# Premium DM Source DB Network Error Passthrough

## Analysis

| Area | Boundary | Verification |
| --- | --- | --- |
| Agent source DB query | Source DB network/MySQL failures should be returned as `ExecSQLOnDMSourceResponse.error_msg` with nil RPC error. | Agent unit tests cover local TCP connection refusal and classifier cases. |
| Agent/internal failures | Missing profile, decrypt/TLS/setup failures, and caller context cancellation remain real errors. | Existing behavior remains, plus classifier tests reject context cancellation/deadline. |
| Premium DM service | Transport errors from mgmt proxy/agent stay generic; payload `error_msg` and mgmt-proxy 504 source DB timeout messages are returned to users. | Controller tests cover payload passthrough, gateway source DB timeout passthrough, and transport generic fallback. |

## Execution Steps

1. Add a source DB payload-error classifier in `dataflow-agent-ng/agent/grpc/services.go`.
   - Success: MySQL errors and DB network errors return message text; caller context errors return empty.
   - Verify: `GOPATH=/Users/leon/.gvm/gos/go1.25.5/global go test ./agent/grpc -run 'TestExecSQLOnDMSource|TestSourceDBPayloadErrorMessage' -count=1`.

2. Use the classifier only in `ExecSQLOnDMSource` query execution.
   - Success: agent returns HTTP/RPC success with `error_msg` for source DB connection failures.
   - Verify: same agent test command.

3. Preserve premium DM service error lanes.
   - Success: `resp.error_msg` propagates; 504 responses with source DB `dial tcp` messages propagate; generic agent transport errors still become `failed to connect database`; retry aggregation does not leak `All attempts fail`.
   - Verify: `GOPATH=/Users/leon/.gvm/gos/go1.25.5/global go test ./app/controllers/premium_dm -run TestValidatePremiumMigrationSourceConn -count=1`.

## Risk Assessment

- No public proto or generated-code changes.
- Source DB network messages are exposed only after the agent reports a source-side DB driver failure, either in the success payload or in the mgmt-proxy 504 body for the source SQL endpoint.
- Transport/infrastructure errors without a source DB network signature remain generic to users.