drivers(turso): an unsafe identifier on the remote transport answers 400 INVALID_REQUEST, not an opaque 500

[os-musk]

Fixes#14287

RemoteTransport.assertSafeIdentifier is the one gate for every position where an identifier is inlined into SQL on the Turso remote transport. It threw a bare Error — no code, no status — so mapDataError reached none of its classifying branches, fell through to its sanitised terminal and served a 500. A caller whose own identifier was refused was told the server had faulted, and an SDK reading a 5xx retries a request that can never succeed. Same class as #11455 / #8931, one position over from #14113's alias half.

Every one of those refusals now carries the ADR-0112 envelope code: 'INVALID_REQUEST', status: 400, built by one constructor so the positions cannot answer three ways.

The accept set is untouched.SAFE_IDENTIFIER and every refusal message are byte-identical; exactly the inputs refused before are refused after, with byte-identical prose. Only code and status are new. The groupBy alias gating question (#14235) moves the accept set and is deliberately left open — this PR pins its current refusal so that card cannot be mistaken for having landed.

Envelope chosen by the triage ruling on the card (2026-09-02): an existing member of the declared vocabulary, no new ledger code.

Per position

Position	Reached by	Before	After	Pinned by
aggregate → object	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	remote-transport-unsafe-identifier-envelope.test.ts — "object refuses with the envelope, and sends nothing"; and the #14113 control "the object position still refuses an unsafe identifier"
aggregate → aggregation field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the aggregation field refuses with the envelope"; and the #14113 control "the field position still refuses an unsafe identifier, and sends nothing"
aggregate → groupBy field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy FIELD refuses with the envelope, and sends nothing"
aggregate → groupBy out key (alias)	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy OUT KEY refuses with the envelope — gating unchanged, envelope added"; and the #14113 control "the groupBy alias position is UNCHANGED"
syncSchema → table name	publishing an object (engine.syncObjectSchema)	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchema refuses an unsafe TABLE name with the envelope"
buildCreateTableSQL → column name	publishing a new object	bare Error → 500	INVALID_REQUEST / 400	same file — "… the CREATE leg"
syncSchema → added column name	re-publishing an existing object (ALTER limb)	bare Error → 500	INVALID_REQUEST / 400	same file — "… the ALTER leg"
syncSchemasBatch → object name	batched schema sync	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchemasBatch refuses an unsafe object name with the envelope"
syncUniqueIndexes → index name / columns	unique-index sync	bare Error → 500	INVALID_REQUEST / 400	inherited from the single producer; not independently pinned — see "What is not pinned" below
remote-canonical-backfill free assertSafeIdentifier	boot-time backfill after remote schema sync, or the public operator-driven method	bare Error, flattened to a report string	INVALID_REQUEST / 400, still flattened	same file — "the free assertSafeIdentifier throws the identical envelope" (direct), plus "the backfill still REPORTS rather than throws, and sends no statement"

The mapDataError reading — does the benefit survive the boundary?

Measured by readingpackages/rest/src/error-response.ts at d62f990a9, not by editing or importing it (@objectstack/rest is not a dependency of this package, and a test reaching outside its own package is the check:cross-package-test-inputs shape):

• mapDataError delegates to classifyDataError. Nine error?.code === '…' branches run first; INVALID_REQUEST matches none of them, and none of them reads the message — so nothing intercepts this refusal ahead of the declared-status passthrough.
• declaredHttpStatus(error) (line 349) reads error.status, falling back to error.statusCode, and keeps it when 400 <= s < 600. Our 400 qualifies.
• declaredServerFaultAnswer is the 5xx arm — not taken at 400.
• The 4xx arm returns { status: declaredStatus, body: { error: msg, ...thrownCodeFields(error, declaredStatus) } }. thrownCodeFields emits the closed ADR-0112 member verbatim when the code is in the union, and demotes an unregistered spelling to declaredCode. INVALID_REQUESTis in the union.

So the two fields this PR sets are exactly the two that door reads, and the response goes from a sanitised 500 to a 400 carrying INVALID_REQUEST and the refusal's own sentence. No change to packages/rest.

Ablation — reverse verification

Restore the bare throw new Error(...) in bothassertSafeIdentifier helpers, run the two test files, restore.

• Mutation proved on disk before the run (never a bare --stat, and never the editing tool's exit code): anchored counts of the injected and removed text — injected transport=1 backfill=1 | removed transport=0 backfill=0. The script carries trap restore EXIT INT TERM with absolute paths seeded from git rev-parse --show-toplevel.
• No rebuild leg, and why that is sound here: every import in the test file is relative (./turso-driver.js, ./remote-transport.js, ./remote-canonical-backfill.js), so vitest resolves the subject from src/*.ts and no dist/ sits between the mutation and the run. The RED result is itself that proof — a dist-resolved subject would have stayed green.
• Result: 19 failed / 13 passed. All 19 failures are toEqual comparisons reading { code: undefined, status: undefined }. Not one is a "expected the transport to refuse …" — every input the gate refuses today is still refused with the ablated helper.
• The predicted direction held for the envelope and was too coarse for the accept-set block, recorded rather than quietly rewritten (also corrected in the test file's own docblock). The accept-set block's REFUSED half goes red because it asserts the envelope in the same toEqual as the message; its ACCEPTED half — the direction that catches a tightened gate — stayed green. The red half's diff is the sharper evidence:

 {
- "code": "INVALID_REQUEST",
+ "code": undefined,
"message": "RemoteTransport: unsafe identifier rejected: \"\"",
- "status": 400,
+ "status": undefined,
}

The message line carries no marker: prose and predicate are provably untouched. That is what makes this an envelope change and not a gating one.

• Restore proved byte-exact, not by an exit code: git status --porcelain empty, git diff HEAD empty, and git hash-object equal to the HEAD blob for both files — 2b8d1bc11719b57ace1b380ccc320ed47b60d717 (transport) and 5d5ce5ea9b1c873de49c654f25c35038fdd0b8b6 (backfill).

Driver-conformance ledger — before and after, verbatim

Before the first edit, at d62f990a9:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

After the last commit, at 8422dd4c1:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Unmoved, as it must be — this PR adds no conformance cell and retires none.

The one file outside the dispatched surface, named rather than slipped in

packages/spec/src/api/error-code-ledger.zod.ts gains one provenance row — '@objectstack/driver-turso': ['INVALID_REQUEST'] with its reachability comment. It was not in the dispatched file surface, so here is the evidence rather than a silent edit:

• It is mechanically required, measured not assumed. With the driver change alone, pnpm --filter @objectstack/spec check:error-code-provenance prints: FAIL — 1 stamp site(s) of a registered code with no provenance row: @objectstack/driver-turso stamps 'INVALID_REQUEST' (constdef) at packages/drivers/driver-turso/src/remote-transport.ts:118 — not listed under its own owner key. The gate's own prescribed fix is this row or a waiver, and it says "Both are decisions on the record; silence is not." With the row: OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver.
• It is not a new ledger code, which is what the dispatch fence's parenthetical guards. INVALID_REQUEST is already registered by seven packages. Measured: the deduped registered-code union is 248 codes before and 248 after, with an empty added set and an empty removed set — so ErrorCode, REGISTERED_ERROR_CODES and every generated spec artifact are unchanged (pnpm --filter @objectstack/spec check:generated reports all 15 up to date).
• The shape is pinned by sibling precedent, not invented: @objectstack/driver-memory (UNIQUE_VIOLATION, error-code-ledger: @objectstack/driver-memory becomes an emitter of UNIQUE_VIOLATION with no provenance row — invisible to every gate, which is the point of the row #13254) and @objectstack/driver-sql (SQL_DIALECT_EMISSION_UNSUPPORTED, sql-driver: one emission-identity source — loud refusal for redshift/cockroachdb DDL, pgnative joins the Postgres family (#11756 ruling) #11991) are the same row for the same reason, and the ledger header's own rule is "a code emitted by several packages is listed once per emitting package".
• The row's wire-reachability evidence (the [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 test) is RemoteTransport's DDL and aggregate positions on a server already serving HTTP — explicitly not the backfill module, whose callers flatten the throw.
• No other in-flight branch touches that file (checked against origin), and the claim comment's file surface is amended on the card in the same round.

If you would rather this row landed separately, say so and it comes out — the driver change cannot go green without it, so the two would have to land together in either order.

What is not pinned, said plainly

The unique-index-sync position (index.name and index.columns) inherits the envelope from the single producer but has no independent case: the index name and columns are derived by uniqueIndexesFromFields from an object whose own name and columns were already gated one call earlier, so no input reaches that assert without being refused first. It is covered by construction, not by a test, and inventing a synthetic route to it would pin the harness rather than the behaviour.

On the backfill producer: its envelope is defence in depth, not a wire answer today, and the test says so rather than implying more. Both callers flatten the throw into report.error by design (ADR-0053 D-B3 forbids a migration taking a boot down), so code/status reach no response envelope from that module. The helper is exported so the envelope has a real pin — nothing else can observe it, and an unobservable assertion is a phantom check rather than a test.

Verification

Union run on 8422dd4c1 (this PR's head, after merging origin/main):

Command	Verdict line
pnpm --filter @objectstack/driver-turso test	Test Files 42 passed (42) · Tests 1143 passed (1143)
pnpm --filter @objectstack/driver-turso typecheck	exit 0 — and tsc --noEmit --listFiles confirms both edited/added test files are in the program (2 hits), so "typecheck clean" really covers them
pnpm lint (whole repo, eslint . --no-inline-config)	exit 0
pnpm --filter @objectstack/spec check:error-code-provenance	OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver (8 waiver(s), all live)
pnpm --filter @objectstack/spec check:generated	✓ All 15 generated artifacts are up to date.
pnpm --filter @objectstack/spec exec vitest run src/api/error-code-ledger.test.ts	18 passed
pnpm check:driver-conformance	OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.
pnpm check:error-code-casing · check:dispatcher-error-vocabulary	exit 0 · exit 0
pnpm check:engine-double-contract · check:where-matcher · check:query-options-erasure · check:type-check-coverage	exit 0 (the four convention-triggered by a new test file)
pnpm check:nul-bytes	exit 0

The rest of the re-derived family (node scripts/pm/dispatch-gates.mjs, 52 path-matched plus 4 by change kind — the dispatch's hint named 20, before the ledger row widened it) ran green too: check:cross-package-test-inputs, check:doc-authoring, check:logger-receiver-detach, check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:changeset-gate-self-tests, check:objectui-changeset, check:pm-half-states, check:merge-driver, check:spec-parsed-alias, check:objectql-double-limit, and the direct-node ones (check-ci-filter-parity, check-comment-mask-adoption, check-cross-package-test-inputs, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, docs-audit/check-affected-docs, docs-audit/check-drift-comment, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, release-rehearsal-clone --self-test).

Two gates returned exit 3 = NOT MEASURED, which is neither green nor red and is recorded as such: scripts/check-test-completeness.mjs (needs a saved turbo run test log that only CI produces) and scripts/pm/check-half-states.mjs (needs repo-scoped REST egress; this session's repo-scoped REST answers 403).

Changeset: patch for @objectstack/driver-turso and @objectstack/spec — a refusal-envelope correction plus a provenance row; nothing an author writes changes, so it is not breaking.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-turso, @objectstack/spec, touching 7 documentable anchor(s).

10 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/metadata-api.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/automation/webhooks.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/data-modeling/import-mappings.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/permissions/authentication.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/permissions/sso.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/ui/forms.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 131 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c78fe6759e4d2f87971c47e7999151d8a5a5972b — the merge of head 8422dd4c1d97fcb6e86943af0398809e0b5b684d into base 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c78fe6759e4d2f87971c47e7999151d8a5a5972b && git checkout c78fe6759e4d2f87971c47e7999151d8a5a5972b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 8422dd4c1d97fcb6e86943af0398809e0b5b684d && git checkout -B drift-repro 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 && git merge --no-ff 8422dd4c1d97fcb6e86943af0398809e0b5b684d
node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Enqueue provenance (domain:engine execution seat, session_0112hMx9hjJ9BgB28X97DS68): ACCEPT on #14287 (comment 5504280781) → at 04:29Z every check run on head 8422dd4c1 was completed with success or skipped (34 runs; Lint & Repo Gates finished 04:24Z), governed-surface test on the six changed paths: NOT governed, mergeable_state not dirty → marked ready and auto-merge (squash) enabled. Landing is by the merge queue; the engine seat follows it to MERGED.

