@@ -0,0 +1,11 @@
+---
+'@objectstack/rest': patch
+---
+
+A sandboxed hook or action that fails on the sandbox's own fault (a capability it was not granted, a `ctx.api` method that is missing or unavailable, a CPU budget or wall-clock ceiling, an install or marshal failure) is now answered by the hand-built write routes the way `POST /api/v1/data/:object` answers it: a withheld `500` with `Internal server error`. The runner's diagnostic text, which names the hook, the object and the capability, goes to the server log only.
+
+Clause-②: no
+
+Before, 23 write routes relayed that text to the caller: `POST /analytics/dataset/query`, `POST /security/explain`, `POST` and `DELETE /data/:object/:id/shares`, the three sharing-rule writes, the two suggested-binding writes, the nine approval-request writes, `POST /packages/publish` and the four `POST /datasources/:name/external/*` routes. Most of them answered `500` with their own fault code, and the four external routes answered `400`. Twenty-one of them now answer `500 INTERNAL_ERROR`, the answer each already gave a sandboxed body that crashed. The record-share routes (and the share list, `GET /data/:object/:id/shares`) keep their own `500` and `SHARE_*_FAILED` code, as they do for a crash, and withhold the sentence the same way.
+
+A refusal a sandboxed body throws keeps its own sentence and status on every route. No key, default, enum member or export moves.
@@ -61,6 +61,7 @@ import {
     fiveXxArmDisplacesDeclared4xx,
     isSandboxCrash,
     isSandboxOrigin,
+    isSandboxOwnFault,
     mapDataError,
     sandboxBusinessMessage,
     structuredCodeAnswer,
@@ -698,7 +699,17 @@ export function classifiedRefusalAnswer(
  *  - a refusal that DECLARED a server-band status. The doors keep the status
  *    and withhold the prose (#5437) unless the producer declared it a refusal
  *    (#16146); the families folded it into their own `500` with the wrapper,
- *    or relayed the sentence at the declared status.
+ *    or relayed the sentence at the declared status;
+ *  - [#22885] the sandbox's OWN fault ({@link isSandboxOwnFault}): a
+ *    `SandboxError` the runner raised itself, with no `innerMessage` — a
+ *    denied capability, an unavailable `ctx.api` or a missing `ctx.api`
+ *    method, a budget, an install or marshal failure, a nested body's fault
+ *    relayed one VM hop up. It is no sandbox ORIGIN, so it fell past the two
+ *    shapes above to each family's own terminal, which relayed the runner's
+ *    diagnostic text (naming the hook, the object, the capability) where the
+ *    `/data` door answers `500 INTERNAL_ERROR` (#22868). Measured: twenty-three
+ *    write rows across these families answered that text, the four external
+ *    ones at `400`.
  *
  * ## One answer, not a second fault terminal
  *
@@ -712,6 +723,11 @@ export function classifiedRefusalAnswer(
  * the original error first: the client no longer reads the words, so the
  * operator must.
  *
+ * [#22885] The own fault takes that same terminal, recognised by the predicate
+ * `classifyDataError` asks (#22868): the producer's identity, never its text,
+ * so the same words thrown by anything else keep the catching route's answer.
+ * ⛔ Not a second rule: no own-fault branch of its own here or in a family.
+ *
  * ## What it deliberately leaves alone
  *
  *  - A throw that is not a sandbox's. A producer-declared 5xx from a service
@@ -725,6 +741,7 @@ export function classifiedRefusalAnswer(
 export function sandboxFaultAnswer(
     error: any,
 ): { status: number; body: Record<string, unknown> } | undefined {
+    if (isSandboxOwnFault(error)) return resolveErrorResponse(error);
     if (!isSandboxOrigin(error)) return undefined;
     if (!isSandboxCrash(error)) {
         const declared = declaredHttpStatus(error);
 
@@ -418,6 +418,8 @@ export function registerExternalDatasourceRoutes(
    * longer reads its words. Before, both reached this family's `400`: a crash
    * as the caller's mistake, with the QuickJS wrapper around the native error
    * text, and a declared `503` as a client error carrying its sentence.
+   * [#22885] The sandbox's own fault (a denied capability, a budget) is that
+   * answer's too, and reached this `400` with the runner's text until then.
    *
    * ⛔ Every other throw keeps this family's own `400` and code, a declared 4xx
    * included: a sandboxed refusal declaring one, and the metadata door's
 
