEnvelopeV1> {
    if !value.is_finite() {
        return Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            format!("{path} must be a finite number"),
            path,
        ));
    }
    if value < min || value > max {
        return Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            format!("{path} must be between {min} and {max}, got {value}"),
            path,
        ));
    }
    Ok(())
}

/// Reject requests whose numbers cannot describe a projectile, before any solve runs.
///
/// Runs after deserialization so the fields are typed and each error can carry the exact
/// JSONPath the caller used, matching how the shape errors above report.
fn validate_request_ranges(request: &SolveRequestV1) -> Result<(), SolveErrorEnvelopeV1> {
    require_range(
        request.projectile.mass_kg,
        limits::MASS_KG,
        "$.projectile.mass_kg",
    )?;
    require_range(
        request.projectile.diameter_m,
        limits::DIAMETER_M,
        "$.projectile.diameter_m",
    )?;
    require_range(
        request.projectile.ballistic_coefficient,
        limits::BALLISTIC_COEFFICIENT,
        "$.projectile.ballistic_coefficient",
    )?;
    if let Some(length_m) = request.projectile.length_m {
        require_range(length_m, limits::LENGTH_M, "$.projectile.length_m")?;
    }
    if let Some(drag_table) = &request.projectile.drag_table {
        validate_drag_table_v1(drag_table)?;
    }
    if let Some(bc_segments) = &request.projectile.bc_segments {
        validate_bc_segments_v1(bc_segments, request.projectile.ballistic_coefficient)?;
    }
    Ok(())
}

fn envelope(error: SolveErrorV1) -> SolveErrorEnvelopeV1 {
    SolveErrorEnvelopeV1::new(error)
}

fn protocol_error(
    code: SolveErrorCodeV1,
    message: impl Into<String>,
    path: impl Into<String>,
) -> SolveErrorEnvelopeV1 {
    envelope(SolveErrorV1::new(code, message).at_path(path))
}

fn validate_request_shape(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let root = require_object(value, "$")?;

    // Dispatch on the version before applying any v1-only shape rules. A future-version
    // request may legitimately contain fields unknown to v1 and must still receive the stable
    // unsupported-version error rather than an order-dependent unknown-field error.
    validate_schema_version(root)?;
    validate_members(
        root,
        "$",
        &[
            "schema_version",
            "projectile",
            "rifle",
            "shot",
            "atmosphere",
            "wind",
            "solver",
            "effects",
            "sampling",
            // MBA-1361: optional, additive. Omitting it is the historical shape.
            "reticle",
            // Offline corrections (BC5D table path): optional, additive.
            "corrections",
        ],
        &[
            "schema_version",
            "projectile",
            "rifle",
            "shot",
            "atmosphere",
            "wind",
            "solver",
            "effects",
            "sampling",
        ],
    )?;

    validate_projectile(required_value(root, "projectile", "$")?)?;
    validate_rifle(required_value(root, "rifle", "$")?)?;
    validate_shot(required_value(root, "shot", "$")?)?;
    validate_atmosphere(required_value(root, "atmosphere", "$")?)?;
    validate_wind(required_value(root, "wind", "$")?)?;
    validate_solver(required_value(root, "solver", "$")?)?;
    validate_effects(required_value(root, "effects", "$")?)?;
    validate_sampling(required_value(root, "sampling", "$")?)?;
    if let Some(reticle) = root.get("reticle") {
        validate_reticle(reticle)?;
    }
    if let Some(corrections) = root.get("corrections") {
        validate_corrections(corrections)?;
    }
    Ok(())
}

/// Shape-validate an optional `corrections` block: a strict envelope whose only
/// member today is `bc5d_table_path`, a string. The path's existence, format, and
/// CRC are solve-time concerns (an `invalid_value`/`io_error` from the service),
/// not protocol-shape ones — same split the reticle description uses.
fn validate_corrections(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.corrections";
    let object = require_object(value, path)?;
    validate_members(object, path, &["bc5d_table_path"], &[])?;
    if let Some(table_path) = object.get("bc5d_table_path") {
        if !table_path.is_string() {
            return Err(protocol_error(
                SolveErrorCodeV1::InvalidValue,
                "expected a string",
                "$.corrections.bc5d_table_path",
            ));
        }
    }
    Ok(())
}

