Ran reference_check.py here: 149 cases, 0 mismatches.
Then I pushed 12 more spellings through your own oracle(): duplicate keys in both orders, -0, 1E3, 15000.00, 1e400, seed 1e20, and a forced tool_choice overwritten by "auto".
All 12 agree with the pinned validator. [], null, "x" and 1 get the object finding too.
So spelling looks covered. The gap I'd add is one step earlier.
The validators are pulled from pinned source by AST. The body-to-attribute step is not.
oracle() hand-copies mlx-lm's reads (server.py L1161-1192) and Rec's context clamp (L249-254): the max_completion_tokens-over-max_tokens precedence and the 1024 / 1.0 / 0.95 / 20 defaults.
If a later rev changes that block, the check still prints 0 mismatches.
Would you extract that read block the same way, or pin it with a source hash so drift fails loudly?