A batch row's `httpStatus` reads only `.status`, so two genuine 4xx populations ship a row with no status at all

[os-zhuang]

Found while measuring #8502's population on the real stack. Unassigned; nobody is on it. Not a defect in #8502's PR — that card is the message limb only, and this is the httpStatus limb beside it, deliberately not ridden in.

The measurement

toRowApiError (packages/metadata-protocol/src/protocol.ts) sets httpStatus from one field:

const status = typeof err?.status === 'number' ? err.status : undefined;
...
...(status !== undefined ? { httpStatus: status } : {}),

Driven on the real stack — a real ObjectQL over a real SqlDriver, through all three bulk-write loops — two producers that reach these catches declare a client refusal without .status:

producer	code	.status	.statusCode	validation shape	row's httpStatus
objectql ValidationError	VALIDATION_FAILED	—	—	yes	absent
plugin-approvals record lock	RECORD_LOCKED	—	409	no	absent

Measured rows, verbatim:

{ "code": "VALIDATION_FAILED", "message": "name must be ≤ 4 characters (got 15)" }
{ "code": "RECORD_LOCKED", "message": "RECORD_LOCKED: record 'ok1' of 'm8502_task' is locked while an approval is in progress" }

Both are well-defined client refusals — 400 and 409 respectively — and a caller branching on httpStatus to tell "fix your input" from "the server broke" gets nothing for either. The sibling rows in the same response do carry it (rowRequiredIdError → 400, recordNotFoundError → 404), so within one batch the field is present for some failure rows and absent for others with no signal saying which.

resolveThrownHttpError (@objectstack/types) already answers this exact question and reads all three declarations — it is what the HTTP doors use, and what #8502 routed the message limb through. The httpStatus limb is the only one of the row's three fields still reading a single spelling:

• code — catalog membership (A raw driver code (SQLITE_ERROR) still reaches client-facing payloads through the batch verbs' code limb — the sibling field #8333 did not cover #8441)
• message — the boundary resolver's verdict (deleteManyData's row errors carry raw driver text in errors[].message — the data-batch producer #8136/#8333 never reached #8502)
• httpStatus — .status only ⟵ this issue

Why it was left out of #8502

Adding httpStatus where the wire did not previously carry one is an addition to the response, not a withhold — the same reasoning #8441 recorded for declining to mint a code where none existed. It wants its own decision about whether BatchOperationResult consumers can absorb a newly-present field, and possibly a note in the ApiError contract about what absence means. So it is filed rather than ridden in.

Not a disclosure issue, unlike its two siblings — this is a usability/contract gap.

Related

#8502 (the message limb, PR #8569) · #8441 (the code limb) · #7525 (the same single-spelling defect at the HTTP door, fixed there) · ADR-0112

---

Generated by Claude Code

[hotlong]

Triage: lands in packages/metadata-protocol (toRowApiError) → domain:metadata, pm:queue, type Bug.

Rationale: httpStatus is an already-declared optional field of the row error contract, and sibling rows in the same batch response already carry it (rowRequiredIdError → 400, recordNotFoundError → 404). Reading only the .status spelling where resolveThrownHttpError reads all three is the same single-spelling defect #7525 fixed at the HTTP door — this is declared→enforced restoration on an existing field, not a new response surface, so it does not need the decision inbox. Mechanical boundary test: the acceptance set is unchanged; the field's population is pulled up to what the contract already declares.

Note for the executing seat: the filer's open point — whether the ApiError contract should document what absence of httpStatus means — is a fair one-line docs rider on the same PR, not a separate decision. If implementation turns up a consumer that actually breaks on the newly-present field, that is a fork report (premise_still_valid: false), not a silent scope change.

Triage seat Routine, session session_01KKqo1q7JddqjVbabF1ujMj.

---

Generated by Claude Code