[Decision] Is ADR-0112's declaredCode channel in scope for 5xx sanitisation at all — and the answer must be applied to all three doors at once

Filed by the domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd, as option C of the fork the #12405 dev raised on PR #12508 and correctly reported rather than decided. That card shipped A under this seat's ruling; this is the follow-up A was ruled without prejudice to.

The question

When a 5xx has its prose withheld, should the producer's demoted declaredCode be withheld with it?

Today the answer is "no" at every door, and at none of them is that a decision anyone made — it is what each door's structure produces.

Measured (on `origin/main`, by the #12405 dev)

A bare driver error (code: 'SQLITE_ERROR' or '42P01', no declared status) resolves to status 500 / code INTERNAL_ERROR with demotedDeclaredCode = the driver's own string. The door then withholds the leaky message (#8086) and puts SQLITE_ERROR on the wire in declaredCode.

⚠️ The flat /data door does not produce that combination — but for a structural reason, not a decision. Its thrownCodeFields is reached only on the declared-5xx passthrough arm, while a bare driver error falls to DATA_STORE_FAULT's fixed body. resolveThrownHttpError's fallback-to-500 is what creates the shape, and it creates it at the nested door only.

⇒ Three doors, one of which can emit a driver dialect on the wire in a channel the other two cannot reach — and the difference is an accident of control flow.

Why it is a decision card and not a fix

The disclosure is real but narrow: SQLITE_ERROR vs 42P01 names the backend, which is one of the two things the message withhold exists to protect (the other, identifiers, is already covered). Against that:

⛔ Withholding at one door invents a third rule and re-creates the divergence rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405 just closed.
⛔ Withholding at all doors silently drops the author-authored channel for exactly the metadata-app 5xx refusals ADR-0112's amendment wrote it for.

That is a scope question about the ADR's channel, not a bug in any one registrar.

⭐ Sequencing note — this is the CODE axis of a question already open on the PROSE axis

#12281 asks whether errorResponseBase should adopt /data's "withhold every declared 5xx" rule for the message. This card asks the same shape of question one channel over, for declaredCode. Both are cross-door 5xx-sanitisation scope questions; both carry needs:contract-review; and an answer to either that ignores the other is how the doors end up disagreeing on a new axis. They should be read together, and probably ruled together.

Not established here

Whether a driver errno can reach a producing seam at all. ⭐ At rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405's four seams it cannot: PackageService discriminates on the status channel, never .code, precisely so driver faults are not re-thrown as refusals. That measurement is what makes today's no safe rather than merely consistent — ⚠️ and it is a premise that can rot. The other doors' seams are unmeasured.
Severity not judged.

Region

packages/rest/src/package-routes.ts (sendThrownError) · packages/rest/src/error-response.ts (thrownCodeFields, the declared-5xx arm) · packages/runtime/src/http-dispatcher.ts (errorFromThrown) — and packages/types/src/thrown-http-error.ts, which owns the fallback-to-500 that creates the shape.

⚠️ packages/rest/src/rest-server.ts is held by open PR #12421 (#11926).

Refs

rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405 / PR fix(rest): the package door carries the demoted producer code on declaredCode (#12405) #12508 — where the fork was raised, and where option A is pinned as a live case
runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 — the prose axis of the same cross-door question
The direct-mount package door ships 5xx messages verbatim — no leak heuristic, unlike the dispatcher twin and unlike rest-server's own /data exit #8086 · /analytics/query 仍把 RLS 策略字段名回显给调用方 —— read-scope 拒收的泄漏在姐妹面上没堵,#5367 只堵了 dataset 路由 #5811 — the message withhold and why it was made structural
ADR-0112 · [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 · finding: packages/rest's flat sendThrownError still puts a thrown error's code on the wire un-narrowed — ADR-0112's closure does not reach that door #9232 — the channel and the two doors that already emit it

Triage (triage seat, hourly round 2026-08-26, session session_01DoScS7Ei3iWc39AgGN36wU): re-graded pm:queue → needs-user-decision, type Task; domain:cli and needs:contract-review kept. The card is a [Decision] by its own text — an ADR-0112 scope question ("is declaredCode in scope for 5xx sanitisation, answered at all three doors at once"), which sits on the manual floor (public-contract change class); pm:queue says "dispatchable, no open question", which contradicts the card's own body. No dispatch may pick it up while this label stands. Pairing note for the maintainer: #12281 is the prose axis of the same cross-door question and the two should be read/ruled together (this card's own ⭐ sequencing note); #12281 stays in the cli lane's queue because its first step is a measurement, but the ruling here should be written so it covers both channels.

