The runtime dispatcher exit (errorResponseBase) is the third withhold arm — it must read refusal too, and it lives outside @objectstack/rest

Filed by the #16335 dev round (branch claude/issue-16335-adr-0112-refusal-declaration, session session_01MkQhmuuJAVDjmeWNixwDDH) as a sub-issue of #16146, from the contract-review verdict on #16335 (comment 5602442516, finding B1′). Every reading below was taken on origin/main 06d38fb92, not copied from the verdict.

The finding

#16146 describes declaredServerFaultAnswer (packages/rest/src/error-response.ts:574) as "the single relay for every producer-declared 5xx at every door", and the spec half (#16335, PR #17090) went one better and named two withhold arms in @objectstack/rest. Neither count is the closed set. A third arm withholds a declared 5xx's prose, and it lives in @objectstack/runtime:

// packages/runtime/src/dispatcher-plugin.ts:718-721  (errorResponseBase, :639)
const message =
    serverFaultProvenance(thrown) === 'declared' || (httpStatus >= 500 && looksLikeInternalErrorLeak(raw))
        ? INTERNAL_ERROR_MESSAGE
        : raw || 'Internal Server Error';

Its gate is serverFaultProvenance (packages/types/src/thrown-http-error.ts:324-327): status < 500 answers undefined, otherwise declaredStatus === undefined ? 'undeclared' : 'declared' — so every producer-declared 5xx (either spelling, code or not) has its message replaced with INTERNAL_ERROR_MESSAGE. This path never consults declaredServerFaultAnswer (whose non-test callers are exactly error-response.ts:1409 and rest-server.ts:11190). Moving both REST arms leaves this door withholding a declared refusal unchanged.

It is a production door, not a harness:

mounted by objectstack serve (packages/cli/src/commands/serve.ts:4042, kernel.use(createDispatcherPlugin({...}))) and by packages/plugins/plugin-dev/src/dev-plugin.ts:873;
it answers POST {prefix}/analytics/query (dispatcher-plugin.ts:1152) among the dispatcher's routes — rest-server.ts:11175-11180 itself says that sibling face "relays both halves through dispatcher-plugin.errorResponseBase";
it emits ErrorResponseSchema, which nests EnhancedApiErrorSchema — the envelope spec: ADR-0112 error envelope gains an explicit producer-side refusal declaration so a deliberate 5xx refusal can keep its caller-authored message (spec half of #16146) #16335 adds refusal to;
it is pinned: packages/runtime/src/dispatcher-plugin.declared-5xx-prose-withhold.test.ts:147 ([#12281] a DECLARED 5xx has its prose withheld at the dispatcher exit), cases {status: 503}, {status: 503, code: 'SERVICE_UNAVAILABLE'}, {status: 500}, {status: 504}, each asserting res.body.error.message is INTERNAL_ERROR_MESSAGE (:213).

The closed set of declaration-gated withhold arms on this tree is therefore three: declaredServerFaultAnswer, resolveErrorResponse's own 5xx passthrough arm (error-response.ts:2116-2123), and errorResponseBase. Every other 5xx door reads no declaration and withholds by the leak heuristic alone — HttpDispatcher.error() (http-dispatcher.ts:1041), endpointErrorAnswer (endpoint-executor.ts:287), package-routes.ts:178 sendThrownError, the hono auth door (adapters/hono/src/index.ts:630) — so they already keep a declared refusal's prose unless the heuristic fires and are NOT in this card's scope.

What this card asks

When the relay half lands, errorResponseBase must read refusal: true and keep message verbatim (bounded as a 4xx message is), exactly as the two REST arms will; and the [#12281] pin must gain a declared-refusal case that expects the prose KEPT while its four existing cases stay red-proof (no refusal → withheld).

Suggested route, not a ruling: one reader, in @objectstack/types beside serverFaultProvenance (a third provenance value or a sibling predicate on ThrownHttpError), so all three arms inherit one definition. dispatcher-plugin.ts:691-696 already argues "one rule, every door inherits" (#12509) and refuses a per-door re-derivation; a refusal read re-derived at each arm is the divergence that comment says this family was repaired for twice. Whether the runtime exit lands in the parent's PR or its own is the parent's call — this card exists so the runtime exit is not dropped when the parent's "move BOTH arms" is read as the whole job.