@@ -211,10 +211,12 @@ async function refusePackageRequest(
  * answered `500 INTERNAL_ERROR` with the QuickJS wrapper around the native
  * error text (the business read declines a crash, so the raw message stood),
  * and a refusal that DECLARED `503` answered at its status with its sentence.
- * {@link sandboxFaultAnswer} is the doors' answer for exactly those two, so it
+ * {@link sandboxFaultAnswer} is the doors' answer for those two, so it
  * is asked first and re-dressed whole, the way the nested families re-dress
  * it. The original error is logged first, the one place its words now reach.
- * Every other throw is answered below exactly as before.
+ * [#22885] It answers the sandbox's own fault too (a denied capability, a
+ * budget), which reached the raw message below until then. Every other throw
+ * is answered below exactly as before.
  */
 function sendThrownError(res: any, error: unknown): void {
   const fault = sandboxFaultAnswer(error);
 
@@ -11936,11 +11936,26 @@ export class RestServer {
          *
          * The full wrapper still reaches the operator: every caller logs the
          * whole error object immediately above its `respondError`.
+         *
+         * [#22885] …and the sandbox read is the doors' own now. The runner's
+         * OWN fault (a denied capability, a missing `ctx.api` method, a
+         * budget) carries no `innerMessage`, so the read above let it through
+         * and these arms relayed the runner's diagnostic text. The sentence is
+         * {@link sandboxFaultAnswer}'s, the answer the other hand-built
+         * families give every sandbox fault, so a crash, a declared 5xx and an
+         * own fault read one withheld sentence here as there. ⛔ Only the
+         * SENTENCE: this family's own `500` and `SHARE_*_FAILED` code stay the
+         * recorded exception the write-route ledger names (#22764's
+         * `OWN_FAULT_TERMINAL`), a decision this does not take. The
+         * `innerMessage` read stays for any sandbox origin that answer declines.
          */
-        const sharingFaultMessage = (error: any): string =>
-            typeof error?.innerMessage === 'string' && error.innerMessage
+        const sharingFaultMessage = (error: any): string => {
+            const fault = sandboxFaultAnswer(error);
+            if (fault !== undefined) return nestedRefusalEnvelope(fault).message;
+            return typeof error?.innerMessage === 'string' && error.innerMessage
                 ? INTERNAL_ERROR_MESSAGE
                 : String(error?.message ?? error).slice(0, 500);
+        };
 
         // GET — list shares on a record. [ADR-0111 D5] Management-gated in the
         // service: invisible record → 404, visible-but-not-manager → 403.
 
@@ -48,12 +48,20 @@
  * holds each to the doors' answer: their status and code, their withheld
  * sentence, and no trace of the native text or the wrapper. §2 stays the
  * control: a refusal keeps its sentence on the same rows.
+ *
+ * [#22885] …and with the sandbox's OWN fault, one shape per kind the runner
+ * raises itself (`isSandboxOwnFault`), held to the same answer. Measured
+ * before the repair: twenty-three of these rows relayed the runner's text at
+ * their own terminal, while the crash and declared-5xx shapes, the CONTROL,
+ * already read the doors' answer on every row and are unchanged by it.
  */
 
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi, beforeAll, afterAll, type MockInstance } from 'vitest';
 import { RestServer } from './rest-server.js';
 import { mountAndRecordDirectRoutes } from './direct-mount-composition.js';
 import { REST_ROUTE_LEDGER } from './rest-route-ledger.js';
+import { sandboxFaultAnswer } from './error-response.js';
+import { isSandboxOwnFault } from '@objectstack/types';
 
 const SENTENCE = 'Locked rows cannot be changed here.';
 const WRAPPER = `hook 'mz_guard' threw: Error: ${SENTENCE}`;
@@ -563,26 +571,80 @@ describe('[#22719] §5 the repaired rows: a fault keeps its own terminal, a refu
 // ─── [#22764] the fault side: every driven row answers as the doors do ──────
 
