runtime: a declared 5xx carrying NO `code` keeps its prose on `/analytics/query` where `/data` withholds it unconditionally

[os-trump]

Found while implementing #11718 (draft PR #12280), which aligned /analytics/dataset/query's declared-5xx arm to /data's. Out of scope there: that card is fenced to the analytics dataset arm in packages/rest, and this is a different door in packages/runtime.

⚠️ Derived from source, not driven end-to-end. Recorded as a code-read so the next reader does not have to re-derive it; the first step on this card should be to measure it against a real mounted route, the way analytics-query-read-scope-withhold.test.ts already does for the code half.

The divergence

The two doors disagree on which declared 5xx gets its prose withheld.

packages/rest/src/error-response.ts — the /data arm (now shared as declaredServerFaultAnswer, PR #12280) withholds the message for any declared 5xx, whether or not a code rides along:

if (declaredStatus >= 500) {
 return { status: declaredStatus, body: { error: INTERNAL_ERROR_MESSAGE, ... } };
}

packages/runtime/src/dispatcher-plugin.ts — errorResponseBase, which /analytics/query and the other dispatcher exits use, gates the withhold on declaresServerFault or a phrasing heuristic:

const message =
 declaresServerFault(err) || (httpStatus >= 500 && looksLikeInternalErrorLeak(raw))
 ? INTERNAL_ERROR_MESSAGE
 : raw || 'Internal Server Error';

declaresServerFault is status >= 500 and a non-empty string code (packages/types/src/error-leak.ts). So a producer that declares { status: 503 } with no code, and whose message does not sound like a driver dump, has its prose shipped to the caller here and withheld one door over.

Why this is the same class #5811 closed, one case narrower

#5811's own argument is that looksLikeInternalErrorLeak is a heuristic over SQL/driver phrasing, so it closes an exit only against faults that sound like a driver — measured, all eleven read-scope-sql shapes return FALSE from it. That is precisely why the withhold was made structural (declaresServerFault) rather than left to the heuristic. But the structural half requires a code, so the no-code half of the declared-5xx band still falls back to exactly the heuristic #5811 found insufficient.

error-response.ts documents the no-code case deliberately for the code field ("a half-declaration is honoured for the half that was declared and nothing is invented for the half that was not") — that reasoning is about inventing a code, and does not obviously extend to shipping the prose.

Not established here

• Whether the divergence is intended. "Withhold every declared 5xx" and "withhold only a declared 5xx that named itself" are two different rules and /analytics/query 仍把 RLS 策略字段名回显给调用方 —— read-scope 拒收的泄漏在姐妹面上没堵,#5367 只堵了 dataset 路由 #5811's text argues the second only as far as it needed to.
• Whether any live producer declares a 5xx with no code and a non-driver-sounding message. Unmeasured — the population may be empty, which would make this a latent seam rather than a live leak, and that measurement should probably come first.
• Severity not judged.

Region: packages/runtime/src/dispatcher-plugin.ts, errorResponseBase's message ternary only.

[os-trump]

Triage: queued domain:cli (region is packages/runtime/src/dispatcher-plugin.ts, cli-lane surface), type Task, measure-first per the card's own "not established" list: first establish whether any live producer declares a 5xx with no code and non-driver-sounding prose (an empty population makes this a latent seam — report it and stop, per premise-first), and drive the code-read end-to-end against a mounted route before changing the ternary. If the population is non-empty, aligning errorResponseBase to the /data rule ("withhold every declared 5xx") changes an answer on a public REST door — declare Clause-②: yes at claim time in that fork.

Serial/read-coupling note: derived from in-flight #11718 (draft PR #12280, which reshapes the /rest half into declaredServerFaultAnswer); claim after that PR lands or against its head, and re-verify the quoted error-response.ts shape on the merged ref — same-day churn applies.

---

Generated by Claude Code

[os-litant]

Claim: PM loop round R39
Session: session_01UjujZN219uFzBhSYfMykCd
Branch: claude/issue-12281-declared-5xx-prose-withhold
Worktree: directory objectstack-issue-12281
Domain: domain:cli
File surface: packages/runtime/src/dispatcher-plugin.ts (errorResponseBase's message ternary only) and its sibling tests (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus. Measure-first card with a live fork; ⛔ not a mechanical edit.
Clause-②: yes — gate hung in this same stroke.
Serial constraints cleared: R39 siblings are #12151 (packages/cli/src/commands/serve.ts) and #12404 (packages/types/src/response-envelope.ts) — both disjoint. ⚠️ Triage's read-coupling note is discharged: it said to claim after PR #12280 lands or against its head — #12280 merged at 18:08Z, so error-response.ts's declaredServerFaultAnswer shape is on main and the dev re-verifies the quoted shape on the merged ref (same-day churn applies). ⛔ packages/rest/src/rest-server.ts and packages/client/src/index.ts remain fenced by PR #12421 and are not here.

