services: a declared 5xx from the service-storage, service-settings and service-i18n route handlers ships the underlying error's message text, where the platform withholds 5xx message text

Filing gate ① a product defect with a named landing. reach: exception: security, because a 5xx body may carry internal detail of the server. Measured once at route level on service-storage's raw-byte routes by the #23143 dev (report on #23143, PR #23172). ⛔ The reproduction is held off public surfaces under the domain:services lane's disclosure rule; this card stays at function level. Filed by domain:services seat 2 (#21118) · zhuangjianguo · session session_01FzQy26KznSa5j2gnf3AzsE. ⛔ Not a claim; grade and lane are triage's.

Reader who acts: triage grades it. The fix lands in three domain:services files, so the domain:services seat claims it next.

What happens

Several route handlers in packages/services/* answer a declared 5xx with their own sendError(res, 5xx, CODE, err?.message ?? 'FALLBACK'). The underlying error's message text therefore reaches the caller. For some adapter or driver errors that text names server-side internals.

Governing text

packages/rest/src/error-response.ts: "[sendError 的显式状态直通覆盖 400–599,5xx 的原始驱动报错绕过全部泄漏启发式直达客户端(metadata-protocol 有活体产出方) #5437] A declared 5xx never ships its own message text." The REST layer withholds it and logs the original ("5xx message withheld from client").
packages/rest/src/package-routes.ts (The direct-mount package door ships 5xx messages verbatim — no leak heuristic, unlike the dispatcher twin and unlike rest-server's own /data exit #8086): "…and a leaky 5xx message is withheld".
These services send through their own sendError helpers and never reach that filter.

Sites (single-line census on `origin/main` `e540e7ffb`)

The census matches sendError calls with a 5xx status whose message argument is err.message / error.message, excluding tests:

File	Sites
`packages/services/service-storage/src/storage-routes.ts`	8
`packages/services/service-settings/src/settings-routes.ts`	5
`packages/services/service-i18n/src/i18n-service-plugin.ts`	3

Control: the rule's own site, packages/rest/src/error-response.ts, is present (1 hit). The single-line pattern cannot see multi-line calls. The storage raw-byte handlers' arm is one such multi-line site, and PR #23172 already withholds it, in code it touched. The fixing dev re-runs the census with a multi-line scanner and a positive control.

Acceptance

Every 5xx these handlers declare answers with the route's generic message, never the error's own text. The original error keeps reaching the server log the way each family logs today. Prefer the REST layer's existing withholding helper if it can be reused; ⛔ no fourth copy of the rule.
One pin per family: an injected fault whose message carries a recognisable string answers its declared 5xx, and the body contains none of that string. Each pin asserts code and status.
4xx answers are untouched. A caller-facing 4xx message is an answer by design (The direct-mount package door ships 5xx messages verbatim — no leak heuristic, unlike the dispatcher twin and unlike rest-server's own /data exit #8086's scope).

Dedupe

MCP search_issues on objectstack-ai/objectstack, closed included:

5xx error response passes raw error message text to client storage settings i18n routes withhold message: 6 hits. They are service-storage: a malformed, forged or expired token on the local adapter's signed byte routes answers 5xx INTERNAL instead of a 4xx refusal (LocalStorageAdapter.verifyToken throws a plain Error the two raw-byte handlers surface) #23143 (the token-status card this came from), [finding] rest: the 20 write routes #22719 repaired still answer a crashed hook body with its native fault text, and a declared-5xx refusal unwithheld, where the data doors answer Internal server error #22764 (closed; the REST write routes), raw Hono mounts (getRawApp()) answer an escaped throw as 500 text/plain "Internal Server Error" — no ADR-0112 envelope, declared status/code discarded #17411 (closed; raw Hono mounts' envelope), rest-server 的 4xx 直通把 ≥500 字符的 message 整条换成 "Request failed" —— #5368 刚写好的过滤器拒收措辞，客户端一个字也收不到（实测） #5423 (closed; the REST 4xx pass-through), service-i18n error responses are bare { error }, not the declared { success: false, error: {...} } envelope #3675 (closed; the i18n envelope shape) and better-auth update-user validation failure returns raw 500 empty body (should be a 4xx) #3398 (closed). None is these handlers' 5xx text.
5xx message withheld leaky internal error message sendError INTERNAL err.message: 2 hits. They are sendError 的显式状态直通覆盖 400–599,5xx 的原始驱动报错绕过全部泄漏启发式直达客户端(metadata-protocol 有活体产出方) #5437 (closed; the REST layer's own sendError, which this card's rule comes from) and external-datasource-federated-read: external-write refusal (ExternalWriteForbiddenError) leaks to the client as a bare 500 INTERNAL_ERROR #7739 (closed). Neither covers these services' own helpers.

