Context

PR #4657 (adversarial OpenAPI audit) aligned several proto descriptions to actual handler behavior. In doing so it surfaced underlying handler / validation-contract mismatches where the doc is now honestly describing what looks like a bug. Each needs a code decision (fix the handler, or accept + tighten the contract).

Items

• webcam GetWebcamImageResponse.last_updated type mismatch. Field is int64 (proto) but server/worldmonitor/webcam/v1/get-webcam-image.ts:42 emits new Date(...).toISOString() — an ISO-8601 string, not epoch ms. Decide: change the proto field to string/google.protobuf.Timestamp, or change the handler to emit getTime().
• get-aircraft-details-batch silently drops items 11–20. buf.validate repeated.max_items = 20 but the handler toUniqueSortedLimited(normalized, 10) truncates to 10 (get-aircraft-details-batch.ts:27). Raise the handler limit to 20 or lower max_items to 10.
• search-gdelt-documents cap. buf.validate int32.lte = 250 on max_records but the handler hard-caps results at 20 (Math.min(..., 20)). Lower the validate bound to 20, or raise the handler cap.
• list-earthquakes unbounded page_size. Handler req.pageSize || 500 with no clamp (list-earthquakes.ts:23) — default 500 (not the documented 100) and a caller can request the entire seed. Add a clamp (e.g. 1–1000).
• list-tech-events "0 = unlimited" is unreachable. clampInt(req.limit, 50, 1, 200) / clampInt(req.days, 90, 1, 365) force a min of 1, so 0 never means unlimited. Either implement unlimited or the contract change (now documented as clamped) stands. Also buf.validate allows limit up to 500 while the handler clamps to 200.
• docs(api): propagate proto required → OpenAPI parameter required:true (#4599) #4604 required-accuracy coverage gaps. BLS get-bls-series.series_id and intelligence list-company-signals.company are effectively required (return empty / throw when absent) but required:false in the docs (proto has no buf.validate.required). Mark required in the proto, or document the empty-on-absent behavior. (Note: the intelligence company endpoints are also disabled stubs.)

Surfaced by the adversarial audit in PR #4657; docs already describe current behavior accurately.