fix(types): teach the internal-leak predicate MySQL's three error templates (#8739)

[qq9340100]

Part of #8739 — ruling item 1 only. Deliberately not a closing keyword: three of the ruling's four consequences live elsewhere (see "What this PR does not do"), so the card should survive this merge.

The ruling

Maintainer, 2026-08-15, comment 5302926756, provenance quoted verbatim and untranslated:

接受你的所有建议。

Option A — MySQL is a supported deployment target, not merely a tested dialect. The reasoning the dev report and the re-grade reached independently: the docs are the promise already made — OS_DATABASE_DRIVER=mysql is a published deployment knob, MysqlConfig is authorable datasource config, types.mdx specifies per-field MySQL DDL, and MySQL-specific defects are accepted and fixed rather than closed as unsupported.

Item 1 of the four consequences: teach DIALECT_LEAK_PHRASINGS MySQL's phrasings.

What changed

looksLikeInternalErrorLeak decides whether a message is a driver dump that must not reach an API client. It is applied at three HTTP boundaries (rest's mapDataError, runtime's dispatcher-plugin and endpoint-executor, the hono adapter) and gates objectql's log redactor. Its dialect list covered the SQLite family and Postgres; on a MySQL deployment it answered false to every one of the same conditions — silent, not clearing.

Three limbs added, one per condition the other two dialects were already covered for, each anchored on MySQL's own errmsg template rather than a bare substring:

condition	MySQL template	code
missing table	Table 'app.t' doesn't exist	ER_NO_SUCH_TABLE 1146
missing column	Unknown column 'c' in 'field list'	ER_BAD_FIELD_ERROR 1054
unique violation	Duplicate entry 'x' for key 'i'	ER_DUP_ENTRY 1062

Anchoring detail, since over-matching is the expensive direction here: the unknown-column pattern requires both quoted parts — the second is MySQL's clause name (field list, where clause, order clause, on clause) and is what separates the driver's template from a sentence that merely calls a column unknown. The duplicate-entry pattern anchors on the for key tail plus a quoted index, and matches the value half loosely because it is the caller's own text and MySQL does not escape a quote inside it.

Deliberately still NOT recognised, on the record rather than inferred:

• MySQL's ACL family — Access denied for user 'u'@'h' to database 'd' (1044), SELECT command denied to user … for table 't' (1142) — the counterpart of the Postgres permission denied for table limb. Nothing here has raised one off a live server, and the standing rule in this neighbourhood (unique-violation.ts) is that a dialect's spelling is added once measured off a thrown error, never from a reading of the manual. Access denied also collides with this platform's own security prose ([Security] Access denied: …, a pinned negative case), so a guessed pattern would over-match — and over-matching suppresses diagnostics an operator needs.
• MSSQL and Oracle — still false.
• Prose sharing the keywords without the driver's anchoring — an import summary saying duplicate entry in the uploaded file, a mapping message saying Unknown column in the uploaded CSV header, The table you selected does not exist. All pinned as new negative cases.

The four pins went red by design, and are rewritten rather than deleted

PR #8824 planted four toBe(false) pins as a deliberate tripwire for exactly this decision. They fired. Measured first, before any test was touched — source edited alone, landed pins run against it:

Test Files 1 failed | 11 passed (12)
Tests 4 failed | 333 passed (337)
× is silent on mysql unknown column — false here means UNCOVERED, never "safe"
× is silent on mysql missing table — false here means UNCOVERED, never "safe"
× is silent on mysql duplicate entry — false here means UNCOVERED, never "safe"
× withholds the same uncovered text through the declaration channel

Zero collateral inside packages/types, which is the evidence that the three limbs match the templates and nothing else in that suite.

The rewrite keeps them equally capable of going red, which was the point of building them:

• The same three measured messages now assert true, plus three more (MySQL's where clause spelling, a qualified table.column key, and a value containing its own quote). A future change that silently drops MySQL coverage fails here, on templates measured off real MySQL text.
• Six new negative cases guard the other direction — if someone relaxes a MySQL anchor to a bare includes(...), they go red before a deployment starts answering "Internal server error" to real questions.
• The false-means-UNCOVERED lesson is not retired with them. It was never about MySQL: it is the reading a reviewer on PR fix(objectql): refuse undeclared insert fields at the schema, and keep bound values out of the write-path logs (#8682) #8737 got wrong while sizing a disclosure residual, which is what produced this card. A second block keeps the original toBe(false) shape pointed at MSSQL and Oracle, so the distinction keeps a live subject instead of becoming a paragraph.

Reverse verification, direction predicted in writing first

Both legs were predicted before running, and the prediction file recorded the inverse direction this card requires.

Leg A — the original pins must fail against the change. Predicted 4 red, zero collateral. Observed exactly that (above).

Leg B — the rewritten pins must go red against pre-ruling behaviour. Fix committed first, then git checkout origin/main -- packages/types/src/error-leak.ts alone:

Tests 5 failed | 79 passed (84)
× covers mysql unknown column
× covers mysql unknown column, where clause
× covers mysql missing table
× covers mysql duplicate entry
× covers mysql duplicate entry, qualified key
✓ covers mysql duplicate entry behind a knex statement prefix
✓ is silent on mssql invalid object name …
✓ is silent on oracle missing table or view …
✓ withholds the same uncovered text through the declaration channel

One missed prediction, kept rather than tidied away: leg B was predicted at 3 red and came back 5. The direction was right; the count was stale because two positive cases were added after the prediction was written. Recording it because the useful half is the two that stayed green: the knex-prefixed case is green in both directions (it reaches true through the pre-existing insert into limb, independently of the MySQL limbs — which is exactly why it was added), and the MSSQL/Oracle block is green in both directions by design, making it a guard rather than evidence.

