Class ProductionScoreRecordSetRunner

Persist predictions back onto the scored records per the request's write-back OutputMapping, returning a WriteBackOutcome the summary folds in.

No-ops (and reports wroteBack: false) when:

• write-back is not requested, or is the boolean form (no explicit mapping — a default-mapping write-back is owned by the higher Record Process layer, not this runner), or
• request.dryRun is true (compute-only — predictions are surfaced but never persisted, matching ProcessRun.DryRun in the substrate).

Otherwise, for each Succeeded record (paired 1:1 with records in order), it resolves the target BaseEntity, validates + applies the mapped fields, and Save()s. A record whose Save fails is recorded in failedIndexes so summarize can move it from scored -> failed.

Validate every mapped target field name against the entity's real fields, throwing on the first unknown name. The mapping is caller-supplied, so an unknown field would otherwise silently no-op (or be swallowed by Set); we reject loudly — the same defensive posture as primaryKeyFilter.

Build the per-record execution context for the processor. A contextUser is required (server-side scoring is user-scoped), and so is the provider every read and write-back goes through (there is no fallback to the global provider); the Action validates the user before delegating, but we also assert both here so this runner can't be driven without them.

Convert a loaded entity object into a record ref carrying the preloaded row.

First string-able value of an object (used to key a record ref from a pk map).

A placeholder IArtifactLoader that fails loudly, used only when the runner is constructed without deps. Production callers (the Score action and the Score Record Set operation) build the runner with BuildScoreRecordSetRunner(), which wires the real LocalArtifactLoader.

Build a Field='value'-style filter from a primary-key object. Each KEY is validated against the entity's PRIMARY-KEY fields BEFORE interpolation — any other name is rejected (SQL-injection defense for the untrusted key names, and a non-key field such as Status would select an arbitrary matching row). Every primary-key field must be supplied, so the filter identifies exactly one record. Values are single-quote-escaped.

Build the filter that selects exactly the given records of entityInfo, where each id is a compact CompositeKey URL segment (the form MJ: List Details.RecordID and RecordRef.RecordID carry). A single-column key — whatever the column is called — becomes one IN (...); a composite key needs one (F1=.. AND F2=..) term per record, since no single column can be compared against a multi-column value.

Resolve the deps bundle, building production model-loader + sidecar when absent.

Resolve an entity id from its name (best-effort; empty when unavailable).

Resolve an entity + filter into entity-object record refs.

maxRows that is absent, null (possible on the operation's JSON input) or <= 0 means no cap: every matching row is read. A positive cap reads one row past it, and a scope that returns more than maxRows rows is refused with ReadCapExceededError (decision D2-C1: scoring a fraction and reporting success is F-L3-2). Reading maxRows + 1 rows detects the cut from the rows themselves, so it holds for maxRows: 1, where the provider issues no count query and TotalRowCount cannot show the truncation.

Resolve a MJ: Lists id into its member records as entity objects. Mirrors the substrate's ListSource membership contract — a List's members live in MJ: List Details (which store a composite-key-safe RecordID), NOT in a backing User View. We (1) read the list's target EntityID/name, (2) read its member RecordIDs from MJ: List Details, then (3) load those target rows as entity_objects so the inference processor gets the same full preloaded rows as the view and filter scopes (feature columns present whatever the key is called, record.<field> write-back refs resolvable, and write-back reuses the loaded entity instead of reloading it).

Resolve the explicit field-mapping out of the write-back directive. Returns undefined for the boolean form or a malformed/empty mapping (treated as "no write-back to apply here").

Resolve the scope into a set of record refs. Exactly one selector is honored.

Resolve the strongly-typed target BaseEntity for a record. Most scopes carry the already-loaded entity on .Record; reuse it (no extra DB round-trip) when it is a real BaseEntity. Otherwise (id-only records/single refs) load it from the provider via the record's EntityID + its RecordID — a compact CompositeKey URL segment, so a bare value maps onto the entity's real single key column and a F1|v1||F2|v2 segment onto a composite key — using the request user, so write-back works regardless of how the scope was resolved.

Resolve a saved-view id into entity-object record refs.

Fold per-record results into the run summary (counts + predictions / write-back). The MLModelInferenceProcessor.ProcessBatch contract returns results 1:1 with the input records in the SAME order, so we pair each result with its record by walking both together and key each prediction off the PAIRED record's RecordID (record-correlated, not a bare positional lookup that would silently misalign if the lengths ever diverged). All three outcome buckets — Succeeded / Failed / Skipped — are tallied.

wroteBack reflects what was ACTUALLY persisted: it is true only when at least one record's prediction was Saved. A record that scored but whose write-back Save failed (its index is in writeBack.failedIndexes) is moved from the scored bucket into the failed bucket — its prediction did not land. Predictions are surfaced ephemerally only when nothing was written back.

Convert a scope records entry (id string or pk object) into a record ref.

Apply the mapping to ONE record's prediction and Save it. Resolves the target BaseEntity (reusing the preloaded .Record when present, else loading by id via the provider), validates every mapped field name against the entity's real fields (rejecting unknown names — mirroring the PK-name validation in primaryKeyFilter), sets the resolved values via the config-driven Set accessor, and Saves. Returns true on a successful Save, false on any failure (logged) so the caller can reclassify the record as failed.