docs(claude): fs-http middleware sync contract + consumer-guard doctrine (WR-0122)

[Goosterhof]

What

Adds a first-class doctrine block ## Middleware Sync Contract (fs-http) to the fs-packages CLAUDE.md, documenting the fs-http middleware sync contract and the consumer-side guard obligation. Docs-only — no source, test, or version change.

Why

fs-http runs request/response/response-error middleware as synchronous loops inside the axios interceptors with no try/catch around the loop and no await of middleware returns (packages/http/src/http.ts:79/86/93). A throwing middleware body rejects a resolved 200 on the success path and masks the real API error on the error path (the :93 throw propagates before Promise.reject at :95).

This is by design — the library stays sync-only + loud (a library-side try/catch was rejected 2026-05-13 as silent-failure, and the rejection held at n=2 on 2026-06-15). The recurring exposure is a consumer-contract gap: every fs-http consumer must guard its own middleware bodies.

Precedent

kendo WR-0078 (PR script-development/kendo#1538) independently re-derived the mechanism against fs-http source and guarded both kendo central + tenant middleware. This block documents the contract at the source so entreezuil / ublgenie / emmie / BIO close the same latent gap.

Closes the territory-file half of war-room deferred.md [adr] fs-packages-fs-http-async-aware-middleware-rejection-doctrine (promoted, n=2).

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying fs-packages with    Cloudflare Pages

Latest commit:	f2dee62
Status:	✅  Deploy successful!
Preview URL:	https://2f9f336e.fs-packages.pages.dev
Branch Preview URL:	https://armorer-wr0122-middleware-sy.fs-packages.pages.dev

View logs

[jasperboerhof]

Town Crier Review · 9/10 · PASS · 🔎 Independent

fs-packages #143 · AC anchor: PR description (WR-0122) · head f2dee62549 · via the town-crier bus (request #203)

Tip

Docs-only addition to CLAUDE.md documenting the fs-http middleware sync contract; I enumerated all four line anchors against packages/http/src/http.ts and each matches exactly (:79 request loop, :86 response-success, :93 response-error, :95 Promise.reject), and the throw-propagation semantics (error-path throw at :93 masks the reject at :95) are correct. Verified the kendo precedent claim against the live clone — central + tenant toastMiddleware.ts are try/catch + fail-safe-swallow guarded via the merged PR #​1538/WR-0078 — so the doc is a true audit trail with no code/API change and nothing that can break a consumer (CI check pending, not red).

No findings — clean against the review checklist.

[jasperboerhof]

Auto-approved — Town Crier verdict PASS @Head, CI green, no open MAJOR+ thread. Our approval is our independent vote (approve-alongside): a peer's review / CHANGES_REQUESTED never withholds it — we verify every blocker ourselves, and a real one drops our own verdict below PASS. See the verdict comment + inline notes.