os-decision-facets

实际业务拉动:泄露面窄但真实 —— 500 兜底路径把 SQLITE_ERROR / 42P01 这类驱动方言放上 wire,等于向调用方点名后端(message withhold 要保护的两件事之一);同时该通道的正当用途(metadata-app 作者自声明的 5xx 拒绝码)是 ADR-0112 修正案专门写进去的,全量吞掉会伤到真实用户场景。
项目长远合理性:三门一规则 —— 今天「nested 门能发、另两门发不到」是控制流意外而非决定;答案应写进 ADR-0112 的 scope 行,由共享 resolver 一处承载,别让每个 registrar 自带一套。
防 AI 犯错:现状的安全性挂在一条未测且会烂的前提上(driver errno 到不了 producing seam —— 只在 rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405 的四个 seam 测过,另两门未测);把裁决落成结构性判据 + pin,出错方向从「静默泄露」变为「响亮拒绝」。
创业阶段不扩散:最小合规动作是把「demoted ≠ author-declared」这条既有区分用起来,不新增通道、不新增行为面。
选项与推荐:A — 三门都不 withhold(把现状记录为决定,补 pin 钉住未测前提);B — 三门全 withhold(⛔ 卡文已指出会吞掉作者通道);C — 只改 nested 门(⛔ 卡文已否:再造刚收敛掉的分歧);D(推荐)— 按来源切分:demoted(未注册、降级而来)的 code 在 5xx 消毒时随 prose 一并 withhold,作者显式声明的 declaredCode 保留;在共享 resolver 一处实现,三门继承;与 runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 的 prose 轴同一次裁决落地。
置信缺口:另两门的 seam 未测(driver errno 可达性);是否已有消费方依赖 wire 上的 demoted 串未测;runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 的人口测量(无 code 的 declared 5xx 生产者是否存在)未做 —— D 若裁定,实施卡应先补这三个读数。

Generated by Claude Code

Maintainer ruling recorded — Option D: split by provenance; one rule at the shared resolver, three doors inherit — and the ruling covers #12281's prose axis

Provenance: maintainer, 2026-08-27, PM chat decision-inbox batch 3 (adjudication session session_01DKWDdUJ2XNRESVVWUvcpnh), verbatim: 「同意」 — accepting the triage recommendation D (2026-08-26T07:17Z facet block). ⛔ A (record the leak as a decision), B (withhold the author channel too), and C (a per-door rule) are all declined for the reasons on the card.

Ruled, as ADR-0112 scope: in 5xx sanitisation, a DEMOTED code — one the fallback-to-500 picked up from an undeclared producer (demotedDeclaredCode, e.g. a driver errno such as SQLITE_ERROR / 42P01) — is withheld along with the prose; an AUTHOR-DECLARED declaredCode survives. Implemented once at the shared resolver layer so all three doors inherit one rule; ⛔ no per-registrar variants.

Same ruling, prose axis (#12281): the dispatcher door's errorResponseBase adopts the structural withhold for EVERY declared 5xx message, aligning to /data — the author's user-facing text channel is userMessage (#9934), never the raw message. #12281 stays in the cli lane's queue with its measurement-first step; its ruling is this one.

Dispatch constraints: Clause-②: yes (needs:contract-review on the card) — contract-review tier. The implementing dispatch's FIRST readings are the three named gaps: (a) driver-errno reachability at the other two doors' seams; (b) whether any consumer depends on demoted strings currently on the wire; (c) #12281's population measurement (declared-5xx-no-code producers). ⚠️ packages/rest/src/rest-server.ts is held by open PR #12421 — serial constraint at dispatch.

State: needs-user-decision → pm:queue.

Generated by Claude Code

🔒 Claimed — `domain:cli` 席位 (#6024), R47。Clause-②: yes

Session session_01UjujZN219uFzBhSYfMykCd,identity os-litant。Branch claude/issue-12509-demoted-code-withhold。

⭐ Clause-② 声明 = yes,按总监席 2026-08-28 执行的 #12887 裁定:该标签只在存在可评审契约增量时挂,⇒ PR 一开,needs:contract-review 自动重挂,由合约评审层处理。⛔ 本席位不清除、也不预挂。

围栏实测 @ 08:09:29Z,origin/main=aef1b7e64(16 个开放 PR / 560 文件并集):packages/rest/src/rest-server.ts 与 packages/rest/src/error-response.ts 均自由。⚠️ 卡上 2026-08-27 那条「被 PR #12421 持有」的提示已过期 —— ⛔ 别照抄它,自己在第一次编辑前重推一遍(并记下你推的时刻)。

Ruling 1 · 维护者已裁 Option D,⛔ 你不做取舍

裁定(2026-08-27,adjudication session_01DKWDdUJ2XNRESVVWUvcpnh,「同意」):

降级而来的 code(fallback-to-500 从未注册的 producer 捡到的,例如驱动 errno)在 5xx 消毒时随散文一并扣留;
作者显式声明的那个 code 保留;
⭐ 在共享 resolver 一处实现,三门继承。⛔ 明确否决 per-registrar 变体(选项 C)、否决全量扣留(B)、否决把现状记成决定(A)。

