fix(agent-bff): read the json array composite id forest_liana serializes

[Tonours]

The BFF now reads the JSON array id forest_liana sends for a real composite key, so listing that collection no longer fails with a 500. fixes PRD-1472

What

• unpackPrimaryKey reads ["acme",1] as the composite id and returns { seq: 1, tenant_id: "acme" }. Pipe ids (a|b) take the same code path as before.
• Three OpenAPI descriptions no longer say a composite id is "joined by |". They now say it is packed in the agent's own format.

Why

• forest_liana serializes a composite id as a JSON array, and split('|') turned every list of such a collection into 500 mapping_error. Measured on the v1-rails bench with composite_primary_keys 14.0.10.
• The ticket's first symptom ({tenant_id} only) comes from a model that declares self.primary_key = "tenant_id". That is a real Rails ≤ 7.0 workaround, and the BFF already reports the key the agent declares.

How

• The JSON branch runs only for 2+ keys when the id is bracketed, valid JSON, and its array length matches the key count. Anything else takes the pipe path.
• Each value is matched to its key through the record's attributes. Values are never paired by position: the array follows the model's column order, while the apimap is alphabetical.
• Some ids read both ways: valid JSON, and also splitting into as many | segments as there are keys. For those, a reading is used only if the record backs every key, pipe first. Otherwise the result is mapping_error, never a wrong key under 200.
• Elements must be strings or safe integers. Not narrowed to Ruby lianas: meta.liana never reaches the read-model.

Verification

• agent-bff suite 2195/2195, plus tsc and eslint clean. New tests cover each stack's id shape, the JSON guards and both collision cases.
• Trust passes and e2e A/B (CLI BFF, main then ed0d132e0; the served OpenAPI text proves which build is running):

Check	Result	What was measured
Independent review (same-family)	✅	GO WITH NOTES. All notes fixed in c705b1f90, including the Macroscope collision. ed0d132e0 is a qlty-only refactor with no behavior change
Independent QA pass at ed0d132e0	✅	PASS. Build proven by recompiling the head and diffing it against the served dist; only EdgeTrueCompositePk takes the JSON branch in a ~500-record scan; conformance vs main differs only on pk-composite
v1-rails composite (EdgeTrueCompositePk)	✅	pk-composite 500 → 200; 6 rows, 6 distinct {seq, tenant_id}; filter, sort, search and projection checks pass
v1-express	✅	conformance and matrix identical across builds
v1-mongoose	✅	identical; no composite fixture exists (_id only)
v2-ruby (OAuth)	✅	identical; API key path not run, the dev project lost its role
v2-node	⛔	not run (reference agent, left untouched)
JSON parentId and guard-boundary ids	⛔	not measurable on the bench: the fixture has no relation, and synthetic ids are covered by unit tests

Limits

• These remain unsupported on the agent side:
  • a v1 model that declares a non-unique single key;
  • plain Rails ≤ 7.0 with no key. The agent sends no id, so the list returns 500 Agent record is missing its id.
• On a liana composite key, a float, boolean or date value that the record cannot match returns mapping_error. This is intended.

Definition of Done

General

• Write an explicit title for the Pull Request, following Conventional Commits specification
• Test manually the implemented changes
• Validate the code quality (indentation, syntax, style, simplicity, readability)

Security

• Consider the security impact of the changes made

[linear-code]

PRD-1472

[qltysh]

All good ✅

[qltysh]

Coverage Impact

This PR will not change total coverage.

Modified Files with Diff Coverage (2)

Rating	File	% Diff	Uncovered Line #s
	packages/agent-bff/src/openapi/unfolded-paths.ts	100.0%
	packages/agent-bff/src/data/pack-id.ts	100.0%
	Total	100.0%

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[nbouliol]

Approved after /validator run 1968-20261006072100-nbouliol: nothing at or above should-fix posted, 1 suppressed.