@kernhq/module-inventory 0.3.0 → 0.4.1

package/dist/server/services/categories.js

@@ -1,5 +1,6 @@
 import { KernError, uuidv7 } from '@kernhq/kernel';
-import { and, asc, eq, isNull } from 'drizzle-orm';
+import { and, asc, count, eq, isNull, sql } from 'drizzle-orm';
+import { MAX_LIVE_CATEGORIES } from '../../contract/models.js';
 import { categories } from '../schema.js';
 import { violated } from './db-errors.js';
 /** The unique index `0000_init.sql` put on (workspace_id, name). */
@@ -25,9 +26,16 @@ export function toCategory(row) {
  */
 export class CategoryService {
     /**
-     * Ordered by `order` and then by name, which is what makes a workspace that never touches the
-     * order field still get an alphabetical picker rather than an arbitrary one — every row has
-     * `order` 0, so the tiebreak is doing all the work and has to be a name rather than an id.
+     * Ordered by `order` and then by name.
+     *
+     * `order` is the sequence somebody dragged their categories into, and no two **live** categories
+     * share a number: `inventory_categories_ws_order_live_uq` is what makes that true rather than
+     * intended. So for the live set the tiebreak never fires.
+     *
+     * It stays because `list` also reads the archived rows, and those are outside the index: an
+     * archived category keeps the number it had when it left, and the very next reorder renumbers a
+     * live row onto it. A duplicate must sort the same way twice, and a name is the only column a
+     * person could predict.
      */
     async list(tx, workspaceId, includeArchived) {
         const filters = [eq(categories.workspaceId, workspaceId)];
@@ -50,29 +58,47 @@ export class CategoryService {
         return row;
     }
     /**
-     * A duplicate name is a `CONFLICT` with the name in it, never a 500.
+     * A new category joins the **end** of the sequence, and a duplicate name is a `CONFLICT` with the
+     * name in it, never a 500.
      *
-     * The unique index is what actually decides — checking first and inserting after is a race that
-     * two people adding "Laptops" at once will find — so the check is the insert, and the driver's
-     * 23505 is translated into a sentence rather than shown as "Failed query: insert into
+     * The unique index is what actually decides the name — checking first and inserting after is a
+     * race that two people adding "Laptops" at once will find — so the check is the insert, and the
+     * driver's 23505 is translated into a sentence rather than shown as "Failed query: insert into
      * mod_inventory.categories …".
+     *
+     * The position is decided the same way, in the statement rather than around it. It used to be an
+     * optional number the caller passed and defaulted to 0, so every category anybody added landed at
+     * the *front*, tied with whatever was already there, and the list resolved the tie by name — a
+     * new category appearing in the middle of a sequence somebody had arranged by hand.
+     *
+     * **The subquery is not what makes the number unique — the lock above it is.** This used to say
+     * that a subquery inside the insert stopped two creates in flight from taking the same maximum,
+     * and that is false: under READ COMMITTED each statement takes its own snapshot, so both read a
+     * list without the other's row in it and both appended to the same place. `lockAppends` is what
+     * serialises them, and `inventory_categories_ws_order_live_uq` is what refuses the pair if
+     * anything ever reaches the table around it.
      */
-    async create(tx, workspaceId, name, order) {
+    async create(tx, workspaceId, name) {
+        await CategoryService.lockAppends(tx, workspaceId);
+        await CategoryService.roomForOneMore(tx, workspaceId);
         try {
-            const [row] = await tx.insert(categories).values({ id: uuidv7(), workspaceId, name, order }).returning();
+            const [row] = await tx
+                .insert(categories)
+                .values({ id: uuidv7(), workspaceId, name, order: CategoryService.appended(workspaceId) })
+                .returning();
             return row;
         }
         catch (err) {
             throw CategoryService.nameTaken(err, name);
         }
     }
+    /** A rename, and nothing else — the sequence is `reorder`'s to write. */
     async update(tx, workspaceId, categoryId, patch) {
         const previous = await this.get(tx, workspaceId, categoryId);
-        // `undefined` means "not mentioned". Neither field is nullable, so there is no "clear it" here
+        // `undefined` means "not mentioned". The column is not nullable, so there is no "clear it" here
         // and no reason for the `null`-versus-`undefined` care `assets.update` needs.
         const values = {
             name: patch.name ?? previous.name,
-            order: patch.order ?? previous.order,
             updatedAt: new Date(),
         };
         try {
@@ -97,17 +123,176 @@ export class CategoryService {
      * entry saying "category changed to <nothing>". None of it recoverable, all of it caused by a
      * settings screen. An archived category disappears from every picker and every filter and leaves
      * each asset able to say what it is.
+     *