/// Shape-validate an optional `reticle` block (MBA-1361).
///
/// The ENVELOPE is strict (exactly `range_m`, `magnification`, `description`, all
/// required); the description itself is handed to the shared reticle schema, whose own
/// `validate()` runs at solve time. Splitting it that way keeps the wire contract tight
/// without making the engine the arbiter of a front end's render metadata.
fn validate_reticle(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.reticle";
    let object = require_object(value, path)?;
    validate_members(
        object,
        path,
        &["range_m", "magnification", "description"],
        &["range_m", "magnification", "description"],
    )?;
    validate_required_numbers(object, path, &["range_m", "magnification"])?;
    require_object(
        required_value(object, "description", path)?,
        "$.reticle.description",
    )?;
    Ok(())
}

fn validate_schema_version(root: &Map<String, Value>) -> Result<(), SolveErrorEnvelopeV1> {
    let value = required_value(root, "schema_version", "$")?;
    let version = if let Some(version) = value.as_i64() {
        i128::from(version)
    } else if let Some(version) = value.as_u64() {
        i128::from(version)
    } else {
        return Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            "schema_version must be the integer 1",
            "$.schema_version",
        ));
    };
    if version != i128::from(SOLVE_JSON_SCHEMA_VERSION_V1) {
        return Err(protocol_error(
            SolveErrorCodeV1::UnsupportedSchemaVersion,
            format!(
                "unsupported schema_version {version}; expected {SOLVE_JSON_SCHEMA_VERSION_V1}"
            ),
            "$.schema_version",
        ));
    }
    Ok(())
}

fn validate_projectile(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.projectile";
    let object = require_object(value, path)?;
    validate_members(
        object,
        path,
        &[
            "mass_kg",
            "diameter_m",
            "length_m",
            "drag_model",
            "ballistic_coefficient",
            // MBA-1597: optional caller-supplied drag curve.
            "drag_table",
            // MBA-1598: optional velocity-banded BC ladder.
            "bc_segments",
        ],
        &[
            "mass_kg",
            "diameter_m",
            "drag_model",
            "ballistic_coefficient",
        ],
    )?;
    validate_required_numbers(
        object,
        path,
        &["mass_kg", "diameter_m", "ballistic_coefficient"],
    )?;
    validate_optional_number(object, path, "length_m")?;
    validate_string_enum(
        required_value(object, "drag_model", path)?,
        "$.projectile.drag_model",
        &DRAG_MODEL_WIRE_NAMES_V1,
    )?;
    if let Some(drag_table) = object.get("drag_table") {
        validate_drag_table_shape(drag_table)?;
    }
    if let Some(bc_segments) = object.get("bc_segments") {
        validate_bc_segments_shape(bc_segments)?;
    }
    Ok(())
}

/// The members of one [`BcSegmentV1`], all required numbers.
const BC_SEGMENT_FIELDS_V1: [&str; 3] = [
    "velocity_min_mps",
    "velocity_max_mps",
    "ballistic_coefficient",
];

/// Shape-validate an optional `projectile.bc_segments` (MBA-1598): a non-empty array of strict
/// `{velocity_min_mps, velocity_max_mps, ballistic_coefficient}` objects, all numbers. `null`
/// is refused here, not read as omission. The values themselves (the band count, the bounds,
/// the order and the no-overlap rule) are range rules, checked by [`validate_bc_segments_v1`]
/// once the request is typed.
fn validate_bc_segments_shape(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let segments_path = "$.projectile.bc_segments";
    let Some(segments) = value.as_array() else {
        return Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            "bc_segments must be an array",
            segments_path,
        ));
    };
    if segments.is_empty() {
        return Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            bc_segment_count_message(0),
            segments_path,
        ));
    }
    for (index, segment) in segments.iter().enumerate() {
        let seg_path = format!("{segments_path}[{index}]");
        let segment = require_object(segment, &seg_path)?;
        validate_members(
            segment,
            &seg_path,
            &BC_SEGMENT_FIELDS_V1,
            &BC_SEGMENT_FIELDS_V1,
        )?;
        validate_required_numbers(segment, &seg_path, &BC_SEGMENT_FIELDS_V1)?;
    }
    Ok(())
}

fn bc_segment_count_message(count: usize) -> String {
    format!("bc_segments must have {MIN_BC_SEGMENTS_V1} to {MAX_BC_SEGMENTS_V1} bands, got {count}")
}