---

Generated by Claude Code

[os-musk]

Fixes#14287

RemoteTransport.assertSafeIdentifier is the one gate for every position where an identifier is inlined into SQL on the Turso remote transport. It threw a bare Error — no code, no status — so mapDataError reached none of its classifying branches, fell through to its sanitised terminal and served a 500. A caller whose own identifier was refused was told the server had faulted, and an SDK reading a 5xx retries a request that can never succeed. Same class as #11455 / #8931, one position over from #14113's alias half.

Every one of those refusals now carries the ADR-0112 envelope code: 'INVALID_REQUEST', status: 400, built by one constructor so the positions cannot answer three ways.

The accept set is untouched.SAFE_IDENTIFIER and every refusal message are byte-identical; exactly the inputs refused before are refused after, with byte-identical prose. Only code and status are new. The groupBy alias gating question (#14235) moves the accept set and is deliberately left open — this PR pins its current refusal so that card cannot be mistaken for having landed.

Envelope chosen by the triage ruling on the card (2026-09-02): an existing member of the declared vocabulary, no new ledger code.

Per position

Position	Reached by	Before	After	Pinned by
aggregate → object	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	remote-transport-unsafe-identifier-envelope.test.ts — "object refuses with the envelope, and sends nothing"; and the #14113 control "the object position still refuses an unsafe identifier"
aggregate → aggregation field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the aggregation field refuses with the envelope"; and the #14113 control "the field position still refuses an unsafe identifier, and sends nothing"
aggregate → groupBy field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy FIELD refuses with the envelope, and sends nothing"
aggregate → groupBy out key (alias)	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy OUT KEY refuses with the envelope — gating unchanged, envelope added"; and the #14113 control "the groupBy alias position is UNCHANGED"
syncSchema → table name	publishing an object (engine.syncObjectSchema)	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchema refuses an unsafe TABLE name with the envelope"
buildCreateTableSQL → column name	publishing a new object	bare Error → 500	INVALID_REQUEST / 400	same file — "… the CREATE leg"
syncSchema → added column name	re-publishing an existing object (ALTER limb)	bare Error → 500	INVALID_REQUEST / 400	same file — "… the ALTER leg"
syncSchemasBatch → object name	batched schema sync	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchemasBatch refuses an unsafe object name with the envelope"
syncUniqueIndexes → index name / columns	unique-index sync	bare Error → 500	INVALID_REQUEST / 400	inherited from the single producer; not independently pinned — see "What is not pinned" below
remote-canonical-backfill free assertSafeIdentifier	boot-time backfill after remote schema sync, or the public operator-driven method	bare Error, flattened to a report string	INVALID_REQUEST / 400, still flattened	same file — "the free assertSafeIdentifier throws the identical envelope" (direct), plus "the backfill still REPORTS rather than throws, and sends no statement"

The mapDataError reading — does the benefit survive the boundary?

Measured by readingpackages/rest/src/error-response.ts at d62f990a9, not by editing or importing it (@objectstack/rest is not a dependency of this package, and a test reaching outside its own package is the check:cross-package-test-inputs shape):

• mapDataError delegates to classifyDataError. Nine error?.code === '…' branches run first; INVALID_REQUEST matches none of them, and none of them reads the message — so nothing intercepts this refusal ahead of the declared-status passthrough.
• declaredHttpStatus(error) (line 349) reads error.status, falling back to error.statusCode, and keeps it when 400 <= s < 600. Our 400 qualifies.
• declaredServerFaultAnswer is the 5xx arm — not taken at 400.
• The 4xx arm returns { status: declaredStatus, body: { error: msg, ...thrownCodeFields(error, declaredStatus) } }. thrownCodeFields emits the closed ADR-0112 member verbatim when the code is in the union, and demotes an unregistered spelling to declaredCode. INVALID_REQUESTis in the union.

So the two fields this PR sets are exactly the two that door reads, and the response goes from a sanitised 500 to a 400 carrying INVALID_REQUEST and the refusal's own sentence. No change to packages/rest.

Ablation — reverse verification

Restore the bare throw new Error(...) in bothassertSafeIdentifier helpers, run the two test files, restore.

• Mutation proved on disk before the run (never a bare --stat, and never the editing tool's exit code): anchored counts of the injected and removed text — injected transport=1 backfill=1 | removed transport=0 backfill=0. The script carries trap restore EXIT INT TERM with absolute paths seeded from git rev-parse --show-toplevel.
• No rebuild leg, and why that is sound here: every import in the test file is relative (./turso-driver.js, ./remote-transport.js, ./remote-canonical-backfill.js), so vitest resolves the subject from src/*.ts and no dist/ sits between the mutation and the run. The RED result is itself that proof — a dist-resolved subject would have stayed green.
• Result: 19 failed / 13 passed. All 19 failures are toEqual comparisons reading { code: undefined, status: undefined }. Not one is a "expected the transport to refuse …" — every input the gate refuses today is still refused with the ablated helper.
• The predicted direction held for the envelope and was too coarse for the accept-set block, recorded rather than quietly rewritten (also corrected in the test file's own docblock). The accept-set block's REFUSED half goes red because it asserts the envelope in the same toEqual as the message; its ACCEPTED half — the direction that catches a tightened gate — stayed green. The red half's diff is the sharper evidence:

 {
- "code": "INVALID_REQUEST",
+ "code": undefined,
"message": "RemoteTransport: unsafe identifier rejected: \"\"",
- "status": 400,
+ "status": undefined,
}

The message line carries no marker: prose and predicate are provably untouched. That is what makes this an envelope change and not a gating one.

• Restore proved byte-exact, not by an exit code: git status --porcelain empty, git diff HEAD empty, and git hash-object equal to the HEAD blob for both files — 2b8d1bc11719b57ace1b380ccc320ed47b60d717 (transport) and 5d5ce5ea9b1c873de49c654f25c35038fdd0b8b6 (backfill).

Driver-conformance ledger — before and after, verbatim

Before the first edit, at d62f990a9:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

After the last commit, at 8422dd4c1:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Unmoved, as it must be — this PR adds no conformance cell and retires none.

The one file outside the dispatched surface, named rather than slipped in

packages/spec/src/api/error-code-ledger.zod.ts gains one provenance row — '@objectstack/driver-turso': ['INVALID_REQUEST'] with its reachability comment. It was not in the dispatched file surface, so here is the evidence rather than a silent edit:

• It is mechanically required, measured not assumed. With the driver change alone, pnpm --filter @objectstack/spec check:error-code-provenance prints: FAIL — 1 stamp site(s) of a registered code with no provenance row: @objectstack/driver-turso stamps 'INVALID_REQUEST' (constdef) at packages/drivers/driver-turso/src/remote-transport.ts:118 — not listed under its own owner key. The gate's own prescribed fix is this row or a waiver, and it says "Both are decisions on the record; silence is not." With the row: OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver.
• It is not a new ledger code, which is what the dispatch fence's parenthetical guards. INVALID_REQUEST is already registered by seven packages. Measured: the deduped registered-code union is 248 codes before and 248 after, with an empty added set and an empty removed set — so ErrorCode, REGISTERED_ERROR_CODES and every generated spec artifact are unchanged (pnpm --filter @objectstack/spec check:generated reports all 15 up to date).
• The shape is pinned by sibling precedent, not invented: @objectstack/driver-memory (UNIQUE_VIOLATION, error-code-ledger: @objectstack/driver-memory becomes an emitter of UNIQUE_VIOLATION with no provenance row — invisible to every gate, which is the point of the row #13254) and @objectstack/driver-sql (SQL_DIALECT_EMISSION_UNSUPPORTED, sql-driver: one emission-identity source — loud refusal for redshift/cockroachdb DDL, pgnative joins the Postgres family (#11756 ruling) #11991) are the same row for the same reason, and the ledger header's own rule is "a code emitted by several packages is listed once per emitting package".
• The row's wire-reachability evidence (the [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 test) is RemoteTransport's DDL and aggregate positions on a server already serving HTTP — explicitly not the backfill module, whose callers flatten the throw.
• No other in-flight branch touches that file (checked against origin), and the claim comment's file surface is amended on the card in the same round.

If you would rather this row landed separately, say so and it comes out — the driver change cannot go green without it, so the two would have to land together in either order.

What is not pinned, said plainly

The unique-index-sync position (index.name and index.columns) inherits the envelope from the single producer but has no independent case: the index name and columns are derived by uniqueIndexesFromFields from an object whose own name and columns were already gated one call earlier, so no input reaches that assert without being refused first. It is covered by construction, not by a test, and inventing a synthetic route to it would pin the harness rather than the behaviour.

On the backfill producer: its envelope is defence in depth, not a wire answer today, and the test says so rather than implying more. Both callers flatten the throw into report.error by design (ADR-0053 D-B3 forbids a migration taking a boot down), so code/status reach no response envelope from that module. The helper is exported so the envelope has a real pin — nothing else can observe it, and an unobservable assertion is a phantom check rather than a test.

Verification

Union run on 8422dd4c1 (this PR's head, after merging origin/main):

Command	Verdict line
pnpm --filter @objectstack/driver-turso test	Test Files 42 passed (42) · Tests 1143 passed (1143)
pnpm --filter @objectstack/driver-turso typecheck	exit 0 — and tsc --noEmit --listFiles confirms both edited/added test files are in the program (2 hits), so "typecheck clean" really covers them
pnpm lint (whole repo, eslint . --no-inline-config)	exit 0
pnpm --filter @objectstack/spec check:error-code-provenance	OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver (8 waiver(s), all live)
pnpm --filter @objectstack/spec check:generated	✓ All 15 generated artifacts are up to date.
pnpm --filter @objectstack/spec exec vitest run src/api/error-code-ledger.test.ts	18 passed
pnpm check:driver-conformance	OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.
pnpm check:error-code-casing · check:dispatcher-error-vocabulary	exit 0 · exit 0
pnpm check:engine-double-contract · check:where-matcher · check:query-options-erasure · check:type-check-coverage	exit 0 (the four convention-triggered by a new test file)
pnpm check:nul-bytes	exit 0

The rest of the re-derived family (node scripts/pm/dispatch-gates.mjs, 52 path-matched plus 4 by change kind — the dispatch's hint named 20, before the ledger row widened it) ran green too: check:cross-package-test-inputs, check:doc-authoring, check:logger-receiver-detach, check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:changeset-gate-self-tests, check:objectui-changeset, check:pm-half-states, check:merge-driver, check:spec-parsed-alias, check:objectql-double-limit, and the direct-node ones (check-ci-filter-parity, check-comment-mask-adoption, check-cross-package-test-inputs, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, docs-audit/check-affected-docs, docs-audit/check-drift-comment, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, release-rehearsal-clone --self-test).

Two gates returned exit 3 = NOT MEASURED, which is neither green nor red and is recorded as such: scripts/check-test-completeness.mjs (needs a saved turbo run test log that only CI produces) and scripts/pm/check-half-states.mjs (needs repo-scoped REST egress; this session's repo-scoped REST answers 403).

Changeset: patch for @objectstack/driver-turso and @objectstack/spec — a refusal-envelope correction plus a provenance row; nothing an author writes changes, so it is not breaking.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-turso, @objectstack/spec, touching 7 documentable anchor(s).

10 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/metadata-api.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/automation/webhooks.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/data-modeling/import-mappings.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/permissions/authentication.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/permissions/sso.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/ui/forms.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 131 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c78fe6759e4d2f87971c47e7999151d8a5a5972b — the merge of head 8422dd4c1d97fcb6e86943af0398809e0b5b684d into base 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c78fe6759e4d2f87971c47e7999151d8a5a5972b && git checkout c78fe6759e4d2f87971c47e7999151d8a5a5972b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 8422dd4c1d97fcb6e86943af0398809e0b5b684d && git checkout -B drift-repro 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 && git merge --no-ff 8422dd4c1d97fcb6e86943af0398809e0b5b684d
node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Enqueue provenance (domain:engine execution seat, session_0112hMx9hjJ9BgB28X97DS68): ACCEPT on #14287 (comment 5504280781) → at 04:29Z every check run on head 8422dd4c1 was completed with success or skipped (34 runs; Lint & Repo Gates finished 04:24Z), governed-surface test on the six changed paths: NOT governed, mergeable_state not dirty → marked ready and auto-merge (squash) enabled. Landing is by the merge queue; the engine seat follows it to MERGED.

