fix(rest): resolveErrorResponse's declared-4xx passthrough strips the declared-code prefix (#13095)

Spread the #12975 ruling's declared-code-anchored strip
(withoutDeclaredCodePrefix) to resolveErrorResponse's passThroughStatus 4xx
arm, converging every /data exit (batch/createMany/updateMany/deleteMany/
clone via handleRouteError) and, because the record-share classified arm
re-dresses the same classification, the share family with it. Converge the
approvals door's blanket /^[A-Z_]+:\s*/ strip onto the code the row answers
(the regex shape #12975 rejected). Correct the #8111 comment's false
mechanism claim in both homes (rest-server.ts and the sharing-envelope.test
docblock) without over-claiming the measured consequence. Move the
MEASURED-NOT-REPAIRED pin to the CONVERGENCE pin it announced, and add the
moved arm's own anchoring controls.

Per the 2026-08-31 maintainer ruling (option 1) on #13095.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UngCYXF98BVpYA9hfz6NYk

Author: claude

packages/rest/src/error-response.ts

@@ -1762,11 +1762,44 @@ function resolveErrorResponse(error: any, object?: string): { status: number; bo
         // means moving the STATUS this arm decided, which is the contract
         // question this card was fenced away from — filed separately.
         const businessMessage = sandboxBusinessMessage(error);
-        const safeMsg = businessMessage !== undefined
-            ? truncateClientMessage(businessMessage)
-            : typeof error.message !== 'string'
+        // [#13095] The sentence this arm hands the caller is the HUMAN half
+        // only — the same #12975 rule `classifyDataError`'s declared-4xx arm
+        // applies, spread here by the 2026-08-31 maintainer ruling (option 1:
+        // one envelope semantics on every `/data` exit). This arm is checked
+        // BEFORE it delegates to `mapDataError`, so every route that reports
+        // through `handleRouteError` / `sendThrownError` (batch, createMany,
+        // updateMany, deleteMany, clone, and the record-share classified arm,
+        // which re-dresses this very answer through `classifiedRefusalAnswer`)
+        // was still shipping the ADR-0111 `CODE:` prefix the by-id door had
+        // stopped shipping — one refusal, two readings, decided by which
+        // route caught it.
+        //
+        // Anchored to the DECLARED code ({@link withoutDeclaredCodePrefix} —
+        // ⛔ never a SCREAMING_SNAKE pattern; that function's docblock carries
+        // the safety argument), and run BEFORE the bound for #12975's reason:
+        // the prefix is not text addressed to the caller, so it must not
+        // spend the caller's #5423 budget. A message that is nothing but the
+        // prefix has no human half to ship and degrades to 'Request failed',
+        // the sibling arm's rule travelling WITH the strip.
+        //
+        // ⛔ What deliberately does NOT converge here: a genuinely EMPTY
+        // string message still ships as itself. This arm's degrade is keyed
+        // on the TYPE, unlike `classifyDataError`'s sibling which also checks
+        // length — a standing pin (`rest-hook-refusal-message-parity.test.ts`)
+        // this card's ruling did not authorise moving. The 'Request failed'
+        // limb below therefore fires only when the STRIP emptied a non-empty
+        // message, never for a message that arrived empty.
+        const addressed = businessMessage !== undefined
+            ? businessMessage
+            : typeof error.message === 'string' ? error.message : undefined;
+        const authored = addressed === undefined
+            ? undefined
+            : withoutDeclaredCodePrefix(addressed, error);
+        const safeMsg = authored === undefined
+            ? 'Request failed'
+            : authored.length === 0 && addressed !== undefined && addressed.length > 0
                 ? 'Request failed'
-                : truncateClientMessage(error.message);
+                : truncateClientMessage(authored);
         // [#9232] Narrowed, same as the three arms above.
         return withDeclaredUserMessage(error, {
             status: error.status,

packages/rest/src/rest-data-door-code-prefix.test.ts

@@ -372,13 +372,20 @@ describe('[#12975] the share family: convergence, and the two exits still carryi
         expect(dataAnswer.body.code).toBe('FORBIDDEN');
     });
 