/// Check a [`ProjectileV1::bc_segments`] ladder's values: the band count, then each band in
/// order, naming the exact entry at fault.
///
/// Each band needs a finite `velocity_min_mps` >= 0, a finite `velocity_max_mps` above it, and
/// a `ballistic_coefficient` inside the scalar BC's own bounds. From the second band on,
/// `velocity_min_mps` must be below the previous band's (fastest band first), and
/// `velocity_max_mps` must not reach above the previous band's `velocity_min_mps` (no
/// overlaps; touching edges and gaps are legal).
///
/// A one-band ladder flies its band at every speed, so the scalar `ballistic_coefficient`
/// never flies beside it. Its band BC must match `scalar_bc` to within
/// [`ONE_BAND_BC_RELATIVE_TOLERANCE_V1`], or the pair is refused as `conflicting_fields` at the
/// band's BC: two different BCs for one projectile can only be a caller mistake, and flying
/// either one silently hides it.
///
/// Called from both the decoder and the solve service, so a Rust caller that builds a request
/// without [`decode_solve_request_v1`] hears about a bad band at the same path.
pub(crate) fn validate_bc_segments_v1(
    segments: &[BcSegmentV1],
    scalar_bc: f64,
) -> Result<(), SolveErrorEnvelopeV1> {
    let base = "$.projectile.bc_segments";
    let count = segments.len();
    if !(MIN_BC_SEGMENTS_V1..=MAX_BC_SEGMENTS_V1).contains(&count) {
        return Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            bc_segment_count_message(count),
            base,
        ));
    }
    let mut previous: Option<BcSegmentV1> = None;
    for (index, seg) in segments.iter().enumerate() {
        let seg_path = format!("{base}[{index}]");
        let min_path = format!("{seg_path}.velocity_min_mps");
        let max_path = format!("{seg_path}.velocity_max_mps");
        if !seg.velocity_min_mps.is_finite() || seg.velocity_min_mps < 0.0 {
            return Err(protocol_error(
                SolveErrorCodeV1::InvalidValue,
                format!(
                    "velocity_min_mps must be finite and >= 0, got {}",
                    seg.velocity_min_mps
                ),
                min_path,
            ));
        }
        if !seg.velocity_max_mps.is_finite() || seg.velocity_max_mps <= seg.velocity_min_mps {
            return Err(protocol_error(
                SolveErrorCodeV1::InvalidValue,
                format!(
                    "velocity_max_mps must be finite and > velocity_min_mps ({}), got {}",
                    seg.velocity_min_mps, seg.velocity_max_mps
                ),
                max_path,
            ));
        }
        require_range(
            seg.ballistic_coefficient,
            limits::BALLISTIC_COEFFICIENT,
            &format!("{seg_path}.ballistic_coefficient"),
        )?;
        if let Some(prev) = previous {
            if seg.velocity_min_mps >= prev.velocity_min_mps {
                return Err(protocol_error(
                    SolveErrorCodeV1::InvalidValue,
                    format!(
                        "velocity_min_mps must be below bc_segments[{}].velocity_min_mps ({}), \
                         got {}: list the bands from the highest speed to the lowest, or \
                         reverse the array",
                        index - 1,
                        prev.velocity_min_mps,
                        seg.velocity_min_mps
                    ),
                    min_path,
                ));
            }
            if seg.velocity_max_mps > prev.velocity_min_mps {
                return Err(protocol_error(
                    SolveErrorCodeV1::InvalidValue,
                    format!(
                        "velocity_max_mps ({}) overlaps bc_segments[{}], which starts at {} m/s: \
                         a band must end at or below the start of the faster band before it",
                        seg.velocity_max_mps,
                        index - 1,
                        prev.velocity_min_mps
                    ),
                    max_path,
                ));
            }
        }
        previous = Some(*seg);
    }
    if let [band] = segments {
        let difference = (band.ballistic_coefficient - scalar_bc).abs();
        let allowed = ONE_BAND_BC_RELATIVE_TOLERANCE_V1 * band.ballistic_coefficient.max(scalar_bc);
        if difference > allowed {
            return Err(protocol_error(
                SolveErrorCodeV1::ConflictingFields,
                format!(
                    "a one-band ladder flies its band's BC at every speed, so \
                     bc_segments[0].ballistic_coefficient ({}) must match \
                     projectile.ballistic_coefficient ({scalar_bc}): send the same value in \
                     both, or omit bc_segments",
                    band.ballistic_coefficient
                ),
                format!("{base}[0].ballistic_coefficient"),
            ));
        }
    }
    Ok(())
}