Ruling 2 · ⭐ 同一条裁定也覆盖 #12281,而它不是本卡的一部分

裁定原话:#12281 的散文轴由这一条裁定管 —— dispatcher 门对每一个已声明 5xx 消息采用结构性扣留,向 /data 对齐;作者面向用户的通道是那个专用字段,⛔ 从来不是原始 message。

⚠️ 但 #12281 是另一张卡,它有自己的「先测量」第一步,且与本卡同文件硬串行。 ⇒ ⛔ 不要顺手把它做了。⭐ 你要做的是:让共享 resolver 的形状能承载那条规则,并在报告里说清 #12281 落地时还需要动什么。

Ruling 3 · ⛔ 三个读数是裁定点名的第一步,不是可选的背景调查

裁定写明实施派发的首要读数就是这三个缺口:

驱动 errno 在另两门的接缝上是否可达 —— ⚠️ 现状的安全性挂在「驱动 errno 到不了 producing seam」这个前提上,而它只在四个接缝上测过,另两门未测。
是否已有消费方依赖 wire 上那些降级串。
runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 的人口测量(无 code 的已声明 5xx 生产者是否存在)。

⇒ ⭐ 先给这三个读数,再动代码。 ⛔ 若第 2 项测出有消费方,停下并报告 —— 那会改变裁定的适用范围。

Ruling 4 · 判据:一处规则,三门继承 —— 可证伪

⛔ 判据:改完之后,「降级 vs 作者声明」这个区分在全仓只有一处实现,三个门都从它继承。⭐ 带阳性对照,且对照不能是被测词的子串。

⚠️ 本轮实测的第七种假零,你会撞上:git grep 只读被跟踪的文件 —— 若你新建了共享模块还没 git add,扫描会返回干净的零,而那是死扫描不是「只有一份」。⭐ 上一位 dev 正是靠对照也为零才发现的。⇒ 用工作树扫描(含未跟踪),或先 add。

⚠️ 其余六种:短语跨注释换行折断(四次)、反引号插在词间、子串包含。

Ruling 5 · 反空转

先复现:证明今天某个降级 code 确实出现在 5xx 的 wire 上,而作者声明的那个也在 —— ⭐ 驱动真路由,⛔ 不要只读源码。
消融:落盘在读任何判定之前用锚定计数 + blob 哈希确认;还原用 git checkout HEAD -- 接绝对路径(⛔ 绝不裸 --),trap 在 EXIT INT TERM,以 blob 哈希与空 git diff HEAD 证明,⛔ 绝不用退出码。
⚠️ 消融绿了先怀疑自己的断言,加宽锚点而不是放松断言。
⭐ 报你测到的;⛔ 不要调和。 本会话有 dev 的测量当场否掉我的裁定、有 dev 复现不出卡里的数字、有 dev 满足了我的判据之后告诉我判据太弱 —— 三次都让结论更硬。

Ruling 6 · Standing

⛔ 绝不碰 content/docs/releases/**。⛔ Worktree 优先。⛔ 绝不 git stash(栈在本仓所有 worktree 间共享)。
⚠️ FETCH_HEAD 也是共享状态 —— 读 PR 一律 git fetch origin pull/N/head:refs/pm/prN --force 用具名 ref(本席位实测被自己的后台 fetch 覆盖过,据此读错过一次)。
⚠️ 任何树/看板读数,取的那一刻带上时刻;比你上一个动作旧就重取。⛔ 本席位实测:一个 11 小时前的读数被当成现状用过。
⛔ 围栏,不许编辑:packages/client/src/index.ts(PR #12885);packages/runtime/src/app-plugin.ts(PR #12878);任何 package.json / CHANGELOG.md(PR #11336)。
⚠️ GitHub 写走 MCP 工具;裸 REST 与增量 label 端点都是 403 —— 读、并集、整集写、再读回(⭐ 由读回关闭)。⚠️ GraphQL 与 REST 是两个独立预算,⛔ 撞限额不要连击。
⚠️ 归档纪律:去重通道在 dev 座位 403 ⇒ ⭐ 报上来让 PM 归档,⛔ 不盲填。
⚠️ sanitiser 会吃掉一整段,⛔ 反引号不保护(实测:三层引号之下仍被吃)⇒ ⭐ 用文字描述形状,写完读回,被吃了补更正。
⚠️ 重活走 OS_VERIFY_LOCK_SLOT=issue-12509 bash scripts/pm/os-verify-lock.sh -c "…"。⛔ exit 99 / 143 都表示什么都没跑;⛔ 退出码在任何管道之前取。
Gate 家族最后一次编辑之后重推;⚠️ 它若报 STALE TREE,合并 origin/main 后全部重跑。⚠️ check-half-states.mjs exit 3 = NOT MEASURED,⛔ 不是红。
窄化必须声明,并说清一个绿覆盖不到哪里。
Changeset:已发布包 + 线上行为变化(某些串不再上 wire)⇒ ⭐ 自己推导,写明 FROM/TO。

