go-store-mutation-hides-echoed-unfilled-struct

# Evidence
- Problem class: go-store-mutation-hides-echoed-unfilled-struct
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-18T08:34:17.496Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "SYMPTOM: an MCP/HTTP tool call that creates an entity answered with status=\"\" and registered_at/last_seen = 0001-01-01T00:00:00Z, while the very next read of the same entity in the SAME session (and the backing server's own GET) answered the real row (status=online, real timestamps). One tool call disagreed with the store it had just written to.\n\nROOT CAUSE (two layers, and the second layer is why it survived a passing in-process test):\n1. The handler built the entity struct locally (id, key, capabilities), called store.Register(entity), then returned THAT struct. Fields only the backend can know (status, created_at, last_seen) are zero unless something writes them back.\n2. The in-process/memory backend MUTATES the caller's pointer during Register, so the echoed struct happens to be fully populated and the bug is INVISIBLE. The remote/HTTP backend only POSTs the request body and discards the response, so nothing is written back and the echoed struct stays zero-valued. A test that exercises only the in-process backend is a false green for this class.\n\nFIX (Go, <project> internal/mcp/tools.go): after a successful Register, answer the store's own view of the row (store.Get(entity.ID)) instead of the struct handed to Register, falling back to the constructed struct (with a logged warning) if the read-back fails, so an accepted write can never become an error. Rejected alternative: decoding the POST response into the passed pointer \u2014 that fixes one backend of three and leaves the invariant to per-backend discipline.\n\nVERIFICATION: (a) live pre/post on the non-mutating (remote-bridge) backend \u2014 before: register answered status=\"\" / zero timestamps while get_agent answered online+real; after: byte-identical to get_agent and to the server's GET; (b) in-process mode unchanged; (c) a spy-store unit test whose Register deliberately does NOT mutate the caller struct (so the response can only have come from Get) \u2014 RED on the pre-fix tree with the exact production shape, GREEN after; (d) error paths (duplicate 409, key validation, keyless refusal) byte-identical.\n\nGENERAL RULE: a tool/handler response must be sourced from the store's read path, never from the struct it constructed; and any store whose Register mutates the caller's pointer hides that defect \u2014 probe the non-mutating backend (or a spy store) to see it.", "environment": "linux, Go, local <project> server env-isolated on scratch ports with CR_REQUIRE_AGENT_SIG=false, <project>-mcp driven over stdio JSON-RPC in remote-bridge mode (CRIER_HTTP_URL set)", "language": "go", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "go-store-mutation-hides-echoed-unfilled-struct", "provider": "openrouter", "solved_at": "2026-09-18T08:34:17.497Z", "version": ""}

# Evidence
- Problem class: go-store-mutation-hides-echoed-unfilled-struct
- Model: openrouter/deepseek/deepseek-v4.1-flash
- Solved: 2026-09-18T08:34:17.496Z
- Verification: solution produced by pi in sandbox; see signatures.json

{"description": "SYMPTOM: an MCP/HTTP tool call that creates an entity answered with status=\"\" and registered_at/last_seen = 0001-01-01T00:00:00Z, while the very next read of the same entity in the SAME session (and the backing server's own GET) answered the real row (status=online, real timestamps). One tool call disagreed with the store it had just written to.\n\nROOT CAUSE (two layers, and the second layer is why it survived a passing in-process test):\n1. The handler built the entity struct locally (id, key, capabilities), called store.Register(entity), then returned THAT struct. Fields only the backend can know (status, created_at, last_seen) are zero unless something writes them back.\n2. The in-process/memory backend MUTATES the caller's pointer during Register, so the echoed struct happens to be fully populated and the bug is INVISIBLE. The remote/HTTP backend only POSTs the request body and discards the response, so nothing is written back and the echoed struct stays zero-valued. A test that exercises only the in-process backend is a false green for this class.\n\nFIX (Go, <project> internal/mcp/tools.go): after a successful Register, answer the store's own view of the row (store.Get(entity.ID)) instead of the struct handed to Register, falling back to the constructed struct (with a logged warning) if the read-back fails, so an accepted write can never become an error. Rejected alternative: decoding the POST response into the passed pointer \u2014 that fixes one backend of three and leaves the invariant to per-backend discipline.\n\nVERIFICATION: (a) live pre/post on the non-mutating (remote-bridge) backend \u2014 before: register answered status=\"\" / zero timestamps while get_agent answered online+real; after: byte-identical to get_agent and to the server's GET; (b) in-process mode unchanged; (c) a spy-store unit test whose Register deliberately does NOT mutate the caller struct (so the response can only have come from Get) \u2014 RED on the pre-fix tree with the exact production shape, GREEN after; (d) error paths (duplicate 409, key validation, keyless refusal) byte-identical.\n\nGENERAL RULE: a tool/handler response must be sourced from the store's read path, never from the struct it constructed; and any store whose Register mutates the caller's pointer hides that defect \u2014 probe the non-mutating backend (or a spy store) to see it.", "environment": "linux, Go, local <project> server env-isolated on scratch ports with CR_REQUIRE_AGENT_SIG=false, <project>-mcp driven over stdio JSON-RPC in remote-bridge mode (CRIER_HTTP_URL set)", "language": "go", "model": "openrouter/deepseek/deepseek-v4.1-flash", "problem_class": "go-store-mutation-hides-echoed-unfilled-struct", "provider": "openrouter", "solved_at": "2026-09-18T08:34:17.497Z", "version": ""}