Address seed-packet review: 413 mapping, deadline, rollback, dedup

Gadfly findings on #94, the real ones:

- scanSeedPacket extends only the READ deadline; a slow upload + a live
  vision call runs past the server's absolute 30s WriteTimeout and the
  successful response is silently dropped (the #78 failure mode). Extend
  the write deadline too (scanWriteTimeout).
- An oversized upload tripping MaxBytesReader was mapped to 400; it's 413.
  Detect *http.MaxBytesError and report IMAGE_TOO_LARGE.
- Split imagenorm error mapping: ErrTooLarge->413, ErrUnsupported->400,
  genuine read/encode faults (and a failed file.Open)->500, not 400.
- CreateFromPacket discarded the plant it created when the lot then
  failed, contradicting its own doc. Roll the new plant back instead so
  the confirm is all-or-nothing (a fresh plant has no lots/plantings, so
  the delete is safe; log-and-continue on cleanup failure).
- Dedup: packetLotRequest and seedLotCreateRequest shared every lot
  field. Extract a seedLotFields base both use. validCategory now reuses
  plantCategories. EffectiveConfig resolves agent+vision from one
  settings-row read instead of two.
- capabilities swallowed an EffectiveVision error silently; log it.
- vision test hand-copied Extract's body (drift risk). Split generate()
  out of Extract so the hermetic test drives the real request builder.

Tests: rollback-on-lot-failure (service), oversized->413 (api).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

internal/api/api.go

@@ -212,7 +212,12 @@ func (h *handlers) capabilities(c *gin.Context) {
 	// configured, resolvable vision model + a key. Read per-request so a settings
 	// change is reflected on the next poll, same as agent.
 	vision := false
-	if vis, err := h.svc.EffectiveVision(c.Request.Context()); err == nil {
+	if vis, err := h.svc.EffectiveVision(c.Request.Context()); err != nil {
+		// A read fault here means the DB is unhappy; report vision off (safe: the
+		// UI just hides a button) but don't do it silently — the same best-effort
+		// settings reads elsewhere log rather than swallow.
+		slog.Error("api: could not resolve vision settings for capabilities", "error", err)
+	} else {
 		vision = vis.Ready()
 	}
 	c.JSON(http.StatusOK, gin.H{"agent": h.agent.get() != nil, "vision": vision})

internal/api/seed_lots.go

@@ -16,9 +16,12 @@ import (
 // the buyer — a lot is never shared along with a garden — so every handler here
 // scopes to the session actor with no garden in the picture.
 
-// seedLotCreateRequest is the body for POST /seed-lots.
-type seedLotCreateRequest struct {
-	PlantID        int64    `json:"plantId" binding:"required"`
+// seedLotFields is the lot half of a create body — every field EXCEPT which plant
+// it attaches to. seedLotCreateRequest adds a required plantId; the seed-packet
+// confirm supplies none (the plant comes from its plantId/newPlant choice), so it
+// embeds these fields directly. Sharing one struct keeps the two request shapes —
+// and their validation — from drifting apart.
+type seedLotFields struct {
 	Vendor         string   `json:"vendor"`
 	SourceURL      string   `json:"sourceUrl"`
 	SKU            string   `json:"sku"`
@@ -32,15 +35,28 @@ type seedLotCreateRequest struct {
 	Notes          string   `json:"notes"`
 }
 
-func (r seedLotCreateRequest) toInput() service.SeedLotInput {
+// toInput builds the service input with no plant attribution; callers that know
+// the plant (the create handler; the packet confirm) set PlantID afterwards.
+func (f seedLotFields) toInput() service.SeedLotInput {
 	return service.SeedLotInput{
-		PlantID: r.PlantID, Vendor: r.Vendor, SourceURL: r.SourceURL, SKU: r.SKU,
-		LotCode: r.LotCode, PurchasedAt: r.PurchasedAt, PackedForYear: r.PackedForYear,
-		Quantity: r.Quantity, Unit: r.Unit, CostCents: r.CostCents,
-		GerminationPct: r.GerminationPct, Notes: r.Notes,
+		Vendor: f.Vendor, SourceURL: f.SourceURL, SKU: f.SKU, LotCode: f.LotCode,
+		PurchasedAt: f.PurchasedAt, PackedForYear: f.PackedForYear, Quantity: f.Quantity,
+		Unit: f.Unit, CostCents: f.CostCents, GerminationPct: f.GerminationPct, Notes: f.Notes,
 	}
 }
 
