PATCH /api/issues/:id with a non-existent parentId (or goalId) returns 500 (raw Postgres FK error) instead of 400/422 #7656

Pre-submission checklist

• I have searched existing open and closed issues and this is not a duplicate.
• I am on the latest released version of Paperclip (or can reproduce on master).
• I have confirmed the error originates in Paperclip itself — not in my agent adapter, API provider, or local configuration.

What happened?

Setting parentId on an issue via PATCH /api/issues/{id} where the supplied parent UUID does not exist in the issues table returns HTTP 500 with a raw Drizzle/Postgres stack trace, instead of a clean 4xx validation error.

The DB rejects the write with the foreign-key constraint issues_parent_id_issues_id_fk:

PostgresError: insert or update on table "issues" violates foreign key constraint "issues_parent_id_issues_id_fk" — at runUpdate (@paperclipai/server/dist/services/issues.js:3890), at routes/issues.js:3436

Why this matters for agent-driven clients: an agent that passes a stale or hallucinated parent UUID gets an opaque 500, reads it as a transient server error, and retries the same bad request repeatedly. In our logs we saw 3 identical 500s in a row for the same PATCH before the agent gave up and corrected the UUID. A 400/422 with a message like parent issue not found would let the client self-correct on the first try and would stop leaking the raw SQL/stack trace.

The same problem applies to goalId on the same endpoint (FK on goal_id).

Expected behavior

Return a 400/422 with a clear, machine-readable message such as parent issue not found (and goal not found for goalId). Validate that the referenced parent/goal exists before issuing the UPDATE, and never surface the raw SQL query or stack trace in the API response.

Steps to reproduce

1. Have an existing issue A.
2. Send PATCH /api/issues/{A} with body {"parentId": "a UUID that is NOT an existing issue id"}.
3. Observe HTTP 500 with a DrizzleQueryError / Postgres FK-violation body, instead of a 4xx validation error. (Same with {"goalId": "a non-existent goal id"}.)

Paperclip version or commit

2026.529.0 (Docker image ghcr.io/hostinger/hvps-paperclip:latest)

Deployment mode

Docker

Installation method

None

Agent adapter(s) involved

• Claude Code
• Codex
• Cursor
• Droid
• Hermes
• Custom / external plugin adapter
• Not adapter-specific (core bug)

Database mode

None

Access context

None

Node.js version

No response

Operating system

No response

Relevant logs or output

[07:44:35] ERROR: PATCH /api/issues/{id} 500 — Failed query: update "issues" set ... "parent_id" = $3 ... returning ...
  caused by: PostgresError: insert or update on table "issues" violates foreign key constraint "issues_parent_id_issues_id_fk"
    at PostgresJsPreparedQuery.queryWithCache (drizzle-orm/pg-core/session.js:41:15)
    at runUpdate (@paperclipai/server/dist/services/issues.js:3890:33)
    at routes/issues.js:3436:25


Three identical 500s in a row (07:44:35, 07:45:04, 07:45:16) for the same PATCH carrying a non-existent parentId; once the client corrected the UUID the next PATCH returned 200.

Relevant config (if applicable)

Additional context

Core server bug, not adapter-specific. Observed on the Hostinger-hosted Docker image (2026.529.0); the code path (routes/issues.js ~L3436 -> services/issues.js runUpdate ~L3890) is current on master. The same FK-violation-as-500 behaviour applies to goalId on the same endpoint.

Privacy checklist

• I have reviewed all pasted output for PII (usernames, file paths, API keys, tokens, company names) and redacted where necessary.