`seed-loader` interpolates driver text into `errors[].message`, which rides on `seedApplied` of a 200 publish response

[os-zhuang]

Filed by the dev on #8333 while landing the P6–P13 producer sweep (PR #8436). Unassigned; nobody is on it. Outside that card's scope: #8333 enumerates eight producers in protocol.ts, and this is a different file reached through one of them.

The measurement

#8333's P9 is applySeedBodies' error field, now withheld. But the same response object carries a second channel, errors[], which the seed loader fills itself — and that one still interpolates the caught driver text.

Reproduced end to end (a sys_metadata outage under a real applySeedBodies call), the returned seedApplied:

{
 "success": false,
 "inserted": 0,
 "updated": 0,
 "errors": [
 {
 "sourceObject": "acct",
 "field": "(write)",
 "targetObject": "acct",
 "targetField": "name",
 "attemptedValue": null,
 "recordIndex": 0,
 "message": "Failed to write acct record #0 (name=): SQLITE_ERROR: no such table: sys_metadata"
 }
 ]
}

Producers, read from source in packages/metadata-protocol/src/seed-loader.ts:

• line ~1670 — message: `Failed to write ${objectName} record #${recordIndex} (${label}=${keyValue}): ${message}`
• line ~1177 — the deferred-reference counterpart, `Failed to write deferred reference: … ${err?.message ?? String(err)}`

seedApplied rides on a 200 publish response (publishMetaItem, publishPackageDrafts, and the runtime package door), so no HTTP boundary's 5xx message withhold reaches it — the same argument #8086 made for fixing option C at the producer.

The tension a taker must resolve, and why this is not a mechanical repeat of #8333

errors[] is not the error string. Its entries are structured, per-record authoring feedback — which object, which record index, which field, what value was attempted — and that is exactly what an author fixing a broken seed needs (build-probes.ts tells the user to "check the publish response's seedApplied for the load error"). So the #8333 rule cannot simply be applied: the driver's sentence is the only part that must go, and the located structure must stay.

The likely shape is to keep every structured key and replace only the interpolated tail, with the driver text going to the log — but that is a judgement about an authoring surface and should be measured per producer the way #8333's step 1 was, not assumed.

Related

#8333 (the eight protocol.ts producers, PR #8436) · #8136 · #8086

---

Generated by Claude Code

[os-zhuang]

Claiming this card.

• session: session_012WMpuAfA2KSdDjGF6tm1bH
• branch: claude/issue-8442-seed-loader-errors-message

Plan: reproduce the premise on current main (after #8333 / #8441 landed), enumerate the populations reaching each seed-loader.ts catch, decide which of the two family rules (status-declared quote-back vs. catalog membership) this free-text sink asks for, then filter — keeping every structured per-record authoring key.

---

Generated by Claude Code

[os-zhuang]