-    it('⚠️ MEASURED, NOT REPAIRED HERE — two exits still ship the prefix', async () => {
-        // Recorded rather than fixed: the ruling moved ONE arm, and both exits
-        // below are reached through `resolveErrorResponse`'s own declared-4xx
-        // passthrough, which it did not name. Filed for the maintainer as
-        // #13095; this case is the evidence, and it REDS the day either exit is
-        // converged, which is the point — the follow-up moves it deliberately
-        // instead of discovering the divergence a third time.
+    it('CONVERGENCE [#13095] — the two exits that used to ship the prefix no longer do', async () => {
+        // ⚠️ MOVED DELIBERATELY. Until #13095 this case was titled
+        // "MEASURED, NOT REPAIRED HERE" and pinned the OLD truth — both exits
+        // below are reached through `resolveErrorResponse`'s declared-4xx
+        // passthrough (checked BEFORE it delegates to `mapDataError`), which
+        // the #12975 ruling did not name, so both still shipped
+        // `FORBIDDEN: ${ZH}` while the by-id door had converged. That case
+        // existed to red the day either exit converged, so the follow-up
+        // would move it deliberately instead of discovering the divergence a
+        // third time. This is that day: the 2026-08-31 maintainer ruling on
+        // #13095 (option 1) put the same declared-code-anchored
+        // `withoutDeclaredCodePrefix` in the passthrough arm, and the
+        // record-share classified arm converges with it for free because it
+        // re-dresses that same classification.
         //
         //   (a) the record-share family's CLASSIFIED arm — a producer that
         //       declared `{ code, status }` AND used the prefix idiom;
@@ -388,13 +395,99 @@ describe('[#12975] the share family: convergence, and the two exits still carryi
             boot({}, throwingShareService(sharingWriteRefusal())),
             'GET', SHARES, { params: { object: 'showcase_inquiry', id: 'rec1' } },
         );
-        expect(classified.body.error.message).toBe(`FORBIDDEN: ${ZH}`);
+        expect(classified.body.error.message).toBe(ZH);
+        expect(classified.body.error.code).toBe('FORBIDDEN');
 