+     * **A restore appends**, for the reason `create` appends. The row kept the position it had when
+     * it left, and every live category has been renumbered since — so putting it back where its old
+     * number points lands it in the middle of somebody's arrangement, tied with whatever is there
+     * now. The end of the list is the one place a person can find it again. Archiving leaves the
+     * number alone: it is out of every list that reads it, and it is about to be overwritten anyway.
+     *
+     * A restore appends, so it races exactly as `create` does and is serialised the same way — and it
+     * is the one place other than `create` where the live set grows, so it is the other place the
+     * limit is enforced. Archiving needs neither: it takes a row out of the live set, and out of the
+     * partial index with it.
      */
     async archive(tx, workspaceId, categoryId, archived) {
+        if (!archived) {
+            await CategoryService.lockAppends(tx, workspaceId);
+            await CategoryService.roomForOneMore(tx, workspaceId);
+        }
         const [row] = await tx
             .update(categories)
-            .set({ archivedAt: archived ? new Date() : null, updatedAt: new Date() })
+            .set({
+            archivedAt: archived ? new Date() : null,
+            ...(archived ? {} : { order: CategoryService.appended(workspaceId) }),
+            updatedAt: new Date(),
+        })
             .where(and(eq(categories.workspaceId, workspaceId), eq(categories.id, categoryId)))
             .returning();
         if (!row)
             throw KernError.notFound('Category');
         return row;
     }
+    /**
+     * The sequence, rewritten from the ids somebody put it in — the only thing that writes `order`.
+     *
+     * Three refusals before a single row is touched, and all three are the same idea: this call
+     * describes the whole live list, so a list that does not match the workspace is not a partial
+     * instruction to be completed, it is an ordering of something else.
+     *
+     *   - **an id twice** — arithmetic that cannot be carried out, `BAD_REQUEST`;
+     *   - **an id that is not this workspace's** — `NOT_FOUND`, the answer `update` and `archive`
+     *     already give for one, and the answer that does not confirm the row exists elsewhere;
+     *   - **a live category the list does not name, or an archived one it does** — somebody added,
+     *     archived or restored a category while this page was open. Renumbering what was named would
+     *     put the missing one wherever its stale number happened to land, silently. `CONFLICT` with
+     *     `inventory.category.order_stale`, which the client turns into "reload and try again".
+     *
+     * All of it inside one transaction, opened by the router, so a refusal writes nothing and a
+     * renumbering is never half-applied. The `for update` is what makes two reorders arriving at once
+     * queue rather than interleave — without it both read the same list, both pass the check, and the
+     * writes of one land between the writes of the other, which is how a sequence ends up being
+     * neither of the two orders anybody asked for. Locking in id order is what stops two of them
+     * taking the same rows in opposite orders and deadlocking.
+     */
+    async reorder(tx, workspaceId, categoryIds) {
+        const named = new Set(categoryIds);
+        if (named.size !== categoryIds.length)
+            throw KernError.badRequest('That list of categories names the same one more than once.');
+        const current = await tx
+            .select()
+            .from(categories)
+            .where(eq(categories.workspaceId, workspaceId))
+            .orderBy(asc(categories.id))
+            .for('update');
+        const known = new Map(current.map((row) => [row.id, row]));
+        if (categoryIds.some((id) => !known.has(id)))
+            throw KernError.notFound('Category');
+        const live = current.filter((row) => !row.archivedAt);
+        if (live.some((row) => !named.has(row.id)) || categoryIds.some((id) => known.get(id)?.archivedAt))
+            throw KernError.conflict('The categories changed while this list was open, so this order was not saved. Reload the list and arrange it again.', 'inventory.category.order_stale');
+        // Only the rows that actually move are touched — a workspace has tens of categories, they are
+        // already locked, and a change event for a row whose position did not change would tell every
+        // screen in the workspace about a write that did not happen. `moved` is settled here, before a
+        // single write, so it stays the honest list whatever the two passes below do.
+        const now = new Date();
+        const going = categoryIds
+            .map((id, index) => ({ id, index }))
+            .filter(({ id, index }) => known.get(id)?.order !== index);
+        const moved = going.map(({ id }) => id);
+        /**
+         * Parked out of the way first, and only then put down where they belong.
+         *
+         * `inventory_categories_ws_order_live_uq` is a plain unique index, and Postgres checks one of
+         * those row by row rather than at the end of the statement. There is no deferrable form to reach
+         * for either: a unique *constraint* can be deferred and cannot be partial, and this one has to be