+// seedLotCreateRequest is the body for POST /seed-lots.
+type seedLotCreateRequest struct {
+	PlantID int64 `json:"plantId" binding:"required"`
+	seedLotFields
+}
+
+func (r seedLotCreateRequest) toInput() service.SeedLotInput {
+	in := r.seedLotFields.toInput()
+	in.PlantID = r.PlantID
+	return in
+}
+
 // seedLotUpdateRequest is the body for PATCH /seed-lots/:id: every field
 // optional, plus the required current version. The nullable columns are
 // json.RawMessage so an explicit null (clear it) is distinguishable from an

internal/api/seed_packet.go

@@ -29,21 +29,40 @@ const scanUploadLimit = 30 << 20
 // ResponseController mechanism the SSE path uses for writes (#78).
 const scanReadTimeout = 60 * time.Second
 
+// scanWriteTimeout extends the write deadline for the same reason. The server's
+// absolute WriteTimeout (30s) is measured from the start of the request, but this
+// handler's response can't be written until AFTER a slow upload AND a live vision
+// call — together easily past 30s. Without this, a successful extraction's
+// response is silently dropped: the exact failure mode #78 fixed for SSE.
+const scanWriteTimeout = 120 * time.Second
+
 // scanSeedPacket reads an uploaded packet photo and returns a proposal.
 func (h *handlers) scanSeedPacket(c *gin.Context) {
-	// Extend the read deadline for the (potentially large, potentially slow)
-	// upload. Best-effort: if the writer doesn't support it, the default applies.
-	_ = http.NewResponseController(c.Writer).SetReadDeadline(time.Now().Add(scanReadTimeout))
+	// Extend both deadlines for the (potentially large, potentially slow) upload
+	// and the live vision call that follows. Best-effort: if the writer doesn't
+	// support it, the server defaults apply.
+	rc := http.NewResponseController(c.Writer)
+	_ = rc.SetReadDeadline(time.Now().Add(scanReadTimeout))
+	_ = rc.SetWriteDeadline(time.Now().Add(scanWriteTimeout))
 
 	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, scanUploadLimit)
 	file, err := c.FormFile("image")
 	if err != nil {
+		// A body over scanUploadLimit trips MaxBytesReader — that's 413, not a
+		// malformed request. Everything else here is a genuinely missing/garbled
+		// multipart field.
+		var tooBig *http.MaxBytesError
+		if errors.As(err, &tooBig) {
+			writeAPIError(c, http.StatusRequestEntityTooLarge, "IMAGE_TOO_LARGE", "that image is too large — try a smaller photo")
+			return
+		}
 		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "attach an image as the \"image\" field")
 		return
 	}
 	f, err := file.Open()
 	if err != nil {
-		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "could not read the uploaded image")
+		// Opening the parsed upload failed on our side, not the client's.
+		writeAPIError(c, http.StatusInternalServerError, "INTERNAL", "could not read the uploaded image")
 		return
 	}
 	defer f.Close()
@@ -51,16 +70,19 @@ func (h *handlers) scanSeedPacket(c *gin.Context) {
 	// Normalize to JPEG (decodes HEIC/webp/png/jpeg, downscales, re-encodes) so
 	// everything downstream — including the vision model — only sees a format it
 	// can read. This is where an iPhone HEIC becomes usable.
-	jpeg, format, err := imagenorm.Normalize(f, imagenorm.Options{})
+	jpeg, _, err := imagenorm.Normalize(f, imagenorm.Options{})
 	if err != nil {
-		if errors.Is(err, imagenorm.ErrTooLarge) {
+		switch {
+		case errors.Is(err, imagenorm.ErrTooLarge):
 			writeAPIError(c, http.StatusRequestEntityTooLarge, "IMAGE_TOO_LARGE", "that image is too large — try a smaller photo")
-			return
+		case errors.Is(err, imagenorm.ErrUnsupported):
+			writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "that doesn't look like an image we can read (JPEG, PNG, HEIC or WebP)")
+		default:
+			// A read or re-encode fault is ours, not bad input.
+			writeAPIError(c, http.StatusInternalServerError, "INTERNAL", "could not process the uploaded image")
 		}
-		writeAPIError(c, http.StatusBadRequest, "INVALID_INPUT", "that doesn't look like an image we can read (JPEG, PNG, HEIC or WebP)")
 		return
 	}
-	_ = format // available for logging if wanted
 
 	prop, err := h.svc.ExtractSeedPacket(c.Request.Context(), mustActor(c).ID, jpeg)
 	if err != nil {
@@ -77,37 +99,14 @@ func (h *handlers) scanSeedPacket(c *gin.Context) {
 	c.JSON(http.StatusOK, prop)
 }
 