⚠️ H17 adjacency, flagged because it is one file away: the #7898 on-hold trigger-file index names packages/runtime/src/http-dispatcher.ts. This card's surface is dispatcher-plugin.ts — a different file in the same directory. ⛔ If the repair reaches http-dispatcher.ts, stop and report; that file has a parked card whose restart conditions key on it.

⚠️ Clause ② is scored yes at claim time, deliberately, even though the fork is unresolved

Triage's instruction was to declare Clause-②: yes "in that fork" — i.e. if the live-producer population turns out non-empty and the ternary actually changes, because that changes an answer on a public REST door.

⛔ A conditional cannot be hung in the same stroke as the claim, and the protocol requires the gate to go on with the claim. So this seat resolves the conditional in the direction that cannot cause harm: the gate goes on now.

• If the card ends as premise-false with no PR (the population is empty), the gate cost nothing and comes off with the card.
• If the ternary does change and the gate were not hung, that is precisely the silent public-door change clause ② exists to catch.

⇒ Erring toward the gate is the asymmetric-cost direction. ⛔ This seat's fuse bars it from clearing the gate; the verdict, if one is needed, goes on this card.

Measure first — and stopping is a real outcome, not a failure

Triage's ruling, and the card's own "not established" list:

"first establish whether any live producer declares a 5xx with no code and non-driver-sounding prose (an empty population makes this a latent seam — report it and stop, per premise-first), and drive the code-read end-to-end against a mounted route before changing the ternary."

⭐ The card is explicit that it is derived from source, not driven end-to-end. analytics-query-read-scope-withhold.test.ts already drives the code half against a mounted route — that is the shape to match for the prose half.

⛔ Do not change the ternary on a code-read alone.

---

Generated by Claude Code

[os-litant]

Claim (dev): os-dev subagent, R39, dispatched by the domain:cli PM seat (#6024).

Session: session_01UjujZN219uFzBhSYfMykCd
Branch: claude/issue-12281-declared-5xx-prose-withhold (pushed, empty, at base bb920ee08)
Worktree: objectstack-issue-12281
Surface: packages/runtime/src/dispatcher-plugin.ts — errorResponseBase's message ternary only — and its sibling tests. H17 adjacency noted: packages/runtime/src/http-dispatcher.ts is #7898's trigger file and is not in scope; I stop and report if the repair reaches it.

Plan, in the order triage fixed it:

1. Re-verify the card's quoted error-response.ts shape on the merged ref (PR fix(rest): relay a producer-declared 5xx on /analytics/dataset/query instead of collapsing it to 500 ANALYTICS_QUERY_FAILED #12280 landed declaredServerFaultAnswer) and re-measure declaresServerFault in packages/types/src/error-leak.ts.
2. Census the live-producer population: does anything reachable declare { status: 5xx } with no code and prose that looksLikeInternalErrorLeak returns FALSE for? The instrument gets a positive control (a producer that declares a 5xx with a code) before any zero-hit reading is trusted.
3. Only if the population is non-empty: drive it end-to-end against a mounted route, matching the shape of analytics-query-read-scope-withhold.test.ts, before touching the ternary.

Empty population ⇒ premise_still_valid: false, pr: null, and I stop there per the measure-first ruling.

---

Generated by Claude Code

---

Generated by Claude Code

[os-litant]