Generated by Claude Code

Release: session_01FzQy26KznSa5j2gnf3AzsE (domain:services seat 2) releases claim 6142771398 · 2026-10-13T10:11Z · reason: the measured fix needs one new export, so it is Clause-②: yes, which is spec-lane work · destination: pm:queue + pm:retriage, asking triage to route it to domain:spec with the grade kept (p2 security). No code was written; the branch claude/issue-23174-services-5xx-withhold holds no commit beyond main.

pm:retriage: evidence and the answer asked for (dev report on this card; disclosure kept at function level)

The leak is measured on origin/main 920bc12a24 in all three families. An injected fault with a recognisable string answered each family's catch-all 5xx with that string as the error message.
The multi-line census (control: storage at 3d6392f1fa^, whose multi-line raw-byte arms the single-line census missed) found:
- storage: 8 catch-all arms passing the caught text;
- settings: 4;
- i18n: 3;
- plus a fourth family with the same defect: plugin-sharing's share-link family door (share-link-routes.ts, the mountFamilyRoute catch), measured the same way. Per the same-family rule it joins this card as a row, never a single-point card.
Why no in-lane fix: no export the families already depend on carries the withholding decision for their nested envelope.
- @objectstack/types' sendError writes any 5xx text verbatim. logServerFault only logs. declaredServerFaultAnswer is flat-dialect and answers nothing for an undeclared throw.
- REST's withholding door is module-private, flat-dialect, and in a package no service depends on.
- Triage's direction forbids a fourth copy of the rule, so composing logServerFault + sendError at each of the 16-plus arms (option A) is that copy.

The seat's recommended route (a recommendation for the claiming seat, not a ruling):

Q1 — B. Add one nested-envelope fault writer to @objectstack/types, beside sendError and logServerFault: hand the caught error once to the fault log with its stack, then write the route's generic text through the envelope.
- The four families' catch-alls call it, and storage's raw-byte arm (PR fix(service-storage): a refused presigned token answers 401 INVALID_TOKEN on both raw byte routes, never a 500 #23172) converges onto it, which also removes that arm's two-log-line shape.
- It is one function in the package every caller already depends on: Clause-②: yes, minor on @objectstack/types.
- Rejected:
  - A: the forbidden copy.
  - C, re-homing REST's door into core: measured as unusable as-is, because it is flat-dialect and module-private.
  - D, sendError withholding every 5xx: it changes authored 501/503 prescriptions repo-wide and needs its own ruling.
Q2 (the seat's scope answer, not escalated): exclude settings' SETTINGS_CRYPTO_UNAVAILABLE arm. Its text is an authored refusal naming a setting and a configuration, not server internals, and the console renders it verbatim as the operator's prescription. Withholding it would regress a shipped cross-repo reading. This narrows triage's "every declared 5xx" by that one arm; the reason is recorded here.
Q3 (the seat's scope answer, not escalated): out of this card — the three branded AuthzStoreUnavailableError 503 relays (storage ×2, settings ×1). REST withholds that text while the datasource admin family pins it as relayed, so the branded error needs one answer across every services family. Carrier: the implementing PR's Acceptance notes, so the decision is made once rather than split here.
Noted: i18n's routes are also served by the runtime dispatcher's i18n domain, whose thrown exit keeps an undeclared 5xx's text legible under its own tiering. After the fix, the plugin mount withholds what the dispatcher mount may relay. That is the safer direction, but the implementer should know of the divergence.

Generated by Claude Code

Triage: retriage answered. `domain:services` → `domain:spec`, grade unchanged (`priority:p2` · `security`). One nested-envelope fault writer, and plugin-sharing joins

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-13T10:55Z. ⛔ Not a claim, ⛔ not a dispatch. Answers 6143276509. pm:retriage is removed in this act.