 /**
- * The two sandbox shapes the doors answer as FAULTS, the status and code they
+ * [#22885] The sandbox's OWN fault: a `SandboxError` the runner raised itself,
+ * not one a body threw. Its producer (`runtime/src/sandbox/quickjs-runner.ts`)
+ * names the class `'SandboxError'` and leaves `innerMessage` unset for "the
+ * sandbox's own internal errors (capability denials, timeouts, marshalling
+ * failures)", so `isSandboxOwnFault` (`@objectstack/types`) answers `true` and
+ * the doors answer it as a fault (#22868).
+ *
+ * Built from that constructor, as {@link sandboxRefusal} is, because this
+ * package does not depend on `@objectstack/runtime` and no factory exports the
+ * runner's raise sites: their census lives inside `@objectstack/core`'s
+ * `import-runner-sandbox-fault-row.test.ts`. One shape per kind that census
+ * names, each message rendered from its raise site's template.
+ */
+function sandboxOwnFault(message: string): () => Error {
+    return () => {
+        const err = new Error(message);
+        err.name = 'SandboxError';
+        return err;
+    };
+}
+
+const OWN_FAULT = { status: 500, code: 'INTERNAL_ERROR' } as const;
+
+/**
+ * The sandbox shapes the doors answer as FAULTS, the status and code they
  * answer each with, and the text that must not reach the caller: the native
- * error a crash carries, and the prose a declared 5xx withholds.
+ * error a crash carries, and the prose a declared 5xx withholds. [#22885] The
+ * CONTROL for {@link SANDBOX_OWN_FAULTS}: unchanged by that card.
  */
-const SANDBOX_FAULTS = [
+const SANDBOX_FAULT_CONTROLS = [
     ['a body that CRASHED', sandboxCrash, { status: 500, code: 'INTERNAL_ERROR' }, /TypeError|boom/],
     ['a refusal that declared a 5xx', sandboxDeclared5xx, { status: 503, code: 'SERVICE_UNAVAILABLE' }, /ledger/],
 ] as const;
 
+/** [#22885] The runner's own faults, one per kind, and the diagnostic text each must not relay. */
+const SANDBOX_OWN_FAULTS = [
+    ['the sandbox\'s own fault: CPU budget',
+        sandboxOwnFault("hook 'mz_guard' exceeded CPU budget of 50ms (after 3 pump iterations)"), OWN_FAULT, /budget/],
+    ['the sandbox\'s own fault: wall-clock ceiling',
+        sandboxOwnFault("hook 'mz_guard' exceeded wall-clock ceiling of 30000ms while awaiting host calls (after 3 pump iterations)"),
+        OWN_FAULT, /ceiling/],
+    ['the sandbox\'s own fault: a capability denial naming the object',
+        sandboxOwnFault(`capability 'api.read' not granted to hook 'mz_guard' (called ctx.api.object('${OBJECT}').find)`),
+        OWN_FAULT, /capability|granted/],
+    ['the sandbox\'s own fault: ctx.api unavailable',
+        sandboxOwnFault("ctx.api unavailable in hook 'mz_guard'"), OWN_FAULT, /unavailable/],
+    ['the sandbox\'s own fault: an install failure',
+        sandboxOwnFault('failed to install ctx.api.transaction: SyntaxError: unexpected token'), OWN_FAULT, /install|SyntaxError/],
+    ['the sandbox\'s own fault: a marshal failure',
+        sandboxOwnFault('failed to marshal host value: SyntaxError: unexpected token'), OWN_FAULT, /marshal|SyntaxError/],
+    ['the sandbox\'s own fault: a nested transaction refusal',
+        sandboxOwnFault('nested ctx.api.transaction is not supported'), OWN_FAULT, /transaction|supported/],
+    ['the sandbox\'s own fault: a missing ctx.api method naming the object',
+        sandboxOwnFault(`ctx.api.object('${OBJECT}').find not implemented`), OWN_FAULT, /implemented|ctx\.api/],
+    ['the sandbox\'s own fault: a nested body\'s crash relayed one VM hop up',
+        sandboxOwnFault("hook 'mz_inner' threw: TypeError: boom"), OWN_FAULT, /TypeError|boom/],
+] as const;
+
+const SANDBOX_FAULTS = [...SANDBOX_FAULT_CONTROLS, ...SANDBOX_OWN_FAULTS] as const;
+const OWN_FAULT_SHAPES: ReadonlySet<unknown> = new Set(SANDBOX_OWN_FAULTS);
+
 /**
  * Driven rows that answer a sandboxed fault at their OWN terminal rather than
  * the doors' status and code, with the reason. Closed. The words are withheld
  * on both all the same, and §6 still holds them to the doors' sentence.
+ * [#22885] The own-fault shapes take the same exception: the family's sentence
+ * is `sandboxFaultAnswer`'s, its status and code its own, as for a crash.
  */
 const OWN_FAULT_TERMINAL: ReadonlyMap<string, { status: number; code: string; reason: string }> = new Map([
     ['POST /api/v1/data/:object/:id/shares', {
         status: 500, code: 'SHARE_GRANT_FAILED',
-        reason: "the record-share family withholds a sandbox's words at its own 500 (`sharingFaultMessage`) and "
-            + 'folds a declared 5xx into that terminal by a recorded choice (#11683, #12693); neither is a '
-            + 'leak, and its status and code are a decision this card does not take',
+        reason: "the record-share family withholds a sandbox's words at its own 500 (`sharingFaultMessage`, which "
+            + "reads `sandboxFaultAnswer`'s sentence) and folds a declared 5xx into that terminal by a recorded "
+            + 'choice (#11683, #12693); neither is a leak, and its status and code are a decision this card does not take',
     }],
     ['DELETE /api/v1/data/:object/:id/shares/:shareId', {
         status: 500, code: 'SHARE_REVOKE_FAILED',
@@ -591,6 +653,20 @@ const OWN_FAULT_TERMINAL: ReadonlyMap<string, { status: number; code: string; re
 ]);
 