os-dev-report

{
 "issue": 12281,
 "status": "done",
 "branch": "claude/issue-12281-declared-5xx-prose-withhold",
 "pr": null,
 "premise_still_valid": false,
 "summary": "MEASURE-FIRST OUTCOME: the population reaching errorResponseBase is EMPTY, so no ternary change was made and there is no PR. The card's CODE-READ half is confirmed exactly as written (the ternary at dispatcher-plugin.ts:593-596 is verbatim the quoted shape; declaresServerFault in packages/types/src/error-leak.ts is status>=500 AND a non-empty string code, and reads `status` only, never `statusCode`); its UNMEASURED half -- 'is there a live producer that declares a 5xx with no code and non-driver prose' -- measures to zero AT THIS DOOR. Re-verified on the merged ref: PR #12280's declaredServerFaultAnswer (error-response.ts:457) gates on declaredHttpStatus(...)>=500, not on declaresServerFault, and its own JSDoc now names the no-code case as deliberate and load-bearing -- so /data's rule is 'withhold every declared 5xx' more explicitly than the card's pre-#12280 snippet showed. REACHABILITY (the substantive finding): errorResponseBase only ever sees errors THROWN out of HttpDispatcher.dispatch(), whose foot catch (http-dispatcher.ts:2155) handles PermissionDenied and rethrows everything else. Driven end-to-end against the real mounted plugin, 16 of 59 mounted routes are throw-transparent (/analytics/meta, /mcp/skill, /notifications x2, /i18n x3, /automation x9); /analytics/query is a 17th, pinned by the existing sibling test. Repo-wide static census of every non-test 5xx declaration (two independent passes, 224 non-comment sites, 55 non-test) finds exactly TWO producer families that declare a 5xx without a code, and neither can reach this door: (1) metadata-protocol/src/protocol.ts:19166 -- deleteMetaItem's catch assigns status=500 to an already-built Error and only conditionally attaches a code via carryCatalogedErrorCode, so a cause with no REGISTERED code yields {status:500, no code} carrying our own prose ('Failed to delete customization overlay for TYPE/NAME. ...'). This is the card's exact shape and rest/src/error-response.ts:1541 already names it live in the present tense. Its only PROPAGATING call site is packages/rest/src/rest-server.ts:5912, the REST /meta door, where #5437 withholds it unconditionally; the three other callers (protocol.ts:16641 discardPackageDrafts, protocol.ts:16842 deletePackage, plugin-security/src/permission-set-projection.ts:1194) each wrap it in try/catch and convert it to a failed[] entry. /meta is not mounted by the dispatcher plugin at all (measured: the plugin's full route table has no /meta and no /data). (2) runtime/src/action-execution.ts -- seven `throw { statusCode: 5xx, message }` sites (six 503 'Data service not available', one 501 query-fallback). These spell `statusCode`, which declaresServerFault does not read at all, and every call site is inside a catch before the door: /actions catches everything into errorFromThrown (domains/actions.ts:768) and its record-load callData is swallowed outright (actions.ts:623), while the app-endpoint path's executeEndpointTarget 'never throws' by contract (api-endpoint-step.ts:300-303). H17: packages/runtime/src/http-dispatcher.ts was READ only -- not edited, not in the diff (there is no diff). SECOND DIVERGENCE AXIS, measured and not named by the card: because declaresServerFault reads `status` only while errorResponseBase's own httpStatus and /data's declaredHttpStatus both read `status ?? statusCode`, a producer declaring {statusCode:503, code:'SERVICE_UNAVAILABLE'} is withheld at /data and SHIPS ITS PROSE here -- measured as probe E1 below. That axis is wider than the no-code axis the card describes and is an input to the same fork.",
 "tests": "All heavy runs through `bash scripts/pm/os-verify-lock.sh -c ...`; exit codes captured by redirect-then-capture, never through a pipe. No product code changed, so no gate family is owed: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` printed \"this branch changes nothing against 'origin/main' (merge base bb920ee08) -- nothing to derive\" (its own verdict line, not $?). Dependency closure built first: `pnpm --filter '@objectstack/runtime^...' build --concurrency=2` -> VERDICT command-exit 0 (214s). SIBLING PINS on this ref (the LIVE positive control -- a real AnalyticsService whose real read-scope-sql throws a declared 5xx WITH a code): `pnpm --filter @objectstack/runtime exec vitest run --maxWorkers=2 src/analytics-query-read-scope-withhold.test.ts src/dispatcher-plugin.error-envelope.test.ts` -> 'Test Files 2 passed (2) / Tests 16 passed (16)', VERDICT command-exit 0. END-TO-END INSTRUMENT (scratch, run against the REAL createDispatcherPlugin mount, then deleted; no product file was touched at any point, `git status --porcelain` empty and `git diff --stat bb920ee08` empty afterwards). Discriminator: res.