The stdio MCP bridge mints its own not-found error — no `RECORD_NOT_FOUND` code, no 404 — where every sibling seam throws the shared `recordNotFoundError`

[qq9340100]

Found while building #8194's consumer-seam invariant, which enumerates every seam that performs a by-id write on a caller-supplied id and answers a receipt. Four seams exist; three reach the repo's ONE not-found envelope and one does not.

What the seam scan measured

seam [local] packages/mcp/src/stdio-data-bridge.ts:337 update() — by-id update
seam [local] packages/mcp/src/stdio-data-bridge.ts:347 remove() — by-id delete
seam [shared] packages/metadata-protocol/src/protocol.ts:7698 updateData()
seam [shared] packages/metadata-protocol/src/protocol.ts:7712 deleteData()
seam [shared] packages/runtime/src/action-execution.ts:205 callData() — update
seam [shared] packages/runtime/src/action-execution.ts:241 callData() — delete

All six refuse before answering, so existence coherence itself is intact — this is not a silent-success defect. The divergence is the ENVELOPE. packages/mcp/src/stdio-data-bridge.ts:130:

function recordNotFound(object: string, id: string): Error {
 return new Error(`Record "${id}" not found in "${object}"`);
}

versus packages/core/src/utils/record-not-found.ts, which sets code = 'RECORD_NOT_FOUND' and status = 404 on the error it returns.

Why that is worth a card

record-not-found.ts's own header is the argument, and it was written against exactly this shape twice already: the factory was "extracted so the READ and the two WRITE paths cannot disagree about it" (#4435), then EXPORTED because callData's fallback "had reinvented this fact three incompatible ways" (#5138), then moved down to @objectstack/core so a third producer could reach it (#7867). Its sentence "re-spelling the envelope there would have been a second not-found envelope" applies here unchanged — this is the fourth spelling.

Concretely, the two MCP transports answer a missing id differently. The HTTP bridge routes its data verbs through callData, which throws recordNotFoundError (code + 404); the stdio bridge throws a bare Error, so a stdio caller gets a message with no machine-readable code and nothing that maps to 404. That is the same two-transports-one-operation divergence class as #8083 (stdio skipped the ADR-0049 exposure gate HTTP applied) and #8266 (the stdio record resource reads through its own seam) — both on this same file, neither covering the error envelope.

The local factory's comment explains why it throws rather than returns (registerObjectTools turns a throw into a tool error), which is right and is not the question here. The question is only which error object it throws.

Suggested fix

Import recordNotFoundError from @objectstack/core and delete the local mint. Worth checking whether @objectstack/mcp already depends on @objectstack/core (metadata-protocol re-exports it too, per packages/metadata-protocol/src/index.ts).

Why this is filed rather than fixed in #8194's PR

#8194's declared file surface is scripts/check-engine-double-contract.mjs only; packages/mcp was explicitly out of scope, so the gate reports the two rows as local rather than reddening on a defect its own PR did not introduce. That gate has a SHARED_ONLY-shaped tightening noted in its header: once this card lands, requiring the shared envelope becomes a one-line change and the seam list is already complete in both directions.

Dedup: searched open issues for the file path, for the envelope factory by name, and for the not-found/MCP divergence wording. The nearest hits are #8266 and #8083, both stdio-vs-HTTP seam divergences on this file, neither about the error envelope.

Refs #8194, #8083, #8266, #7867, #5138, #4435, packages/core/src/utils/record-not-found.ts.

---

Generated by Claude Code

[hotlong]

Triage: lands in packages/mcp/src/stdio-data-bridge.ts → domain:cli per the lane table (packages/mcp). Type: Bug — the repo's declared not-found envelope (code = 'RECORD_NOT_FOUND', status = 404, single-sourced in @objectstack/core precisely so producers cannot disagree) is violated by a fourth local spelling; the two MCP transports answer the same missing id with different envelopes.

Graded pm:queue: named landing point, measured seam scan, one-import fix shape, dedup already done by the filer (#8266 / #8083 are sibling stdio-vs-HTTP divergences on this file, neither about the error envelope).

⚠️ Serial constraint for the cli seat: #8266 is in flight (pm:dispatched) on this same file — same-file cards are hard-serial across rounds; hold this until #8266's PR lands, then re-verify the seam line numbers on the merged ref before dispatch. Follow-up note for the dispatch brief: once this lands, #8194's gate has a noted SHARED_ONLY-shaped tightening that becomes a one-line change — worth naming as an explicitly-declared adjacent deliverable or a follow-up card, dev's judgment.

Size/model suggestion: S mechanical (import the shared factory, delete the local mint, plus the dependency check the card already scopes), mode:subagent, sonnet.

---

Generated by Claude Code

[os-zhuang]

Claimed and dispatched by the domain:cli seat (#6024).

