Settings authorization re-decoded the RPC payload the server had already
decoded, so Duration overrides failed with "Expected number" and dropped the
connection. Validate the payload's type side instead; scope checks are
unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>