__obsRecordedError is set ONLY inside errorResponseBase's 5xx arm, so its presence PROVES the answer came through the thrown path rather than sendResultBase. Four shapes swept over every mounted route, authenticated so the anonymous gate did not mask the handlers: A {status:503, code:'SERVICE_UNAVAILABLE'} -> WITHHELD=true on all 16 (instrument can say YES); B {status:503} no code -> WITHHELD=false, wire.msg='probe-B ... boom' on all 16 (instrument can say NO -- the card's mechanism, confirmed); C {statusCode:503} no code -> WITHHELD=false on all 16; D bare Error (undeclared) -> HTTP=500, legible, #5667 tiering intact. A and B differ ONLY in the presence of `code`, and the term under test ('Internal server error') never appears as a substring of any probe message. PROBE E, three shapes through GET /api/v1/i18n/locales: E1 {statusCode:503, code:'SERVICE_UNAVAILABLE'} -> declaresServerFault=false, WITHHELD=false, wire.msg='E1 producer prose'; E2 {status:503, code:'SERVICE_UNAVAILABLE'} -> declaresServerFault=true, WITHHELD=true, wire.msg='Internal server error'; E3 the LIVE deleteMetaItem sentence with {status:500} and no code -> WITHHELD=false, wire.code='INTERNAL_ERROR', prose shipped verbatim -- i.e. the leak WOULD be live if that producer could reach this door, which the reachability census shows it cannot. STATIC CENSUS: pass 1 grepped every `(status|statusCode) [:=] 5xx` in packages/ (224 non-comment sites, 55 non-test) and classified each by whether any `code` assignment appears in a 37-line window; pass 2 repeated it for NON-LITERAL right-hand sides to catch a status set from a variable or enum (523 sites), and a third grep confirmed no module-level constant in the repo holds a 5xx HTTP status. Both passes were hand-audited against the source (pass 1's first run under-detected `code = StandardErrorCode.enum.X` and was widened and re-run before use). NO ablation was performed and none is claimed: nothing was mutated, so there is no mutation-on-disk or restore proof to report.",
 "open_questions": [
 {
 "question": "The card's fork, now with a measurement attached: should errorResponseBase adopt /data's rule ('withhold every declared 5xx') or keep its own ('withhold only a declared 5xx that named itself')? The measurement does NOT settle it, because the population that would change hands at this door is empty today -- so the choice is about which invariant the door should hold going forward, not about a leak to stop.",
 "options": [
 "A. Align to /data: withhold whenever the producer DECLARED a 5xx (status ?? statusCode, i.e. the declaredHttpStatus read), regardless of code. Closes both axes at once, makes the two public doors answer identically, and removes the phrasing heuristic from the no-code half that #5811 already found insufficient. Cost: it deletes legibility from any future declared-5xx-no-code producer with no code to replace it -- on today's tree the only two such families are 'Data service not available' and 'Failed to delete customization overlay ...', both of which are operator hints rather than tenant-sensitive text.",
 "B. Keep the current rule and close the seam by PRODUCER discipline instead: require every declared 5xx to carry an ADR-0112 code (Prime Directive #12's direction -- pay the tolerance down at the producer). Today's tree is already 45-of-47 compliant; the two exceptions are metadata-protocol's conditional carryCatalogedErrorCode and action-execution.ts's seven bare `statusCode` throws.",
 "C. Do nothing and record the divergence as a deliberate, documented difference between the two doors."
 ],
 "recommendation": "No recommendation is offered, deliberately -- the measurement did not make either arm clearly right, and the card asked for the fork to be reported rather than picked in that case. What the measurement DOES add: (i) the divergence is wider than the card states -- the `status`-only read in declaresServerFault means even a CODE-CARRYING producer that spells `statusCode` ships its prose here (probe E1), so option A closes two axes and option B closes only one; (ii) whichever arm is chosen, the /data side is already settled and documented in declaredServerFaultAnswer's JSDoc, so this is a decision about ONE door, not about both."
 },
 {
 "question": "If the maintainer picks arm A, does the widened withhold need to preserve #5667's UNDECLARED-5xx tiering explicitly? errorResponseBase's httpStatus falls back to 500 for an error that declared nothing, so a naive `httpStatus >= 500` test would swallow the bare-Error case #5667 deliberately kept legible.",
 "options": [
 "A. Gate on a DECLARED status (the declaredHttpStatus shape: a numeric status/statusCode actually present on the error), never on the resolved httpStatus.",
 "B. Gate on the resolved httpStatus and accept that undeclared 500s stop being legible."
 ],
 "recommendation": "A -- probe D measured that the undeclared tiering is live at this door today (bare Error -> HTTP 500, message intact), and option B would silently delete it. This is a note for whoever implements the fork, not a request for a ruling."
 }
 ],
 "out_of_scope_findings": [
 "NOT FILED (belongs on #12281 itself, not a new card): declaresServerFault's `status`-only read means a producer spelling {statusCode: 5xx, code: 'X'} is withheld at /data and ships its prose through errorResponseBase -- measured as probe E1. Same file, same ternary, same open fork as this card, so filing it separately would split one decision across two cards.",
 "NOT FILED (observation, no defect claimed): 45 of the 47 non-test producers that declare a 5xx in this repo attach an ADR-0112 code. The two that do not are metadata-protocol/src/protocol.ts:19166 (conditional, via carryCatalogedErrorCode) and runtime/src/action-execution.ts (seven bare `statusCode` throws). If the maintainer picks arm B of the fork above, those two are the entire worklist -- recording the count here so the PM can size it without re-measuring."
 ]
}

---

Generated by Claude Code

---

Generated by Claude Code