fix: address CodeRabbit review findings

- fix(jsonpath): move depth-limit check before child-segment application
  in removeFromParentAt/modifyInParentAt for consistent truncation
  behaviour matching recursiveDescend
- fix(parser): remove unused type-switch variable in promoteSchemaOrBool
- fix(converter): newConverter() now calls New() to match production
  initialization (IncludeInfo defaults to true)
- test(parser): add bool=true cases for additionalProperties, and bool
  preservation tests for additionalItems/unevaluatedItems/unevaluatedProperties
- test(parser): add populated security marshal and empty-security round-trip
  subtests to TestOperationEmptySecurityMarshal
- test(overlay): add root-target overwrites-existing-key subtest

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: erraggy

converter/helpers_test.go

@@ -740,9 +740,10 @@ func TestConvertOAS2ParameterToOAS3_ItemsCollectionFormat(t *testing.T) {
 		"should warn about non-csv collectionFormat on items")
 }
 
-// newConverter creates a minimal Converter for unit testing helpers.
+// newConverter creates a Converter for unit testing helpers using the same
+// initialization path as production code.
 func newConverter() *Converter {
-	return &Converter{}
+	return New()
 }
 
 // countIssuesContaining counts issues whose message contains the given substring.

internal/jsonpath/eval.go

@@ -390,13 +390,13 @@ func removeFromParentAt(parent any, seg Segment, depth int) any {
 
 	case RecursiveSegment:
 		if s.Child != nil {
-			// Remove child at this level, then recurse into all descendants.
-			parent = removeFromParentAt(parent, s.Child, depth)
 			if depth > maxRecursionDepth {
 				jsonpathLogger.Warn("jsonpath recursive remove truncated at depth limit",
 					"depth", depth, "maxDepth", maxRecursionDepth)
 				return parent
 			}
+			// Remove child at this level, then recurse into all descendants.
+			parent = removeFromParentAt(parent, s.Child, depth)
 			switch v := parent.(type) {
 			case map[string]any:
 				for key, val := range v {
@@ -468,13 +468,13 @@ func modifyInParentAt(parent any, seg Segment, fn func(any) any, depth int) {
 
 	case RecursiveSegment:
 		if s.Child != nil {
-			// Apply transform at this level, then recurse into all descendants.
-			modifyInParentAt(parent, s.Child, fn, depth)
 			if depth > maxRecursionDepth {
 				jsonpathLogger.Warn("jsonpath recursive modify truncated at depth limit",
 					"depth", depth, "maxDepth", maxRecursionDepth)
 				return
 			}
+			// Apply transform at this level, then recurse into all descendants.
+			modifyInParentAt(parent, s.Child, fn, depth)
 			switch v := parent.(type) {
 			case map[string]any:
 				for _, val := range v {

overlay/overlay_test.go

@@ -1147,6 +1147,21 @@ func TestApplyRootTarget(t *testing.T) {
 
 	doc := result.Document.(map[string]any)
 	assert.Equal(t, "added", doc["x-custom"], "root update should merge x-custom into document")
+
+	t.Run("root update overwrites existing key", func(t *testing.T) {
+		spec2 := mustParseSpec(t, `{"openapi":"3.0.0","info":{"title":"t","version":"1"},"paths":{}}`)
+		o2 := &Overlay{
+			Version: "1.0.0",
+			Info:    Info{Title: "test", Version: "1.0.0"},
+			Actions: []Action{
+				{Target: "$", Update: map[string]any{"openapi": "3.1.0"}},
+			},
+		}
+		result2, err2 := a.ApplyParsed(spec2, o2)
+		require.NoError(t, err2)
+		doc2 := result2.Document.(map[string]any)
+		assert.Equal(t, "3.1.0", doc2["openapi"], "root update should overwrite existing key")
+	})
 }
 
 // TestApplyRecursiveRemove verifies that $..field remove deletes the field from

parser/paths_json_test.go

@@ -625,4 +625,28 @@ func TestOperationEmptySecurityMarshal(t *testing.T) {
 		require.NoError(t, err)
 		assert.Contains(t, string(data), `"security":[]`, "empty non-nil security should marshal as [] even without x- fields")
 	})
+
+	t.Run("populated security slice marshals correctly", func(t *testing.T) {
+		op := &Operation{
+			Responses: okResponses,
+			Security: []SecurityRequirement{
+				{"api_key": []string{}},
+				{"oauth2": []string{"read", "write"}},
+			},
+		}
+		data, err := json.Marshal(op)
+		require.NoError(t, err)
+		assert.Contains(t, string(data), `"security"`, "populated security should be present")
+		assert.Contains(t, string(data), `"api_key"`, "security requirement should contain api_key")
+		assert.Contains(t, string(data), `"oauth2"`, "security requirement should contain oauth2")
+	})
+
+	t.Run("empty security array round-trips through unmarshal", func(t *testing.T) {
+		input := `{"responses":{"200":{"description":"ok"}},"security":[]}`
+		var op Operation
+		err := json.Unmarshal([]byte(input), &op)
+		require.NoError(t, err)
+		require.NotNil(t, op.Security, "empty security array should unmarshal to non-nil slice")
+		assert.Empty(t, op.Security, "security slice should be empty after round-trip")
+	})
 }

