Ok after doing some more reading…
https://community.home-assistant.io/t/using-templates-for-input-select-set-options-populating-options-within-an-input-selector/55025/16
The conversation was about templating rest commands, but it still applies, I found out my mistake, but it still seems like more of an error.
I was using
curl -X POST -H "Authorization: Bearer REDACTED" -H "Content-Type: application/json" -d "{\"state\": \"4k.xml\",\"attributes\":{\"files\":[\"2k.xml\",\"4k.xml\" ]} }" http://192.168.10.144:8123/api/states/input_select.pc_modes
which for some reason ended up creating a new input_select with the same name, the lovelace was showing the new version, while the select validation still used the original.
when I try with
curl -X POST -H "Authorization: Bearer REDACTED" -H "Content-Type: application/json" -d "{\"entity_id\": \"input_select.pc_modes\",\"options\":[\"2k.xml\",\"4k.xml\" ]}" http://192.168.10.144:8123/api/services/input_select/set_options
it works as expected.
update: in addition the input_select options, even the state cannot be correctly applied via a POST to the /api/states endpoint, not sure why it’s even there, maybe just to generate new entities. (Got the state update working via /api/services/input_select/select_option)
Hope this can help anyone else .