---

Generated by Claude Code

[os-musk]

Fixes#14287

RemoteTransport.assertSafeIdentifier is the one gate for every position where an identifier is inlined into SQL on the Turso remote transport. It threw a bare Error — no code, no status — so mapDataError reached none of its classifying branches, fell through to its sanitised terminal and served a 500. A caller whose own identifier was refused was told the server had faulted, and an SDK reading a 5xx retries a request that can never succeed. Same class as #11455 / #8931, one position over from #14113's alias half.

Every one of those refusals now carries the ADR-0112 envelope code: 'INVALID_REQUEST', status: 400, built by one constructor so the positions cannot answer three ways.

The accept set is untouched.SAFE_IDENTIFIER and every refusal message are byte-identical; exactly the inputs refused before are refused after, with byte-identical prose. Only code and status are new. The groupBy alias gating question (#14235) moves the accept set and is deliberately left open — this PR pins its current refusal so that card cannot be mistaken for having landed.

Envelope chosen by the triage ruling on the card (2026-09-02): an existing member of the declared vocabulary, no new ledger code.

Per position

Position	Reached by	Before	After	Pinned by
aggregate → object	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	remote-transport-unsafe-identifier-envelope.test.ts — "object refuses with the envelope, and sends nothing"; and the #14113 control "the object position still refuses an unsafe identifier"
aggregate → aggregation field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the aggregation field refuses with the envelope"; and the #14113 control "the field position still refuses an unsafe identifier, and sends nothing"
aggregate → groupBy field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy FIELD refuses with the envelope, and sends nothing"
aggregate → groupBy out key (alias)	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy OUT KEY refuses with the envelope — gating unchanged, envelope added"; and the #14113 control "the groupBy alias position is UNCHANGED"
syncSchema → table name	publishing an object (engine.syncObjectSchema)	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchema refuses an unsafe TABLE name with the envelope"
buildCreateTableSQL → column name	publishing a new object	bare Error → 500	INVALID_REQUEST / 400	same file — "… the CREATE leg"
syncSchema → added column name	re-publishing an existing object (ALTER limb)	bare Error → 500	INVALID_REQUEST / 400	same file — "… the ALTER leg"
syncSchemasBatch → object name	batched schema sync	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchemasBatch refuses an unsafe object name with the envelope"
syncUniqueIndexes → index name / columns	unique-index sync	bare Error → 500	INVALID_REQUEST / 400	inherited from the single producer; not independently pinned — see "What is not pinned" below
remote-canonical-backfill free assertSafeIdentifier	boot-time backfill after remote schema sync, or the public operator-driven method	bare Error, flattened to a report string	INVALID_REQUEST / 400, still flattened	same file — "the free assertSafeIdentifier throws the identical envelope" (direct), plus "the backfill still REPORTS rather than throws, and sends no statement"

The mapDataError reading — does the benefit survive the boundary?

Measured by readingpackages/rest/src/error-response.ts at d62f990a9, not by editing or importing it (@objectstack/rest is not a dependency of this package, and a test reaching outside its own package is the check:cross-package-test-inputs shape):

• mapDataError delegates to classifyDataError. Nine error?.code === '…' branches run first; INVALID_REQUEST matches none of them, and none of them reads the message — so nothing intercepts this refusal ahead of the declared-status passthrough.
• declaredHttpStatus(error) (line 349) reads error.status, falling back to error.statusCode, and keeps it when 400 <= s < 600. Our 400 qualifies.
• declaredServerFaultAnswer is the 5xx arm — not taken at 400.
• The 4xx arm returns { status: declaredStatus, body: { error: msg, ...thrownCodeFields(error, declaredStatus) } }. thrownCodeFields emits the closed ADR-0112 member verbatim when the code is in the union, and demotes an unregistered spelling to declaredCode. INVALID_REQUESTis in the union.

So the two fields this PR sets are exactly the two that door reads, and the response goes from a sanitised 500 to a 400 carrying INVALID_REQUEST and the refusal's own sentence. No change to packages/rest.

Ablation — reverse verification

Restore the bare throw new Error(...) in bothassertSafeIdentifier helpers, run the two test files, restore.

• Mutation proved on disk before the run (never a bare --stat, and never the editing tool's exit code): anchored counts of the injected and removed text — injected transport=1 backfill=1 | removed transport=0 backfill=0. The script carries trap restore EXIT INT TERM with absolute paths seeded from git rev-parse --show-toplevel.
• No rebuild leg, and why that is sound here: every import in the test file is relative (./turso-driver.js, ./remote-transport.js, ./remote-canonical-backfill.js), so vitest resolves the subject from src/*.ts and no dist/ sits between the mutation and the run. The RED result is itself that proof — a dist-resolved subject would have stayed green.
• Result: 19 failed / 13 passed. All 19 failures are toEqual comparisons reading { code: undefined, status: undefined }. Not one is a "expected the transport to refuse …" — every input the gate refuses today is still refused with the ablated helper.
• The predicted direction held for the envelope and was too coarse for the accept-set block, recorded rather than quietly rewritten (also corrected in the test file's own docblock). The accept-set block's REFUSED half goes red because it asserts the envelope in the same toEqual as the message; its ACCEPTED half — the direction that catches a tightened gate — stayed green. The red half's diff is the sharper evidence:

 {
- "code": "INVALID_REQUEST",
+ "code": undefined,
"message": "RemoteTransport: unsafe identifier rejected: \"\"",
- "status": 400,
+ "status": undefined,
}

The message line carries no marker: prose and predicate are provably untouched. That is what makes this an envelope change and not a gating one.

• Restore proved byte-exact, not by an exit code: git status --porcelain empty, git diff HEAD empty, and git hash-object equal to the HEAD blob for both files — 2b8d1bc11719b57ace1b380ccc320ed47b60d717 (transport) and 5d5ce5ea9b1c873de49c654f25c35038fdd0b8b6 (backfill).

Driver-conformance ledger — before and after, verbatim

Before the first edit, at d62f990a9:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

After the last commit, at 8422dd4c1:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Unmoved, as it must be — this PR adds no conformance cell and retires none.

The one file outside the dispatched surface, named rather than slipped in

packages/spec/src/api/error-code-ledger.zod.ts gains one provenance row — '@objectstack/driver-turso': ['INVALID_REQUEST'] with its reachability comment. It was not in the dispatched file surface, so here is the evidence rather than a silent edit:

• It is mechanically required, measured not assumed. With the driver change alone, pnpm --filter @objectstack/spec check:error-code-provenance prints: FAIL — 1 stamp site(s) of a registered code with no provenance row: @objectstack/driver-turso stamps 'INVALID_REQUEST' (constdef) at packages/drivers/driver-turso/src/remote-transport.ts:118 — not listed under its own owner key. The gate's own prescribed fix is this row or a waiver, and it says "Both are decisions on the record; silence is not." With the row: OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver.
• It is not a new ledger code, which is what the dispatch fence's parenthetical guards. INVALID_REQUEST is already registered by seven packages. Measured: the deduped registered-code union is 248 codes before and 248 after, with an empty added set and an empty removed set — so ErrorCode, REGISTERED_ERROR_CODES and every generated spec artifact are unchanged (pnpm --filter @objectstack/spec check:generated reports all 15 up to date).
• The shape is pinned by sibling precedent, not invented: @objectstack/driver-memory (UNIQUE_VIOLATION, error-code-ledger: @objectstack/driver-memory becomes an emitter of UNIQUE_VIOLATION with no provenance row — invisible to every gate, which is the point of the row #13254) and @objectstack/driver-sql (SQL_DIALECT_EMISSION_UNSUPPORTED, sql-driver: one emission-identity source — loud refusal for redshift/cockroachdb DDL, pgnative joins the Postgres family (#11756 ruling) #11991) are the same row for the same reason, and the ledger header's own rule is "a code emitted by several packages is listed once per emitting package".
• The row's wire-reachability evidence (the [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 test) is RemoteTransport's DDL and aggregate positions on a server already serving HTTP — explicitly not the backfill module, whose callers flatten the throw.
• No other in-flight branch touches that file (checked against origin), and the claim comment's file surface is amended on the card in the same round.

If you would rather this row landed separately, say so and it comes out — the driver change cannot go green without it, so the two would have to land together in either order.

What is not pinned, said plainly

The unique-index-sync position (index.name and index.columns) inherits the envelope from the single producer but has no independent case: the index name and columns are derived by uniqueIndexesFromFields from an object whose own name and columns were already gated one call earlier, so no input reaches that assert without being refused first. It is covered by construction, not by a test, and inventing a synthetic route to it would pin the harness rather than the behaviour.

On the backfill producer: its envelope is defence in depth, not a wire answer today, and the test says so rather than implying more. Both callers flatten the throw into report.error by design (ADR-0053 D-B3 forbids a migration taking a boot down), so code/status reach no response envelope from that module. The helper is exported so the envelope has a real pin — nothing else can observe it, and an unobservable assertion is a phantom check rather than a test.

Verification

Union run on 8422dd4c1 (this PR's head, after merging origin/main):

Command	Verdict line
pnpm --filter @objectstack/driver-turso test	Test Files 42 passed (42) · Tests 1143 passed (1143)
pnpm --filter @objectstack/driver-turso typecheck	exit 0 — and tsc --noEmit --listFiles confirms both edited/added test files are in the program (2 hits), so "typecheck clean" really covers them
pnpm lint (whole repo, eslint . --no-inline-config)	exit 0
pnpm --filter @objectstack/spec check:error-code-provenance	OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver (8 waiver(s), all live)
pnpm --filter @objectstack/spec check:generated	✓ All 15 generated artifacts are up to date.
pnpm --filter @objectstack/spec exec vitest run src/api/error-code-ledger.test.ts	18 passed
pnpm check:driver-conformance	OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.
pnpm check:error-code-casing · check:dispatcher-error-vocabulary	exit 0 · exit 0
pnpm check:engine-double-contract · check:where-matcher · check:query-options-erasure · check:type-check-coverage	exit 0 (the four convention-triggered by a new test file)
pnpm check:nul-bytes	exit 0

The rest of the re-derived family (node scripts/pm/dispatch-gates.mjs, 52 path-matched plus 4 by change kind — the dispatch's hint named 20, before the ledger row widened it) ran green too: check:cross-package-test-inputs, check:doc-authoring, check:logger-receiver-detach, check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:changeset-gate-self-tests, check:objectui-changeset, check:pm-half-states, check:merge-driver, check:spec-parsed-alias, check:objectql-double-limit, and the direct-node ones (check-ci-filter-parity, check-comment-mask-adoption, check-cross-package-test-inputs, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, docs-audit/check-affected-docs, docs-audit/check-drift-comment, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, release-rehearsal-clone --self-test).

Two gates returned exit 3 = NOT MEASURED, which is neither green nor red and is recorded as such: scripts/check-test-completeness.mjs (needs a saved turbo run test log that only CI produces) and scripts/pm/check-half-states.mjs (needs repo-scoped REST egress; this session's repo-scoped REST answers 403).

Changeset: patch for @objectstack/driver-turso and @objectstack/spec — a refusal-envelope correction plus a provenance row; nothing an author writes changes, so it is not breaking.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-turso, @objectstack/spec, touching 7 documentable anchor(s).

10 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/metadata-api.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/automation/webhooks.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/data-modeling/import-mappings.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/permissions/authentication.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/permissions/sso.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/ui/forms.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 131 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c78fe6759e4d2f87971c47e7999151d8a5a5972b — the merge of head 8422dd4c1d97fcb6e86943af0398809e0b5b684d into base 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c78fe6759e4d2f87971c47e7999151d8a5a5972b && git checkout c78fe6759e4d2f87971c47e7999151d8a5a5972b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 8422dd4c1d97fcb6e86943af0398809e0b5b684d && git checkout -B drift-repro 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 && git merge --no-ff 8422dd4c1d97fcb6e86943af0398809e0b5b684d
node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Enqueue provenance (domain:engine execution seat, session_0112hMx9hjJ9BgB28X97DS68): ACCEPT on #14287 (comment 5504280781) → at 04:29Z every check run on head 8422dd4c1 was completed with success or skipped (34 runs; Lint & Repo Gates finished 04:24Z), governed-surface test on the six changed paths: NOT governed, mergeable_state not dirty → marked ready and auto-merge (squash) enabled. Landing is by the merge queue; the engine seat follows it to MERGED.

