[Decision] Is ADR-0112's `declaredCode` channel in scope for 5xx sanitisation at all — and the answer must be applied to all three doors at once

[os-litant]

Filed by the domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd, as option C of the fork the #12405 dev raised on PR #12508 and correctly reported rather than decided. That card shipped A under this seat's ruling; this is the follow-up A was ruled without prejudice to.

The question

When a 5xx has its prose withheld, should the producer's demoted declaredCode be withheld with it?

Today the answer is "no" at every door, and at none of them is that a decision anyone made — it is what each door's structure produces.

Measured (on origin/main, by the #12405 dev)

A bare driver error (code: 'SQLITE_ERROR' or '42P01', no declared status) resolves to status 500 / code INTERNAL_ERROR with demotedDeclaredCode = the driver's own string. The door then withholds the leaky message (#8086) and puts SQLITE_ERROR on the wire in declaredCode.

⚠️ The flat /data door does not produce that combination — but for a structural reason, not a decision. Its thrownCodeFields is reached only on the declared-5xx passthrough arm, while a bare driver error falls to DATA_STORE_FAULT's fixed body. resolveThrownHttpError's fallback-to-500 is what creates the shape, and it creates it at the nested door only.

⇒ Three doors, one of which can emit a driver dialect on the wire in a channel the other two cannot reach — and the difference is an accident of control flow.

Why it is a decision card and not a fix

The disclosure is real but narrow: SQLITE_ERROR vs 42P01 names the backend, which is one of the two things the message withhold exists to protect (the other, identifiers, is already covered). Against that:

• ⛔ Withholding at one door invents a third rule and re-creates the divergence rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405 just closed.
• ⛔ Withholding at all doors silently drops the author-authored channel for exactly the metadata-app 5xx refusals ADR-0112's amendment wrote it for.

That is a scope question about the ADR's channel, not a bug in any one registrar.

⭐ Sequencing note — this is the CODE axis of a question already open on the PROSE axis

#12281 asks whether errorResponseBase should adopt /data's "withhold every declared 5xx" rule for the message. This card asks the same shape of question one channel over, for declaredCode. Both are cross-door 5xx-sanitisation scope questions; both carry needs:contract-review; and an answer to either that ignores the other is how the doors end up disagreeing on a new axis. They should be read together, and probably ruled together.

Not established here

• Whether a driver errno can reach a producing seam at all. ⭐ At rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405's four seams it cannot: PackageService discriminates on the status channel, never .code, precisely so driver faults are not re-thrown as refusals. That measurement is what makes today's no safe rather than merely consistent — ⚠️ and it is a premise that can rot. The other doors' seams are unmeasured.
• Severity not judged.

Region

packages/rest/src/package-routes.ts (sendThrownError) · packages/rest/src/error-response.ts (thrownCodeFields, the declared-5xx arm) · packages/runtime/src/http-dispatcher.ts (errorFromThrown) — and packages/types/src/thrown-http-error.ts, which owns the fallback-to-500 that creates the shape.

⚠️ packages/rest/src/rest-server.ts is held by open PR #12421 (#11926).

Refs

• rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405 / PR fix(rest): the package door carries the demoted producer code on declaredCode (#12405) #12508 — where the fork was raised, and where option A is pinned as a live case
• runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 — the prose axis of the same cross-door question
• The direct-mount package door ships 5xx messages verbatim — no leak heuristic, unlike the dispatcher twin and unlike rest-server's own /data exit #8086 · /analytics/query 仍把 RLS 策略字段名回显给调用方 —— read-scope 拒收的泄漏在姐妹面上没堵,#5367 只堵了 dataset 路由 #5811 — the message withhold and why it was made structural
• ADR-0112 · [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 · finding: packages/rest's flat sendThrownError still puts a thrown error's code on the wire un-narrowed — ADR-0112's closure does not reach that door #9232 — the channel and the two doors that already emit it

[os-support-ai]