         const bulk = await call(
             boot({ batchData: vi.fn().mockRejectedValue(sharingWriteRefusal()) }),
             'POST', `${COLLECTION}/batch`,
             { params: { object: 'showcase_inquiry' }, body: { operation: 'update', records: [{ id: 'r1' }] } },
         );
-        expect(bulk.body.error).toBe(`FORBIDDEN: ${ZH}`);
+        expect(bulk.body.error).toBe(ZH);
+        expect(bulk.body.code).toBe('FORBIDDEN');
+    });
+});
+
+// ---------------------------------------------------------------------------
+// §6 The passthrough arm's own controls — the strip stays ANCHORED (#13095)
+// ---------------------------------------------------------------------------
+
+describe('[#13095] the bulk door strips by declared code, never by pattern', () => {
+    const batchWith = (error: unknown) => call(
+        boot({ batchData: vi.fn().mockRejectedValue(error) }),
+        'POST', `${COLLECTION}/batch`,
+        { params: { object: 'showcase_inquiry' }, body: { operation: 'update', records: [{ id: 'r1' }] } },
+    );
+
+    it('⭐ a declared 4xx with NO `code` KEEPS its prefix — the token is nowhere else', async () => {
+        // §2's control, restated on the arm #13095 moved: `thrownCodeFields`
+        // answers `{}` for a producer that named no code, so stripping here
+        // would delete the only machine token in the response rather than
+        // move it to its axis.
+        const answer = await batchWith(thrown(`FORBIDDEN: ${ZH}`, { status: 403 }));
+        expect(answer.status).toBe(403);
+        expect(answer.body.error).toBe(`FORBIDDEN: ${ZH}`);
+        expect('code' in answer.body).toBe(false);
+    });
+
+    it('⭐ a prefix that does not name the declared code is left alone — driver prose stays', async () => {
+        const answer = await batchWith(
+            thrown('SQLITE_ERROR: no such table: showcase_inquiry', { code: 'FORBIDDEN', status: 400 }),
+        );
+        expect(answer.body.error).toBe('SQLITE_ERROR: no such table: showcase_inquiry');
+    });
+
+    it('a message that is nothing but the prefix degrades to the generic sentence', async () => {
+        const answer = await batchWith(thrown('FORBIDDEN:', { code: 'FORBIDDEN', status: 403 }));
+        expect(answer.body.error).toBe('Request failed');
+        expect(answer.body.code).toBe('FORBIDDEN');
+    });
+});
+
+// ---------------------------------------------------------------------------
+// §7 The approvals door — the third strip point, converged onto the anchor
+// ---------------------------------------------------------------------------
+
+describe('[#13095] the approvals door strips the code it answers, never a blanket pattern', () => {
+    const APPROVE = '/api/v1/approvals/requests/:id/approve';
+
+    const approveWith = (error: unknown) => {
+        const protocol: any = {
+            getDiscovery: vi.fn().mockResolvedValue({
+                version: 'v0', routes: { data: '', metadata: '', ui: '', auth: '/auth' },
+            }),
+            getMetaTypes: vi.fn().mockResolvedValue([]),
+            getMetaItems: vi.fn().mockResolvedValue([]),
+            findData: vi.fn().mockResolvedValue([]),
+        };
+        const rest = new RestServer(
+            mockServer() as any, protocol, { api: { requireAuth: false } } as any,
+            undefined, undefined, undefined, undefined, undefined, undefined,
+            undefined, undefined,
+            (async () => ({ decide: vi.fn().mockRejectedValue(error) })) as any,
+        );
+        (rest as any).resolveExecCtx = async () => ({ userId: 'u1' });
+        rest.registerRoutes();
+        return call(rest, 'POST', APPROVE, { params: { id: 'req_1' } });
+    };
+
+    it('the well-formed idiom is unchanged: the answered code is stripped from the sentence', async () => {
+        const answer = await approveWith(thrown(`FORBIDDEN: ${ZH}`));
+        expect(answer.status).toBe(403);
+        expect(answer.body.code).toBe('FORBIDDEN');
+        expect(answer.body.error).toBe(ZH);
+    });
+
+    it('⭐ a LONGER token sharing the matched spelling is NOT eaten — the blanket regex would have', async () => {
+        // The distinguisher between the old `/^[A-Z_]+:\s*/` strip and the
+        // anchored one: `/^FORBIDDEN/` matches this message, so the row
+        // answers `code: 'FORBIDDEN'` — but the sentence opens with a
+        // DIFFERENT token, which the wire carries nowhere else. The blanket
+        // regex deleted it; the anchored strip removes only a duplicate of
+        // the code being answered (#12975's rule, spread by #13095).
+        const answer = await approveWith(thrown('FORBIDDEN_BY_POLICY: contact your administrator'));
+        expect(answer.status).toBe(403);
+        expect(answer.body.code).toBe('FORBIDDEN');
+        expect(answer.body.error).toBe('FORBIDDEN_BY_POLICY: contact your administrator');
     });
 });

