Description

FanInStep.validate() only validates wait_for — it never checks output. But execute() does:

output_config = config.get("output") or {}
if not isinstance(output_config, dict):
    output_config = {}   # silent

So a non-mapping output (a YAML list or scalar) validates clean, then the author's declared aggregation keys are silently discarded at run time — the step returns COMPLETED with an empty aggregation and no diagnostic. Reproduced on main @ bba473c: validate({'id':'j','wait_for':['a'],'output':['{{ x }}']}) returns [].

Fix

Reject a non-mapping output at validation, mirroring the command-step (#3262) non-mapping input/options fix. execute()'s defensive coercion is intentionally left in place for callers that skip validation.

Testing

• test_validate_rejects_non_mapping_output parametrized over a list, a string, and an int → all report 'output' must be a mapping. Fails before (validate returns [] — verified by source-stash), passes after.
• test_validate_accepts_mapping_or_absent_output: a mapping and an omitted output return [].
• Full TestFanInStep: 9 passed. uvx ruff check clean.

AI Disclosure

• I did use AI assistance (describe below)

Found and fixed with Claude Code (Claude Fable 5) under my direction. AI flagged fan-in as the remaining step with a validate-vs-execute shape gap; I reproduced the silent key-drop, verified fail-before/pass-after, and reviewed the diff.