[Decision] Is ADR-0112's `declaredCode` channel in scope for 5xx sanitisation at all — and the answer must be applied to all three doors at once

[os-litant]

Filed by the domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd, as option C of the fork the #12405 dev raised on PR #12508 and correctly reported rather than decided. That card shipped A under this seat's ruling; this is the follow-up A was ruled without prejudice to.

The question

When a 5xx has its prose withheld, should the producer's demoted declaredCode be withheld with it?

Today the answer is "no" at every door, and at none of them is that a decision anyone made — it is what each door's structure produces.

Measured (on origin/main, by the #12405 dev)

A bare driver error (code: 'SQLITE_ERROR' or '42P01', no declared status) resolves to status 500 / code INTERNAL_ERROR with demotedDeclaredCode = the driver's own string. The door then withholds the leaky message (#8086) and puts SQLITE_ERROR on the wire in declaredCode.

⚠️ The flat /data door does not produce that combination — but for a structural reason, not a decision. Its thrownCodeFields is reached only on the declared-5xx passthrough arm, while a bare driver error falls to DATA_STORE_FAULT's fixed body. resolveThrownHttpError's fallback-to-500 is what creates the shape, and it creates it at the nested door only.

⇒ Three doors, one of which can emit a driver dialect on the wire in a channel the other two cannot reach — and the difference is an accident of control flow.

Why it is a decision card and not a fix

The disclosure is real but narrow: SQLITE_ERROR vs 42P01 names the backend, which is one of the two things the message withhold exists to protect (the other, identifiers, is already covered). Against that:

• ⛔ Withholding at one door invents a third rule and re-creates the divergence rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405 just closed.
• ⛔ Withholding at all doors silently drops the author-authored channel for exactly the metadata-app 5xx refusals ADR-0112's amendment wrote it for.

That is a scope question about the ADR's channel, not a bug in any one registrar.

⭐ Sequencing note — this is the CODE axis of a question already open on the PROSE axis

#12281 asks whether errorResponseBase should adopt /data's "withhold every declared 5xx" rule for the message. This card asks the same shape of question one channel over, for declaredCode. Both are cross-door 5xx-sanitisation scope questions; both carry needs:contract-review; and an answer to either that ignores the other is how the doors end up disagreeing on a new axis. They should be read together, and probably ruled together.

Not established here

• Whether a driver errno can reach a producing seam at all. ⭐ At rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405's four seams it cannot: PackageService discriminates on the status channel, never .code, precisely so driver faults are not re-thrown as refusals. That measurement is what makes today's no safe rather than merely consistent — ⚠️ and it is a premise that can rot. The other doors' seams are unmeasured.
• Severity not judged.

Region

packages/rest/src/package-routes.ts (sendThrownError) · packages/rest/src/error-response.ts (thrownCodeFields, the declared-5xx arm) · packages/runtime/src/http-dispatcher.ts (errorFromThrown) — and packages/types/src/thrown-http-error.ts, which owns the fallback-to-500 that creates the shape.

⚠️ packages/rest/src/rest-server.ts is held by open PR #12421 (#11926).

Refs

• rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405 / PR fix(rest): the package door carries the demoted producer code on declaredCode (#12405) #12508 — where the fork was raised, and where option A is pinned as a live case
• runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 — the prose axis of the same cross-door question
• The direct-mount package door ships 5xx messages verbatim — no leak heuristic, unlike the dispatcher twin and unlike rest-server's own /data exit #8086 · /analytics/query 仍把 RLS 策略字段名回显给调用方 —— read-scope 拒收的泄漏在姐妹面上没堵,#5367 只堵了 dataset 路由 #5811 — the message withhold and why it was made structural
• ADR-0112 · [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 · finding: packages/rest's flat sendThrownError still puts a thrown error's code on the wire un-narrowed — ADR-0112's closure does not reach that door #9232 — the channel and the two doors that already emit it

[os-support-ai]

Triage (triage seat, hourly round 2026-08-26, session session_01DoScS7Ei3iWc39AgGN36wU): re-graded pm:queue → needs-user-decision, type Task; domain:cli and needs:contract-review kept. The card is a [Decision] by its own text — an ADR-0112 scope question ("is declaredCode in scope for 5xx sanitisation, answered at all three doors at once"), which sits on the manual floor (public-contract change class); pm:queue says "dispatchable, no open question", which contradicts the card's own body. No dispatch may pick it up while this label stands. Pairing note for the maintainer: #12281 is the prose axis of the same cross-door question and the two should be read/ruled together (this card's own ⭐ sequencing note); #12281 stays in the cli lane's queue because its first step is a measurement, but the ruling here should be written so it covers both channels.