+         * partial. So the single-pass loop writes a collision the moment two rows swap — putting the
+         * first on 1 while the second still holds 1 — and a swap is the commonest reorder there is.
+         *
+         * `park` sits above both the highest number any row in this workspace holds **and** the last
+         * place in the new sequence. That is what makes the two passes safe: the parked values are
+         * distinct from one another and from every row staying put, and the `0…n-1` the second pass
+         * writes into is empty, because every live row that could have been sitting there is either
+         * parked or already on the number it is being given.
+         *
+         * Only the rows that actually move are written, so a reorder that shifts one row does not stamp
+         * `updated_at` across the whole list — and `updated_at` is left off the parking pass, which is
+         * bookkeeping rather than a change anybody made.
+         */
+        if (going.length > 0) {
+            const park = Math.max(...current.map((row) => row.order), categoryIds.length - 1) + 1;
+            for (const [offset, { id }] of going.entries()) {
+                await tx
+                    .update(categories)
+                    .set({ order: park + offset })
+                    .where(and(eq(categories.workspaceId, workspaceId), eq(categories.id, id)));
+            }
+            for (const { id, index } of going) {
+                await tx
+                    .update(categories)
+                    .set({ order: index, updatedAt: now })
+                    .where(and(eq(categories.workspaceId, workspaceId), eq(categories.id, id)));
+            }
+        }
+        const rows = await tx
+            .select()
+            .from(categories)
+            .where(and(eq(categories.workspaceId, workspaceId), isNull(categories.archivedAt)))
+            .orderBy(asc(categories.order), asc(categories.name));
+        return { rows, moved };
+    }
+    /**
+     * One past the highest position this workspace has used, archived rows counted.
+     *
+     * Archived rows count because one of them can be restored, and a restored category landing on a
+     * live one's number is the tie this whole change exists to remove.
+     *
+     * **Only correct under `lockAppends`.** A subquery inside the write saves a round trip and settles
+     * nothing about concurrency: under READ COMMITTED it is evaluated against the snapshot its own
+     * statement started with, so two transactions appending at the same instant read the same maximum
+     * and take the same number. That is the defect `0008` exists for.
+     */
+    static appended(workspaceId) {
+        return sql `(select coalesce(max(${categories.order}), -1) + 1 from ${categories} where ${categories.workspaceId} = ${workspaceId})`;
+    }
+    /**
+     * Hold the right to append to this workspace's list until the transaction ends.
+     *
+     * An advisory lock rather than `select … for update`, because the thing being protected is the
+     * *next* number rather than any row that exists: a workspace with no categories at all has no row
+     * to lock, and two creates against it would still collide. Taken per workspace, so two workspaces
+     * adding a category at the same moment never wait for each other.
+     *
+     * The first key is a constant for this list, so another module taking an advisory lock on the same
+     * workspace does not queue behind this one by accident.
+     *
+     * It cannot deadlock against `reorder`, which takes row locks and never asks for this one — so
+     * there is no pair of waits pointing at each other.
+     */
+    static async lockAppends(tx, workspaceId) {
+        await tx.execute(sql `select pg_advisory_xact_lock(hashtext('mod_inventory.categories.order'), hashtext(${workspaceId}))`);
+    }
+    /**
+     * Refuse the one that would take a workspace past `MAX_LIVE_CATEGORIES`, and say so.
+     *
+     * The number exists because `categories.reorder` is handed every live category at once and that
+     * array needs a bound. Leaving the bound only on the array is a silent ceiling: a workspace could
+     * pass it one category at a time and then discover that the only procedure that can order them is
+     * the one it can no longer call. Enforced here, the array can always name every live category a
+     * workspace is allowed to have.
+     *
+     * **Live rows, not every row ever made**, so that archiving one frees a place — which is what the
+     * refusal tells the reader to do, and the advice has to be true.
+     */
+    static async roomForOneMore(tx, workspaceId) {
+        const [row] = await tx
+            .select({ n: count() })
+            .from(categories)
+            .where(and(eq(categories.workspaceId, workspaceId), isNull(categories.archivedAt)));
+        if ((row?.n ?? 0) < MAX_LIVE_CATEGORIES)
+            return;
+        throw KernError.conflict(`This workspace already has ${MAX_LIVE_CATEGORIES} categories, which is as many as Inventory keeps in one order. Archive one it no longer uses to make room.`, 'inventory.category.limit_reached');
+    }
     /**
      * The unique index refused it, or something else did and must not be disguised.
      *