---

Generated by Claude Code

[os-musk]

Fixes#14287

RemoteTransport.assertSafeIdentifier is the one gate for every position where an identifier is inlined into SQL on the Turso remote transport. It threw a bare Error — no code, no status — so mapDataError reached none of its classifying branches, fell through to its sanitised terminal and served a 500. A caller whose own identifier was refused was told the server had faulted, and an SDK reading a 5xx retries a request that can never succeed. Same class as #11455 / #8931, one position over from #14113's alias half.

Every one of those refusals now carries the ADR-0112 envelope code: 'INVALID_REQUEST', status: 400, built by one constructor so the positions cannot answer three ways.

The accept set is untouched.SAFE_IDENTIFIER and every refusal message are byte-identical; exactly the inputs refused before are refused after, with byte-identical prose. Only code and status are new. The groupBy alias gating question (#14235) moves the accept set and is deliberately left open — this PR pins its current refusal so that card cannot be mistaken for having landed.

Envelope chosen by the triage ruling on the card (2026-09-02): an existing member of the declared vocabulary, no new ledger code.

Per position

Position	Reached by	Before	After	Pinned by
aggregate → object	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	remote-transport-unsafe-identifier-envelope.test.ts — "object refuses with the envelope, and sends nothing"; and the #14113 control "the object position still refuses an unsafe identifier"
aggregate → aggregation field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the aggregation field refuses with the envelope"; and the #14113 control "the field position still refuses an unsafe identifier, and sends nothing"
aggregate → groupBy field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy FIELD refuses with the envelope, and sends nothing"
aggregate → groupBy out key (alias)	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy OUT KEY refuses with the envelope — gating unchanged, envelope added"; and the #14113 control "the groupBy alias position is UNCHANGED"
syncSchema → table name	publishing an object (engine.syncObjectSchema)	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchema refuses an unsafe TABLE name with the envelope"
buildCreateTableSQL → column name	publishing a new object	bare Error → 500	INVALID_REQUEST / 400	same file — "… the CREATE leg"
syncSchema → added column name	re-publishing an existing object (ALTER limb)	bare Error → 500	INVALID_REQUEST / 400	same file — "… the ALTER leg"
syncSchemasBatch → object name	batched schema sync	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchemasBatch refuses an unsafe object name with the envelope"
syncUniqueIndexes → index name / columns	unique-index sync	bare Error → 500	INVALID_REQUEST / 400	inherited from the single producer; not independently pinned — see "What is not pinned" below
remote-canonical-backfill free assertSafeIdentifier	boot-time backfill after remote schema sync, or the public operator-driven method	bare Error, flattened to a report string	INVALID_REQUEST / 400, still flattened	same file — "the free assertSafeIdentifier throws the identical envelope" (direct), plus "the backfill still REPORTS rather than throws, and sends no statement"

The mapDataError reading — does the benefit survive the boundary?

Measured by readingpackages/rest/src/error-response.ts at d62f990a9, not by editing or importing it (@objectstack/rest is not a dependency of this package, and a test reaching outside its own package is the check:cross-package-test-inputs shape):

• mapDataError delegates to classifyDataError. Nine error?.code === '…' branches run first; INVALID_REQUEST matches none of them, and none of them reads the message — so nothing intercepts this refusal ahead of the declared-status passthrough.
• declaredHttpStatus(error) (line 349) reads error.status, falling back to error.statusCode, and keeps it when 400 <= s < 600. Our 400 qualifies.
• declaredServerFaultAnswer is the 5xx arm — not taken at 400.
• The 4xx arm returns { status: declaredStatus, body: { error: msg, ...thrownCodeFields(error, declaredStatus) } }. thrownCodeFields emits the closed ADR-0112 member verbatim when the code is in the union, and demotes an unregistered spelling to declaredCode. INVALID_REQUESTis in the union.

So the two fields this PR sets are exactly the two that door reads, and the response goes from a sanitised 500 to a 400 carrying INVALID_REQUEST and the refusal's own sentence. No change to packages/rest.

Ablation — reverse verification

Restore the bare throw new Error(...) in bothassertSafeIdentifier helpers, run the two test files, restore.

• Mutation proved on disk before the run (never a bare --stat, and never the editing tool's exit code): anchored counts of the injected and removed text — injected transport=1 backfill=1 | removed transport=0 backfill=0. The script carries trap restore EXIT INT TERM with absolute paths seeded from git rev-parse --show-toplevel.
• No rebuild leg, and why that is sound here: every import in the test file is relative (./turso-driver.js, ./remote-transport.js, ./remote-canonical-backfill.js), so vitest resolves the subject from src/*.ts and no dist/ sits between the mutation and the run. The RED result is itself that proof — a dist-resolved subject would have stayed green.
• Result: 19 failed / 13 passed. All 19 failures are toEqual comparisons reading { code: undefined, status: undefined }. Not one is a "expected the transport to refuse …" — every input the gate refuses today is still refused with the ablated helper.
• The predicted direction held for the envelope and was too coarse for the accept-set block, recorded rather than quietly rewritten (also corrected in the test file's own docblock). The accept-set block's REFUSED half goes red because it asserts the envelope in the same toEqual as the message; its ACCEPTED half — the direction that catches a tightened gate — stayed green. The red half's diff is the sharper evidence:

 {
- "code": "INVALID_REQUEST",
+ "code": undefined,
"message": "RemoteTransport: unsafe identifier rejected: \"\"",
- "status": 400,
+ "status": undefined,
}

The message line carries no marker: prose and predicate are provably untouched. That is what makes this an envelope change and not a gating one.

• Restore proved byte-exact, not by an exit code: git status --porcelain empty, git diff HEAD empty, and git hash-object equal to the HEAD blob for both files — 2b8d1bc11719b57ace1b380ccc320ed47b60d717 (transport) and 5d5ce5ea9b1c873de49c654f25c35038fdd0b8b6 (backfill).

Driver-conformance ledger — before and after, verbatim

Before the first edit, at d62f990a9:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

After the last commit, at 8422dd4c1:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Unmoved, as it must be — this PR adds no conformance cell and retires none.

The one file outside the dispatched surface, named rather than slipped in

packages/spec/src/api/error-code-ledger.zod.ts gains one provenance row — '@objectstack/driver-turso': ['INVALID_REQUEST'] with its reachability comment. It was not in the dispatched file surface, so here is the evidence rather than a silent edit:

• It is mechanically required, measured not assumed. With the driver change alone, pnpm --filter @objectstack/spec check:error-code-provenance prints: FAIL — 1 stamp site(s) of a registered code with no provenance row: @objectstack/driver-turso stamps 'INVALID_REQUEST' (constdef) at packages/drivers/driver-turso/src/remote-transport.ts:118 — not listed under its own owner key. The gate's own prescribed fix is this row or a waiver, and it says "Both are decisions on the record; silence is not." With the row: OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver.
• It is not a new ledger code, which is what the dispatch fence's parenthetical guards. INVALID_REQUEST is already registered by seven packages. Measured: the deduped registered-code union is 248 codes before and 248 after, with an empty added set and an empty removed set — so ErrorCode, REGISTERED_ERROR_CODES and every generated spec artifact are unchanged (pnpm --filter @objectstack/spec check:generated reports all 15 up to date).
• The shape is pinned by sibling precedent, not invented: @objectstack/driver-memory (UNIQUE_VIOLATION, error-code-ledger: @objectstack/driver-memory becomes an emitter of UNIQUE_VIOLATION with no provenance row — invisible to every gate, which is the point of the row #13254) and @objectstack/driver-sql (SQL_DIALECT_EMISSION_UNSUPPORTED, sql-driver: one emission-identity source — loud refusal for redshift/cockroachdb DDL, pgnative joins the Postgres family (#11756 ruling) #11991) are the same row for the same reason, and the ledger header's own rule is "a code emitted by several packages is listed once per emitting package".
• The row's wire-reachability evidence (the [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 test) is RemoteTransport's DDL and aggregate positions on a server already serving HTTP — explicitly not the backfill module, whose callers flatten the throw.
• No other in-flight branch touches that file (checked against origin), and the claim comment's file surface is amended on the card in the same round.

If you would rather this row landed separately, say so and it comes out — the driver change cannot go green without it, so the two would have to land together in either order.

What is not pinned, said plainly

The unique-index-sync position (index.name and index.columns) inherits the envelope from the single producer but has no independent case: the index name and columns are derived by uniqueIndexesFromFields from an object whose own name and columns were already gated one call earlier, so no input reaches that assert without being refused first. It is covered by construction, not by a test, and inventing a synthetic route to it would pin the harness rather than the behaviour.

On the backfill producer: its envelope is defence in depth, not a wire answer today, and the test says so rather than implying more. Both callers flatten the throw into report.error by design (ADR-0053 D-B3 forbids a migration taking a boot down), so code/status reach no response envelope from that module. The helper is exported so the envelope has a real pin — nothing else can observe it, and an unobservable assertion is a phantom check rather than a test.

Verification

Union run on 8422dd4c1 (this PR's head, after merging origin/main):

Command	Verdict line
pnpm --filter @objectstack/driver-turso test	Test Files 42 passed (42) · Tests 1143 passed (1143)
pnpm --filter @objectstack/driver-turso typecheck	exit 0 — and tsc --noEmit --listFiles confirms both edited/added test files are in the program (2 hits), so "typecheck clean" really covers them
pnpm lint (whole repo, eslint . --no-inline-config)	exit 0
pnpm --filter @objectstack/spec check:error-code-provenance	OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver (8 waiver(s), all live)
pnpm --filter @objectstack/spec check:generated	✓ All 15 generated artifacts are up to date.
pnpm --filter @objectstack/spec exec vitest run src/api/error-code-ledger.test.ts	18 passed
pnpm check:driver-conformance	OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.
pnpm check:error-code-casing · check:dispatcher-error-vocabulary	exit 0 · exit 0
pnpm check:engine-double-contract · check:where-matcher · check:query-options-erasure · check:type-check-coverage	exit 0 (the four convention-triggered by a new test file)
pnpm check:nul-bytes	exit 0

The rest of the re-derived family (node scripts/pm/dispatch-gates.mjs, 52 path-matched plus 4 by change kind — the dispatch's hint named 20, before the ledger row widened it) ran green too: check:cross-package-test-inputs, check:doc-authoring, check:logger-receiver-detach, check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:changeset-gate-self-tests, check:objectui-changeset, check:pm-half-states, check:merge-driver, check:spec-parsed-alias, check:objectql-double-limit, and the direct-node ones (check-ci-filter-parity, check-comment-mask-adoption, check-cross-package-test-inputs, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, docs-audit/check-affected-docs, docs-audit/check-drift-comment, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, release-rehearsal-clone --self-test).

Two gates returned exit 3 = NOT MEASURED, which is neither green nor red and is recorded as such: scripts/check-test-completeness.mjs (needs a saved turbo run test log that only CI produces) and scripts/pm/check-half-states.mjs (needs repo-scoped REST egress; this session's repo-scoped REST answers 403).

Changeset: patch for @objectstack/driver-turso and @objectstack/spec — a refusal-envelope correction plus a provenance row; nothing an author writes changes, so it is not breaking.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-turso, @objectstack/spec, touching 7 documentable anchor(s).

10 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/metadata-api.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/automation/webhooks.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/data-modeling/import-mappings.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/permissions/authentication.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/permissions/sso.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/ui/forms.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 131 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c78fe6759e4d2f87971c47e7999151d8a5a5972b — the merge of head 8422dd4c1d97fcb6e86943af0398809e0b5b684d into base 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c78fe6759e4d2f87971c47e7999151d8a5a5972b && git checkout c78fe6759e4d2f87971c47e7999151d8a5a5972b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 8422dd4c1d97fcb6e86943af0398809e0b5b684d && git checkout -B drift-repro 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 && git merge --no-ff 8422dd4c1d97fcb6e86943af0398809e0b5b684d
node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Enqueue provenance (domain:engine execution seat, session_0112hMx9hjJ9BgB28X97DS68): ACCEPT on #14287 (comment 5504280781) → at 04:29Z every check run on head 8422dd4c1 was completed with success or skipped (34 runs; Lint & Repo Gates finished 04:24Z), governed-surface test on the six changed paths: NOT governed, mergeable_state not dirty → marked ready and auto-merge (squash) enabled. Landing is by the merge queue; the engine seat follows it to MERGED.

---

Generated by Claude Code

[os-musk]

Fixes#14287

RemoteTransport.assertSafeIdentifier is the one gate for every position where an identifier is inlined into SQL on the Turso remote transport. It threw a bare Error — no code, no status — so mapDataError reached none of its classifying branches, fell through to its sanitised terminal and served a 500. A caller whose own identifier was refused was told the server had faulted, and an SDK reading a 5xx retries a request that can never succeed. Same class as #11455 / #8931, one position over from #14113's alias half.