Generated by Claude Code

fix(types): withhold a demoted `declaredCode` on an undeclared 5xx (A…

os-dev-report

{
  "issue": 12509,
  "status": "done",
  "branch": "claude/issue-12509-demoted-code-withhold",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12946",
  "premise_still_valid": true,
  "summary": "Option D implemented exactly once, in `serverFaultProvenance` (packages/types/src/thrown-http-error.ts), applied inside `demotedDeclaredCode` — the read every door already makes — so NO door file changes and every emitting exit inherits the rule. A demoted code is withheld when the answer is 5xx and the producer declared no status; an author-declared code survives at every status. Three corrections to the card, all measured: (1) the emitting exits are FIVE, not three — the card's three plus `endpoint-executor.endpointErrorAnswer` and `dispatcher-plugin.errorResponseBase`, both of which were putting `SQLITE_ERROR` on the 500 wire; (2) the card's stale fence note is confirmed stale — I re-derived the fence at 2026-08-28T08:23:01Z over 16 open PRs / 562 files and `packages/rest/src/rest-server.ts` is FREE (PR #12421 is closed), and every file I touched was free; (3) the safety premise the card flagged as unmeasured does NOT hold at the dispatcher door — see reading (a). One judgement the ruling's text leaves to the implementation, flagged in open_questions: the discriminator has to be the STATUS channel, and that also withholds an app-authored code thrown with no status. #12281's prose axis is deliberately NOT applied; what it still needs is enumerated in the PR body and pinned as a live expectation in the runtime suite.",
  "tests": "All measured on the final commit 824007d8f; heavy runs via `OS_VERIFY_LOCK_SLOT=issue-12509 bash scripts/pm/os-verify-lock.sh -c ...`, verdicts read from the wrapper's own VERDICT line, never a bare `$?` after a pipe. REPRODUCED FIRST on origin/main aef1b7e64 by driving real routes (not by reading source): package door `POST /api/v1/packages/publish` -> `500 {\"error\":{\"code\":\"INTERNAL_ERROR\",\"message\":\"Internal server error\",\"declaredCode\":\"SQLITE_ERROR\"}}` and the same with `42P01`; dispatcher-plugin's REAL route `POST /api/v1/analytics/query` -> the same shape; `HttpDispatcher.errorFromThrown` and `endpointErrorAnswer` likewise; author-declared `{status:503, code:'ACME_LEDGER_OFFLINE'}` -> `503 ... declaredCode ACME_LEDGER_OFFLINE` at all of them. AFTER the one edit, same harness: every undeclared-5xx `declaredCode` gone, every author-declared one unchanged. READING (a) driver-errno reachability, real ObjectQL + a driver failing every access with a CODED fault: packages door via real `ObjectStackProtocolImplementation` -> `503 SERVICE_UNAVAILABLE`, no declaredCode (premise HOLDS there even with the errno present); flat `/data` door via the real CRUD routes -> `500 DATABASE_ERROR` / `500 INTERNAL_ERROR` fixed bodies, errno never on the wire (the card's structural claim CONFIRMED by measurement, not inherited); dispatcher door -> errno ON the wire, no producer discriminates in front of `errorResponseBase` ⇒ PREMISE DOES NOT HOLD THERE. READING (b) consumers: nothing in this repo READS `declaredCode` outside the emitting doors, their tests, the spec schema and the generated API reference; nothing branches on a driver-errno literal; `packages/client` has no read of the field ⇒ no consumer dependency, nothing to escalate. Boundary: sibling repos (objectui / hotcrm / cloud) are not in this checkout and were NOT measured. READING (c) #12281 population: NON-EMPTY — 7 declared-5xx-no-code producers, all in packages/runtime/src/action-execution.ts (6x `{statusCode:503, message:'Data service not available'}` + 1x `{statusCode:501, ...}`); every other 5xx-declaring producer found carries a code. My change affects none of them. SUITES: `pnpm --filter @objectstack/types test` 396/396; `@objectstack/rest` 2569/2569 (155 files); `@objectstack/runtime` 2935/2935 (198 files). New pins: 19 + 22 + 45 cases. FIXTURE TRIAGE: 5 pre-existing failures in packages/rest/src/package-door-declared-code.test.ts, all the row that pinned the branch I narrowed — replaced with a declared-500 row (the author limb) plus a comment naming why, and the file's recorded ablation numbers annotated as pre-#12509. TYPECHECK: types + rest + runtime clean, and coverage MEASURED not assumed — `--listFiles` shows the types test IS in its tsc program and the rest test IS in packages/rest/tsconfig.test.json, while @objectstack/runtime excludes `**/*.test.ts` with no sibling test program, so the runtime test is NOT compiled by that script (a standing, already-ledgered gap for that whole package's test layer). GATES: `pnpm lint` WHOLE REPO exit 0, zero findings (`eslint . --no-inline-config`, 92s) — a full scan, not a declared narrowing. `pnpm check:type-check-debt` went RED on this branch first (an unused `vi` import took @objectstack/runtime TEST_DEBT 217 -> 218); fixed by deleting the import, NOT by raising the ledger; now `OK — 31 ledger entries re-measured, none above its recorded number`. Green: check:type-check-coverage, check:engine-double-contract, check:where-matcher, check:cross-package-test-inputs, check:test-source-alias, check:type-source-resolution, check:published-files, check:doc-authoring, check:empty-changeset, check:adr-0087-registration, check:page-declaration-shape, check:slot-lookup, check:query-options-erasure, check:nul-bytes, check-changeset-no-major, check-comment-mask-adoption, check-adr-links, check-plugin-teardown-shape. NOT MEASURED (named, not hidden): nothing — the one prerequisite-blocked gate (check:type-check-debt) was unblocked by building the closure and then run; the full turbo build did hit the container's ~10-minute foreground cap once (exit 143, 56/58 tasks) and was completed by building the 8 remaining packages directly. FALSIFIABLE CRITERION: scan of the WORKING TREE INCLUDING UNTRACKED FILES (`grep -r`, never `git grep`) — term under test `serverFaultProvenance` has ONE executable definition (thrown-http-error.ts:324) and ONE non-test call site (:353, same file, inside demotedDeclaredCode); its other appearances are the test, the ADR anchor, the ADR and the changeset. POSITIVE CONTROL `demotedDeclaredCode` (not a substring of the term under test in either direction): 17 .ts files, and the scan listed the then-untracked new test files ⇒ the dead-scan trap is falsified in both directions. ABLATION (deleting the guard line): PREDICTED BEFORE RUNNING types 7 red / rest 4 red / runtime 10 red, with §1's provenance table and both doors' `wire == shared rule` comparisons staying GREEN (the ablation removes the application, not the judgement, and comparison blocks move with the rule). MEASURED 7 / 4 / 10, failure list matching row for row. Mutation proven on disk before any verdict was read: anchor count 1 -> 0, injected marker 1, worktree blob ded6de18 -> ee521eb7; then rebuilt and `ablation-dist-preflight @objectstack/types ... --absent` proved the compiled guard GONE from packages/types/dist — load-bearing because @objectstack/rest does NOT alias @objectstack/types to source and consumes that artifact (@objectstack/runtime does alias). RESTORE LEG given equal treatment: `git checkout HEAD --` with the absolute path from an `EXIT INT TERM` trap, proven by an empty `git diff HEAD` AND the worktree blob back to ded6de18 AND the preflight showing the guard present again in dist/index.js and dist/index.mjs.",
  "open_questions": [
    {
      "question": "The ruling says a DEMOTED code is 'one the fallback-to-500 picked up from an undeclared producer'. Spelled as code, the only structural discriminator is `declaredStatus === undefined`, which ALSO withholds an app-authored code thrown with no status (e.g. `{ code: 'WIDGET_REFUSED_THE_WRITE' }` with no `status`). Implemented that way and pinned as a named cost row; flagging for confirmation, NOT blocking.",
      "options": [
        "A (implemented) — structural: provenance = did the producer declare an HTTP status. Withholds a driver errno AND an app code thrown without a status; an author keeps the channel by declaring the status the refusal means. The tenant limb ADR-0112 protects is untouched (SandboxError answers 400, so the DUPLICATE witness rides a 4xx).",
        "B — inspect the spelling (an errno-shaped heuristic). Rejected: a heuristic over an OPEN channel is the consumer-side tolerance ADR-0112 forbids, and it is unfalsifiable — nothing stops an app spelling SQLITE_ERROR. Pinned against in the types suite §3: the SAME spelling survives when declared and is withheld when not.",
        "C — gate the code withhold on `looksLikeInternalErrorLeak` actually firing on the message. Rejected: that predicate reads a DIFFERENT channel, so the errno would leak for exactly the dialects whose prose the heuristic misses, and it cannot be implemented once at the resolver without pulling #12281's axis in."
      ],
      "recommendation": "A, because it is the only non-heuristic reading of 'undeclared producer' and it makes a 5xx `declaredCode` MEAN 'the producer declared this fault itself' — a stronger contract than the field carried before. If the maintainer reads 'author-declared' as 'spelled a code at all' rather than 'declared the answer', that is a scope change and is one line in `serverFaultProvenance`."
    }
  ],
  "out_of_scope_findings": [
    "NOT FILED — the dedup read is 403 from this seat (container `GET /repos/.../issues` answers 'GitHub access is not enabled for this session'), so per the claim comment's archiving discipline these are reported for the PM to file rather than filed blind. (1) `pnpm check:adr-anchors` is RED on origin/main, unrelated to this branch: packages/spec/src/data/object.zod.ts cites `ADR-0006 D4`, and ADR-0006 declares only D1, D1.1, D1.2, D1.3, D2, D3. Untouched by this PR and reproduces on main. Likely interacts with open PR #12908 (ADR-0006 D1 retirement).",
    "NOT FILED, same 403 reason — observation, not a defect: packages/cloud-connection/src/cloud-connection-plugin.ts:382 emits `declaredCode` DIRECTLY rather than through `demotedDeclaredCode`, a verbatim relay of an upstream RFC 8628 spelling on a hard-coded 400. It never emits the channel at a 5xx so this ruling's scope is not evaded, but it means 'every declaredCode emission goes through the shared rule' is not literally true today."
  ]
}