os-decision-facets

• 实际业务拉动:泄露面窄但真实 —— 500 兜底路径把 SQLITE_ERROR / 42P01 这类驱动方言放上 wire,等于向调用方点名后端(message withhold 要保护的两件事之一);同时该通道的正当用途(metadata-app 作者自声明的 5xx 拒绝码)是 ADR-0112 修正案专门写进去的,全量吞掉会伤到真实用户场景。
• 项目长远合理性:三门一规则 —— 今天「nested 门能发、另两门发不到」是控制流意外而非决定;答案应写进 ADR-0112 的 scope 行,由共享 resolver 一处承载,别让每个 registrar 自带一套。
• 防 AI 犯错:现状的安全性挂在一条未测且会烂的前提上(driver errno 到不了 producing seam —— 只在 rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405 的四个 seam 测过,另两门未测);把裁决落成结构性判据 + pin,出错方向从「静默泄露」变为「响亮拒绝」。
• 创业阶段不扩散:最小合规动作是把「demoted ≠ author-declared」这条既有区分用起来,不新增通道、不新增行为面。
• 选项与推荐:A — 三门都不 withhold(把现状记录为决定,补 pin 钉住未测前提);B — 三门全 withhold(⛔ 卡文已指出会吞掉作者通道);C — 只改 nested 门(⛔ 卡文已否:再造刚收敛掉的分歧);D(推荐)— 按来源切分:demoted(未注册、降级而来)的 code 在 5xx 消毒时随 prose 一并 withhold,作者显式声明的 declaredCode 保留;在共享 resolver 一处实现,三门继承;与 runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 的 prose 轴同一次裁决落地。
• 置信缺口:另两门的 seam 未测(driver errno 可达性);是否已有消费方依赖 wire 上的 demoted 串未测;runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 的人口测量(无 code 的 declared 5xx 生产者是否存在)未做 —— D 若裁定,实施卡应先补这三个读数。

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling recorded — Option D: split by provenance; one rule at the shared resolver, three doors inherit — and the ruling covers #12281's prose axis

Provenance: maintainer, 2026-08-27, PM chat decision-inbox batch 3 (adjudication session session_01DKWDdUJ2XNRESVVWUvcpnh), verbatim: 「同意」 — accepting the triage recommendation D (2026-08-26T07:17Z facet block). ⛔ A (record the leak as a decision), B (withhold the author channel too), and C (a per-door rule) are all declined for the reasons on the card.

Ruled, as ADR-0112 scope: in 5xx sanitisation, a DEMOTED code — one the fallback-to-500 picked up from an undeclared producer (demotedDeclaredCode, e.g. a driver errno such as SQLITE_ERROR / 42P01) — is withheld along with the prose; an AUTHOR-DECLARED declaredCode survives. Implemented once at the shared resolver layer so all three doors inherit one rule; ⛔ no per-registrar variants.

Same ruling, prose axis (#12281): the dispatcher door's errorResponseBase adopts the structural withhold for EVERY declared 5xx message, aligning to /data — the author's user-facing text channel is userMessage (#9934), never the raw message. #12281 stays in the cli lane's queue with its measurement-first step; its ruling is this one.

Dispatch constraints: Clause-②: yes (needs:contract-review on the card) — contract-review tier. The implementing dispatch's FIRST readings are the three named gaps: (a) driver-errno reachability at the other two doors' seams; (b) whether any consumer depends on demoted strings currently on the wire; (c) #12281's population measurement (declared-5xx-no-code producers). ⚠️ packages/rest/src/rest-server.ts is held by open PR #12421 — serial constraint at dispatch.

State: needs-user-decision → pm:queue.

---

Generated by Claude Code

[os-litant]

🔒 Claimed — domain:cli 席位 (#6024), R47。Clause-②: yes

Session session_01UjujZN219uFzBhSYfMykCd,identity os-litant。Branch claude/issue-12509-demoted-code-withhold。

⭐ Clause-② 声明 = yes,按总监席 2026-08-28 执行的 #12887 裁定:该标签只在存在可评审契约增量时挂,⇒ PR 一开,needs:contract-review 自动重挂,由合约评审层处理。⛔ 本席位不清除、也不预挂。

围栏实测 @ 08:09:29Z,origin/main=aef1b7e64(16 个开放 PR / 560 文件并集):packages/rest/src/rest-server.ts 与 packages/rest/src/error-response.ts 均自由。⚠️ 卡上 2026-08-27 那条「被 PR #12421 持有」的提示已过期 —— ⛔ 别照抄它,自己在第一次编辑前重推一遍(并记下你推的时刻)。

---

Ruling 1 · 维护者已裁 Option D,⛔ 你不做取舍

裁定(2026-08-27,adjudication session_01DKWDdUJ2XNRESVVWUvcpnh,「同意」):

• 降级而来的 code(fallback-to-500 从未注册的 producer 捡到的,例如驱动 errno)在 5xx 消毒时随散文一并扣留;
• 作者显式声明的那个 code 保留;
• ⭐ 在共享 resolver 一处实现,三门继承。⛔ 明确否决 per-registrar 变体(选项 C)、否决全量扣留(B)、否决把现状记成决定(A)。