Every one of those refusals now carries the ADR-0112 envelope code: 'INVALID_REQUEST', status: 400, built by one constructor so the positions cannot answer three ways.

The accept set is untouched.SAFE_IDENTIFIER and every refusal message are byte-identical; exactly the inputs refused before are refused after, with byte-identical prose. Only code and status are new. The groupBy alias gating question (#14235) moves the accept set and is deliberately left open — this PR pins its current refusal so that card cannot be mistaken for having landed.

Envelope chosen by the triage ruling on the card (2026-09-02): an existing member of the declared vocabulary, no new ledger code.

Per position

Position	Reached by	Before	After	Pinned by
aggregate → object	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	remote-transport-unsafe-identifier-envelope.test.ts — "object refuses with the envelope, and sends nothing"; and the #14113 control "the object position still refuses an unsafe identifier"
aggregate → aggregation field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the aggregation field refuses with the envelope"; and the #14113 control "the field position still refuses an unsafe identifier, and sends nothing"
aggregate → groupBy field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy FIELD refuses with the envelope, and sends nothing"
aggregate → groupBy out key (alias)	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy OUT KEY refuses with the envelope — gating unchanged, envelope added"; and the #14113 control "the groupBy alias position is UNCHANGED"
syncSchema → table name	publishing an object (engine.syncObjectSchema)	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchema refuses an unsafe TABLE name with the envelope"
buildCreateTableSQL → column name	publishing a new object	bare Error → 500	INVALID_REQUEST / 400	same file — "… the CREATE leg"
syncSchema → added column name	re-publishing an existing object (ALTER limb)	bare Error → 500	INVALID_REQUEST / 400	same file — "… the ALTER leg"
syncSchemasBatch → object name	batched schema sync	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchemasBatch refuses an unsafe object name with the envelope"
syncUniqueIndexes → index name / columns	unique-index sync	bare Error → 500	INVALID_REQUEST / 400	inherited from the single producer; not independently pinned — see "What is not pinned" below
remote-canonical-backfill free assertSafeIdentifier	boot-time backfill after remote schema sync, or the public operator-driven method	bare Error, flattened to a report string	INVALID_REQUEST / 400, still flattened	same file — "the free assertSafeIdentifier throws the identical envelope" (direct), plus "the backfill still REPORTS rather than throws, and sends no statement"

The mapDataError reading — does the benefit survive the boundary?

Measured by readingpackages/rest/src/error-response.ts at d62f990a9, not by editing or importing it (@objectstack/rest is not a dependency of this package, and a test reaching outside its own package is the check:cross-package-test-inputs shape):

• mapDataError delegates to classifyDataError. Nine error?.code === '…' branches run first; INVALID_REQUEST matches none of them, and none of them reads the message — so nothing intercepts this refusal ahead of the declared-status passthrough.
• declaredHttpStatus(error) (line 349) reads error.status, falling back to error.statusCode, and keeps it when 400 <= s < 600. Our 400 qualifies.
• declaredServerFaultAnswer is the 5xx arm — not taken at 400.
• The 4xx arm returns { status: declaredStatus, body: { error: msg, ...thrownCodeFields(error, declaredStatus) } }. thrownCodeFields emits the closed ADR-0112 member verbatim when the code is in the union, and demotes an unregistered spelling to declaredCode. INVALID_REQUESTis in the union.

So the two fields this PR sets are exactly the two that door reads, and the response goes from a sanitised 500 to a 400 carrying INVALID_REQUEST and the refusal's own sentence. No change to packages/rest.

Ablation — reverse verification

Restore the bare throw new Error(...) in bothassertSafeIdentifier helpers, run the two test files, restore.

• Mutation proved on disk before the run (never a bare --stat, and never the editing tool's exit code): anchored counts of the injected and removed text — injected transport=1 backfill=1 | removed transport=0 backfill=0. The script carries trap restore EXIT INT TERM with absolute paths seeded from git rev-parse --show-toplevel.
• No rebuild leg, and why that is sound here: every import in the test file is relative (./turso-driver.js, ./remote-transport.js, ./remote-canonical-backfill.js), so vitest resolves the subject from src/*.ts and no dist/ sits between the mutation and the run. The RED result is itself that proof — a dist-resolved subject would have stayed green.
• Result: 19 failed / 13 passed. All 19 failures are toEqual comparisons reading { code: undefined, status: undefined }. Not one is a "expected the transport to refuse …" — every input the gate refuses today is still refused with the ablated helper.
• The predicted direction held for the envelope and was too coarse for the accept-set block, recorded rather than quietly rewritten (also corrected in the test file's own docblock). The accept-set block's REFUSED half goes red because it asserts the envelope in the same toEqual as the message; its ACCEPTED half — the direction that catches a tightened gate — stayed green. The red half's diff is the sharper evidence:

 {
- "code": "INVALID_REQUEST",
+ "code": undefined,
"message": "RemoteTransport: unsafe identifier rejected: \"\"",
- "status": 400,
+ "status": undefined,
}

The message line carries no marker: prose and predicate are provably untouched. That is what makes this an envelope change and not a gating one.

• Restore proved byte-exact, not by an exit code: git status --porcelain empty, git diff HEAD empty, and git hash-object equal to the HEAD blob for both files — 2b8d1bc11719b57ace1b380ccc320ed47b60d717 (transport) and 5d5ce5ea9b1c873de49c654f25c35038fdd0b8b6 (backfill).

Driver-conformance ledger — before and after, verbatim

Before the first edit, at d62f990a9:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

After the last commit, at 8422dd4c1:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Unmoved, as it must be — this PR adds no conformance cell and retires none.

The one file outside the dispatched surface, named rather than slipped in

packages/spec/src/api/error-code-ledger.zod.ts gains one provenance row — '@objectstack/driver-turso': ['INVALID_REQUEST'] with its reachability comment. It was not in the dispatched file surface, so here is the evidence rather than a silent edit:

• It is mechanically required, measured not assumed. With the driver change alone, pnpm --filter @objectstack/spec check:error-code-provenance prints: FAIL — 1 stamp site(s) of a registered code with no provenance row: @objectstack/driver-turso stamps 'INVALID_REQUEST' (constdef) at packages/drivers/driver-turso/src/remote-transport.ts:118 — not listed under its own owner key. The gate's own prescribed fix is this row or a waiver, and it says "Both are decisions on the record; silence is not." With the row: OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver.
• It is not a new ledger code, which is what the dispatch fence's parenthetical guards. INVALID_REQUEST is already registered by seven packages. Measured: the deduped registered-code union is 248 codes before and 248 after, with an empty added set and an empty removed set — so ErrorCode, REGISTERED_ERROR_CODES and every generated spec artifact are unchanged (pnpm --filter @objectstack/spec check:generated reports all 15 up to date).
• The shape is pinned by sibling precedent, not invented: @objectstack/driver-memory (UNIQUE_VIOLATION, error-code-ledger: @objectstack/driver-memory becomes an emitter of UNIQUE_VIOLATION with no provenance row — invisible to every gate, which is the point of the row #13254) and @objectstack/driver-sql (SQL_DIALECT_EMISSION_UNSUPPORTED, sql-driver: one emission-identity source — loud refusal for redshift/cockroachdb DDL, pgnative joins the Postgres family (#11756 ruling) #11991) are the same row for the same reason, and the ledger header's own rule is "a code emitted by several packages is listed once per emitting package".
• The row's wire-reachability evidence (the [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 test) is RemoteTransport's DDL and aggregate positions on a server already serving HTTP — explicitly not the backfill module, whose callers flatten the throw.
• No other in-flight branch touches that file (checked against origin), and the claim comment's file surface is amended on the card in the same round.

If you would rather this row landed separately, say so and it comes out — the driver change cannot go green without it, so the two would have to land together in either order.

What is not pinned, said plainly

The unique-index-sync position (index.name and index.columns) inherits the envelope from the single producer but has no independent case: the index name and columns are derived by uniqueIndexesFromFields from an object whose own name and columns were already gated one call earlier, so no input reaches that assert without being refused first. It is covered by construction, not by a test, and inventing a synthetic route to it would pin the harness rather than the behaviour.

On the backfill producer: its envelope is defence in depth, not a wire answer today, and the test says so rather than implying more. Both callers flatten the throw into report.error by design (ADR-0053 D-B3 forbids a migration taking a boot down), so code/status reach no response envelope from that module. The helper is exported so the envelope has a real pin — nothing else can observe it, and an unobservable assertion is a phantom check rather than a test.

Verification

Union run on 8422dd4c1 (this PR's head, after merging origin/main):

Command	Verdict line
pnpm --filter @objectstack/driver-turso test	Test Files 42 passed (42) · Tests 1143 passed (1143)
pnpm --filter @objectstack/driver-turso typecheck	exit 0 — and tsc --noEmit --listFiles confirms both edited/added test files are in the program (2 hits), so "typecheck clean" really covers them
pnpm lint (whole repo, eslint . --no-inline-config)	exit 0
pnpm --filter @objectstack/spec check:error-code-provenance	OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver (8 waiver(s), all live)
pnpm --filter @objectstack/spec check:generated	✓ All 15 generated artifacts are up to date.
pnpm --filter @objectstack/spec exec vitest run src/api/error-code-ledger.test.ts	18 passed
pnpm check:driver-conformance	OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.
pnpm check:error-code-casing · check:dispatcher-error-vocabulary	exit 0 · exit 0
pnpm check:engine-double-contract · check:where-matcher · check:query-options-erasure · check:type-check-coverage	exit 0 (the four convention-triggered by a new test file)
pnpm check:nul-bytes	exit 0

The rest of the re-derived family (node scripts/pm/dispatch-gates.mjs, 52 path-matched plus 4 by change kind — the dispatch's hint named 20, before the ledger row widened it) ran green too: check:cross-package-test-inputs, check:doc-authoring, check:logger-receiver-detach, check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:changeset-gate-self-tests, check:objectui-changeset, check:pm-half-states, check:merge-driver, check:spec-parsed-alias, check:objectql-double-limit, and the direct-node ones (check-ci-filter-parity, check-comment-mask-adoption, check-cross-package-test-inputs, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, docs-audit/check-affected-docs, docs-audit/check-drift-comment, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, release-rehearsal-clone --self-test).

Two gates returned exit 3 = NOT MEASURED, which is neither green nor red and is recorded as such: scripts/check-test-completeness.mjs (needs a saved turbo run test log that only CI produces) and scripts/pm/check-half-states.mjs (needs repo-scoped REST egress; this session's repo-scoped REST answers 403).

Changeset: patch for @objectstack/driver-turso and @objectstack/spec — a refusal-envelope correction plus a provenance row; nothing an author writes changes, so it is not breaking.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-turso, @objectstack/spec, touching 7 documentable anchor(s).

10 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/metadata-api.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/automation/webhooks.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/data-modeling/import-mappings.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/permissions/authentication.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/permissions/sso.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/ui/forms.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 131 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c78fe6759e4d2f87971c47e7999151d8a5a5972b — the merge of head 8422dd4c1d97fcb6e86943af0398809e0b5b684d into base 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c78fe6759e4d2f87971c47e7999151d8a5a5972b && git checkout c78fe6759e4d2f87971c47e7999151d8a5a5972b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 8422dd4c1d97fcb6e86943af0398809e0b5b684d && git checkout -B drift-repro 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 && git merge --no-ff 8422dd4c1d97fcb6e86943af0398809e0b5b684d
node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Enqueue provenance (domain:engine execution seat, session_0112hMx9hjJ9BgB28X97DS68): ACCEPT on #14287 (comment 5504280781) → at 04:29Z every check run on head 8422dd4c1 was completed with success or skipped (34 runs; Lint & Repo Gates finished 04:24Z), governed-surface test on the six changed paths: NOT governed, mergeable_state not dirty → marked ready and auto-merge (squash) enabled. Landing is by the merge queue; the engine seat follows it to MERGED.

---

Generated by Claude Code

[os-musk]

Fixes#14287

RemoteTransport.assertSafeIdentifier is the one gate for every position where an identifier is inlined into SQL on the Turso remote transport. It threw a bare Error — no code, no status — so mapDataError reached none of its classifying branches, fell through to its sanitised terminal and served a 500. A caller whose own identifier was refused was told the server had faulted, and an SDK reading a 5xx retries a request that can never succeed. Same class as #11455 / #8931, one position over from #14113's alias half.

