get_authoring_meta stops at the first AuthoringMetaV1 map on failure and collapses all failure modes into None

[thedavidmeister]

Unit

crates/cli/src/meta/query/mod.rs — DeployerResponse::get_authoring_meta (AMT group g3-graphql-query-processing, adversarial pass).

Intent oracle

Doc comment: "get authoring meta bytes of this deployer meta". The constructor meta bytes are a cbor sequence that can contain several documents; the loop shape (for meta_map in &meta_maps) says the whole sequence is meant to be searched for the AuthoringMetaV1 document.

Violated property

Two escapes cut the search short and erase the reason:

1. On the FIRST map whose magic is AuthoringMetaV1, a validation/decode failure does return None instead of continuing the scan — a later valid AuthoringMetaV1 document in the same sequence is unreachable (mirror of the metas[0] issue in fetch_for_contract, fetch_for_contract only considers metas[0] and the first cbor document: a valid authoring meta later in the list is unreachable #157, but here the loop exists and is then short-circuited).
2. All failure modes (corrupt cbor, unpack failure, abi decode failure, validation failure, simply no authoring-magic map) collapse into None; callers (Store::search_deployer, set_deployer_from_query_response) cache the deployer with authoring_meta: None, so "this deployer has no authoring meta" and "the authoring meta was malformed" become permanently indistinguishable in the cache.

Verified repro

On commit bba50a7, build meta_bytes as a cbor sequence of two documents: first an AuthoringMetaV1-magic map with an invalid payload, second a valid AuthoringMetaV1 document. get_authoring_meta returns None on the first map although a valid document follows; swapping the order returns Some.

Triage framing

Flagging for a maintainer decision: continue-on-failure (Err(_) => continue) would make the scan order-independent, and an error-carrying return type would let callers distinguish absence from corruption — but the current Option shape may be a deliberate best-effort contract. Not adjudicating.

[thedavidmeister]

Read against origin/main @ 45ca96c. The function is unchanged from the filing:

// crates/cli/src/meta/query/mod.rs:64-67
match AuthoringMeta::abi_decode_validate(&v) {
    Ok(am) => return Some(am),
    Err(_) => return None,
}

Escape 1 (order-dependent scan) is #176, and open PR #258 fixes it

Same unit, same line, same repro. #258 replaces that match with
if let Ok(am) = AuthoringMeta::abi_decode_validate(&v) { return Some(am); }, so a failed
validate falls through to the next item exactly as an unpack failure already did, and adds
test_get_authoring_meta_skips_invalid_item — which builds precisely the document this issue
names, [AuthoringMetaV1(fails abi_decode_validate), AuthoringMetaV1(valid)], and asserts
Some(..). rainix-rs / test / rs-test is green on both ubuntu-latest and macos-latest at
that PR's head.

I have not opened a competing PR for this half: it is the same one-line hunk in the same
function and would conflict with #258 rather than add anything.

Escape 2 (all failure modes collapse into None) is untouched by #258, and is not fixable inside get_authoring_meta

The indistinguishability this issue names is in the cache, and the cache field is part of a
public serde type:

• crates/cli/src/meta/mod.rs:491 — pub authoring_meta: Option<AuthoringMeta> on
  NPE2Deployer (Serialize, Deserialize, Default, #[serde(rename_all = "camelCase")]).
• Both callers move the value straight into that field: Store::search_deployer
  (mod.rs:689) and set_deployer_from_query_response (mod.rs:727).

So an error-carrying return type on get_authoring_meta alone changes nothing observable —
the callers would .ok() it back into the Option and the cache would stay exactly as
indistinguishable as the issue describes. Distinguishing "no authoring meta" from "malformed
authoring meta" in the cache means changing NPE2Deployer.authoring_meta itself, i.e. the
serialized shape of a public type and every downstream consumer of it.

One code-level datum for the "deliberate best-effort contract" reading the triage framing
offers: NPE2Deployer::is_corrupt() (mod.rs:495-515) tests all six byte fields for emptiness
and deliberately does not test authoring_meta — by the type's own predicate, a deployer
cached with authoring_meta: None is not corrupt.

Where this leaves the issue

Escape 1 lands with #258. Escape 2 is a ruling on the public shape of NPE2Deployer, not a
defect against any oracle stated in the repo, and the filing explicitly declines to adjudicate
it — so I am not adjudicating it either by shipping one of the two options unilaterally. Once
#258 merges this is a close-candidate unless that ruling says the cache should carry the
reason.