[bbedward]

overwrite_hosts: [], overwrite_ports: [] and is_public: false returned 200 and changed nothing.

Root cause:

• huma decodes [] into a non-nil empty slice (encoding/json, huma formats.go), but every check downstream uses len(...) > 0: MergeHosts/MergePorts and the repository update in repositories/service/mutations.go. An empty overwrite looked the same as no overwrite.
• The "Determine is public" switch in update.go sets is_public back to true whenever the service still has hosts and ports. With the hosts never cleared, false was always overwritten.

Fix: expandClears runs in prepareServiceUpdate for non-database services. It turns an empty overwrite into removals of the service's current hosts or ports, and is_public: false into removing every domain. Sending domains together with is_public: false is refused. After that, the existing remove_hosts path runs, the one that worked by hand on banano: removesLastHost makes the service private, and staged batches see the domains as released.

Backwards compatibility:

• The repository merge is unchanged, so create, templates and the volume attach that build MutateConfigInput themselves behave as before.
• The web never sends an empty overwrite list (undefined or a filled list, update-service-input.ts and the undeployed forms).
• The undeployed forms do send is_public: false when public is unticked. That used to keep the generated domain and stay public. Now it removes the domain, which is what the form asks for.
• Databases are untouched: their public toggle already manages hosts and ports.
• No CRD or operator change.

Field docs on overwrite_hosts, overwrite_ports and is_public say what empty and false do. Generated docs data and web client types are regenerated (comments only).

Tests: TestExpandClears decodes request bodies with huma's JSON format, then checks the merged result and the private switch. Not run against a live cluster.

fixes UNB-402