fix(services): the user-reference refusal is built by the shared validationFailure constructor

The producer-side refusal assigned its code in each package, which made both
packages new stamp sites of a registered code with no provenance row. It is
now built by `validationFailure` from `@objectstack/types` (already a runtime
dependency of both), the constructor that already holds that provenance. The
envelope is unchanged: same name, code, message and findings.

The settings pin's find double applies the caller's bound before copying rows,
and the package's vitest config aliases `platform-objects/identity` to source.

Claude-Session: https://claude.ai/code/session_011K3zqE8Pv1Evw5hc8tZCnN
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/services/service-messaging/src/actor-reference.ts

@@ -2,6 +2,7 @@
 
 import type { IDataEngine } from '@objectstack/spec/contracts';
 import { renderValidationMessage } from '@objectstack/spec/system';
+import { validationFailure } from '@objectstack/types';
 import { FAN_OUT_SYSTEM_CONTEXT } from './fan-out-system-context.js';
 import { USER_OBJECT } from './recipient-locale.js';
 
@@ -29,8 +30,11 @@ const ACTOR_FIELD = 'actor_id';
  *    write through, as the engine's fail-open does;
  *  - the same answer — `VALIDATION_FAILED` carrying one `reference_not_found`
  *    finding on `actor_id`, whose message is rendered from the same catalog
- *    entry and the field's declared label. The differential pin holds it
- *    equal to the engine's refusal over a real engine.
+ *    entry and the field's declared label. It is built by `validationFailure`
+ *    (`@objectstack/types`), the shared constructor for the shape every door
+ *    serves as `400 VALIDATION_FAILED`, so this package stamps no code of its
+ *    own. The differential pin holds it equal to the engine's refusal over a
+ *    real engine.
  *
  * A write that names no actor (`null`, `undefined`, `''`) is unchanged: the
  * engine never checked an empty reference either.
@@ -68,9 +72,5 @@ function actorReferenceNotFound(data: IDataEngine, object: string, value: string
         field: ACTOR_FIELD,
         params: { ...constraint, value },
     });
-    const error = new Error(message) as Error & { code: string; fields: unknown[] };
-    error.name = 'ValidationError';
-    error.code = 'VALIDATION_FAILED';
-    error.fields = [{ field: ACTOR_FIELD, code: 'reference_not_found', message, label, constraint, value }];
-    return error;
+    return validationFailure(message, [{ field: ACTOR_FIELD, code: 'reference_not_found', message, label, constraint, value }]);
 }

packages/services/service-settings/src/actor-reference.ts

@@ -1,6 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 import { renderValidationMessage } from '@objectstack/spec/system';
+import { validationFailure } from '@objectstack/types';
 
 /** The object every user reference below targets. */
 export const USER_OBJECT = 'sys_user';
@@ -40,8 +41,11 @@ export interface UserReferenceField {
  *    does;
  *  - the same answer: `VALIDATION_FAILED` carrying one `reference_not_found`
  *    finding on the field, rendered from the same catalog entry and the
- *    field's label. The differential pin holds it equal to the engine's
- *    refusal over a real engine.
+ *    field's label. It is built by `validationFailure` (`@objectstack/types`),
+ *    the shared constructor for the shape every door serves as
+ *    `400 VALIDATION_FAILED`, so this package stamps no code of its own. The
+ *    differential pin holds it equal to the engine's refusal over a real
+ *    engine.
  *
  * A write that names no user (`null`, `undefined`, `''`) is unchanged: the
  * engine never checked an empty reference either.
@@ -66,13 +70,9 @@ export async function assertUserReferenceResolves(
     field: ref.field,
     params: { ...constraint, value: String(value) },
   });
-  const error = new Error(message) as Error & { code: string; fields: unknown[] };
-  error.name = 'ValidationError';
-  error.code = 'VALIDATION_FAILED';
-  error.fields = [
+  throw validationFailure(message, [
     { field: ref.field, code: 'reference_not_found', message, label: ref.label, constraint, value: String(value) },
-  ];
-  throw error;
+  ]);
 }
 
 /**

packages/services/service-settings/src/settings-user-reference.pin.test.ts

@@ -46,8 +46,9 @@ function makeMemoryDriver() {
     async connect() {}, async disconnect() {}, async checkHealth() { return true; },
     async execute() { return null; },
     async find(object: string, ast: any) {
-      const hits = [...rowsOf(object).values()].filter((r) => matches(r, ast?.where)).map((r) => ({ ...r }));
-      return typeof ast?.limit === 'number' ? hits.slice(0, ast.limit) : hits;
+      const hits = [...rowsOf(object).values()].filter((r) => matches(r, ast?.where));
+      const page = typeof ast?.limit === 'number' ? hits.slice(0, ast.limit) : hits;
+      return page.map((r) => ({ ...r }));
     },
     async findOne(object: string, ast: any) {
       for (const r of rowsOf(object).values()) if (matches(r, ast?.where)) return { ...r };

packages/services/service-settings/vitest.config.ts

@@ -73,6 +73,13 @@ export default defineConfig({
         find: /^@objectstack\/platform-objects\/system$/,
         replacement: path.resolve(__dirname, '../../platform-objects/src/system/index.ts'),
       },
+      // `platform-objects/identity` arrived with the user-reference pin
+      // (`settings-user-reference.pin.test.ts`), which registers `sys_user` on a
+      // real engine; same explicit-subpath shape as `system` above.
+      {
+        find: /^@objectstack\/platform-objects\/identity$/,
+        replacement: path.resolve(__dirname, '../../platform-objects/src/identity/index.ts'),
+      },
       {
         find: /^@objectstack\/platform-objects$/,
         replacement: path.resolve(__dirname, '../../platform-objects/src/index.ts'),