Why it moves: the dev measured that no export the families already depend on carries the withholding decision for their nested envelope, so the shared door is one new export. That is Clause-②: yes, and spec-lane work. Composing logServerFault + sendError at each arm would be the fourth copy triage ruled out.
Direction: the seat's B.
- One nested-envelope fault writer in @objectstack/types, beside sendError and logServerFault. It hands the caught error once to the fault log with its stack, and writes the route's generic text through the envelope.
- The catch-all arms of storage, settings, i18n and plugin-sharing's share-link door (the fourth family, joined here per the family rule) call it.
The two scope questions, answered:
- The settings crypto-unavailable arm is an authored message, not caught text. It is product copy the console renders, so it stays verbatim.
- The branded authorization-store outage relays its own declared code and message, so it stays as it is.
- The rule withholds only text that came from a caught error. ⛔ It is not widened to authored 5xx copy.
Pins, per family: an injected fault answers its declared code / status and leaks none of the fault's string; the two authored arms are unchanged.
Disclosure stays at function level.

Claim: PM loop round 1, rolling slot (#23174, triage 6143999851: one nested-envelope fault writer in @objectstack/types; the catch-all 5xx arms of four families withhold the caught text) · 2026-10-13T20:37Z
Session: session_01BRQ9Mp1yH7R1az6MaUM18H
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-23174-nested-fault-writer
Worktree: objectstack-issue-23174
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface (at origin/main cc14657ed or later; cross-lane domain:services files, held here because the shared door is a new export, per triage; stop on breach and explain in the report):

packages/types/src/: one new nested-envelope fault writer beside sendError and logServerFault, exported from the package index;
the catch-all 5xx arms of packages/services/service-storage/src/storage-routes.ts (the raw-byte arm PR fix(service-storage): a refused presigned token answers 401 INVALID_TOKEN on both raw byte routes, never a 500 #23172 withheld converges onto the writer), packages/services/service-settings/src/settings-routes.ts, packages/services/service-i18n/src/i18n-service-plugin.ts and packages/plugins/plugin-sharing/src/share-link-routes.ts;
their tests, and one .changeset/23174-*.md.
⛔ Not packages/rest (its door stays as it is).
Container & model: M, mode:subagent, model: default tier (dispatch-gates --tier: no path-derived mandate). A CONTRACT_REVIEW_TIER review by an isolated subagent precedes the queue.
Clause-②: yes (widening)
Responsibility: the four families' route handlers (the platform's own code), which pass the caught error's message into their own sendError | none: the REST layer withholds 5xx text (sendError 的显式状态直通覆盖 400–599,5xx 的原始驱动报错绕过全部泄漏启发式直达客户端(metadata-protocol 有活体产出方) #5437), but these handlers never reach it | any caller of the four families that meets a server fault (measured in all four by the first dev, report 6143208505)
Thread-read: 6143999851
Serial constraints cleared (all open PRs' file lists read in this act; the lane's queue re-read in this act, with no open P0/P1 and no pm:blocking card):
No open PR and no pm:dispatched claim touches these files. services: route families mounted straight on the HTTP server never consult the ADR-0069 authentication-policy gate, so a session held by enforced MFA or password expiry may still reach them #23178 and service-storage: a malformed, forged or expired token on the local adapter's signed byte routes answers 5xx INTERNAL instead of a 4xx refusal (LocalStorageAdapter.verifyToken throws a plain Error the two raw-byte handlers surface) #23143, the serial predecessors named on this card, are landed (08b38cb9d, 3d6392f1fa).
service-storage: a server-side verb that stores bytes and attaches them to a record (sys_file + sys_attachment), under the parent's organization, quota and access hooks: the prerequisite for inbound-mail attachments #23306 (service-storage, p2, in pm:queue, not dispatched) works in the same package and names no file of this surface; whoever claims it reads this card's PR first.
The previous claim (domain:services seat 2, 6142771398) was released in 6143276509 with an empty branch; this claim starts from main.

This act moves the card pm:queue → pm:dispatched and assigns os-justin. The PR carries Fixes #23174.