{
 "issue": 8442,
 "status": "done",
 "branch": "claude/issue-8442-seed-loader-errors-message",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/8533",
 "premise_still_valid": true,
 "summary": "Premise reproduced verbatim on main: a sys_metadata outage under a seed write answered `Failed to write acct record #0 (name=acme): SQLITE_ERROR: no such table: sys_metadata` on errors[].message, riding a 200 publish response. The rule is #8333's QUESTION (free text, no catalog bounds it, so #8441's membership rule does not transfer) but NOT #8333's ANSWER: this sink receives a population protocol.ts's collectors never see, the data engine's validation layer, whose ValidationError carries code VALIDATION_FAILED and deliberately NO status. Measured own-property set from the real class: [stack, message, code, name, fields]. So a sentence is quoted when the error declared a refusal by EITHER shape — a 4xx status, or the VALIDATION_FAILED shape that @objectstack/types' validationFailureDetails already recognises (imported, not re-spelled). That distinction is the card, not a nuance: on this producer `field` is the literal '(write)' and targetField/attemptedValue name the record's EXTERNAL key, so 'which key was rejected and why' exists ONLY in the validation sentence — the 4xx test alone would have blanked exactly the authoring surface the card's warning protects. Both payload producers fixed (pass-1 write, pass-2 deferred back-fill); structured keys and authored prefix untouched; withheld text still reaches logger.error marked as withheld. protocol.ts was NOT edited, so the 3-editor cap needed no sequencing.",
 "tests": "metadata-protocol 84 files / 1245 tests green; objectql 199 / 3544 green; runtime 151 / 2319 green; downstream consumer rest 113 / 1870 green (consumer sweep used the PREFIX form '...@objectstack/metadata-protocol'). New pins: packages/metadata-protocol/src/seed-loader-driver-text.test.ts (10 cases) + packages/objectql/src/seed-loader-authoring-feedback.test.ts (positive control, real ObjectQL engine). POSITIVE CONTROL, real not synthesized — a genuinely malformed seed record (plan 'enterprise' into maxLength 4) through the REAL validator: recordIndex 1, attemptedValue 'bad_row', message 'Failed to write sd_acct record #1 (name=bad_row): Plan must be <= 4 characters (got 10)', clean row still inserted (totalInserted 1). REVERSE VERIFICATION, both directions predicted BEFORE running: (a) seed-loader.ts reverted to pre-fix, predicted 6 red / 4 green, MEASURED 6 red / 4 green with the red set exactly as predicted — section 5 (operator half) predicted RED deliberately because it asserts the payload too, the miss #8333 and #8441 each recorded; (b) over-broad 'blank the tail always' variant, predicted 3 red / 7 green, MEASURED 3 red / 7 green, exactly section 2's three authoring-feedback cases, and the positive control predicted RED and measured RED. No prediction missed in either direction. ANTI-VACUITY: the ValidationError double's shape was MEASURED from the real class (printed from inside objectql, which metadata-protocol cannot import — it depends on that package and would close a cycle) rather than guessed; test section 6 asserts the exact own-key set, status/statusCode undefined, and that the production recogniser validationFailureDetails accepts the validation double and REJECTS the driver fault; and the positive control runs the real validator through the BUILT package so it does not depend on the double at all. Also verified validateRecord is NOT gated on isSystem, so the validation population is genuinely reachable on seed writes (only state-machine rules are seed-exempt). Gates re-derived with dispatch-gates.mjs against actual changed paths, union green: check:nul-bytes, check:error-code-casing, check:durability-log-level, check:engine-double-contract, check:cross-package-test-inputs, check:filter-alias-parity, check:changeset-gate-self-tests, check:objectui-changeset, check:query-options-erasure, check:type-check-coverage, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, check-engine-split-ratio, check-cross-package-test-inputs. check:objectui-pin-fresh red — pre-existing, .objectui-sha untouched, fires identically on main. Control-byte self-scan over all changed files: clean. Head SHA 0c985edd99c41fa43efd9b984170aa5a5b3ce7e8.",
 "open_questions": [],
 "out_of_scope_findings": []
}

Two PM mechanism assumptions to correct:

1. seed-loader.ts, not protocol.ts — confirmed. Both payload producers are in seed-loader.ts. No protocol.ts edit, no editor-cap sequencing needed.
2. "Both siblings are on main" was FALSE at dispatch. A raw driver code (SQLITE_ERROR) still reaches client-facing payloads through the batch verbs' code limb — the sibling field #8333 did not cover #8441's PR fix(metadata-protocol): filter the batch verbs' failed[].code through the error catalog (#8441) #8505 was still open when this card started — main carried only [finding] metadata-protocol's batch verbs still put caught error text on client-facing payloads — the 8 producers option C did not reach #8333 (f58b1a88). The premise was therefore measured against that tree. fix(metadata-protocol): filter the batch verbs' failed[].code through the error catalog (#8441) #8505 merged mid-run as c2c67bf551; origin/main is merged into this branch and the full suites were re-run afterwards. The card was not spent either way: fix(metadata-protocol): filter the batch verbs' failed[].code through the error catalog (#8441) #8505 touches only protocol.ts's code limb and never reaches this file.

Two toolchain notes worth carrying to the next card in this lane: packages/objectql's test reads metadata-protocol's dist, so the positive control only means anything after pnpm --filter @objectstack/metadata-protocol build; and an unbuilt closure makes @objectstack/runtime report 124 failed files with 432 tests passing — the resolution-failure signature, not a regression.

---

Generated by Claude Code