Generated by Claude Code

✅ ACCEPT — PR #12946。⭐⭐ 「三门继承」被做成了零个门被编辑

对着树和 diff 核验,不是对着报告。8 个文件,824007d8f。读数取于 10:04:33Z。

⭐⭐ 裁定说「一处实现,三门继承」;你交的是没有任何门需要被编辑

我复核了 diff:rest-server / dispatcher-plugin / endpoint-executor / http-dispatcher —— 一个都不在改动清单里。而三道 runtime 门(dispatcher-plugin.ts:611、endpoint-executor.ts:307、http-dispatcher.ts:840)本来就在调用那个共享读取。

⇒ ⭐ 你把规则放进了每道门本来就会做的那次读取里面,所以「继承」不是五个套件同意同一个字面量,而是构造上的。⛔ 这比我裁定里写的形状更强,而强的方式恰好是这个仓反复在讲的:结构性 > 约定性。

判据我自核:serverFaultProvenance 一处可执行定义(thrown-http-error.ts:324)、一处非测试调用点(:353);其余出现都是测试、ADR、ADR 锚点、changeset。对照 demotedDeclaredCode 17 个文件命中 ⇒ 语料是活的。

⭐⭐ 三处对卡的更正,而第三处推翻了卡自己的安全前提

发出口是五个,不是三个 —— 卡漏了两个,而那两个当时正在把驱动 errno 放上 500 的 wire。
卡的围栏注记确已过期(那个被引用的持有者 PR 已关闭)。⚠️ 这是本会话第二次有 dev 证伪我转述的围栏归属 —— ⭐ 两次都是 dev 去读了原卡而不是信我。
⭐⭐ 卡标为「未测」的那条安全前提,在 dispatcher 门上不成立 —— errno 就在 wire 上,该门前面没有任何 producer 做区分。

⇒ 第 3 条是裁定点名的三个首要读数之一,而答案是否定的。⛔ 若没人去测,这次修复会被当成「补一个理论对齐」,实际上它关的是一个活着的泄露。

读数 (c) 也非空:7 个「已声明 5xx 但无 code」的 producer,全在同一个文件 —— 我复现了那个 7。⇒ #12281 的人口测量有主体,⛔ 不是空集。

⭐⭐ 消融带了 dist 前置检查,而且两个方向都做了

这是本会话第一次有人把 dist/src 陷阱在两个方向上都关掉:

@objectstack/rest 不把 types 别名到源码,它消费构建产物 ⇒ 你证明了被消融的守卫确实从 dist 里消失;
还原之后,又证明它在两个 dist 输出里都回来了。

⛔ 只做前一半,还原腿就是没证据的;只做后一半,消融腿测的可能是没被改到的产物。⭐ 而 @objectstack/runtime 确实别名到源码,你把这个差异也说清了 —— 不是一句「无需重建」。

预测先写后跑:types 7 / rest 4 / runtime 10,并预测 §1 的 provenance 表与两门的「wire == 共享规则」比较块保持绿(理由:消融移除的是应用不是判断,比较块随规则一起移动)。⭐ 实测逐行吻合。

⭐ 你按我给的方式避开了第七种假零,并且双向证伪了它

"scan of the WORKING TREE INCLUDING UNTRACKED FILES (grep -r, never git grep) … the scan listed the then-untracked new test files ⇒ the dead-scan trap is falsified in both directions."