/// Shape-validate an optional `projectile.drag_table` (MBA-1597): a strict object with a
/// closed `kind` enum and an array of strict `{mach, cd}` points. The values themselves — the
/// point count, ascending Mach, positive Cd — are range rules, checked by
/// [`validate_drag_table_v1`] once the request is typed.
fn validate_drag_table_shape(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.projectile.drag_table";
    let object = require_object(value, path)?;
    validate_members(object, path, &["kind", "points"], &["kind", "points"])?;
    validate_string_enum(
        required_value(object, "kind", path)?,
        "$.projectile.drag_table.kind",
        &["reference", "projectile"],
    )?;
    let points_path = "$.projectile.drag_table.points";
    let Some(points) = required_value(object, "points", path)?.as_array() else {
        return Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            "points must be an array",
            points_path,
        ));
    };
    for (index, point) in points.iter().enumerate() {
        let point_path = format!("{points_path}[{index}]");
        let point = require_object(point, &point_path)?;
        validate_members(point, &point_path, &["mach", "cd"], &["mach", "cd"])?;
        validate_required_numbers(point, &point_path, &["mach", "cd"])?;
    }
    Ok(())
}

fn validate_rifle(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.rifle";
    let object = require_object(value, path)?;
    validate_members(
        object,
        path,
        &[
            "muzzle_velocity_mps",
            "sight_height_m",
            "muzzle_height_m",
            "twist_rate_m_per_turn",
            "twist_direction",
            "sight_offset_lateral_m",
        ],
        &["muzzle_velocity_mps"],
    )?;
    validate_required_numbers(object, path, &["muzzle_velocity_mps"])?;
    validate_optional_numbers(
        object,
        path,
        &[
            "sight_height_m",
            "muzzle_height_m",
            "twist_rate_m_per_turn",
            "sight_offset_lateral_m",
        ],
    )?;
    if let Some(direction) = object.get("twist_direction") {
        validate_string_enum(direction, "$.rifle.twist_direction", &["left", "right"])?;
    }
    Ok(())
}

fn validate_shot(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.shot";
    let object = require_object(value, path)?;
    validate_members(
        object,
        path,
        &[
            "max_range_m",
            "zero_distance_m",
            "muzzle_angle_rad",
            "aim_azimuth_rad",
            "shot_azimuth_rad",
            "shooting_angle_rad",
            "cant_angle_rad",
            "target_height_m",
            "ground_threshold_m",
            "zero_poi_up_m",
            "zero_poi_right_m",
            "drops_reference",
        ],
        &["max_range_m"],
    )?;
    validate_required_numbers(object, path, &["max_range_m"])?;
    validate_optional_number(object, path, "zero_distance_m")?;
    validate_optional_number(object, path, "muzzle_angle_rad")?;
    validate_optional_numbers(
        object,
        path,
        &[
            "aim_azimuth_rad",
            "shot_azimuth_rad",
            "shooting_angle_rad",
            "cant_angle_rad",
            "target_height_m",
            "ground_threshold_m",
            "zero_poi_up_m",
            "zero_poi_right_m",
        ],
    )?;
    // MBA-1403: string enum, not a number — same shape-validation pattern as
    // $.rifle.twist_direction.
    if let Some(reference) = object.get("drops_reference") {
        validate_string_enum(reference, "$.shot.drops_reference", &["los", "target"])?;
    }
    Ok(())
}

pub(crate) fn validate_atmosphere(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.atmosphere";
    let object = require_object(value, path)?;
    validate_members(
        object,
        path,
        &[
            "altitude_m",
            "temperature_k",
            "pressure_pa",
            "pressure_reference",
            "relative_humidity",
            "latitude_rad",
        ],
        &[],
    )?;
    validate_optional_numbers(
        object,
        path,
        &[
            "altitude_m",
            "temperature_k",
            "pressure_pa",
            "relative_humidity",
            "latitude_rad",
        ],
    )?;
    // MBA-1397: string enum, not a number -- same shape-validation pattern as
    // $.shot.drops_reference / $.wind.wind_reference. This field has existed on
    // AtmosphereV1 and been consumed by resolve_atmosphere since MBA-1397, but was never
    // added to this hand-maintained allowlist, so decode_solve_request_v1 rejected it as
    // an unknown field even though direct SolveRequestV1 construction always accepted it.
    if let Some(reference) = object.get("pressure_reference") {
        validate_string_enum(
            reference,
            "$.atmosphere.pressure_reference",
            &["absolute", "qnh"],
        )?;
    }
    Ok(())
}