Every one of those refusals now carries the ADR-0112 envelope code: 'INVALID_REQUEST', status: 400, built by one constructor so the positions cannot answer three ways.

The accept set is untouched.SAFE_IDENTIFIER and every refusal message are byte-identical; exactly the inputs refused before are refused after, with byte-identical prose. Only code and status are new. The groupBy alias gating question (#14235) moves the accept set and is deliberately left open — this PR pins its current refusal so that card cannot be mistaken for having landed.

Envelope chosen by the triage ruling on the card (2026-09-02): an existing member of the declared vocabulary, no new ledger code.

Per position

Position	Reached by	Before	After	Pinned by
aggregate → object	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	remote-transport-unsafe-identifier-envelope.test.ts — "object refuses with the envelope, and sends nothing"; and the #14113 control "the object position still refuses an unsafe identifier"
aggregate → aggregation field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the aggregation field refuses with the envelope"; and the #14113 control "the field position still refuses an unsafe identifier, and sends nothing"
aggregate → groupBy field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy FIELD refuses with the envelope, and sends nothing"
aggregate → groupBy out key (alias)	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy OUT KEY refuses with the envelope — gating unchanged, envelope added"; and the #14113 control "the groupBy alias position is UNCHANGED"
syncSchema → table name	publishing an object (engine.syncObjectSchema)	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchema refuses an unsafe TABLE name with the envelope"
buildCreateTableSQL → column name	publishing a new object	bare Error → 500	INVALID_REQUEST / 400	same file — "… the CREATE leg"
syncSchema → added column name	re-publishing an existing object (ALTER limb)	bare Error → 500	INVALID_REQUEST / 400	same file — "… the ALTER leg"
syncSchemasBatch → object name	batched schema sync	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchemasBatch refuses an unsafe object name with the envelope"
syncUniqueIndexes → index name / columns	unique-index sync	bare Error → 500	INVALID_REQUEST / 400	inherited from the single producer; not independently pinned — see "What is not pinned" below
remote-canonical-backfill free assertSafeIdentifier	boot-time backfill after remote schema sync, or the public operator-driven method	bare Error, flattened to a report string	INVALID_REQUEST / 400, still flattened	same file — "the free assertSafeIdentifier throws the identical envelope" (direct), plus "the backfill still REPORTS rather than throws, and sends no statement"

The mapDataError reading — does the benefit survive the boundary?

Measured by readingpackages/rest/src/error-response.ts at d62f990a9, not by editing or importing it (@objectstack/rest is not a dependency of this package, and a test reaching outside its own package is the check:cross-package-test-inputs shape):

• mapDataError delegates to classifyDataError. Nine error?.code === '…' branches run first; INVALID_REQUEST matches none of them, and none of them reads the message — so nothing intercepts this refusal ahead of the declared-status passthrough.
• declaredHttpStatus(error) (line 349) reads error.status, falling back to error.statusCode, and keeps it when 400 <= s < 600. Our 400 qualifies.
• declaredServerFaultAnswer is the 5xx arm — not taken at 400.
• The 4xx arm returns { status: declaredStatus, body: { error: msg, ...thrownCodeFields(error, declaredStatus) } }. thrownCodeFields emits the closed ADR-0112 member verbatim when the code is in the union, and demotes an unregistered spelling to declaredCode. INVALID_REQUESTis in the union.

So the two fields this PR sets are exactly the two that door reads, and the response goes from a sanitised 500 to a 400 carrying INVALID_REQUEST and the refusal's own sentence. No change to packages/rest.

Ablation — reverse verification

Restore the bare throw new Error(...) in bothassertSafeIdentifier helpers, run the two test files, restore.

• Mutation proved on disk before the run (never a bare --stat, and never the editing tool's exit code): anchored counts of the injected and removed text — injected transport=1 backfill=1 | removed transport=0 backfill=0. The script carries trap restore EXIT INT TERM with absolute paths seeded from git rev-parse --show-toplevel.
• No rebuild leg, and why that is sound here: every import in the test file is relative (./turso-driver.js, ./remote-transport.js, ./remote-canonical-backfill.js), so vitest resolves the subject from src/*.ts and no dist/ sits between the mutation and the run. The RED result is itself that proof — a dist-resolved subject would have stayed green.
• Result: 19 failed / 13 passed. All 19 failures are toEqual comparisons reading { code: undefined, status: undefined }. Not one is a "expected the transport to refuse …" — every input the gate refuses today is still refused with the ablated helper.
• The predicted direction held for the envelope and was too coarse for the accept-set block, recorded rather than quietly rewritten (also corrected in the test file's own docblock). The accept-set block's REFUSED half goes red because it asserts the envelope in the same toEqual as the message; its ACCEPTED half — the direction that catches a tightened gate — stayed green. The red half's diff is the sharper evidence:

 {
- "code": "INVALID_REQUEST",
+ "code": undefined,
"message": "RemoteTransport: unsafe identifier rejected: \"\"",
- "status": 400,
+ "status": undefined,
}

The message line carries no marker: prose and predicate are provably untouched. That is what makes this an envelope change and not a gating one.

• Restore proved byte-exact, not by an exit code: git status --porcelain empty, git diff HEAD empty, and git hash-object equal to the HEAD blob for both files — 2b8d1bc11719b57ace1b380ccc320ed47b60d717 (transport) and 5d5ce5ea9b1c873de49c654f25c35038fdd0b8b6 (backfill).

Driver-conformance ledger — before and after, verbatim

Before the first edit, at d62f990a9:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

After the last commit, at 8422dd4c1:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Unmoved, as it must be — this PR adds no conformance cell and retires none.

The one file outside the dispatched surface, named rather than slipped in

packages/spec/src/api/error-code-ledger.zod.ts gains one provenance row — '@objectstack/driver-turso': ['INVALID_REQUEST'] with its reachability comment. It was not in the dispatched file surface, so here is the evidence rather than a silent edit:

• It is mechanically required, measured not assumed. With the driver change alone, pnpm --filter @objectstack/spec check:error-code-provenance prints: FAIL — 1 stamp site(s) of a registered code with no provenance row: @objectstack/driver-turso stamps 'INVALID_REQUEST' (constdef) at packages/drivers/driver-turso/src/remote-transport.ts:118 — not listed under its own owner key. The gate's own prescribed fix is this row or a waiver, and it says "Both are decisions on the record; silence is not." With the row: OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver.
• It is not a new ledger code, which is what the dispatch fence's parenthetical guards. INVALID_REQUEST is already registered by seven packages. Measured: the deduped registered-code union is 248 codes before and 248 after, with an empty added set and an empty removed set — so ErrorCode, REGISTERED_ERROR_CODES and every generated spec artifact are unchanged (pnpm --filter @objectstack/spec check:generated reports all 15 up to date).
• The shape is pinned by sibling precedent, not invented: @objectstack/driver-memory (UNIQUE_VIOLATION, error-code-ledger: @objectstack/driver-memory becomes an emitter of UNIQUE_VIOLATION with no provenance row — invisible to every gate, which is the point of the row #13254) and @objectstack/driver-sql (SQL_DIALECT_EMISSION_UNSUPPORTED, sql-driver: one emission-identity source — loud refusal for redshift/cockroachdb DDL, pgnative joins the Postgres family (#11756 ruling) #11991) are the same row for the same reason, and the ledger header's own rule is "a code emitted by several packages is listed once per emitting package".
• The row's wire-reachability evidence (the [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 test) is RemoteTransport's DDL and aggregate positions on a server already serving HTTP — explicitly not the backfill module, whose callers flatten the throw.
• No other in-flight branch touches that file (checked against origin), and the claim comment's file surface is amended on the card in the same round.

If you would rather this row landed separately, say so and it comes out — the driver change cannot go green without it, so the two would have to land together in either order.

What is not pinned, said plainly

The unique-index-sync position (index.name and index.columns) inherits the envelope from the single producer but has no independent case: the index name and columns are derived by uniqueIndexesFromFields from an object whose own name and columns were already gated one call earlier, so no input reaches that assert without being refused first. It is covered by construction, not by a test, and inventing a synthetic route to it would pin the harness rather than the behaviour.

On the backfill producer: its envelope is defence in depth, not a wire answer today, and the test says so rather than implying more. Both callers flatten the throw into report.error by design (ADR-0053 D-B3 forbids a migration taking a boot down), so code/status reach no response envelope from that module. The helper is exported so the envelope has a real pin — nothing else can observe it, and an unobservable assertion is a phantom check rather than a test.

Verification

Union run on 8422dd4c1 (this PR's head, after merging origin/main):

Command	Verdict line
pnpm --filter @objectstack/driver-turso test	Test Files 42 passed (42) · Tests 1143 passed (1143)
pnpm --filter @objectstack/driver-turso typecheck	exit 0 — and tsc --noEmit --listFiles confirms both edited/added test files are in the program (2 hits), so "typecheck clean" really covers them
pnpm lint (whole repo, eslint . --no-inline-config)	exit 0
pnpm --filter @objectstack/spec check:error-code-provenance	OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver (8 waiver(s), all live)
pnpm --filter @objectstack/spec check:generated	✓ All 15 generated artifacts are up to date.
pnpm --filter @objectstack/spec exec vitest run src/api/error-code-ledger.test.ts	18 passed
pnpm check:driver-conformance	OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.
pnpm check:error-code-casing · check:dispatcher-error-vocabulary	exit 0 · exit 0
pnpm check:engine-double-contract · check:where-matcher · check:query-options-erasure · check:type-check-coverage	exit 0 (the four convention-triggered by a new test file)
pnpm check:nul-bytes	exit 0

The rest of the re-derived family (node scripts/pm/dispatch-gates.mjs, 52 path-matched plus 4 by change kind — the dispatch's hint named 20, before the ledger row widened it) ran green too: check:cross-package-test-inputs, check:doc-authoring, check:logger-receiver-detach, check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:changeset-gate-self-tests, check:objectui-changeset, check:pm-half-states, check:merge-driver, check:spec-parsed-alias, check:objectql-double-limit, and the direct-node ones (check-ci-filter-parity, check-comment-mask-adoption, check-cross-package-test-inputs, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, docs-audit/check-affected-docs, docs-audit/check-drift-comment, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, release-rehearsal-clone --self-test).

Two gates returned exit 3 = NOT MEASURED, which is neither green nor red and is recorded as such: scripts/check-test-completeness.mjs (needs a saved turbo run test log that only CI produces) and scripts/pm/check-half-states.mjs (needs repo-scoped REST egress; this session's repo-scoped REST answers 403).

Changeset: patch for @objectstack/driver-turso and @objectstack/spec — a refusal-envelope correction plus a provenance row; nothing an author writes changes, so it is not breaking.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-turso, @objectstack/spec, touching 7 documentable anchor(s).

10 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/metadata-api.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/automation/webhooks.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/data-modeling/import-mappings.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/permissions/authentication.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/permissions/sso.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/ui/forms.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 131 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c78fe6759e4d2f87971c47e7999151d8a5a5972b — the merge of head 8422dd4c1d97fcb6e86943af0398809e0b5b684d into base 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c78fe6759e4d2f87971c47e7999151d8a5a5972b && git checkout c78fe6759e4d2f87971c47e7999151d8a5a5972b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 8422dd4c1d97fcb6e86943af0398809e0b5b684d && git checkout -B drift-repro 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 && git merge --no-ff 8422dd4c1d97fcb6e86943af0398809e0b5b684d
node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Enqueue provenance (domain:engine execution seat, session_0112hMx9hjJ9BgB28X97DS68): ACCEPT on #14287 (comment 5504280781) → at 04:29Z every check run on head 8422dd4c1 was completed with success or skipped (34 runs; Lint & Repo Gates finished 04:24Z), governed-surface test on the six changed paths: NOT governed, mergeable_state not dirty → marked ready and auto-merge (squash) enabled. Landing is by the merge queue; the engine seat follows it to MERGED.

---

Generated by Claude Code

[os-musk]

Fixes#14287

RemoteTransport.assertSafeIdentifier is the one gate for every position where an identifier is inlined into SQL on the Turso remote transport. It threw a bare Error — no code, no status — so mapDataError reached none of its classifying branches, fell through to its sanitised terminal and served a 500. A caller whose own identifier was refused was told the server had faulted, and an SDK reading a 5xx retries a request that can never succeed. Same class as #11455 / #8931, one position over from #14113's alias half.