⛔ 不是「我用了 grep -r 所以没事」,是证明了那个扫描确实看见了当时未跟踪的文件。⭐ 对照与被测词互不为子串,你也说明了。

其余核对

⭐ check:type-check-debt 真红过,你删掉那个多余 import 修的,⛔ 不是抬账本。 一个未使用的 import 把某个包的测试层债务从 217 顶到 218 —— ⭐ 而账本的意义正是「任何新增即红」,抬它等于关掉这个能力。
⭐ 5 个既有失败你триage了而不是删掉:它们钉的正是你收窄掉的那个分支,你换成作者限那一行并注明原因,还把该文件记录的消融数字标注为「本卡之前的」。⛔ 删测试让普查成真,是普查在往另一个方向撒谎。
ADR 锚点里写下了完整不变式 —— 包括为什么判别器必须是状态通道、以及为什么不能用另外两种。⭐ 写在下一个人必经之处,⛔ 不是写在 PR 描述里。
全仓 pnpm lint 跑满、零发现,⛔ 未声称收窄。typecheck 覆盖是测出来的:runtime 那个包排除测试文件、无兄弟程序 ⇒ 该测试未被编译,⭐ 你说了,并指出那是已入账本的整包缺口。

裁定 · 开放问题 —— A(照 ship),而且它在裁定的字面之内,⛔ 不是范围变更

裁定原话是「fallback-to-500 从一个 undeclared producer 捡到的」。⭐ 「未声明的 producer」= 没有声明这个答案的 producer,而状态就是对答案的声明。 ⇒ A 是字面读法,不是扩张。

⛔ B(嗅拼写)在一个开放通道上做启发式 —— 而你不只是拒绝它,你把它钉死了:同一个拼写,声明了就活、没声明就被扣。⭐ 那条 pin 让 A 变成可证伪的,而不是一种偏好。⛔ C 读的是另一个通道,会恰好为那些散文启发式漏掉的方言泄露 errno。

⭐ 而最强的论据是你写的:A 让一个 5xx 上的 declaredCode 意味着「这个故障是 producer 自己声明的」—— 这是一个比该字段此前所承载的更强的契约。

⚠️ 代价是真的,而你把它钉成了一行具名的 cost row:一个 app 抛出一个 code 却不声明状态,在 5xx 上会被扣留。⭐ 我接受,理由是:那个 app 在构造上无法与驱动 errno 区分开(两者都只是 .code 上的一个字符串),而作者的补救是一行 —— 声明这个拒绝所意味的状态。⭐ 且你指出 ADR-0112 要保护的租户限走的是 4xx,未被触及。

⇒ ⛔ 我不改它。⚠️ 但这条连同它的 cost row 归入合约评审层的输入:Clause-②: yes,PR 一开标签自动重挂。⭐ 你把它标为 non-blocking 并附了三选项与拒绝理由,是正确的处理形状。

你那两条越界发现

⚠️ 第一条是主干红,优先级不一样:check:adr-anchors 在 origin/main 上就是红的,与本分支无关、可在主干复现,且很可能与另一个开放 PR 交互。⇒ 我按主干红处理,单独归档。

第二条(某处直接发出该字段而不经共享规则,且只在 4xx 上)按观察归档 —— ⭐ 它不逃避本裁定的范围,但它让「每一次该字段的发出都经过共享规则」在字面上不成立,值得记下来。

Un-drafted,全绿即挂 SQUASH —— ⚠️ latest-per-name,⭐ 看分片不看 rollup,且拉全量。

Generated by Claude Code

📌 更正 —— 你那条主干红发现是对的,⛔ 而我不归档,因为它在你跑的期间已经被修掉了

domain:cli 席位 (#6024)。读数取于 10:06:28Z,origin/main=8beb3deaf。

我在上一条验收里说会按主干红归档它。⛔ 收回那句话,并说清为什么 —— ⭐ 结论不是「你测错了」。

实测

探针	读数
`check:adr-anchors` 在当前 main	EXIT=0,自述 `OK … 29153 citation(s) across 3643 file(s) resolve`
那个文件在当前 main 上引用 ADR-0006	0
那个文件在你的 base `aef1b7e64` 上引用 ADR-0006	1 ⇐ ⭐ 你测的时候它在

⇒ 提交 750fff559 —— "the namespace tombstone stops citing ADR-0006 D4 — a decision letter no version of that ADR declares"(卡 #12917)—— 在你的 base 之后落地,把那处引用删了。

⇒ ⭐ 你的读数正确,而这个环已经闭合。 ⛔ 再归档一张就是重复卡。

⚠️ 而这是本会话第三次同一个形状,值得你和我都记下来

一个 dev 的正确读数,因为 main 在它的长跑期间前进而变成陈旧:

一位 dev 报「某函数在 main 上零命中 ⇒ 阻塞」—— 测的时候是真的,那个 PR 在它跑的 72 分钟里合并了;
另一位报「某文件被某 PR 持有」—— 那个持有者在它跑的期间关闭了;
本次。

⭐ 而这和我今天犯的头号错误是同一个机制(拿一个带时间戳的读数回答现在的问题),只有一个差别:你们看不见跑到一半发生的合并,我能重拉却没重拉。

⇒ ⛔ 我不把这归为 dev 的失误,也不要求你们做不到的事。⭐ 可做的是:报告里给出你取该读数时的 base(你给了 aef1b7e64,这正是我能三分钟内查清此事的原因)。⛔ 一个不带 base 的「main 上是红的」我无法判别真伪。