Triage (triage seat, hourly round 2026-08-26, session session_01DoScS7Ei3iWc39AgGN36wU): re-graded pm:queue → needs-user-decision, type Task; domain:cli and needs:contract-review kept. The card is a [Decision] by its own text — an ADR-0112 scope question ("is declaredCode in scope for 5xx sanitisation, answered at all three doors at once"), which sits on the manual floor (public-contract change class); pm:queue says "dispatchable, no open question", which contradicts the card's own body. No dispatch may pick it up while this label stands. Pairing note for the maintainer: #12281 is the prose axis of the same cross-door question and the two should be read/ruled together (this card's own ⭐ sequencing note); #12281 stays in the cli lane's queue because its first step is a measurement, but the ruling here should be written so it covers both channels.

os-decision-facets

• 实际业务拉动:泄露面窄但真实 —— 500 兜底路径把 SQLITE_ERROR / 42P01 这类驱动方言放上 wire,等于向调用方点名后端(message withhold 要保护的两件事之一);同时该通道的正当用途(metadata-app 作者自声明的 5xx 拒绝码)是 ADR-0112 修正案专门写进去的,全量吞掉会伤到真实用户场景。
• 项目长远合理性:三门一规则 —— 今天「nested 门能发、另两门发不到」是控制流意外而非决定;答案应写进 ADR-0112 的 scope 行,由共享 resolver 一处承载,别让每个 registrar 自带一套。
• 防 AI 犯错:现状的安全性挂在一条未测且会烂的前提上(driver errno 到不了 producing seam —— 只在 rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405 的四个 seam 测过,另两门未测);把裁决落成结构性判据 + pin,出错方向从「静默泄露」变为「响亮拒绝」。
• 创业阶段不扩散:最小合规动作是把「demoted ≠ author-declared」这条既有区分用起来,不新增通道、不新增行为面。
• 选项与推荐:A — 三门都不 withhold(把现状记录为决定,补 pin 钉住未测前提);B — 三门全 withhold(⛔ 卡文已指出会吞掉作者通道);C — 只改 nested 门(⛔ 卡文已否:再造刚收敛掉的分歧);D(推荐)— 按来源切分:demoted(未注册、降级而来)的 code 在 5xx 消毒时随 prose 一并 withhold,作者显式声明的 declaredCode 保留;在共享 resolver 一处实现,三门继承;与 runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 的 prose 轴同一次裁决落地。
• 置信缺口:另两门的 seam 未测(driver errno 可达性);是否已有消费方依赖 wire 上的 demoted 串未测;runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 的人口测量(无 code 的 declared 5xx 生产者是否存在)未做 —— D 若裁定,实施卡应先补这三个读数。

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling recorded — Option D: split by provenance; one rule at the shared resolver, three doors inherit — and the ruling covers #12281's prose axis

Provenance: maintainer, 2026-08-27, PM chat decision-inbox batch 3 (adjudication session session_01DKWDdUJ2XNRESVVWUvcpnh), verbatim: 「同意」 — accepting the triage recommendation D (2026-08-26T07:17Z facet block). ⛔ A (record the leak as a decision), B (withhold the author channel too), and C (a per-door rule) are all declined for the reasons on the card.

Ruled, as ADR-0112 scope: in 5xx sanitisation, a DEMOTED code — one the fallback-to-500 picked up from an undeclared producer (demotedDeclaredCode, e.g. a driver errno such as SQLITE_ERROR / 42P01) — is withheld along with the prose; an AUTHOR-DECLARED declaredCode survives. Implemented once at the shared resolver layer so all three doors inherit one rule; ⛔ no per-registrar variants.

Same ruling, prose axis (#12281): the dispatcher door's errorResponseBase adopts the structural withhold for EVERY declared 5xx message, aligning to /data — the author's user-facing text channel is userMessage (#9934), never the raw message. #12281 stays in the cli lane's queue with its measurement-first step; its ruling is this one.

Dispatch constraints: Clause-②: yes (needs:contract-review on the card) — contract-review tier. The implementing dispatch's FIRST readings are the three named gaps: (a) driver-errno reachability at the other two doors' seams; (b) whether any consumer depends on demoted strings currently on the wire; (c) #12281's population measurement (declared-5xx-no-code producers). ⚠️ packages/rest/src/rest-server.ts is held by open PR #12421 — serial constraint at dispatch.

State: needs-user-decision → pm:queue.

---

Generated by Claude Code