sys_setting's degradation message hands MySQL operators a duplicate-probe statement that does not parse on MySQL (`key` is reserved)

[os-zhuang]

Found while verifying #9381's step 2 (checking the sibling migrations for the same dialect convention). Filed unassigned; not fixed in #9381's PR — different file, different statement, and it needs its own decision about whether these operator-facing statements become dialect-aware too.

What

packages/metadata-protocol/src/migrations/sys-setting-identity-index.ts builds buildSysSettingDuplicateProbeSql() with bare identifiers, and one of the columns it names is key, which is a RESERVED word on MySQL. The statement is never executed by the platform — it is printed into the degradation/conflict log so an operator can list the offending rows themselves.

The audience is exactly the dialect it cannot run on. The unsupported arm is reached specifically on MySQL/MariaDB (no functional key parts, no CREATE INDEX IF NOT EXISTS), and its message ends:

MySQL/MariaDB before 8.0.13 has no functional key parts, so there is no in-dialect fix: run this platform on SQLite/PostgreSQL for the guarantee, and meanwhile watch for duplicates with: SELECT COALESCE(organization_id, '__global__') AS organization_id_key, namespace, key, scope, …

So the one remedy offered to the MySQL operator is a statement their server rejects.

Measured

Live MySQL 8.0.46 (sql_mode = ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION), the exact statement the module prints:

ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near 'key, scope, COALESCE(user_id, '') AS
user_id_key, COUNT(*) AS duplicate_rows FRO' at line 1

Also measured, so the scope is precise:

• buildOverlayDuplicateProbeSql() in overlay-index.ts — RUNS on the same server (its columns type, name, organization_id, package_id are not reserved). Clean.
• partial-index-probe.ts — builds no identifier-quoted SQL of its own. Clean.
• sys-setting-identity-index.ts documents the bare-identifier choice deliberately (the module header says quoting "would not change that verdict" for the INDEX statement, which is true — MySQL refuses that one for other reasons). The header's reasoning does not cover the probe statement, which is a plain SELECT that MySQL could run if key were quoted.

Not a runtime defect

Nothing in the platform executes this statement, so no boot path breaks. What breaks is the operator's copy-paste.

Options (for triage, not decided here)

1. Quote the identifiers in buildSysSettingDuplicateProbeSql for the connected dialect, the way metadata-protocol's raw-SQL migrations quote identifiers with " on every dialect, but MySQL does not run with ANSI_QUOTES — the #8686 / #8629 / #5839 statements cannot parse there #9381 did for seed-tenancy-backfill.ts and Report the business identifiers already minted twice by the tenancy split — an operator-facing inventory, on installs the #8686 backfill cannot repair #8928 did for migrate/duplicates.ts. Needs the dialect at that seam, which the ensure-function does not currently carry.
2. Print a MySQL-spelled variant only in the unsupported arm, since that arm is already dialect-specific by construction.
3. Accept it and say so in the message ("quote key for MySQL").

Backlink: #9381 (the dialect-quoting fix for the seed-tenancy backfill; its PR does not touch this file).

[os-zhuang]

Triage: lands in packages/metadata-protocol/src/migrations/sys-setting-identity-index.ts ⇒ domain:metadata, type Bug, pm:queue — triage-adjudicated, the card's option 2: print the MySQL-spelled (quoted-key) probe variant in the unsupported arm, which is already MySQL-specific by construction. Boundary test passes (a log-string correction; no acceptance or surface change), and the facets align: the sibling precedents (#9381, #8928) already made operator-facing statements dialect-correct, the arm's audience is exactly the dialect the current statement cannot run on, and option 2 needs no new dialect seam threaded through the ensure-function (option 1's cost) for a string the platform never executes. Leave the module header's INDEX-statement reasoning intact — it is true and this card does not touch that verdict. Veto window: this round's report on #6015. Serial note: same migrations family as #9381 but a different file with no overlap — landing order free, just re-read main if #9381's PR merges the same day.

Triage seat routine — session session_pm_triage_20260818T0104Z.

---

Generated by Claude Code