 describe('[#22764] §6 every driven write row answers a sandboxed fault as the doors do, its words withheld', () => {
+    // [#22885] §6 observes the REST fault log: a withheld own fault's words must
+    // still reach the operator. 'info' is the SHIPPED default, declared here
+    // as `scripts/check-rest-log-spy-declared.mjs` requires; the spy swallows
+    // the output.
+    let faultLog: MockInstance<typeof console.error>;
+    beforeAll(() => {
+        vi.stubEnv('OS_REST_LOG', 'info');
+        faultLog = vi.spyOn(console, 'error').mockImplementation(() => {});
+    });
+    afterAll(() => {
+        faultLog.mockRestore();
+        vi.unstubAllEnvs();
+    });
+
     it('the reference: the `/data` door answers each shape at the pinned status and code', async () => {
         for (const [label, error, doors, leak] of SANDBOX_FAULTS) {
             const res = await drive(boot(error), 'POST /api/v1/data/:object', { name: 'x' });
@@ -600,15 +676,26 @@ describe('[#22764] §6 every driven write row answers a sandboxed fault as the d
         }
     }, 60_000);
 
+    it('[#22885] the own-fault shapes are the shared predicate\'s, read off the producer and never its words', () => {
+        for (const [label, error] of SANDBOX_OWN_FAULTS) {
+            expect(isSandboxOwnFault(error()), label).toBe(true);
+            // CONTROL: the same words thrown by anything else are not the answer's.
+            expect(sandboxFaultAnswer(new Error(error().message)), label).toBeUndefined();
+        }
+        for (const [label, error] of SANDBOX_FAULT_CONTROLS) expect(isSandboxOwnFault(error()), label).toBe(false);
+    });
+
     it('every row naming its own terminal is a driven row', () => {
         for (const route of OWN_FAULT_TERMINAL.keys()) expect(Object.keys(ANSWERS_THE_SENTENCE), route).toContain(route);
     });
 
     for (const [route, driver] of Object.entries(ANSWERS_THE_SENTENCE)) {
-        for (const [label, error, doors, leak] of SANDBOX_FAULTS) {
+        for (const shape of SANDBOX_FAULTS) {
+            const [label, error, doors, leak] = shape;
             it(`${route}: ${label}`, async () => {
                 const door = await drive(boot(error), 'POST /api/v1/data/:object', { name: 'x' });
                 const b = boot(error, driver.protocol?.(error));
+                faultLog.mockClear();
                 const res = await drive(b, route, driver.body ?? {});
                 // Read first: the async job's worker writes after the `201`.
                 const answer = driver.answer ? await driver.answer(res, b) : sentenceOf(res.body);
@@ -624,6 +711,12 @@ describe('[#22764] §6 every driven write row answers a sandboxed fault as the d
                 const expected = OWN_FAULT_TERMINAL.get(route) ?? doors;
                 expect(res.statusCode).toBe(expected.status);
                 expect(codeOf(res.body)).toBe(expected.code);
+                if (!OWN_FAULT_SHAPES.has(shape)) return;
+                // [#22885] The whole error, not a summary of it, reaches the log.
+                const runnerText = error().message;
+                const logged = faultLog.mock.calls.some((args) => args.some((arg) =>
+                    arg instanceof Error && arg.name === 'SandboxError' && arg.message === runnerText));
+                expect(logged, 'the runner\'s error reaches the server log').toBe(true);
             }, 60_000);
         }
     }
Original file line number	Diff line number	Diff line change
`@@ -418,6 +418,8 @@ export function registerExternalDatasourceRoutes(`
`418`	`418`	* longer reads its words. Before, both reached this family's `400`: a crash
`419`	`419`	`* as the caller's mistake, with the QuickJS wrapper around the native error`
`420`	`420`	* text, and a declared `503` as a client error carrying its sentence.
	`421`	`+ * [#22885] The sandbox's own fault (a denied capability, a budget) is that`
	`422`	+ * answer's too, and reached this `400` with the runner's text until then.
`421`	`423`	`*`
`422`	`424`	* ⛔ Every other throw keeps this family's own `400` and code, a declared 4xx
`423`	`425`	`* included: a sandboxed refusal declaring one, and the metadata door's`