Let a declaration reach into the body and count up what goes out

[haruotsu]

Two additions to openapi:, designed together because they are one
mechanism seen from both sides: what the declaration pins, and what the
model may write.

A dotted params name reaches into the JSON body

Services commonly nest what matters. A helpdesk ticket update carries its
comment inside the record:

{"ticket": {"comment": {"body": "...", "public": true}}}

Whether that comment goes out to the requester — mail, irreversible — is a
boolean two levels down. params could only name arguments and top-level
body properties, so the one value that separates an internal note from an
outgoing reply was the model's to write, guarded by nothing but describe
and the instruction. The code such a declaration replaces kept the two
apart as differently named functions; the declaration has to be able to pin
the same value structurally.

params:
  UpdateTicket:
    ticket.comment.public: {value: false}

• A dotted name is read as a path into the body only when no parameter
  carries the name literally — query parameters with dots in their names
  exist in the wild and keep meaning what they always meant. A name both
  readings can claim is refused, like the existing parameter-vs-body
  ambiguity.
• A fixed leaf disappears from the declaration shown to the model, and the
  declared value is written wherever its parent object is sent — overwriting
  anything found there (smuggled values included), never conjuring the
  parent up: no comment written means no comment sent.
• A parent that arrives as a non-object refuses the request instead of
  sending it around the fix.
• validate walks the path through $ref and one level of allOf per
  step, reports certain misses with the properties that do exist at the
  level that missed, and stays quiet where the schema cannot be enumerated —
  the same certainty rule flat names follow. prefix/suffix still demand
  a string leaf.

only counts up what the model may write

Published update operations accept the whole record — status, assignee,
tags, custom fields — when an agent is only meant to add a comment. With
fixes alone one would enumerate every unwanted field, and that list goes
stale silently as the description grows. only turns the enumeration
around:

only:
  UpdateTicket: [ticket_id, ticket.comment.body]

• Everything unlisted is taken out of the declaration and never sent, even
  when smuggled into the arguments. A params value still rides — that is
  how a hidden field is pinned.
• A dotted entry exposes just that path: the declared schema is narrowed to
  the named subtree, and the outgoing body is filtered to it.
• validate holds the two against each other: an entry cannot name what a
  fix already pins, a prefix cannot wrap what only withholds, a nested
  fix cannot sit under a parent only never sends, and a required argument
  must be either listed or fixed.

The README example shows the pair composed: the model writes nothing but
the ticket id and the comment text, and the declaration keeps the comment
internal.