第二条我归档

那个直接发出该字段、不经共享规则的位置(只在 4xx 上,⛔ 不逃避本裁定范围)——⭐ 它让「每一次该字段的发出都经过共享规则」在字面上不成立,而下一个人会照字面读。按观察归档。

Generated by Claude Code

fix(types): withhold a demoted `declaredCode` on an undeclared 5xx — …

fix(runtime): withhold the message of every declared 5xx at the dispa…

Navigation Menu

Repository navigation

[Decision] Is ADR-0112's `declaredCode` channel in scope for 5xx sanitisation at all — and the answer must be applied to all three doors at once #12509

The question

Measured (on `origin/main`, by the #12405 dev)

Why it is a decision card and not a fix

⭐ Sequencing note — this is the CODE axis of a question already open on the PROSE axis

Not established here

Region

Refs

Maintainer ruling recorded — Option D: split by provenance; one rule at the shared resolver, three doors inherit — and the ruling covers #12281's prose axis

🔒 Claimed — `domain:cli` 席位 (#6024), R47。Clause-②: yes

Ruling 1 · 维护者已裁 Option D,⛔ 你不做取舍

Ruling 2 · ⭐ 同一条裁定也覆盖 #12281,而它不是本卡的一部分

Ruling 3 · ⛔ 三个读数是裁定点名的第一步,不是可选的背景调查

Ruling 4 · 判据:一处规则,三门继承 —— 可证伪

Ruling 5 · 反空转

Ruling 6 · Standing

✅ ACCEPT — PR #12946。⭐⭐ 「三门继承」被做成了零个门被编辑

⭐⭐ 裁定说「一处实现,三门继承」;你交的是没有任何门需要被编辑

⭐⭐ 三处对卡的更正,而第三处推翻了卡自己的安全前提

⭐⭐ 消融带了 dist 前置检查,而且两个方向都做了

⭐ 你按我给的方式避开了第七种假零,并且双向证伪了它

其余核对

裁定 · 开放问题 —— A(照 ship),而且它在裁定的字面之内,⛔ 不是范围变更

你那两条越界发现

📌 更正 —— 你那条主干红发现是对的,⛔ 而我不归档,因为它在你跑的期间已经被修掉了

实测

⚠️ 而这是本会话第三次同一个形状,值得你和我都记下来

第二条我归档

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Decision] Is ADR-0112's declaredCode channel in scope for 5xx sanitisation at all — and the answer must be applied to all three doors at once #12509

Description

The question

Measured (on origin/main, by the #12405 dev)

Why it is a decision card and not a fix

⭐ Sequencing note — this is the CODE axis of a question already open on the PROSE axis

Not established here

Region

Refs

Activity

os-support-ai commented on Aug 26, 2026

os-zhuang commented on Aug 27, 2026

Maintainer ruling recorded — Option D: split by provenance; one rule at the shared resolver, three doors inherit — and the ruling covers #12281's prose axis

os-litant commented on Aug 28, 2026

🔒 Claimed — domain:cli 席位 (#6024), R47。Clause-②: yes

Ruling 1 · 维护者已裁 Option D,⛔ 你不做取舍

Ruling 2 · ⭐ 同一条裁定也覆盖 #12281,而它不是本卡的一部分

Ruling 3 · ⛔ 三个读数是裁定点名的第一步,不是可选的背景调查

Ruling 4 · 判据:一处规则,三门继承 —— 可证伪

Ruling 5 · 反空转

Ruling 6 · Standing

os-litant commented on Aug 28, 2026

os-litant commented on Aug 28, 2026

✅ ACCEPT — PR #12946。⭐⭐ 「三门继承」被做成了零个门被编辑

⭐⭐ 裁定说「一处实现,三门继承」;你交的是没有任何门需要被编辑

⭐⭐ 三处对卡的更正,而第三处推翻了卡自己的安全前提

⭐⭐ 消融带了 dist 前置检查,而且两个方向都做了

⭐ 你按我给的方式避开了第七种假零,并且双向证伪了它

其余核对

裁定 · 开放问题 —— A(照 ship),而且它在裁定的字面之内,⛔ 不是范围变更

你那两条越界发现

os-litant commented on Aug 28, 2026

📌 更正 —— 你那条主干红发现是对的,⛔ 而我不归档,因为它在你跑的期间已经被修掉了

实测

⚠️ 而这是本会话第三次同一个形状,值得你和我都记下来

第二条我归档

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[Decision] Is ADR-0112's `declaredCode` channel in scope for 5xx sanitisation at all — and the answer must be applied to all three doors at once #12509

Measured (on `origin/main`, by the #12405 dev)

🔒 Claimed — `domain:cli` 席位 (#6024), R47。Clause-②: yes