Restored by git checkout of the branch, byte-identity proved rather than assumed: worktree blob 4e2d8a49ab83996acddb646e4a75cff6ebfb302f equals git rev-parse HEAD:packages/types/src/error-leak.ts.

The card's four measurements, re-measured through the shipped functions

Not inherited from the round-8 report. Driven through the real redactStatementFromMessage, resolving @objectstack/types from its built dist:

mysql unknown column => "Unknown column 'zzz' in 'field list' [statement and bound values redacted]"
mysql duplicate entry => "Duplicate entry 'acme@example.com' for key 'crm_account.email' [statement and bound values redacted]"
sqlite unique violation => "UNIQUE constraint failed: crm_account.email [statement and bound values redacted]"
pg unique violation => "duplicate key value violates unique constraint \"crm_account_email_key\" [statement and bound values redacted]"

Byte-identical to the recorded values. Three keep an identifier; one keeps a caller's value, and it is the dialect the false claim excluded. Postgres' own value was confirmed to live on error.detail — Key (email)=(acme@example.com) already exists. — which Logger does not serialize, and which the redactor's rebuilt Error drops as well; so Postgres escapes for a reason unrelated to the cut, as recorded.

No status mapping moves, and the log does not move either

Measured, not reasoned:

• A MySQL duplicate-entry error is still 409 UNIQUE_VIOLATION and a MySQL unknown-column error is still 400 INVALID_FIELD — both decided above the leak branch, by isUniqueViolationError and the INVALID_FIELD limb respectively. 唯一约束冲突没有单一判别谓词:仓内四套各自为政的方言词表,REST 的 409 映射漏掉 MySQL(Duplicate entry 落成 500 INTERNAL_ERROR) #6250's separation is what makes the widening safe.
• The log redactor is unchanged in both directions: a bare MySQL diagnostic newly answers true to the gate but carries no knex - separator, so lastIndexOf returns -1 and the message comes back byte-identical. Measured for all seven dialect shapes — unchanged=true for every one.

Consumption-radius sweep, not a package-scoped one

The predicate has consumers in seven packages, so the sweep followed the rule's consumers rather than the edited package. Full suites run:

package	result
types	348 passed
objectql	3721 passed
rest	2001 passed
runtime	2456 passed
metadata-protocol	1524 passed
service-analytics	1722 passed
service-package	38 passed
hono	73 passed

Exactly two verdicts moved outside packages/types, and both are files that measure this predicate directly rather than files that merely use it:

• rest/src/rest-unique-violation-dialects.test.ts — the #6250 block pinned "the fix did not widen the internal-leak classifier". Rewritten to assert the invariant it was always for: the 409 does not depend on the leak verdict. The rewrite is a stronger demonstration than the original — the message now IS classified as a leak and the 409 is returned anyway, which can only be true if the conflict branch runs above and independently of the leak branch.
• metadata-protocol/src/protocol.driver-text-disclosure.test.ts — the DIALECTS matrix row and its uncovered-count. That file's own header instructs the next author to flip rather than delete, and that is what was done. Every withhold case in it passed before and after the flip, which is the cleanest available demonstration of its thesis: a producer that withholds by DECLARATION is unaffected when the phrasing list moves underneath it.

Two neighbouring comments that state the old verdict as history were given a dated qualifier so the next reader cannot re-derive a false present-tense claim from them — which is the exact defect class this card exists for.

What this PR does not do

• The #8682 write-path redaction keeps a caller's VALUE in the log on MySQL — Duplicate entry 'acme@example.com' for key … survives the cut, measured through the shipped function #8823 is not addressed here. The value-bearing Duplicate entry residual in the server log is a separate card in the engine-core lane, and this change provably does not touch it (the log output is byte-identical in both directions, measured above).
• [finding] The same false "this repo runs two dialects" claim survives in metadata-protocol's driver-text-disclosure test — in a test NAME, where it reads as an assertion #8822 needs nothing further — it merged via PR fix(metadata-protocol): say what the predicate covers, not what the repo runs, in driver-text-disclosure test #8859. The prose it corrected is untouched; only the measured verdict beside it moved.
• Ruling item 2 is out of scope and had no card, so it is filed as MySQL's documented degradations are still source comments, not published support-matrix caveats — ruling item 2 of #8739 has no card #9029 rather than left to evaporate: MySQL's two documented degradations are still source comments, not published support-matrix caveats.
• No leak is claimed. The card is explicit that none was demonstrated, and none was measured here. This closes a gap in what the boundary recognises.
• The two retrospective nobody here runs narrations PR docs(types): correct error-leak.ts's false MySQL dialect claim, and pin the uncovered dialect #8824 left as a tripwire are deliberately preserved, not cleaned up.

Gates

Derived after the final commit against the actual changed paths, and run at that HEAD — 05e85a759.

The derivation named more families than the dispatch prompt predicted: it expected check:nul-bytes, check:query-options-erasure, check:type-check-coverage, check:type-check-debt, and the re-derivation added check:changeset-gate-self-tests, check:cross-package-test-inputs, check:durability-log-level, check:objectui-changeset, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, check-cross-package-test-inputs, plus convention-triggered check:engine-double-contract and check:where-matcher (this PR edits three test files). The union was run, output redirected to files, never piped.

14 of 14 EXIT=0.check:type-check-debt --re-measure ran on the built workspace closure — 33 ledger entries re-measured in 294.7s, 1926 raw errors, none above its recorded number — so it is MEASURED, not the unbuilt-worktree refusal. Nothing was NOT MEASURED.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 16, 2026 7:05am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/types.

1 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/plugins/packages.mdx(via @objectstack/types)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.