metadata-protocol: the organization probe records 'unknown error' for an empty message channel, unlike the other three raw-exec sites

[os-sam]

The divergence

packages/metadata-protocol/src/migrations/seed-tenancy-backfill.ts keeps

organizationProbeError = operatorFacingErrorText(e) || 'unknown error'

— the only surviving 'unknown error' in the file. At the other three operatorFacingErrorText sites in the same file the record is the helper's return value as is.

So for an empty operator-facing channel that one site does not follow the rule the surrounding documentation states.

Measurement

From the round-4 contract review of PR #17073 (isolated subagent at CONTRACT_REVIEW_TIER, verdict adopted verbatim by the domain:engine seat), measured at 82ee689cdb2aafb8e4a478ef0afe28b0ed88eb4d by driving backfillSeedTenancy with the site test's own seamExec fixture and throwing at the ORGANIZATION_TABLE probe:

thrown	recorded
''	'unknown error'
[]	'unknown error'
Error with name '' and message ''	'unknown error'
new Error('boom') (control)	'boom'
throw '' at the pinned collision-probe site (control)	''

Both controls fire, so the reading is not an artefact of the harness.

The question this card carries

Should the fallback be removed, so the site records what the other three record ('' for an empty channel), or is 'unknown error' a deliberate choice for a migration record, where an empty string in a persisted probe result is worse than a placeholder?

This is a behaviour question, not a wording question. Whoever takes it should also check whether any consumer of organizationProbeError distinguishes empty from absent.

Why this is not being settled in PR #17073

#17073 is code-free by construction: at 82ee689cd its 84 changed .ts lines are 62 comment lines and 22 test-title lines, 0 other, and the runtime bundles (packages/types/dist/index.mjs, dist/index.js) are byte-identical across all four verification rounds. Removing the fallback is a behaviour change; folding it in would discard that invariant and the four rounds of verification resting on it.

#17073 instead corrects its own prose to name this site's surviving fallback, in the three carriers that currently assert otherwise — the metadata-protocol docblock's after-state, the "at every one of these sites" title, and .changeset/operator-facing-raw-exec-cause-text.md :79-84, which ships as release notes.

Provenance

Found by the round-4 contract-review subagent on PR #17073 as blocking item 2; the verdict comment on that PR carries the full reading. Related: card #16657.