Every one of those refusals now carries the ADR-0112 envelope code: 'INVALID_REQUEST', status: 400, built by one constructor so the positions cannot answer three ways.

The accept set is untouched.SAFE_IDENTIFIER and every refusal message are byte-identical; exactly the inputs refused before are refused after, with byte-identical prose. Only code and status are new. The groupBy alias gating question (#14235) moves the accept set and is deliberately left open — this PR pins its current refusal so that card cannot be mistaken for having landed.

Envelope chosen by the triage ruling on the card (2026-09-02): an existing member of the declared vocabulary, no new ledger code.

Per position

Position	Reached by	Before	After	Pinned by
aggregate → object	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	remote-transport-unsafe-identifier-envelope.test.ts — "object refuses with the envelope, and sends nothing"; and the #14113 control "the object position still refuses an unsafe identifier"
aggregate → aggregation field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the aggregation field refuses with the envelope"; and the #14113 control "the field position still refuses an unsafe identifier, and sends nothing"
aggregate → groupBy field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy FIELD refuses with the envelope, and sends nothing"
aggregate → groupBy out key (alias)	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy OUT KEY refuses with the envelope — gating unchanged, envelope added"; and the #14113 control "the groupBy alias position is UNCHANGED"
syncSchema → table name	publishing an object (engine.syncObjectSchema)	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchema refuses an unsafe TABLE name with the envelope"
buildCreateTableSQL → column name	publishing a new object	bare Error → 500	INVALID_REQUEST / 400	same file — "… the CREATE leg"
syncSchema → added column name	re-publishing an existing object (ALTER limb)	bare Error → 500	INVALID_REQUEST / 400	same file — "… the ALTER leg"
syncSchemasBatch → object name	batched schema sync	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchemasBatch refuses an unsafe object name with the envelope"
syncUniqueIndexes → index name / columns	unique-index sync	bare Error → 500	INVALID_REQUEST / 400	inherited from the single producer; not independently pinned — see "What is not pinned" below
remote-canonical-backfill free assertSafeIdentifier	boot-time backfill after remote schema sync, or the public operator-driven method	bare Error, flattened to a report string	INVALID_REQUEST / 400, still flattened	same file — "the free assertSafeIdentifier throws the identical envelope" (direct), plus "the backfill still REPORTS rather than throws, and sends no statement"

The mapDataError reading — does the benefit survive the boundary?

Measured by readingpackages/rest/src/error-response.ts at d62f990a9, not by editing or importing it (@objectstack/rest is not a dependency of this package, and a test reaching outside its own package is the check:cross-package-test-inputs shape):

• mapDataError delegates to classifyDataError. Nine error?.code === '…' branches run first; INVALID_REQUEST matches none of them, and none of them reads the message — so nothing intercepts this refusal ahead of the declared-status passthrough.
• declaredHttpStatus(error) (line 349) reads error.status, falling back to error.statusCode, and keeps it when 400 <= s < 600. Our 400 qualifies.
• declaredServerFaultAnswer is the 5xx arm — not taken at 400.
• The 4xx arm returns { status: declaredStatus, body: { error: msg, ...thrownCodeFields(error, declaredStatus) } }. thrownCodeFields emits the closed ADR-0112 member verbatim when the code is in the union, and demotes an unregistered spelling to declaredCode. INVALID_REQUESTis in the union.

So the two fields this PR sets are exactly the two that door reads, and the response goes from a sanitised 500 to a 400 carrying INVALID_REQUEST and the refusal's own sentence. No change to packages/rest.

Ablation — reverse verification

Restore the bare throw new Error(...) in bothassertSafeIdentifier helpers, run the two test files, restore.

• Mutation proved on disk before the run (never a bare --stat, and never the editing tool's exit code): anchored counts of the injected and removed text — injected transport=1 backfill=1 | removed transport=0 backfill=0. The script carries trap restore EXIT INT TERM with absolute paths seeded from git rev-parse --show-toplevel.
• No rebuild leg, and why that is sound here: every import in the test file is relative (./turso-driver.js, ./remote-transport.js, ./remote-canonical-backfill.js), so vitest resolves the subject from src/*.ts and no dist/ sits between the mutation and the run. The RED result is itself that proof — a dist-resolved subject would have stayed green.
• Result: 19 failed / 13 passed. All 19 failures are toEqual comparisons reading { code: undefined, status: undefined }. Not one is a "expected the transport to refuse …" — every input the gate refuses today is still refused with the ablated helper.
• The predicted direction held for the envelope and was too coarse for the accept-set block, recorded rather than quietly rewritten (also corrected in the test file's own docblock). The accept-set block's REFUSED half goes red because it asserts the envelope in the same toEqual as the message; its ACCEPTED half — the direction that catches a tightened gate — stayed green. The red half's diff is the sharper evidence:

 {
- "code": "INVALID_REQUEST",
+ "code": undefined,
"message": "RemoteTransport: unsafe identifier rejected: \"\"",
- "status": 400,
+ "status": undefined,
}

The message line carries no marker: prose and predicate are provably untouched. That is what makes this an envelope change and not a gating one.

• Restore proved byte-exact, not by an exit code: git status --porcelain empty, git diff HEAD empty, and git hash-object equal to the HEAD blob for both files — 2b8d1bc11719b57ace1b380ccc320ed47b60d717 (transport) and 5d5ce5ea9b1c873de49c654f25c35038fdd0b8b6 (backfill).

Driver-conformance ledger — before and after, verbatim

Before the first edit, at d62f990a9:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

After the last commit, at 8422dd4c1:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Unmoved, as it must be — this PR adds no conformance cell and retires none.

The one file outside the dispatched surface, named rather than slipped in

packages/spec/src/api/error-code-ledger.zod.ts gains one provenance row — '@objectstack/driver-turso': ['INVALID_REQUEST'] with its reachability comment. It was not in the dispatched file surface, so here is the evidence rather than a silent edit:

• It is mechanically required, measured not assumed. With the driver change alone, pnpm --filter @objectstack/spec check:error-code-provenance prints: FAIL — 1 stamp site(s) of a registered code with no provenance row: @objectstack/driver-turso stamps 'INVALID_REQUEST' (constdef) at packages/drivers/driver-turso/src/remote-transport.ts:118 — not listed under its own owner key. The gate's own prescribed fix is this row or a waiver, and it says "Both are decisions on the record; silence is not." With the row: OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver.
• It is not a new ledger code, which is what the dispatch fence's parenthetical guards. INVALID_REQUEST is already registered by seven packages. Measured: the deduped registered-code union is 248 codes before and 248 after, with an empty added set and an empty removed set — so ErrorCode, REGISTERED_ERROR_CODES and every generated spec artifact are unchanged (pnpm --filter @objectstack/spec check:generated reports all 15 up to date).
• The shape is pinned by sibling precedent, not invented: @objectstack/driver-memory (UNIQUE_VIOLATION, error-code-ledger: @objectstack/driver-memory becomes an emitter of UNIQUE_VIOLATION with no provenance row — invisible to every gate, which is the point of the row #13254) and @objectstack/driver-sql (SQL_DIALECT_EMISSION_UNSUPPORTED, sql-driver: one emission-identity source — loud refusal for redshift/cockroachdb DDL, pgnative joins the Postgres family (#11756 ruling) #11991) are the same row for the same reason, and the ledger header's own rule is "a code emitted by several packages is listed once per emitting package".
• The row's wire-reachability evidence (the [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 test) is RemoteTransport's DDL and aggregate positions on a server already serving HTTP — explicitly not the backfill module, whose callers flatten the throw.
• No other in-flight branch touches that file (checked against origin), and the claim comment's file surface is amended on the card in the same round.

If you would rather this row landed separately, say so and it comes out — the driver change cannot go green without it, so the two would have to land together in either order.

What is not pinned, said plainly

The unique-index-sync position (index.name and index.columns) inherits the envelope from the single producer but has no independent case: the index name and columns are derived by uniqueIndexesFromFields from an object whose own name and columns were already gated one call earlier, so no input reaches that assert without being refused first. It is covered by construction, not by a test, and inventing a synthetic route to it would pin the harness rather than the behaviour.

On the backfill producer: its envelope is defence in depth, not a wire answer today, and the test says so rather than implying more. Both callers flatten the throw into report.error by design (ADR-0053 D-B3 forbids a migration taking a boot down), so code/status reach no response envelope from that module. The helper is exported so the envelope has a real pin — nothing else can observe it, and an unobservable assertion is a phantom check rather than a test.

Verification

Union run on 8422dd4c1 (this PR's head, after merging origin/main):

Command	Verdict line
pnpm --filter @objectstack/driver-turso test	Test Files 42 passed (42) · Tests 1143 passed (1143)
pnpm --filter @objectstack/driver-turso typecheck	exit 0 — and tsc --noEmit --listFiles confirms both edited/added test files are in the program (2 hits), so "typecheck clean" really covers them
pnpm lint (whole repo, eslint . --no-inline-config)	exit 0
pnpm --filter @objectstack/spec check:error-code-provenance	OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver (8 waiver(s), all live)
pnpm --filter @objectstack/spec check:generated	✓ All 15 generated artifacts are up to date.
pnpm --filter @objectstack/spec exec vitest run src/api/error-code-ledger.test.ts	18 passed
pnpm check:driver-conformance	OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.
pnpm check:error-code-casing · check:dispatcher-error-vocabulary	exit 0 · exit 0
pnpm check:engine-double-contract · check:where-matcher · check:query-options-erasure · check:type-check-coverage	exit 0 (the four convention-triggered by a new test file)
pnpm check:nul-bytes	exit 0

The rest of the re-derived family (node scripts/pm/dispatch-gates.mjs, 52 path-matched plus 4 by change kind — the dispatch's hint named 20, before the ledger row widened it) ran green too: check:cross-package-test-inputs, check:doc-authoring, check:logger-receiver-detach, check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:changeset-gate-self-tests, check:objectui-changeset, check:pm-half-states, check:merge-driver, check:spec-parsed-alias, check:objectql-double-limit, and the direct-node ones (check-ci-filter-parity, check-comment-mask-adoption, check-cross-package-test-inputs, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, docs-audit/check-affected-docs, docs-audit/check-drift-comment, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, release-rehearsal-clone --self-test).

Two gates returned exit 3 = NOT MEASURED, which is neither green nor red and is recorded as such: scripts/check-test-completeness.mjs (needs a saved turbo run test log that only CI produces) and scripts/pm/check-half-states.mjs (needs repo-scoped REST egress; this session's repo-scoped REST answers 403).

Changeset: patch for @objectstack/driver-turso and @objectstack/spec — a refusal-envelope correction plus a provenance row; nothing an author writes changes, so it is not breaking.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-turso, @objectstack/spec, touching 7 documentable anchor(s).

10 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/metadata-api.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/automation/webhooks.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/data-modeling/import-mappings.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/permissions/authentication.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/permissions/sso.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/ui/forms.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 131 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c78fe6759e4d2f87971c47e7999151d8a5a5972b — the merge of head 8422dd4c1d97fcb6e86943af0398809e0b5b684d into base 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c78fe6759e4d2f87971c47e7999151d8a5a5972b && git checkout c78fe6759e4d2f87971c47e7999151d8a5a5972b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 8422dd4c1d97fcb6e86943af0398809e0b5b684d && git checkout -B drift-repro 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 && git merge --no-ff 8422dd4c1d97fcb6e86943af0398809e0b5b684d
node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Enqueue provenance (domain:engine execution seat, session_0112hMx9hjJ9BgB28X97DS68): ACCEPT on #14287 (comment 5504280781) → at 04:29Z every check run on head 8422dd4c1 was completed with success or skipped (34 runs; Lint & Repo Gates finished 04:24Z), governed-surface test on the six changed paths: NOT governed, mergeable_state not dirty → marked ready and auto-merge (squash) enabled. Landing is by the merge queue; the engine seat follows it to MERGED.

---

Generated by Claude Code

[os-musk]

Fixes#14287

RemoteTransport.assertSafeIdentifier is the one gate for every position where an identifier is inlined into SQL on the Turso remote transport. It threw a bare Error — no code, no status — so mapDataError reached none of its classifying branches, fell through to its sanitised terminal and served a 500. A caller whose own identifier was refused was told the server had faulted, and an SDK reading a 5xx retries a request that can never succeed. Same class as #11455 / #8931, one position over from #14113's alias half.

Every one of those refusals now carries the ADR-0112 envelope code: 'INVALID_REQUEST', status: 400, built by one constructor so the positions cannot answer three ways.