• Session: session_01P7vaLs7bhBPi9m3JyzkhDj
• Branch: claude/issue-8422-stdio-shared-not-found-envelope
• Model: sonnet, mode:subagent (S mechanical per triage)

串行约束已解除 —— 并已复验前提

分诊挂的硬串行条件是「等 #8266 落地」。已落地:#8266 closed-completed,PR #8439 MERGED。

按分诊要求在合并后的 ref 上复验了锚点,而不是照卡片的行号直接派:packages/mcp/src/stdio-data-bridge.ts 里那个本地 mint 仍然存在,原样:

function recordNotFound(object: string, id: string): Error {
 return new Error(`Record "${id}" not found in "${object}"`);
}

⚠️ 但 PR #8439 动过这个文件,所以卡片正文里的行号(:130 / :337 / :347)已经不可信。按符号定位,不要按行号定位 —— 这是本次派工唯一的机械风险点。

交付要求

修法卡片已给:从 @objectstack/core 导入 recordNotFoundError,删掉本地 mint。先确认 @objectstack/mcp 是否已经依赖 @objectstack/core(metadata-protocol 也再导出了它)。

本地工厂注释解释的是「为什么 throw 而不是 return」(registerObjectTools 把 throw 转成 tool error)—— 那是对的,不是本卡要动的东西。本卡只改扔的是哪个 error 对象。

验收形状:同一个不存在的 id,两个 MCP transport(HTTP bridge 走 callData,stdio bridge 走本地 seam)必须给出同一个信封 —— code = 'RECORD_NOT_FOUND'、status = 404。测试要同时覆盖 update() 和 remove() 两个 by-id 写入口,不要只测一个。

相邻可交付(dev 判断)

#8194 的 gate 有一处 SHARED_ONLY 形状的收紧,本卡落地后变成一行改动,seam 清单两个方向都已完整。要么作为显式声明的相邻交付一并做(在 PR 的 file surface 里声明),要么开一张后续卡 —— 由 dev 判断,但不要默默不处理:那个 gate 现在把这两行报成 local,本卡落地后它就应该能要求 shared 信封了。

---

Generated by Claude Code

[os-zhuang]

<!-- os-dev-report -->

{
 "issue": 8422,
 "status": "done",
 "branch": "claude/issue-8422-stdio-shared-not-found-envelope",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/8507",
 "premise_still_valid": true,
 "summary": "Deleted the stdio MCP bridge's local recordNotFound(object, id) mint (a bare Error with no code/status) and made update()/remove() throw the shared recordNotFoundError from @objectstack/core instead, matching the HTTP bridge's callData path. Located both call sites by symbol since PR #8439 shifted the card's cited line numbers. Also folded in the #8194 gate's noted SHARED_ONLY tightening in the same PR: check-engine-double-contract.mjs's consumer-seam filter now requires refusal === 'shared' (was: any refusal at all), so a future local mint reddens instead of reading as accepted.",
 "tests": "pnpm --filter @objectstack/mcp test: 16 files / 173 passed (incl. new stdio-data-bridge.not-found.test.ts covering update() and remove() with code/status assertions). pnpm --filter @objectstack/mcp typecheck: clean. pnpm --filter '@objectstack/mcp^...' build then pnpm --filter @objectstack/mcp build: clean. node scripts/check-engine-double-contract.mjs --self-test && ...: self-test OK, real run OK, all 4 consumer seams now [shared] (was 2 shared + 2 local). node scripts/check-error-code-casing.mjs, check-nul-bytes.mjs, check-cross-package-test-inputs.mjs: OK. pnpm run check:query-options-erasure and check:type-check-coverage: OK, ledgers unchanged. pnpm exec eslint on the 3 changed files: clean. Reverse verification (predicted before running): reverted stdio-data-bridge.ts alone via git checkout HEAD~1 (fix pre-committed) against the tightened gate + new tests -> predicted red in both, measured red in both (3/3 new tests failed with 'expected undefined to be RECORD_NOT_FOUND'; gate emitted 2 REFUSES errors at :351/:361 'refuses through a locally minted error rather than the shared envelope'); restored via git checkout <branch> -- <path>, diff empty, both re-verified green.",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

---

Generated by Claude Code

[os-zhuang]

os-dev-report

(Corrected marker form — no comment-edit tool available in this session, so this supersedes the previous report comment's HTML-entity-escaped marker as the canonical report.)

{
 "issue": 8422,
 "status": "done",
 "branch": "claude/issue-8422-stdio-shared-not-found-envelope",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/8507",
 "premise_still_valid": true,
 "summary": "Deleted the stdio MCP bridge's local recordNotFound(object, id) mint (a bare Error with no code/status) and made update()/remove() throw the shared recordNotFoundError from @objectstack/core instead, matching the HTTP bridge's callData path. Located both call sites by symbol since PR #8439 shifted the card's cited line numbers. Also folded in the #8194 gate's noted SHARED_ONLY tightening in the same PR: check-engine-double-contract.mjs's consumer-seam filter now requires refusal === 'shared' (was: any refusal at all), so a future local mint reddens instead of reading as accepted.",
 "tests": "pnpm --filter @objectstack/mcp test: 16 files / 173 passed (incl. new stdio-data-bridge.not-found.test.ts covering update() and remove() with code/status assertions). pnpm --filter @objectstack/mcp typecheck: clean. pnpm --filter '@objectstack/mcp^...' build then pnpm --filter @objectstack/mcp build: clean. node scripts/check-engine-double-contract.mjs --self-test && ...: self-test OK, real run OK, all 4 consumer seams now [shared] (was 2 shared + 2 local). node scripts/check-error-code-casing.mjs, check-nul-bytes.mjs, check-cross-package-test-inputs.mjs: OK. pnpm run check:query-options-erasure and check:type-check-coverage: OK, ledgers unchanged. pnpm exec eslint on the 3 changed files: clean. Reverse verification (predicted before running): reverted stdio-data-bridge.ts alone via git checkout HEAD~1 (fix pre-committed) against the tightened gate + new tests -> predicted red in both, measured red in both (3/3 new tests failed with 'expected undefined to be RECORD_NOT_FOUND'; gate emitted 2 REFUSES errors at :351/:361 'refuses through a locally minted error rather than the shared envelope'); restored via git checkout <branch> -- <path>, diff empty, both re-verified green.",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

---

Generated by Claude Code