docs(read): retract "not reproducible" — #513's coercion is live, and FlexString does not make the value correct

[ZacxDev]

Item 37's evidence carried two false claims and was missing one consequence. All three are now measured.

1. RETRACTED: "not reproducible"

pkg/civitai/flexstring.go:24-28 and claudedocs/decisions/37-numeric-username.md both stated the reported shape was not reproducible, and that /api/v1/images "could not be exercised at all".

It reproduces on every request reaching the Meilisearch feed branch of runImageSearch. Measured 2026-09-11 across 55 digit-username accounts with public images: 51/51 cache-busted responses unquoted, 0 quoted.

?username=2428023993&limit=3   cf-cache-status: MISS   ->  "username":2428023993   UNQUOTED
?imageId=1446527                                       ->  "username":"2428023993" QUOTED

Same user, same route, different internal path (image-search.service.ts:127).

2. Why the earlier negative was wrong — the part worth keeping

Two independent causes, either sufficient alone:

1. No all-digit account it sampled had public images, so the path was never exercised.
2. 🔴 The quoted readings were Cloudflare cache HITs, not origin responses. s-maxage=300. On a fresh cache key, 38 of 38 "quoted" readings flipped to unquoted.

That probe read raw bytes, avoided jq, and ran a positive control — everything our rules ask — and none of those checks can see a CDN. The doc now says to require cf-cache-status: MISS before believing any negative about this API.

The retracted paragraph is preserved verbatim in a <details> block rather than deleted, because it guessed the mechanism correctly ("embeds the user through a different serialiser") and was defeated only by being unable to measure it. The inference was sound; the measurement was missing. That is worth a reader seeing.

Note the original justification is untouched and still stands on its own — a client must not hard-fail a 200 whose body it can read. The fix was right while the evidence for it was wrong, which is why nothing about FlexString itself changes here.

3. The mechanism narrows a residual without closing it

The "MECHANISM is unidentified, so the FIELD SET is a guess" residual is updated. The mechanism is Meili's dynamic JSON typing on the stored image document.

• Narrows: the old worst case was "any all-digit string column on the way out". TagItem.Name — the old text's worked example — is not on that document and is no longer implicated.
• Does not close: any other all-digit-capable field on the same document has identical exposure by construction. civitai/civitai#4768 asks the platform side to enumerate it.
• Trigger to widen is unchanged: an observation, not the plausibility of the mechanism.

4. 🔴 The new residual, and the reason this is more than bookkeeping

The coercion is numeric, so leading zeros are destroyed upstream:

?imageId=622901         ->  "username":"0222"     the real name
?username=0222&limit=4  ->  "username":222        what we receive
?username=222&limit=4   ->  0 items               matches no account

FlexString decodes this cleanly and cannot fix it. It made the failure quieter, not absent — an opaque exit 1 became a confident, wrong username. Item 37 must not be read as "#513 is solved"; the decode half is solved, the value half is a server bug.

Generalised in the doc: a fix on the consumer side of a lossy producer should state which half it does not cover.

Tracking

• Server side: /api/v1/images serialises an all-digit username as a JSON number, destroying leading zeros — Meilisearch feed path only civitai#4768, filed with root cause and a closing condition. The fix belongs at the index-document boundary plus a re-index — a cast at the emit site fixes the type but cannot recover the lost zeros.
• numeric usernames coerced to numbers failing the CLI #513 stays open deliberately. @Rochet2 was told all of this directly rather than left to infer it from a merged PR.

Verification

• make ci → green, 22 packages tested (positive control: package count > 0).
• golangci-lint run ./... → 0 issues (run under nix-shell; make lint errors on this host as golangci-lint is not on PATH, and per AGENTS.md lint reports without gating, so it is worth running locally).
• Docs-only plus one comment block; no behaviour change, no test change.

The blocks/images endpoint is described in #4768 as suspected, not verified — it returns 401 Block token required, so I could not exercise it and said so there rather than asserting it.