package/dist/server/services/categories.js.map

@@ -1 +1 @@
-{"version":3,"file":"categories.js","sourceRoot":"","sources":["../../../src/server/services/categories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAW,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAElD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAIzC,oEAAoE;AACpE,MAAM,UAAU,GAAG,iCAAiC,CAAA;AAEpD,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,GAAQ;IACjC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,WAA2C;QAC5D,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;KAClD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IAC1B;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,WAAmB,EAAE,eAAwB;QAC9D,MAAM,OAAO,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,eAAe;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QACjE,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;aACtB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAM,EAAE,WAAmB,EAAE,UAAkB;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,EAAM,EAAE,WAAmB,EAAE,IAAY,EAAE,KAAa;QACnE,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAA;YACxG,OAAO,GAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,eAAe,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CACV,EAAM,EACN,WAAmB,EACnB,UAAkB,EAClB,KAAwC;QAExC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;QAC5D,+FAA+F;QAC/F,8EAA8E;QAC9E,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;YACjC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,MAAM,CAAC;iBACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;iBAClF,SAAS,EAAE,CAAA;YACd,OAAO,GAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,eAAe,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,WAAmB,EAAE,UAAkB,EAAE,QAAiB;QAC9E,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACxE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;aAClF,SAAS,EAAE,CAAA;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,GAAY,EAAE,IAAY;QACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;YAAE,OAAO,GAAG,CAAA;QAC1C,OAAO,SAAS,CAAC,QAAQ,CACvB,iDAAiD,IAAI,IAAI,EACzD,+BAA+B,CAChC,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"categories.js","sourceRoot":"","sources":["../../../src/server/services/categories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAW,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAkC,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9F,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAIzC,oEAAoE;AACpE,MAAM,UAAU,GAAG,iCAAiC,CAAA;AASpD,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,GAAQ;IACjC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,WAA2C;QAC5D,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;KAClD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IAC1B;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,WAAmB,EAAE,eAAwB;QAC9D,MAAM,OAAO,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,eAAe;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QACjE,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;aACtB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,EAAM,EAAE,WAAmB,EAAE,UAAkB;QACvD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,MAAM,CAAC,EAAM,EAAE,WAAmB,EAAE,IAAY;QACpD,MAAM,eAAe,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QAClD,MAAM,eAAe,CAAC,cAAc,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QACrD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,UAAU,CAAC;iBAClB,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;iBACzF,SAAS,EAAE,CAAA;YACd,OAAO,GAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,eAAe,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAM,CAAC,EAAM,EAAE,WAAmB,EAAE,UAAkB,EAAE,KAAwB;QACpF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,CAAA;QAC5D,gGAAgG;QAChG,8EAA8E;QAC9E,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAA;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,UAAU,CAAC;iBAClB,GAAG,CAAC,MAAM,CAAC;iBACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;iBAClF,SAAS,EAAE,CAAA;YACd,OAAO,GAAI,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,eAAe,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,WAAmB,EAAE,UAAkB,EAAE,QAAiB;QAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,eAAe,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;YAClD,MAAM,eAAe,CAAC,cAAc,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;YACxC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACrE,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;aAClF,SAAS,EAAE,CAAA;QACd,IAAI,CAAC,GAAG;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAC9C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,WAAmB,EAAE,WAAqB;QAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM;YACnC,MAAM,SAAS,CAAC,UAAU,CAAC,4DAA4D,CAAC,CAAA;QAE1F,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;aAC9C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;aAC3B,GAAG,CAAC,QAAQ,CAAC,CAAA;QAChB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;QAE1D,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;QAClF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QACrD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC;YAC/F,MAAM,SAAS,CAAC,QAAQ,CACtB,qHAAqH,EACrH,gCAAgC,CACjC,CAAA;QAEH,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,8EAA8E;QAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;QACtB,MAAM,KAAK,GAAG,WAAW;aACtB,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;aACnC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,KAAK,KAAK,CAAC,CAAA;QAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;QAEvC;;;;;;;;;;;;;;;;;;WAkBG;QACH,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;YACrF,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC/C,MAAM,EAAE;qBACL,MAAM,CAAC,UAAU,CAAC;qBAClB,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,MAAM,EAAE,CAAC;qBAC7B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;YAC/E,CAAC;YACD,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,KAAK,EAAE,CAAC;gBAClC,MAAM,EAAE;qBACL,MAAM,CAAC,UAAU,CAAC;qBAClB,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;qBACrC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;YAC/E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;aAClF,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;QACvD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACxB,CAAC;IAED;;;;;;;;;;OAUG;IACK,MAAM,CAAC,QAAQ,CAAC,WAAmB;QACzC,OAAO,GAAG,CAAQ,wBAAwB,UAAU,CAAC,KAAK,mBAAmB,UAAU,UAAU,UAAU,CAAC,WAAW,MAAM,WAAW,GAAG,CAAA;IAC7I,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAM,EAAE,WAAmB;QAC1D,MAAM,EAAE,CAAC,OAAO,CACd,GAAG,CAAA,qFAAqF,WAAW,IAAI,CACxG,CAAA;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACK,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAM,EAAE,WAAmB;QAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;aACtB,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,mBAAmB;YAAE,OAAM;QAC/C,MAAM,SAAS,CAAC,QAAQ,CACtB,8BAA8B,mBAAmB,4GAA4G,EAC7J,kCAAkC,CACnC,CAAA;IACH,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,GAAY,EAAE,IAAY;QACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;YAAE,OAAO,GAAG,CAAA;QAC1C,OAAO,SAAS,CAAC,QAAQ,CACvB,iDAAiD,IAAI,IAAI,EACzD,+BAA+B,CAChC,CAAA;IACH,CAAC;CACF"}

