[SAY-5]

Closes #1705

What changed

The RECORD_ARRAY(...) guard in extractRecordArrayEntry used && where it needed ||, so a cell missing its closing parenthesis was accepted and lost its last character. Each field was also split on every colon, so a value like 10:30 was stored as 10; fields are now split on their first colon only, and a field with no colon is rejected as a malformed record.

[joshunrau]

Thanks for picking this up. The guard fix and the first-colon split are correct and match #1705, and both new tests fail on main and pass with your change, which is what we want. Two things are needed before this can merge:

1. Test the new "field with no colon" rejection. apps/web/src/utils/upload.ts:171 now rejects a field like quantity with no : as a malformed record. That is a good change, but no test covers it: deleting separatorIndex === -1 || leaves the whole suite green. Please add a case to the Zod 3 record arrays suite in apps/web/src/utils/__tests__/upload.test.ts (around lines 509-552). For example, processItems('RECORD_ARRAY(name:item1,quantity)') should reject with "Malformed record at index 1 at column name: 'items' and row number '1'".
2. Add the end-to-end test. Every change in this repo needs a Playwright test in testing/ as well as a unit test, and #1705 asks for one in testing/src/specs/upload.spec.ts: upload a record-array cell that is missing its closing parenthesis, and assert that the error names the column. One thing to know up front: none of the seeded instruments has a record-array field (the demo catalog in apps/api/src/demo/demo.service.ts seeds only the three forms under packages/instrument-library/src/forms). So the spec has to create one first. You can post a form bundle with a record-array field to POST /api/v1/instruments, using a token from GET /api/v1/auth/create-instrument-token. testing/src/specs/authorization.spec.ts (lines 384-408) shows how to do that. A helper in testing/src/support/api-client.ts is the natural home for it. Make sure the acting user's group has access to the new instrument before the test opens /upload. .agents/docs/playbooks/add-e2e-test.md walks through the rest.

If you hand this to Claude Code, Opus 5 is the right size. The end-to-end test needs a new way to seed a custom instrument into the suite, and there is no existing pattern to copy.

Reviewed at commit 2ffc557.