test(metadata-protocol): read the backfill receipt's declared organization field apart from the carriers

Claude-Session: https://claude.ai/code/session_016GiHYRmLSNWTfbX9gVQkpz
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/21418-operator-text-cut.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/types': patch
+---
+
+fix(types): `operatorFacingErrorText` answers through the driver-fault redaction, so an operator-facing record carries no statement and no bound value
+
+Clause-②: no
+
+- **What changed.** `operatorFacingErrorText` passes every text it returns through `redactStatementFromMessage`, the one driver-fault redaction in this package. Text it reads off a raw-statement fault's `cause` is cut with `{ statementSent: true }`, which is the cut `@objectstack/driver-sql` applies to its own log line for the same fault. Every other text asks the shared leak predicate, as the engine's own log line does.
+- **What an operator reads now.** The records this helper fills, in `os db clean` and in the metadata migrations and probes, keep the dialect's own diagnostic: the missing column, the failed constraint or the locked database. The value slots the redaction's dialect templates own are cut from it, and the redaction's marker stands where the statement was removed. The records no longer carry the statement or the values bound into it.
+- **What does not change.** Text that is not a driver dump comes back exactly as before, empty text included. The thrown error is not touched: its `code`, `status`, class and `cause` reach every other reader as the driver composed them. The function's signature and the package's exports are unchanged.

packages/metadata-protocol/src/migrations/raw-exec-operator-detail-16657.test.ts

@@ -515,7 +515,7 @@ describe('[#21418] a bound sentinel reaches no carrier at any site in this packa
             const err = rawStatementFault(
                 knexDump(sql, [], `Duplicate entry '${SENTINEL}' for key 't.idx_real'`),
             );
-            Object.assign((err as { cause: object }).cause, { code: 'ER_DUP_ENTRY', errno: 1062 });
+            Object.assign((err as unknown as { cause: object }).cause, { code: 'ER_DUP_ENTRY', errno: 1062 });
             return err;
         };
         const options = {
@@ -548,6 +548,13 @@ describe('[#21418] a bound sentinel reaches no carrier at any site in this packa
          * with the organization the probe finds BEING the sentinel, so the
          * stamp and the counter merge bind it themselves, and every refusal
          * composed from the statement and parameters actually sent.
+         *
+         * ⚠️ The run's receipt names the organization it adopted, on purpose
+         * and not through the helper: `organizationId` is a declared field of
+         * the result (and of the `info` line a repair writes, which this
+         * logger does not record). So the scan below reads the result WITHOUT
+         * that one field, and pins the field's value separately, rather than
+         * calling a declared receipt a leak.
          */
         function sentinelExec(refuse: (sql: string) => boolean) {
             return async (sql: string, params?: unknown[]): Promise<unknown> => {
@@ -629,7 +636,9 @@ describe('[#21418] a bound sentinel reaches no carrier at any site in this packa
 
                 expect(fixture.seen.length, 'the site was never refused').toBeGreaterThan(0);
                 expect(fixture.seen.every((m) => m.includes(SENTINEL))).toBe(true);
-                expect(inspect(result, { depth: 8 })).not.toContain(SENTINEL);
+                const { organizationId, ...carriers } = result as typeof result & { organizationId?: string };
+                expect([undefined, SENTINEL]).toContain(organizationId);
+                expect(inspect(carriers, { depth: 8 })).not.toContain(SENTINEL);
                 expect(logged(log)).not.toContain(SENTINEL);
                 if (line === '') {
                     expect(result.status).toBe('absent');