packages/rest/src/rest-server.ts

@@ -10304,12 +10304,23 @@ export class RestServer {
         // signals the verdict via message prefixes, the plugin's established
         // error idiom — this maps them onto HTTP. Returns true when handled.
         //
-        // [#8111] The prefix is a SERVER-INTERNAL service→REST derivation: it
-        // is stripped below and never reaches the wire, so no consumer can
-        // read it (censused at claim — the only in-repo `startsWith(CODE)`
-        // readers are this file's own route mappings plus one
-        // `plugin-approvals` check on an error it threw itself in-process).
-        // It therefore stays exactly as it is; only the response SHAPE moved.
+        // [#8111] The prefix is a SERVER-INTERNAL service→REST derivation.
+        // ⚠️ [#13095] This comment used to claim the MECHANISM guaranteed
+        // that: "it is stripped below and never reaches the wire". That was
+        // true of the prefix-idiom arm it was written about and FALSE for the
+        // classified limb #11683 added beside it, which re-dresses
+        // `resolveErrorResponse`'s answer — an answer that shipped the prefix
+        // inside the sentence until the 2026-08-31 ruling converged that arm
+        // onto the same declared-code-anchored strip. Even now the strip is
+        // ANCHORED (it removes only a prefix restating the declared code), so
+        // "never reaches the wire" is not a mechanism anyone may lean on.
+        // What holds instead is MEASURED, not guaranteed: no consumer
+        // branches on the prefix in the wire `error` text — censused at
+        // #8111's claim and re-censused 2026-09-01 (objectstack + objectui:
+        // zero wire readers; every `startsWith(CODE)` hit is this file's own
+        // route mappings or an in-process producer-side check; `cloud` was
+        // not reachable and is NOT measured). The prefix idiom itself stays
+        // exactly as it is; #8111 moved only the response SHAPE.
         //
         // [#11683] …and it stays exactly as it is here too. What moved is that
         // the prefix read is no longer the FIRST question, and no longer the
@@ -11403,7 +11414,18 @@ export class RestServer {
             ];
             for (const [re, status, code] of mapping) {
                 if (re.test(msg)) {
-                    res.status(status).json({ code, error: msg.replace(/^[A-Z_]+:\s*/, '') });
+                    // [#13095] The strip is anchored to the CODE this row just
+                    // answered — the same declared-code anchoring
+                    // `withoutDeclaredCodePrefix` (error-response.ts) and
+                    // `respondSharingError`'s prefix arm apply, converged here
+                    // by the 2026-08-31 ruling. The blanket
+                    // SCREAMING_SNAKE-colon regex that used to sit here
+                    // (`/^[A-Z_]+:\s*/`) is exactly the shape #12975 rejected:
+                    // it could eat a token the wire carries nowhere else (a
+                    // message opening with a DIFFERENT capitalised word and a
+                    // colon), where the anchored form can only ever remove a
+                    // duplicate of the `code` already on the wire.
+                    res.status(status).json({ code, error: msg.replace(new RegExp(`^${code}:\\s*`), '') });
                     return true;
                 }
             }

packages/rest/src/sharing-envelope.test.ts

@@ -24,11 +24,18 @@
  *
  * `respondSharingError` recovers the verdict by parsing the service's message
  * text (`msg.startsWith(CODE)`) and then STRIPS that prefix before answering.
- * The prefix is a server-internal service→REST derivation that never reaches
- * the wire, so no consumer can read it — censused at claim. It is therefore
- * untouched here: this card moved the response SHAPE only. `stripsThePrefix`
- * below pins that the stripping still happens, so a future reader does not
- * "restore" a prefix the wire never carried.
+ * The prefix is a server-internal service→REST derivation. ⚠️ [#13095] This
+ * docblock used to say the mechanism guaranteed that ("never reaches the
+ * wire") — false for the CLASSIFIED limb #11683 later added beside this arm,
+ * which re-dressed `resolveErrorResponse`'s answer prefix and all until the
+ * 2026-08-31 ruling converged that arm onto the same declared-code-anchored
+ * strip. What holds is MEASURED, not guaranteed: no consumer branches on the
+ * prefix in the wire text (censused at #8111's claim; re-censused 2026-09-01
+ * over objectstack + objectui with zero wire readers; `cloud` unreachable,
+ * NOT measured). The prefix idiom itself is untouched here: #8111 moved the
+ * response SHAPE only. `stripsThePrefix` below pins that the stripping still
+ * happens, so a future reader does not "restore" a prefix the wire does not
+ * carry on this arm.
  *
  * ## What these cases assert, and why not `toThrow`
  *