`packages/runtime`'s package-publish door has its own copy of the P9 seed-apply disclosure, outside `metadata-protocol`

[os-zhuang]

Filed by the dev on #8333 while landing the P6–P13 producer sweep (PR #8436). Unassigned; nobody is on it. Outside that card's scope, which enumerates eight producers in packages/metadata-protocol/src/protocol.ts.

The site

packages/runtime/src/domains/packages.ts, ~line 381 — the runtime package door's fallback when the protocol did not already produce a seedApplied:

} catch (e: any) {
 (result as any).seedApplied = { success: false, error: e?.message ?? 'seed apply failed' };
}

Structurally identical to #8333's P9 (applySeedBodies' error), which PR #8436 has now converted inside metadata-protocol. Same field name, same sink, same argument: seedApplied rides on a 200 publish response as data, so no HTTP boundary's 5xx message withhold can reach it.

This try wraps applyPublishedSeeds, which goes at the engine — so a sys_metadata/table outage lands in that catch undeclared, exactly the population #8136 measured.

Status of the evidence

Read from source, NOT reproduced end to end. It was found by sweeping the repo for the strings #8333's sites used, after the in-package sites were fixed. Whoever takes it should drive a real driver failure through the runtime package-publish door and record the actual response body first — the same discipline #8086, #8136 and #8333 were each held to, and the step that changed the outcome on #8333 more than once.

The fix, if the premise holds

The same rule, already implemented next door: quote the caught sentence only when the error declared a 4xx status (ADR-0112), otherwise a stable sentence with the original sent to the log. ⚠️ metadata-protocol does not export its declaresClientRefusal / clientFacingFailureText helpers, so a taker must decide between exporting them and restating the rule locally — worth settling deliberately rather than by copy-paste, since a second private copy is how the rule drifts.

Related

#8333 (the metadata-protocol producers, PR #8436) · #8136 · #8086

---

Generated by Claude Code

[hotlong]

Concentrated findings round (maintainer-directed, 2026-08-13): promoted finding → pm:queue, and re-routed domain:metadata → domain:cli per the anchoring rule — the fix lands in packages/runtime/src/domains/packages.ts (runtime is the cli lane's family), not in metadata-protocol, even though the pattern was found by #8333's sweep there. Type: Bug (the ADR-0112 rule is the declared contract: caught driver text must not ride a client-facing payload without a declared 4xx status; this site violates it), security kept.

Dispatch conditions, binding on the brief:

1. Reproduce first — the card is honest that this is read-from-source: drive a real driver failure through the runtime package-publish door and record the actual response body before changing anything. premise_still_valid: false + no PR is a legitimate deliverable if the fallback turns out unreachable.
2. The helpers question must be settled deliberately, producer-side preferred: metadata-protocol does not export declaresClientRefusal / clientFacingFailureText. Exporting them (a producer-side enabling change, reported as such) beats a second private restatement — a second copy is how the rule drifts. If exporting, that half touches packages/metadata-protocol (metadata lane's package): declare it in the file surface, it is enabling-export only, no behavior change there.

Size/model suggestion: S–M, mode:subagent, opus (the reproduce-first half needs judgment).

---

Generated by Claude Code