fn validate_wind(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.wind";
    let object = require_object(value, path)?;
    validate_members(
        object,
        path,
        &[
            "speed_mps",
            "direction_from_rad",
            "vertical_speed_mps",
            "segments",
            "wind_reference",
        ],
        &[],
    )?;
    for field in ["speed_mps", "direction_from_rad", "vertical_speed_mps"] {
        validate_optional_number(object, path, field)?;
    }
    // MBA-1368: wind_reference is a closed string enum (shooter | compass).
    if let Some(reference) = object.get("wind_reference") {
        validate_string_enum(reference, "$.wind.wind_reference", &["shooter", "compass"])?;
    }

    if let Some(segments) = object.get("segments") {
        let Some(segments) = segments.as_array() else {
            return Err(protocol_error(
                SolveErrorCodeV1::InvalidValue,
                "segments must be an array",
                "$.wind.segments",
            ));
        };
        for (index, segment) in segments.iter().enumerate() {
            let segment_path = format!("$.wind.segments[{index}]");
            let segment = require_object(segment, &segment_path)?;
            validate_members(
                segment,
                &segment_path,
                &[
                    "until_distance_m",
                    "speed_mps",
                    "direction_from_rad",
                    "vertical_speed_mps",
                ],
                &["until_distance_m", "speed_mps", "direction_from_rad"],
            )?;
            validate_required_numbers(
                segment,
                &segment_path,
                &["until_distance_m", "speed_mps", "direction_from_rad"],
            )?;
            validate_optional_number(segment, &segment_path, "vertical_speed_mps")?;
        }
    }
    Ok(())
}

fn validate_solver(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.solver";
    let object = require_object(value, path)?;
    validate_members(object, path, &["method", "time_step_s"], &[])?;
    validate_optional_number(object, path, "time_step_s")?;
    if let Some(method) = object.get("method") {
        validate_string_enum(method, "$.solver.method", &["euler", "rk4", "rk45"])?;
    }
    Ok(())
}

/// Every member name `effects` accepts on the v1 wire, in declaration order.
///
/// One list, because there are two readers: `validate_effects` rejects anything outside it,
/// and the MCP `solve` tool publishes an `inputSchema` with `additionalProperties: false` over
/// the same vocabulary. Those drifted apart once already — `wind_shear_model` reached the JSON
/// wire in 0.36.0 and never reached the MCP schema, so an MCP caller could not ask for shear
/// that the bridge underneath was perfectly willing to apply. `mcp_effect_schema_matches_the_wire`
/// in `src/mcp_command.rs` pins them together.
pub const SOLVE_JSON_EFFECT_NAMES_V1: &[&str] = &[
    "magnus",
    "coriolis",
    "enhanced_spin_drift",
    "wind_shear_model",
    "aerodynamic_jump",
];

fn validate_effects(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.effects";
    let object = require_object(value, path)?;
    validate_members(object, path, SOLVE_JSON_EFFECT_NAMES_V1, &[])?;
    validate_optional_booleans(
        object,
        path,
        &[
            "magnus",
            "coriolis",
            "enhanced_spin_drift",
            "aerodynamic_jump",
        ],
    )?;

    // An unknown shear model is rejected here, with the exact path and the accepted spellings,
    // rather than deserializing to the `none` default. Silently unsheared numbers are
    // indistinguishable from sheared ones downstream.
    if let Some(model) = object.get("wind_shear_model") {
        validate_string_enum(
            model,
            "$.effects.wind_shear_model",
            &[
                "none",
                "logarithmic",
                "power_law",
                "ekman_spiral",
                // Alias, canonicalized to `ekman_spiral` in the resolved echo.
                "ekman",
            ],
        )?;
    }

    if object.get("magnus").and_then(Value::as_bool) == Some(true)
        && object.get("enhanced_spin_drift").and_then(Value::as_bool) == Some(true)
    {
        return Err(protocol_error(
            SolveErrorCodeV1::ConflictingFields,
            "magnus and enhanced_spin_drift cannot both be enabled",
            "$.effects",
        ));
    }