package/migrations/0008_category_order_unique.sql

@@ -0,0 +1,71 @@
+-- No two live categories on the same place, enforced rather than intended.
+--
+-- Hand-written, because the repair below is not something drizzle-kit generates — the same reason
+-- `0001_rls.sql`, `0006_workspace_registry_read.sql` and `0007_history_sequence.sql` are. Every
+-- statement carries its own guard, and `migrations.test.ts` applies this folder twice against a
+-- database created from nothing to prove the guards are real rather than intended.
+--
+-- ## What was wrong
+--
+-- The contract, the changeset and `CategoryService.list`'s own comment all said that `reorder` keeps
+-- the live categories on distinct numbers, so the `order by "order", "name"` tiebreak never fires for
+-- them. All three were describing an intention.
+--
+-- A category joins the end of the list by taking `(select coalesce(max("order"), -1) + 1)`, and a
+-- restore appends the same way. Putting that subquery *inside* the insert removes a round trip; it
+-- does not remove the race. Under READ COMMITTED every statement takes its own snapshot, so two
+-- transactions appending at the same instant each read a list without the other's row in it and both
+-- take the same number. `reorder`'s `select … for update` does not serialise them either: a row lock
+-- cannot cover a row that does not exist yet, and a restore's subquery is evaluated against the
+-- snapshot its statement started with rather than the one it would get after waiting.
+--
+-- Two live categories on one number is not a crash. It is a list whose order changes under somebody
+-- when a name changes, and a *move up* that appears to do nothing because the row it swapped with
+-- sorts back ahead of it by name.
+--
+-- ## Why an index
+--
+-- Because checking first and writing after is the race, not the fix — the same reason
+-- `inventory_repairs_one_open_uq` is an index in `0003`. `CategoryService` takes a per-workspace
+-- advisory lock so the ordinary append never meets this index at all; the index is what makes the
+-- claim true whatever else reaches the table.
+--
+-- **Partial, over the live rows only.** An archived category keeps the number it had when it left,
+-- and the next reorder renumbers a live row straight onto it. That collision is invisible — an
+-- archived category is in no picker, no filter and no sequence — so a total unique index would refuse
+-- an archive-and-reorder that is entirely correct.
+--
+-- ## The repair comes first, or the upgrade takes the host service down
+--
+-- A module's migrations are the first thing the kernel runs, so a `CREATE UNIQUE INDEX` that meets
+-- rows already sharing a number does not break categories: it throws during boot, and `core` hosts
+-- five modules and never binds its port. Every instance that has run 0.2.0 may hold such a pair, so
+-- the duplicates are renumbered before the index is built.
+--
+-- The renumbering is confined to the workspaces that actually have a duplicate, and it walks them in
+-- `("order", "name", "id")` — which is the order `list` already returns and therefore the order the
+-- screen already showed. Nobody's arrangement visibly changes. `"order" <> ordered.rn - 1` is what
+-- makes a replay match nothing rather than rewrite rows a second time.
+--
+-- ## Append-only, and readable by the image before this one
+--
+-- 0.2.0 is published and `core` depends on it. This changes no table and no column: it adds an index
+-- and moves some integers within the range they already occupied, so the previous image reads the
+-- table exactly as it read it before and rolling back needs no dump.
+
+UPDATE "mod_inventory"."categories" AS c
+   SET "order" = ordered.rn - 1
+  FROM (SELECT "id",
+               row_number() OVER (PARTITION BY "workspace_id" ORDER BY "order", "name", "id") AS rn
+          FROM "mod_inventory"."categories"
+         WHERE "archived_at" IS NULL
+           AND "workspace_id" IN (SELECT "workspace_id"
+                                    FROM "mod_inventory"."categories"
+                                   WHERE "archived_at" IS NULL
+                                   GROUP BY "workspace_id", "order"
+                                  HAVING count(*) > 1)) AS ordered
+ WHERE c."id" = ordered."id"
+   AND c."order" <> ordered.rn - 1;--> statement-breakpoint
+
+CREATE UNIQUE INDEX IF NOT EXISTS "inventory_categories_ws_order_live_uq"
+  ON "mod_inventory"."categories" USING btree ("workspace_id","order") WHERE "archived_at" IS NULL;