Generated by Claude Code

os-dev-report

{
  "issue": 23174,
  "status": "done",
  "branch": "claude/issue-23174-nested-fault-writer",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23346",
  "session": "session_01BRQ9Mp1yH7R1az6MaUM18H",
  "premise_still_valid": true,
  "summary": "@objectstack/types gains sendServerFault(res, status, code, message, thrown, request?) beside sendError and logServerFault (response-envelope.ts): it writes the route's generic text in the nested envelope and hands the caught error, stack included, to logServerFault as the fault's one line, sharing sendError's envelope write (module-private writeErrorEnvelope) so SHARED_BUILDER stays 2/1/1. The catch-all 5xx arms call it: storage 8 (plus sendRawByteRouteFailure's 500 arm converged, two log lines to one), settings 4 refuse tails, i18n 3, and plugin-sharing's share-link door for a throw that declares no status. Authored 5xx (SETTINGS_CRYPTO_UNAVAILABLE, the branded authz-store outage relays, storage 501s, share-link throws with a declared status) and every 4xx are unchanged; packages/rest untouched. Draft PR #23346 (assignee os-justin), base cc14657ed, final head fd5162d10.",
  "zone2_measurements": {
    "1_census": "HOLDS on cc14657ed with a multi-line scanner (comment/string aware, balanced-paren arg split). Positive control storage-routes.ts at 3d6392f1fa^ finds the two multi-line raw-byte arms (invalidToken ? 403 : 500, err?.message ?? fallback). Changed: storage :979 :1035 :1134 :1290 :1393 :1452 :1491 :1540 (+ :246 funnel converged); settings :245 :266 :348 :381; i18n :178 :193 :228; share-link :285 (undeclared-status half). Left: storage 4 x 501 NOT_IMPLEMENTED (:1482 :1534 :1552 :1597, authored) and 2 brand relays (:592 :682, ruled); settings :344 crypto (authored, ruled) and :145 brand relay (ruled); share-link declared-status half (4xx, brand, authored 5xx). Repo-wide over the 10 non-test files calling sendError( by name: no other literal-5xx caught-text arm.",
    "2_one_line": "CONFIRMED. At BASE the raw-byte arm logs 2 [5xx] lines per fault (reverse leg: 'expected [ [ ...(2) ], [ ...(2) ] ] to have a length of 1 but got 2'); after, 1 line with stack. Every converted arm is pinned at exactly one line carrying the fault text and its stack.",
    "3_token_route_log": "CONFIRMED and pinned: both _local/raw token routes log one line containing the mounted pattern, and no console argument (message or meta) contains the request token. Share-link token routes: the door passes no request object, pinned token-absent on all five routes.",
    "4_share_link": "CONFIRMED: the catch-all is mountFamilyRoute's catch (share-link-routes.ts :285 at BASE), writing the nested @objectstack/types envelope (pins parse BaseResponseSchema and envelopeViolations). Converged only for a throw with no declared status; a declared status keeps its envelope.",
    "5_levels": "CONFIRMED: @objectstack/types minor (Clause-② yes (widening)); service-storage, service-settings, service-i18n, plugin-sharing patch. All five are in the changeset fixed group. Stated in PR body and .changeset/23174-nested-fault-writer.md."
  },
  "tests": "Build (lock): pnpm --workspace-concurrency=2 --filter the four families + dependency closure build, 20 projects, VERDICT command-exit 0; sendServerFault present in packages/types/dist/index.d.ts. On d57800f1e (lock): typecheck EXIT 0 for types, service-i18n, service-settings, plugin-sharing (check:test-typecheck OK), service-storage (check:test-typecheck OK); test EXIT 0: types 27 files/759 tests, service-i18n 6/80, service-settings 45/823, plugin-sharing 44/1052, service-storage 54/939. After the fd5162d10 pin edit: share-link pin 16/16, plugin-sharing typecheck EXIT 0. Reverse verification (lock): the four route files restored to their cc14657ed blobs (hash == BASE blob), pins run, restored from HEAD (hash == HEAD blob, git diff HEAD empty): i18n 6/6 failed; settings 8 failed / 5 passed (authored arms); share-link 10 failed / 6 passed (4xx + brand relays); storage 18/18 failed. Ablations via scripts/ablation-replace.mjs on packages/types/src/response-envelope.ts (types suite reads src, no build involved; each landed anchor 1->0 with blob change, each restored to HEAD blob with git diff HEAD empty): A1 body ships thrown text -> 'writes the declared envelope with the generic text' red (1 failed / 28 passed); A2 writer routes through sendError -> 'logs ONE line' red; A3 throw dropped from the log -> 'logs ONE line, carrying the caught text and its stack' red. Lint narrowing on fd5162d10: eslint --no-inline-config --format json over the 15 changed .ts files -> 15 files, 0 errors, 0 warnings, 0 ignored; population = eslint.config.mjs files '**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}' minus NEVER_LINTED; invariance: no parserOptions.project / projectService in eslint.config.mjs, so no type-aware linting. packages/runtime package typecheck NOT MEASURED (closure unbuilt when the ledger changed); the module alone: tsc --ignoreConfig --strict, exit 0 (it has no imports).",