    Ok(())
}

fn validate_sampling(value: &Value) -> Result<(), SolveErrorEnvelopeV1> {
    let path = "$.sampling";
    let object = require_object(value, path)?;
    validate_members(object, path, &["interval_m"], &[])?;
    validate_optional_number(object, path, "interval_m")
}

pub(crate) fn require_object<'a>(
    value: &'a Value,
    path: &str,
) -> Result<&'a Map<String, Value>, SolveErrorEnvelopeV1> {
    value
        .as_object()
        .ok_or_else(|| protocol_error(SolveErrorCodeV1::InvalidValue, "expected an object", path))
}

fn required_value<'a>(
    object: &'a Map<String, Value>,
    field: &str,
    parent_path: &str,
) -> Result<&'a Value, SolveErrorEnvelopeV1> {
    object.get(field).ok_or_else(|| {
        protocol_error(
            SolveErrorCodeV1::MissingField,
            format!("missing required field `{field}`"),
            child_path(parent_path, field),
        )
    })
}

pub(crate) fn validate_members(
    object: &Map<String, Value>,
    path: &str,
    allowed: &[&str],
    required: &[&str],
) -> Result<(), SolveErrorEnvelopeV1> {
    if let Some(field) = object
        .keys()
        .find(|field| !allowed.contains(&field.as_str()))
    {
        return Err(protocol_error(
            SolveErrorCodeV1::UnknownField,
            format!("unknown field `{field}`"),
            child_path(path, field),
        ));
    }

    if let Some(field) = required.iter().find(|field| !object.contains_key(**field)) {
        return Err(protocol_error(
            SolveErrorCodeV1::MissingField,
            format!("missing required field `{field}`"),
            child_path(path, field),
        ));
    }
    Ok(())
}

fn validate_string_enum(
    value: &Value,
    path: &str,
    allowed: &[&str],
) -> Result<(), SolveErrorEnvelopeV1> {
    let Some(value) = value.as_str() else {
        return Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            "expected a string enum value",
            path,
        ));
    };
    if !allowed.contains(&value) {
        return Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            format!(
                "invalid value `{value}`; expected one of {}",
                allowed.join(", ")
            ),
            path,
        ));
    }
    Ok(())
}

fn validate_required_numbers(
    object: &Map<String, Value>,
    parent_path: &str,
    fields: &[&str],
) -> Result<(), SolveErrorEnvelopeV1> {
    for field in fields {
        let value = required_value(object, field, parent_path)?;
        validate_number(value, &child_path(parent_path, field))?;
    }
    Ok(())
}

fn validate_optional_numbers(
    object: &Map<String, Value>,
    parent_path: &str,
    fields: &[&str],
) -> Result<(), SolveErrorEnvelopeV1> {
    for field in fields {
        validate_optional_number(object, parent_path, field)?;
    }
    Ok(())
}

fn validate_optional_number(
    object: &Map<String, Value>,
    parent_path: &str,
    field: &str,
) -> Result<(), SolveErrorEnvelopeV1> {
    if let Some(value) = object.get(field) {
        validate_number(value, &child_path(parent_path, field))?;
    }
    Ok(())
}

fn validate_number(value: &Value, path: &str) -> Result<(), SolveErrorEnvelopeV1> {
    if value.is_number() {
        Ok(())
    } else {
        Err(protocol_error(
            SolveErrorCodeV1::InvalidValue,
            "expected a number",
            path,
        ))
    }
}

fn validate_optional_booleans(
    object: &Map<String, Value>,
    parent_path: &str,
    fields: &[&str],
) -> Result<(), SolveErrorEnvelopeV1> {
    for field in fields {
        if let Some(value) = object.get(*field) {
            if !value.is_boolean() {
                return Err(protocol_error(
                    SolveErrorCodeV1::InvalidValue,
                    "expected a boolean",
                    child_path(parent_path, field),
                ));
            }
        }
    }
    Ok(())
}

fn child_path(parent: &str, field: &str) -> String {
    format!("{parent}.{field}")
}

/// MBA-1413: physical bounds on the projectile fields.
#[cfg(test)]
mod request_range_tests {
    use super::*;