package/migrations/meta/_journal.json

@@ -57,6 +57,13 @@
       "when": 1787788455674,
       "tag": "0007_history_sequence",
       "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1787788455675,
+      "tag": "0008_category_order_unique",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kernhq/module-inventory",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Kern inventory module: the company's asset register — what it owns, item by item, with asset tags, serial numbers, purchase and warranty details",
   "homepage": "https://github.com/KernAIO/module-inventory#readme",
   "license": "AGPL-3.0-only",
@@ -56,13 +56,14 @@
     "@orpc/contract": "^1.15.0",
     "@orpc/server": "^1.15.0",
     "drizzle-orm": "^0.45.0",
+    "svelte-dnd-action": "^0.9.64",
     "zod": "^4.1.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.0.0",
     "@changesets/cli": "^2.27.0",
     "@kernhq/contracts": "^0.7.0",
-    "@kernhq/kernel": "^0.7.0",
+    "@kernhq/kernel": "^0.9.1",
     "@kernhq/tsconfig": "^0.1.0",
     "@kernhq/ui": "^0.12.0",
     "@tanstack/svelte-query": "^6.1.0",
@@ -77,7 +78,7 @@
   },
   "peerDependencies": {
     "@kernhq/contracts": "^0.7.0",
-    "@kernhq/kernel": "^0.7.0",
+    "@kernhq/kernel": "^0.9.1",
     "@kernhq/ui": "^0.12.0",
     "@tanstack/svelte-query": "^6.1.0",
     "svelte": "^5.46.0"

package/src/client/errors.test.ts

@@ -2,6 +2,7 @@ import { readdirSync, readFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { describe, expect, it } from 'vitest'
+import { MAX_LIVE_CATEGORIES } from '../contract/models.js'
 import {
   codeOf,
   errorLine,
@@ -203,6 +204,35 @@ describe('which sentence a refusal earns', () => {
       '<error_custody_not_held>',
     )
   })
+
+  /**
+   * The one refusal whose sentence has a number in it.
+   *
+   * A limit that will not say what it is cannot be planned around, and `KernError.conflict` carries a
+   * reason and no data — so the figure comes from the contract, which is the same constant the server
+   * enforces. Passed through `t`, which puts it through `Intl.NumberFormat`, so the reader sees it in
+   * their own digits rather than in ASCII.
+   */
+  it('hands the category limit its number, from the constant the server enforces', () => {
+    const refusal = conflict('inventory.category.limit_reached')
+    expect(errorLine(refusal)).toEqual({
+      key: 'error_category_limit_reached',
+      detail: null,
+      values: { max: MAX_LIVE_CATEGORIES },
+    })
+    expect(
+      errorMessage(refusal, (key, values) => `${key}:${JSON.stringify(values ?? null)}`),
+      'and the screen is handed the values along with the key',
+    ).toBe(`error_category_limit_reached:{"max":${MAX_LIVE_CATEGORIES}}`)
+    expect(en['inventory.error_category_limit_reached'], 'which the sentence really asks for').toContain(
+      '{max}',
+    )
+  })
+
+  it('leaves values off every key that has no placeholder', () => {
+    expect(errorLine(conflict('inventory.category.order_stale')).values).toBeUndefined()
+    expect(errorLine({ code: 'NOT_FOUND' }).values).toBeUndefined()
+  })
 })
 