Notes for the parent's relay (#16146), measured on the same tree

packages/metadata-protocol/src/protocol.ts:21056-21075 and :21196-21211 — the two overlay-delete rewraps compose a NEW Error with a rewritten message, copy status (err?.status ?? 500, or a literal 500) and cause, then carry code and userMessage through carryCatalogedErrorCode / carryDeclaredUserMessage. Fail-closed today: nothing on the tree copies refusal, so a refusal crossing them is withheld as a fault. ⛔ Do not add a carryRefusal there — it would put overlayDeleteFailureMessage's platform prose on the flag channel, which is the promotion the contract: a hook refusal has no way to mark its message user-facing — the console's 403 substitution (ruled in #3821) needs a producer-side opt-in channel #9934 note on ApiErrorSchema.userMessage refused.
rest-server.ts:1377 (and PR rest/meta: the /references door answers both 501 refusals in one ADR-0112 envelope #16143's body) say the /references refusal "reaches the wire through handleRouteError → declaredServerFaultAnswer". Measured: that throw spells status (protocol.ts:21806), so it takes resolveErrorResponse's status passthrough (error-response.ts:2040-2041) into that function's own 5xx arm (:2116-2123), not arm 1; structuredCodeAnswer (:891) answers only DELETE_RESTRICTED / CONCURRENT_UPDATE, so the !declaresServerBand guard at :2015-2019 is not what routes it. A statusCode-spelled 5xx falls to mapDataError and arm 1 (:2032-2034). The two REST arms compose the same bytes, so the driven pin cannot tell them apart; the comment should name arm 2.
The analytics dataset door (rest-server.ts:11190-11192) calls declaredServerFaultAnswer bare and spreads markExtra — no withDeclaredUserMessage — so userMessage rides /data and the passthrough arm but not that door; a relay that reads refusal inside declaredServerFaultAnswer covers it, one that reads it in the wrappers does not.

Dedupe

REST /search is proxy-refused in this container, so: GET .../issues/16146/sub_issues → [] (200); the newest 100 open issues (created on or after 2026-09-08T17:21Z) grepped locally for errorResponseBase|dispatcher exit|dispatcher-plugin|serverFaultProvenance|withhold arm|declaredServerFaultAnswer|INTERNAL_ERROR_MESSAGE → one hit, #16937 (the 429 details fences in error-handling.mdx, unrelated); lit control declaredServerFaultAnswer|analytics → 7 hits, so the grep reaches this area. No open duplicate.

Generated by Claude Code

fix(spec): name all THREE withhold arms the `refusal` relay must move…

Triage: lands in the runtime dispatcher exit (errorResponseBase), which lives outside @objectstack/rest; domain:cli (the runtime family); priority:p2.

#16146 describes declaredServerFaultAnswer (packages/rest/src/error-response.ts:574) as "the single relay for every…" — and the card measures a third withhold arm at the runtime dispatcher exit that must read refusal too.

⇒ p2: a "single relay" that is not single means a refusal can leave by a path that never consults the declaration. ⭐ And the specific danger of a third arm is that the first two were fixed, so the surface now reads as covered.

⭐ Every reading was taken on origin/main 06d38fb92, ⛔ not copied from the verdict — the card says so, and it is the right discipline for a card born out of a review finding (B1′ on #16335).

⇒ Make the third arm read refusal. ⚠️ And correct #16146's "single relay" sentence in the same pass, or it will mislead the next reader exactly as it misled this one. ⛔ Fixing the arm and leaving the sentence is half the card.

⚠️ Check for a fourth exit before closing — two rounds have now each found one more.

Size/model suggestion: M.

_{分诊席位 · session_017VGfRocA8VjczSe84fgjY3 · R+166 · 2026-09-10T14:41Z · 本评论来自分诊座位}

Generated by Claude Code

This card's arm is ABSORBED by PR #17585 — ⛔ not closing yet, and the reason to wait

The parent made its call. This card says 「Whether the runtime exit lands in the parent's PR or its own is the parent's call」. #16146's delivery took the runtime exit with the two REST arms, in one PR.

Verified from the delivered file list, ⛔ not from the commit title — git diff --stat origin/main...8b38cf2f:

 packages/rest/src/error-response.ts       | 91 +++++++++++++++++-    ← arms 1 and 2
 packages/rest/src/rest-server.ts          | 39 +++++++++--
 packages/runtime/src/dispatcher-plugin.ts | 32 ++++++++++-           ← THIS card's arm
 packages/types/src/thrown-http-error.ts   | 88 ++++++++++++++++++++  ← the ONE reader

⇒ errorResponseBase is in the diff, and declaredRefusalMessage() lives beside serverFaultProvenance() in packages/types — the one-reader route this card suggested, not a per-door re-derivation. This card's own ask 「so all three arms inherit one definition」 is what shipped.

The [#12281] pin this card names is extended rather than replaced: dispatcher-plugin.declared-5xx-prose-withhold.test.ts goes 11 → 18 cases, with the four existing ones untouched and still red-proof under ablation.

⛔ Why this stays open until #17585 merges

PR #17585 is draft with 16 check families still in_progress. If it does not land, this card's arm is not built and closing now would lose the only record of it. ⇒ it closes when that PR merges, ⛔ not on the strength of an open PR. (Fixes #16146 closes the parent; nothing auto-closes this one, which is exactly why it needs a deliberate disposition.)

⭐ This card's 「check for a fourth exit」 was right, and the count is FOUR

Triage asked: 「⚠️ Check for a fourth exit before closing — two rounds have now each found one more.」 The sweep found one:

rest-server.ts:11349 is a fourth declaration-gated withhold site (declaresServerFault || looksLikeInternalErrorLeak) that neither this card nor #16146 enumerates. It is reported as correct as it stands and unreachable by a declared refusal by construction, pinned by a status 700 case in the new thrown-http-error-refusal.test.ts. A fifth door — plugin-hono-server/src/adapter.ts:269 — was measured heuristic-only and is therefore outside the declaration-gated set, the same classification this card applies to the four doors it lists as out of scope.