parser/schema_json.go

@@ -122,11 +122,11 @@ func (s *Schema) UnmarshalJSON(data []byte) error {
 // map cannot be round-tripped through JSON into a *Schema, so callers get a
 // clear parse error rather than a silent type-assertion panic downstream.
 func promoteSchemaOrBool(v any) (any, error) {
-	switch val := v.(type) {
+	switch v.(type) {
 	case nil, bool, *Schema:
 		return v, nil
 	case map[string]any:
-		data, err := json.Marshal(val)
+		data, err := json.Marshal(v)
 		if err != nil {
 			return nil, fmt.Errorf("parser: schema field promotion: %w", err)
 		}

parser/schema_json_test.go

@@ -303,7 +303,7 @@ func TestSchemaJSONRoundTrip(t *testing.T) {
 		assert.True(t, ok, "additionalProperties should be *Schema after JSON unmarshal")
 	})
 
-	t.Run("additionalProperties bool preserved", func(t *testing.T) {
+	t.Run("additionalProperties bool false preserved", func(t *testing.T) {
 		data := []byte(`{"type":"object","additionalProperties":false}`)
 		var s Schema
 		require.NoError(t, json.Unmarshal(data, &s))
@@ -312,6 +312,15 @@ func TestSchemaJSONRoundTrip(t *testing.T) {
 		assert.False(t, b)
 	})
 
+	t.Run("additionalProperties bool true preserved", func(t *testing.T) {
+		data := []byte(`{"type":"object","additionalProperties":true}`)
+		var s Schema
+		require.NoError(t, json.Unmarshal(data, &s))
+		b, ok := s.AdditionalProperties.(bool)
+		assert.True(t, ok, "additionalProperties true should remain bool")
+		assert.True(t, b)
+	})
+
 	t.Run("additionalItems decoded as *Schema", func(t *testing.T) {
 		data := []byte(`{"type":"array","additionalItems":{"type":"string"}}`)
 		var s Schema
@@ -320,6 +329,15 @@ func TestSchemaJSONRoundTrip(t *testing.T) {
 		assert.True(t, ok, "additionalItems should be *Schema after JSON unmarshal")
 	})
 
+	t.Run("additionalItems bool preserved", func(t *testing.T) {
+		data := []byte(`{"type":"array","additionalItems":false}`)
+		var s Schema
+		require.NoError(t, json.Unmarshal(data, &s))
+		b, ok := s.AdditionalItems.(bool)
+		assert.True(t, ok, "additionalItems false should remain bool")
+		assert.False(t, b)
+	})
+
 	t.Run("unevaluatedItems decoded as *Schema", func(t *testing.T) {
 		data := []byte(`{"type":"array","unevaluatedItems":{"type":"integer"}}`)
 		var s Schema
@@ -328,6 +346,15 @@ func TestSchemaJSONRoundTrip(t *testing.T) {
 		assert.True(t, ok, "unevaluatedItems should be *Schema after JSON unmarshal")
 	})
 
+	t.Run("unevaluatedItems bool preserved", func(t *testing.T) {
+		data := []byte(`{"type":"array","unevaluatedItems":false}`)
+		var s Schema
+		require.NoError(t, json.Unmarshal(data, &s))
+		b, ok := s.UnevaluatedItems.(bool)
+		assert.True(t, ok, "unevaluatedItems false should remain bool")
+		assert.False(t, b)
+	})
+
 	t.Run("unevaluatedProperties decoded as *Schema", func(t *testing.T) {
 		data := []byte(`{"type":"object","unevaluatedProperties":{"type":"boolean"}}`)
 		var s Schema
@@ -336,6 +363,15 @@ func TestSchemaJSONRoundTrip(t *testing.T) {
 		assert.True(t, ok, "unevaluatedProperties should be *Schema after JSON unmarshal")
 	})
 
+	t.Run("unevaluatedProperties bool preserved", func(t *testing.T) {
+		data := []byte(`{"type":"object","unevaluatedProperties":false}`)
+		var s Schema
+		require.NoError(t, json.Unmarshal(data, &s))
+		b, ok := s.UnevaluatedProperties.(bool)
+		assert.True(t, ok, "unevaluatedProperties false should remain bool")
+		assert.False(t, b)
+	})
+
 	t.Run("XML round-trip", func(t *testing.T) {
 		original := &XML{
 			Name:      "pet",