 // ------------------------------------------------------- the two lists that have to stay in step

package/src/client/errors.ts

@@ -25,8 +25,14 @@
  *
  * Pure and string-free: this file decides *which* key, `i18n.ts` holds the words, and a `.svelte`
  * file cannot be unit-tested. `errorMessage()` at the bottom is the one function the screens call.
+ *
+ * The one import is a number from the contract — the same file the server reads it from — because a
+ * limit a sentence refuses to name is a limit nobody can plan around. It brings no runtime with it;
+ * what this file still must never reach for is `i18n.ts`, which drags a Svelte compiler in behind it.
  */
 
+import { MAX_LIVE_CATEGORIES } from '../contract/models.js'
+
 /** What oRPC hands a screen. `code` is the contract's `ErrorCode`; `data` is what the server put in it. */
 export interface ServerError {
   code?: unknown
@@ -121,10 +127,24 @@ const REASON_KEYS: Record<string, string> = {
   'inventory.repair.already_complete': 'error_repair_already_complete',
   'inventory.repair.returned_before_sent': 'error_repair_returned_before_sent',
   'inventory.category.name_taken': 'error_category_name_taken',
+  'inventory.category.order_stale': 'error_category_order_stale',
+  'inventory.category.limit_reached': 'error_category_limit_reached',
 }
 
 export const reasonKeys = (): readonly string[] => Object.keys(REASON_KEYS)
 
+/**
+ * The one refusal whose sentence has a number in it, and where that number comes from.
+ *
+ * A limit stated as "quite a lot" is not stated. `KernError.conflict` carries a reason and no data,
+ * so the server cannot hand the figure over — and it does not need to: it is a constant in the
+ * contract, which is the same file both halves read. Passed through `t`, it goes through
+ * `Intl.NumberFormat`, so a Persian reader is shown ۵۰۰ rather than 500.
+ */
+const REASON_VALUES: Record<string, Record<string, string | number>> = {
+  'inventory.category.limit_reached': { max: MAX_LIVE_CATEGORIES },
+}
+
 /**
  * The sentence a whole class of failure earns, when no reason narrows it further.
  *
@@ -162,12 +182,17 @@ export interface ErrorLine {
   key: string
   /** The server's own sentence, for a failure nothing here recognised. Null otherwise. */
   detail: string | null
+  /** What the sentence's placeholders need. Absent for every key that has none. */
+  values?: Record<string, string | number>
 }
 
 export function errorLine(err: unknown): ErrorLine {
   const reason = reasonOf(err)
   const byReason = reason ? REASON_KEYS[reason] : undefined
-  if (byReason) return { key: byReason, detail: null }
+  if (byReason) {
+    const values = reason ? REASON_VALUES[reason] : undefined
+    return values ? { key: byReason, detail: null, values } : { key: byReason, detail: null }
+  }
 
   const code = codeOf(err)
 
@@ -194,8 +219,11 @@ export function errorLine(err: unknown): ErrorLine {
  * `@kernhq/ui`, and that entry point drags a Svelte compiler into whatever imports it, which is
  * what makes a helper untestable.
  */
-export function errorMessage(err: unknown, translate: (key: string) => string): string {
+export function errorMessage(
+  err: unknown,
+  translate: (key: string, values?: Record<string, string | number>) => string,
+): string {
   const line = errorLine(err)
-  const sentence = translate(line.key)
+  const sentence = translate(line.key, line.values)
   return line.detail ? `${sentence} — ${line.detail}` : sentence
 }