The accept set is untouched.SAFE_IDENTIFIER and every refusal message are byte-identical; exactly the inputs refused before are refused after, with byte-identical prose. Only code and status are new. The groupBy alias gating question (#14235) moves the accept set and is deliberately left open — this PR pins its current refusal so that card cannot be mistaken for having landed.

Envelope chosen by the triage ruling on the card (2026-09-02): an existing member of the declared vocabulary, no new ledger code.

Per position

Position	Reached by	Before	After	Pinned by
aggregate → object	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	remote-transport-unsafe-identifier-envelope.test.ts — "object refuses with the envelope, and sends nothing"; and the #14113 control "the object position still refuses an unsafe identifier"
aggregate → aggregation field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the aggregation field refuses with the envelope"; and the #14113 control "the field position still refuses an unsafe identifier, and sends nothing"
aggregate → groupBy field	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy FIELD refuses with the envelope, and sends nothing"
aggregate → groupBy out key (alias)	an aggregate query over HTTP	bare Error → 500	INVALID_REQUEST / 400	same file — "the groupBy OUT KEY refuses with the envelope — gating unchanged, envelope added"; and the #14113 control "the groupBy alias position is UNCHANGED"
syncSchema → table name	publishing an object (engine.syncObjectSchema)	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchema refuses an unsafe TABLE name with the envelope"
buildCreateTableSQL → column name	publishing a new object	bare Error → 500	INVALID_REQUEST / 400	same file — "… the CREATE leg"
syncSchema → added column name	re-publishing an existing object (ALTER limb)	bare Error → 500	INVALID_REQUEST / 400	same file — "… the ALTER leg"
syncSchemasBatch → object name	batched schema sync	bare Error → 500	INVALID_REQUEST / 400	same file — "syncSchemasBatch refuses an unsafe object name with the envelope"
syncUniqueIndexes → index name / columns	unique-index sync	bare Error → 500	INVALID_REQUEST / 400	inherited from the single producer; not independently pinned — see "What is not pinned" below
remote-canonical-backfill free assertSafeIdentifier	boot-time backfill after remote schema sync, or the public operator-driven method	bare Error, flattened to a report string	INVALID_REQUEST / 400, still flattened	same file — "the free assertSafeIdentifier throws the identical envelope" (direct), plus "the backfill still REPORTS rather than throws, and sends no statement"

The mapDataError reading — does the benefit survive the boundary?

Measured by readingpackages/rest/src/error-response.ts at d62f990a9, not by editing or importing it (@objectstack/rest is not a dependency of this package, and a test reaching outside its own package is the check:cross-package-test-inputs shape):

• mapDataError delegates to classifyDataError. Nine error?.code === '…' branches run first; INVALID_REQUEST matches none of them, and none of them reads the message — so nothing intercepts this refusal ahead of the declared-status passthrough.
• declaredHttpStatus(error) (line 349) reads error.status, falling back to error.statusCode, and keeps it when 400 <= s < 600. Our 400 qualifies.
• declaredServerFaultAnswer is the 5xx arm — not taken at 400.
• The 4xx arm returns { status: declaredStatus, body: { error: msg, ...thrownCodeFields(error, declaredStatus) } }. thrownCodeFields emits the closed ADR-0112 member verbatim when the code is in the union, and demotes an unregistered spelling to declaredCode. INVALID_REQUESTis in the union.

So the two fields this PR sets are exactly the two that door reads, and the response goes from a sanitised 500 to a 400 carrying INVALID_REQUEST and the refusal's own sentence. No change to packages/rest.

Ablation — reverse verification

Restore the bare throw new Error(...) in bothassertSafeIdentifier helpers, run the two test files, restore.

• Mutation proved on disk before the run (never a bare --stat, and never the editing tool's exit code): anchored counts of the injected and removed text — injected transport=1 backfill=1 | removed transport=0 backfill=0. The script carries trap restore EXIT INT TERM with absolute paths seeded from git rev-parse --show-toplevel.
• No rebuild leg, and why that is sound here: every import in the test file is relative (./turso-driver.js, ./remote-transport.js, ./remote-canonical-backfill.js), so vitest resolves the subject from src/*.ts and no dist/ sits between the mutation and the run. The RED result is itself that proof — a dist-resolved subject would have stayed green.
• Result: 19 failed / 13 passed. All 19 failures are toEqual comparisons reading { code: undefined, status: undefined }. Not one is a "expected the transport to refuse …" — every input the gate refuses today is still refused with the ablated helper.
• The predicted direction held for the envelope and was too coarse for the accept-set block, recorded rather than quietly rewritten (also corrected in the test file's own docblock). The accept-set block's REFUSED half goes red because it asserts the envelope in the same toEqual as the message; its ACCEPTED half — the direction that catches a tightened gate — stayed green. The red half's diff is the sharper evidence:

 {
- "code": "INVALID_REQUEST",
+ "code": undefined,
"message": "RemoteTransport: unsafe identifier rejected: \"\"",
- "status": 400,
+ "status": undefined,
}

The message line carries no marker: prose and predicate are provably untouched. That is what makes this an envelope change and not a gating one.

• Restore proved byte-exact, not by an exit code: git status --porcelain empty, git diff HEAD empty, and git hash-object equal to the HEAD blob for both files — 2b8d1bc11719b57ace1b380ccc320ed47b60d717 (transport) and 5d5ce5ea9b1c873de49c654f25c35038fdd0b8b6 (backfill).

Driver-conformance ledger — before and after, verbatim

Before the first edit, at d62f990a9:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

After the last commit, at 8422dd4c1:

check-driver-conformance: OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.

Unmoved, as it must be — this PR adds no conformance cell and retires none.

The one file outside the dispatched surface, named rather than slipped in

packages/spec/src/api/error-code-ledger.zod.ts gains one provenance row — '@objectstack/driver-turso': ['INVALID_REQUEST'] with its reachability comment. It was not in the dispatched file surface, so here is the evidence rather than a silent edit:

• It is mechanically required, measured not assumed. With the driver change alone, pnpm --filter @objectstack/spec check:error-code-provenance prints: FAIL — 1 stamp site(s) of a registered code with no provenance row: @objectstack/driver-turso stamps 'INVALID_REQUEST' (constdef) at packages/drivers/driver-turso/src/remote-transport.ts:118 — not listed under its own owner key. The gate's own prescribed fix is this row or a waiver, and it says "Both are decisions on the record; silence is not." With the row: OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver.
• It is not a new ledger code, which is what the dispatch fence's parenthetical guards. INVALID_REQUEST is already registered by seven packages. Measured: the deduped registered-code union is 248 codes before and 248 after, with an empty added set and an empty removed set — so ErrorCode, REGISTERED_ERROR_CODES and every generated spec artifact are unchanged (pnpm --filter @objectstack/spec check:generated reports all 15 up to date).
• The shape is pinned by sibling precedent, not invented: @objectstack/driver-memory (UNIQUE_VIOLATION, error-code-ledger: @objectstack/driver-memory becomes an emitter of UNIQUE_VIOLATION with no provenance row — invisible to every gate, which is the point of the row #13254) and @objectstack/driver-sql (SQL_DIALECT_EMISSION_UNSUPPORTED, sql-driver: one emission-identity source — loud refusal for redshift/cockroachdb DDL, pgnative joins the Postgres family (#11756 ruling) #11991) are the same row for the same reason, and the ledger header's own rule is "a code emitted by several packages is listed once per emitting package".
• The row's wire-reachability evidence (the [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 test) is RemoteTransport's DDL and aggregate positions on a server already serving HTTP — explicitly not the backfill module, whose callers flatten the throw.
• No other in-flight branch touches that file (checked against origin), and the claim comment's file surface is amended on the card in the same round.

If you would rather this row landed separately, say so and it comes out — the driver change cannot go green without it, so the two would have to land together in either order.

What is not pinned, said plainly

The unique-index-sync position (index.name and index.columns) inherits the envelope from the single producer but has no independent case: the index name and columns are derived by uniqueIndexesFromFields from an object whose own name and columns were already gated one call earlier, so no input reaches that assert without being refused first. It is covered by construction, not by a test, and inventing a synthetic route to it would pin the harness rather than the behaviour.

On the backfill producer: its envelope is defence in depth, not a wire answer today, and the test says so rather than implying more. Both callers flatten the throw into report.error by design (ADR-0053 D-B3 forbids a migration taking a boot down), so code/status reach no response envelope from that module. The helper is exported so the envelope has a real pin — nothing else can observe it, and an unobservable assertion is a phantom check rather than a test.

Verification

Union run on 8422dd4c1 (this PR's head, after merging origin/main):

Command	Verdict line
pnpm --filter @objectstack/driver-turso test	Test Files 42 passed (42) · Tests 1143 passed (1143)
pnpm --filter @objectstack/driver-turso typecheck	exit 0 — and tsc --noEmit --listFiles confirms both edited/added test files are in the program (2 hits), so "typecheck clean" really covers them
pnpm lint (whole repo, eslint . --no-inline-config)	exit 0
pnpm --filter @objectstack/spec check:error-code-provenance	OK — every registered-code stamp site is listed under its own owner key or carries a recorded waiver (8 waiver(s), all live)
pnpm --filter @objectstack/spec check:generated	✓ All 15 generated artifacts are up to date.
pnpm --filter @objectstack/spec exec vitest run src/api/error-code-ledger.test.ts	18 passed
pnpm check:driver-conformance	OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt.
pnpm check:error-code-casing · check:dispatcher-error-vocabulary	exit 0 · exit 0
pnpm check:engine-double-contract · check:where-matcher · check:query-options-erasure · check:type-check-coverage	exit 0 (the four convention-triggered by a new test file)
pnpm check:nul-bytes	exit 0

The rest of the re-derived family (node scripts/pm/dispatch-gates.mjs, 52 path-matched plus 4 by change kind — the dispatch's hint named 20, before the ledger row widened it) ran green too: check:cross-package-test-inputs, check:doc-authoring, check:logger-receiver-detach, check:page-declaration-shape, check:published-files, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:changeset-gate-self-tests, check:objectui-changeset, check:pm-half-states, check:merge-driver, check:spec-parsed-alias, check:objectql-double-limit, and the direct-node ones (check-ci-filter-parity, check-comment-mask-adoption, check-cross-package-test-inputs, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, docs-audit/check-affected-docs, docs-audit/check-drift-comment, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, release-rehearsal-clone --self-test).

Two gates returned exit 3 = NOT MEASURED, which is neither green nor red and is recorded as such: scripts/check-test-completeness.mjs (needs a saved turbo run test log that only CI produces) and scripts/pm/check-half-states.mjs (needs repo-scoped REST egress; this session's repo-scoped REST answers 403).

Changeset: patch for @objectstack/driver-turso and @objectstack/spec — a refusal-envelope correction plus a provenance row; nothing an author writes changes, so it is not breaking.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-turso, @objectstack/spec, touching 7 documentable anchor(s).

10 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/api/metadata-api.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/automation/webhooks.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/data-modeling/import-mappings.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object))
• content/docs/permissions/authentication.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/permissions/sso.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))
• content/docs/ui/forms.mdx(via INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol, a top-level const object), INVALID_REQUEST (literal, a string literal in ERROR_CODE_LEDGER; a string literal in UNSAFE_IDENTIFIER_CODE))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 131 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from c78fe6759e4d2f87971c47e7999151d8a5a5972b — the merge of head 8422dd4c1d97fcb6e86943af0398809e0b5b684d into base 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c78fe6759e4d2f87971c47e7999151d8a5a5972b && git checkout c78fe6759e4d2f87971c47e7999151d8a5a5972b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 8422dd4c1d97fcb6e86943af0398809e0b5b684d && git checkout -B drift-repro 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 && git merge --no-ff 8422dd4c1d97fcb6e86943af0398809e0b5b684d
node scripts/docs-audit/affected-docs.mjs --json 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 038f3332e62d61469b67ffa2cf8d3ef7ac8ccea4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Enqueue provenance (domain:engine execution seat, session_0112hMx9hjJ9BgB28X97DS68): ACCEPT on #14287 (comment 5504280781) → at 04:29Z every check run on head 8422dd4c1 was completed with success or skipped (34 runs; Lint & Repo Gates finished 04:24Z), governed-surface test on the six changed paths: NOT governed, mergeable_state not dirty → marked ready and auto-merge (squash) enabled. Landing is by the merge queue; the engine seat follows it to MERGED.

---

Generated by Claude Code