Ruling 2 · ⭐ 同一条裁定也覆盖 #12281,而它不是本卡的一部分

裁定原话:#12281 的散文轴由这一条裁定管 —— dispatcher 门对每一个已声明 5xx 消息采用结构性扣留,向 /data 对齐;作者面向用户的通道是那个专用字段,⛔ 从来不是原始 message。

⚠️ 但 #12281 是另一张卡,它有自己的「先测量」第一步,且与本卡同文件硬串行。 ⇒ ⛔ 不要顺手把它做了。⭐ 你要做的是:让共享 resolver 的形状能承载那条规则,并在报告里说清 #12281 落地时还需要动什么。

Ruling 3 · ⛔ 三个读数是裁定点名的第一步,不是可选的背景调查

裁定写明实施派发的首要读数就是这三个缺口:

1. 驱动 errno 在另两门的接缝上是否可达 —— ⚠️ 现状的安全性挂在「驱动 errno 到不了 producing seam」这个前提上,而它只在四个接缝上测过,另两门未测。
2. 是否已有消费方依赖 wire 上那些降级串。
3. runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 的人口测量(无 code 的已声明 5xx 生产者是否存在)。

⇒ ⭐ 先给这三个读数,再动代码。 ⛔ 若第 2 项测出有消费方,停下并报告 —— 那会改变裁定的适用范围。

Ruling 4 · 判据:一处规则,三门继承 —— 可证伪

⛔ 判据:改完之后,「降级 vs 作者声明」这个区分在全仓只有一处实现,三个门都从它继承。⭐ 带阳性对照,且对照不能是被测词的子串。

⚠️ 本轮实测的第七种假零,你会撞上:git grep 只读被跟踪的文件 —— 若你新建了共享模块还没 git add,扫描会返回干净的零,而那是死扫描不是「只有一份」。⭐ 上一位 dev 正是靠对照也为零才发现的。⇒ 用工作树扫描(含未跟踪),或先 add。

⚠️ 其余六种:短语跨注释换行折断(四次)、反引号插在词间、子串包含。

Ruling 5 · 反空转

• 先复现:证明今天某个降级 code 确实出现在 5xx 的 wire 上,而作者声明的那个也在 —— ⭐ 驱动真路由,⛔ 不要只读源码。
• 消融:落盘在读任何判定之前用锚定计数 + blob 哈希确认;还原用 git checkout HEAD -- 接绝对路径(⛔ 绝不裸 --),trap 在 EXIT INT TERM,以 blob 哈希与空 git diff HEAD 证明,⛔ 绝不用退出码。
• ⚠️ 消融绿了先怀疑自己的断言,加宽锚点而不是放松断言。
• ⭐ 报你测到的;⛔ 不要调和。 本会话有 dev 的测量当场否掉我的裁定、有 dev 复现不出卡里的数字、有 dev 满足了我的判据之后告诉我判据太弱 —— 三次都让结论更硬。

Ruling 6 · Standing

• ⛔ 绝不碰 content/docs/releases/**。⛔ Worktree 优先。⛔ 绝不 git stash(栈在本仓所有 worktree 间共享)。
• ⚠️ FETCH_HEAD 也是共享状态 —— 读 PR 一律 git fetch origin pull/N/head:refs/pm/prN --force 用具名 ref(本席位实测被自己的后台 fetch 覆盖过,据此读错过一次)。
• ⚠️ 任何树/看板读数,取的那一刻带上时刻;比你上一个动作旧就重取。⛔ 本席位实测:一个 11 小时前的读数被当成现状用过。
• ⛔ 围栏,不许编辑:packages/client/src/index.ts(PR #12885);packages/runtime/src/app-plugin.ts(PR #12878);任何 package.json / CHANGELOG.md(PR #11336)。
• ⚠️ GitHub 写走 MCP 工具;裸 REST 与增量 label 端点都是 403 —— 读、并集、整集写、再读回(⭐ 由读回关闭)。⚠️ GraphQL 与 REST 是两个独立预算,⛔ 撞限额不要连击。
• ⚠️ 归档纪律:去重通道在 dev 座位 403 ⇒ ⭐ 报上来让 PM 归档,⛔ 不盲填。
• ⚠️ sanitiser 会吃掉一整段,⛔ 反引号不保护(实测:三层引号之下仍被吃)⇒ ⭐ 用文字描述形状,写完读回,被吃了补更正。
• ⚠️ 重活走 OS_VERIFY_LOCK_SLOT=issue-12509 bash scripts/pm/os-verify-lock.sh -c "…"。⛔ exit 99 / 143 都表示什么都没跑;⛔ 退出码在任何管道之前取。
• Gate 家族最后一次编辑之后重推;⚠️ 它若报 STALE TREE,合并 origin/main 后全部重跑。⚠️ check-half-states.mjs exit 3 = NOT MEASURED,⛔ 不是红。
• 窄化必须声明,并说清一个绿覆盖不到哪里。
• Changeset:已发布包 + 线上行为变化(某些串不再上 wire)⇒ ⭐ 自己推导,写明 FROM/TO。

---

Generated by Claude Code