-// packetLotRequest is the lot half of a confirm. It's seedLotCreateRequest
-// WITHOUT plantId — the plant comes from the confirm's plantId/newPlant choice,
-// not the lot body, and reusing seedLotCreateRequest would wrongly require one.
-type packetLotRequest struct {
-	Vendor         string   `json:"vendor"`
-	SourceURL      string   `json:"sourceUrl"`
-	SKU            string   `json:"sku"`
-	LotCode        string   `json:"lotCode"`
-	PurchasedAt    *string  `json:"purchasedAt"`
-	PackedForYear  *int     `json:"packedForYear"`
-	Quantity       float64  `json:"quantity"`
-	Unit           string   `json:"unit" binding:"required"`
-	CostCents      *int     `json:"costCents"`
-	GerminationPct *float64 `json:"germinationPct"`
-	Notes          string   `json:"notes"`
-}
-
-func (r packetLotRequest) toInput() service.SeedLotInput {
-	return service.SeedLotInput{
-		Vendor: r.Vendor, SourceURL: r.SourceURL, SKU: r.SKU, LotCode: r.LotCode,
-		PurchasedAt: r.PurchasedAt, PackedForYear: r.PackedForYear, Quantity: r.Quantity,
-		Unit: r.Unit, CostCents: r.CostCents, GerminationPct: r.GerminationPct, Notes: r.Notes,
-	}
-}
-
 // fromPacketRequest confirms a proposal: exactly one of plantId (attach to an
-// existing plant) or newPlant (create a variety), plus the lot to record.
+// existing plant) or newPlant (create a variety), plus the lot to record. The lot
+// is seedLotFields — the create body's lot half WITHOUT plantId, since the plant
+// comes from the plantId/newPlant choice, not the lot body.
 type fromPacketRequest struct {
 	PlantID  *int64              `json:"plantId"`
 	NewPlant *plantCreateRequest `json:"newPlant"`
-	Lot      packetLotRequest    `json:"lot"`
+	Lot      seedLotFields       `json:"lot"`
 }
 
 // createFromPacket turns a confirmed proposal into a plant + lot.

internal/api/seed_packet_test.go

@@ -141,6 +141,24 @@ func TestScanSeedPacketErrorsAPI(t *testing.T) {
 	}
 }
 
+// TestScanSeedPacketTooLargeAPI: a body over the multipart cap trips
+// MaxBytesReader, which must surface as 413 (too large), not 400 (malformed).
+func TestScanSeedPacketTooLargeAPI(t *testing.T) {
+	r := packetEngine(t, visionCfg(), func() (vision.SeedPacket, error) { return vision.SeedPacket{}, nil })
+	cookie := registerAndCookie(t, r, "[email protected]")
+
+	var buf bytes.Buffer
+	mw := multipart.NewWriter(&buf)
+	part, _ := mw.CreateFormFile("image", "big.png")
+	// A hair over scanUploadLimit (30 MiB) so MaxBytesReader trips during parsing.
+	part.Write(bytes.Repeat([]byte{0}, (30<<20)+1024))
+	mw.Close()
+
+	if w := doMultipart(t, r, "/api/v1/seed-lots/scan", mw.FormDataContentType(), &buf, cookie); w.Code != http.StatusRequestEntityTooLarge {
+		t.Errorf("oversized upload = %d, want 413", w.Code)
+	}
+}
+
 // TestCreateFromPacketAPI: confirm → plant + lot. No model involved, so the full
 // path runs through the router.
 func TestCreateFromPacketAPI(t *testing.T) {

internal/api/settings.go

@@ -58,17 +58,14 @@ type effectiveView struct {
 }
 
 // settingsPayload builds the response, or an error. It does NOT swallow an
-// EffectiveAgent failure into a misleading empty "effective" view — an empty
+// EffectiveConfig failure into a misleading empty "effective" view — an empty
 // view would report no model and no key, which reads as "nothing configured"
-// rather than "we couldn't read it". Since EffectiveAgent re-reads the same row
+// rather than "we couldn't read it". Since EffectiveConfig re-reads the same row
 // GetInstanceSettings just returned, a failure here is a genuine DB fault worth
-// surfacing as a 500, not papering over.
+// surfacing as a 500, not papering over. It also resolves the agent and vision
+// views from ONE row read rather than fetching the single-row table twice.
 func (h *handlers) settingsPayload(c *gin.Context, st *domain.InstanceSettings) (settingsResponse, error) {
-	eff, err := h.svc.EffectiveAgent(c.Request.Context())
-	if err != nil {
-		return settingsResponse{}, err
-	}
-	vis, err := h.svc.EffectiveVision(c.Request.Context())
+	eff, vis, err := h.svc.EffectiveConfig(c.Request.Context())
 	if err != nil {
 		return settingsResponse{}, err
 	}