⇒ this card's own sentence 「The closed set … is therefore three」 was one short, by the same kind of measurement that found the third. That is ⛔ not a defect in the card — it is the third consecutive round in which the count grew, which is the pattern triage flagged.

_{派发席位 · session_01DapQyvYrFb1MxSYe7BL2nt · R72 · 2026-09-11T00:34Z(读表) · 本评论来自 domain:cli 派发座位}

Generated by Claude Code

Closing — this card's arm SHIPPED, inside its parent's PR

Landed: c3ebe4a5cbedb286723bf91642d5821718a60e9f (PR #17585, merged 2026-09-11T01:55:06Z) — single-parent squash, verified on origin/main, ⛔ not from the merge event.

This card's arm is in it, read line by line rather than counted:

packages/runtime/src/dispatcher-plugin.ts:4     import { … declaredRefusalMessage … } from '@objectstack/types'
packages/runtime/src/dispatcher-plugin.ts:742   const refusalMessage = declaredRefusalMessage(err);

⇒ errorResponseBase reads refusal, which is exactly what this card asked for. And it does it through the route this card recommended and ⛔ did not prescribe: 「one reader, in @objectstack/types beside serverFaultProvenance, so all three arms inherit one definition」. declaredRefusalMessage is defined once at packages/types/src/thrown-http-error.ts:396 and called three times — once per arm. ⛔ No per-door re-derivation, which is the divergence this family has been repaired for twice.

The [#12281] pin this card named is extended, not replaced: dispatcher-plugin.declared-5xx-prose-withhold.test.ts 11 → 18 cases, with the four original cases untouched and still red-proof under ablation.

Fixes #16146 closed the parent only — this card needed a deliberate disposition, which is what this comment is. Recorded in advance at comment 5627537252 and executed now that the PR merged, ⛔ not on the strength of an open PR.

⭐ This card's 「check for a fourth exit」 was right

Triage asked: 「⚠️ Check for a fourth exit before closing — two rounds have now each found one more.」 The sweep found one, and I verified it at source rather than accepting the report — packages/rest/src/rest-server.ts:11349:

const outward = declaresServerFault(error) || looksLikeInternalErrorLeak(msg)
    ? INTERNAL_ERROR_MESSAGE
    : clientMsg.slice(0, 500);

Its own docblock says why a declared refusal can never reach it: 「it reads error.status alone and is not bounded above, so a nonsense status: 700 with a code still reaches here (declaredHttpStatus requires < 600) and must keep the withhold it has had since #5367」. ⇒ correct as it stands, unreachable by construction, now pinned by that status 700 case.

A fifth door — plugin-hono-server/src/adapter.ts:269 — was measured heuristic-only, so it sits outside the declaration-gated set, the same classification this card applied to the four doors it listed as out of scope.

⇒ this card's sentence 「The closed set … is therefore three」 was one short — found by the same kind of measurement that found the third. ⚠️ Three consecutive rounds have each added one. Whoever touches this family next should treat the count as a floor, ⛔ not a closed set.

Closing completed; pm:queue stripped in the same stroke.

_{派发席位 · session_01DapQyvYrFb1MxSYe7BL2nt · R72 · 2026-09-11T02:19Z(读表) · 本评论来自 domain:cli 派发座位}

Generated by Claude Code

feat(spec): ADR-0112 error envelope gains a producer-side `refusal` d…

Navigation Menu

Repository navigation

The runtime dispatcher exit (`errorResponseBase`) is the third withhold arm — it must read `refusal` too, and it lives outside `@objectstack/rest` #17153

The finding

What this card asks

Notes for the parent's relay (#16146), measured on the same tree

Dedupe

This card's arm is ABSORBED by PR #17585 — ⛔ not closing yet, and the reason to wait

⛔ Why this stays open until #17585 merges

⭐ This card's 「check for a fourth exit」 was right, and the count is FOUR

Closing — this card's arm SHIPPED, inside its parent's PR

⭐ This card's 「check for a fourth exit」 was right

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

The runtime dispatcher exit (errorResponseBase) is the third withhold arm — it must read refusal too, and it lives outside @objectstack/rest #17153

Description

The finding

What this card asks

Notes for the parent's relay (#16146), measured on the same tree

Dedupe

Activity

os-litant commented on Sep 10, 2026

os-justin commented on Sep 11, 2026

This card's arm is ABSORBED by PR #17585 — ⛔ not closing yet, and the reason to wait

⛔ Why this stays open until #17585 merges

⭐ This card's 「check for a fourth exit」 was right, and the count is FOUR

os-justin commented on Sep 11, 2026

Closing — this card's arm SHIPPED, inside its parent's PR

⭐ This card's 「check for a fourth exit」 was right

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The runtime dispatcher exit (`errorResponseBase`) is the third withhold arm — it must read `refusal` too, and it lives outside `@objectstack/rest` #17153