    /// A complete, ordinary request. Every range test below starts from this and perturbs one
    /// field, so a bound that accidentally rejects real data fails loudly here first.
    fn valid_request_json() -> String {
        r#"{"schema_version":1,
            "projectile":{"mass_kg":0.01134,"diameter_m":0.00782,"length_m":0.031,
                          "drag_model":"G7","ballistic_coefficient":0.243},
            "rifle":{"muzzle_velocity_mps":823.0},
            "shot":{"max_range_m":1000.0},
            "atmosphere":{},"wind":{},"solver":{},"effects":{},"sampling":{}}"#
            .to_string()
    }

    fn decode_err(json: &str) -> SolveErrorEnvelopeV1 {
        decode_solve_request_v1(json).expect_err("request should have been rejected")
    }

    #[test]
    fn an_ordinary_request_still_decodes() {
        decode_solve_request_v1(&valid_request_json()).expect("a real load must not be rejected");
    }

    /// The exact input cargo-fuzz found (MBA-1413). It declared a projectile mass of about
    /// 1.1e-66 kg — roughly 10^40 times lighter than a proton — and the engine accepted and
    /// solved it. The visible symptom was that the request did not survive a JSON round trip,
    /// because serde_json's float parser is a bit off re-reading its own output at that
    /// magnitude; the actual defect was accepting the number at all.
    #[test]
    fn the_fuzz_reproducer_is_now_a_clean_typed_rejection() {
        let reproducer = r#"{"schema_version":1,
            "projectile":{"mass_kg":0.011366666667e-64,"diameter_m":0.00782,
                          "drag_model":"G7","ballistic_coefficient":1.2e2},
            "rifle":{"muzzle_velocity_mps":823.0},
            "shot":{"max_range_m":100.0},
            "atmosphere":{},"wind":{},"solver":{},"effects":{},"sampling":{}}"#;

        let envelope = decode_err(reproducer);
        assert_eq!(envelope.error.code, SolveErrorCodeV1::InvalidValue);
        assert_eq!(envelope.error.path(), Some("$.projectile.mass_kg"));
    }

    /// An error envelope must itself round-trip, since that is the invariant the fuzz target
    /// asserts on the rejection branch.
    #[test]
    fn the_rejection_envelope_round_trips() {
        let envelope = decode_err(
            r#"{"schema_version":1,
                "projectile":{"mass_kg":1.0e-66,"diameter_m":0.00782,
                              "drag_model":"G7","ballistic_coefficient":0.243},
                "rifle":{"muzzle_velocity_mps":823.0},
                "shot":{"max_range_m":100.0},
                "atmosphere":{},"wind":{},"solver":{},"effects":{},"sampling":{}}"#,
        );
        let encoded = serde_json::to_string(&envelope).expect("serialize");
        let decoded: SolveErrorEnvelopeV1 = serde_json::from_str(&encoded).expect("deserialize");
        assert_eq!(decoded, envelope);
    }

    #[test]
    fn each_bounded_field_reports_its_own_path() {
        for (field, bad_value, path) in [
            ("mass_kg", "1.0e-66", "$.projectile.mass_kg"),
            ("diameter_m", "1.0e-9", "$.projectile.diameter_m"),
            (
                "ballistic_coefficient",
                "1.0e6",
                "$.projectile.ballistic_coefficient",
            ),
            ("length_m", "1.0e-9", "$.projectile.length_m"),
        ] {
            let json = valid_request_json().replace(
                &format!("\"{field}\":{}", default_for(field)),
                &format!("\"{field}\":{bad_value}"),
            );
            let envelope = decode_err(&json);
            assert_eq!(envelope.error.path(), Some(path), "wrong path for {field}");
            assert_eq!(envelope.error.code, SolveErrorCodeV1::InvalidValue);
        }
    }

    fn default_for(field: &str) -> &'static str {
        match field {
            "mass_kg" => "0.01134",
            "diameter_m" => "0.00782",
            "ballistic_coefficient" => "0.243",
            "length_m" => "0.031",
            other => panic!("no default recorded for {other}"),
        }
    }

    /// Muzzle velocity is deliberately unbounded: the MCP server documents and tests a split
    /// where a structurally valid request the engine cannot solve returns a tool error rather
    /// than a protocol error, using an absurd muzzle velocity as its example.
    #[test]
    fn muzzle_velocity_is_deliberately_left_unbounded() {
        let json = valid_request_json().replace("823.0", "1.0e308");
        decode_solve_request_v1(&json)
            .expect("muzzle velocity must stay a solve-time concern, not a protocol one");
    }
}