  "gates": "Derived on final HEAD fd5162d10 with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths): 68 commands, identical to the d57800f1e derivation. Run with exit codes recorded before any pipe; reconcile: 'Run reconciliation — 68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN.' / '✓ dispatch-gates --ran: 68 derived famil(ies) accounted for', exit 0. All 68 exit 0 on fd5162d10. First pass (d57800f1e) reds this diff caused, fixed in fd5162d10: check:dispatcher-error-vocabulary exit 1 (two new helpers unclassified -> two compiler-narrowed rows), check:engine-double-contract exit 1 (pin's engine double declared unused update/delete). Re-run individually on fd5162d10 after the second pass's type-check-debt build completed the workspace: check:dts-closure (second pass exit 1: six unrelated packages left without declarations by the first pass's check:type-check-debt closure build, killed 137) -> exit 0, 173/173 across 72 packages; check:dual-build-cjs-loads (exit 3 PREREQUISITE NOT MET on both passes) -> exit 0; check:i18n (exit 3) -> exit 0, '10 package(s) — all bundles in sync'. check:type-check-debt second pass exit 0 ('26 raw tsc error(s) total, none above its recorded number'). Reconcile notes origin/main 8 commits ahead (430e5f5ad), two gate-family files stale on this tree (an adr-anchors JSON, scripts/pm/ci-failure.mjs); none of the 8 touches the 16 changed files. CI checks: in_progress / not read (report delivered at end of local verification).",
  "line_budget": "16 files, +956 / -72 = 1028 changed lines vs merge base cc14657ed (under the 3000 human-merge threshold); no skills/** or governed surface touched.",
  "files_changed": [
    ".changeset/23174-nested-fault-writer.md",
    "packages/types/src/response-envelope.ts",
    "packages/types/src/server-fault-log.ts",
    "packages/types/src/server-fault-log.test.ts",
    "packages/services/service-storage/src/storage-routes.ts",
    "packages/services/service-storage/src/storage-routes.server-fault-withheld.test.ts",
    "packages/services/service-storage/src/storage-routes.metadata-outage.test.ts",
    "packages/services/service-storage/src/chunk-part-record-concurrency.test.ts",
    "packages/services/service-settings/src/settings-routes.ts",
    "packages/services/service-settings/src/settings-routes.server-fault-withheld.test.ts",
    "packages/services/service-settings/src/settings-routes.authz-outage-relay.test.ts",
    "packages/services/service-i18n/src/i18n-service-plugin.ts",
    "packages/services/service-i18n/src/i18n-routes.server-fault-withheld.test.ts",
    "packages/plugins/plugin-sharing/src/share-link-routes.ts",
    "packages/plugins/plugin-sharing/src/share-link-routes.server-fault-withheld.test.ts",
    "packages/runtime/src/dispatcher-error-vocabulary.ts"
  ],
  "deviations": [
    "File surface extended by one file outside the claim: packages/runtime/src/dispatcher-error-vocabulary.ts gains two UNRESOLVED_CODE_HELPERS rows (sendServerFault, writeErrorEnvelope; compiler-narrowed, as sendError's row). check:dispatcher-error-vocabulary requires them for the new export; the module is a data ledger no non-test runtime file imports, so nothing ships. Stated in the PR body.",
    "Existing fixtures that pinned the caught text in a 500 body were re-pinned to the log side (settings authz-outage-relay §3: 1 case; storage metadata-outage: 10 sites; chunk-part-record-concurrency: 1 site). Consequence stated in the PR: StorageMetadataStoreError's outage sentence (ends in 'Cause:' + the engine message) and the chunk door's internal-fault sentence now reach the operator's fault line, not the caller.",
    "The first push was refused by pre-push check:commit-card-trailers: the harness attribution reminder asked for a 'Co-Authored-By' trailer naming a model. The unpublished commit was amended to the model-free pair before any push landed; no history rewrite of published commits.",
    "Not merged with origin/main (8 commits ahead at reconcile, none touching the 16 files); CI's merge ref and the queue validate the merged generation.",
    "check:type-check-debt ran its own (unlocked, gate-owned) closure build in this worktree; its first-pass build was killed 137 and left partial dist in six unrelated packages; plugin-sharing, service-settings and service-storage dist were rebuilt under the lock before re-running dist-reading gates.",
    "metadata-store.ts (outside the surface) was left untouched although one doc sentence there is now stale; recorded in the PR's Acceptance notes."
  ],
  "mcp_calls": "0",
  "api_writes": "2 — (1) POST /repos/objectstack-ai/objectstack/dispatches via scripts/pm/fleet-write/dispatch.mjs, one pr_create action executed as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectstack/pulls (draft, #23346) + POST /repos/objectstack-ai/objectstack/issues/23346/assignees (os-justin); read-back identical. (2) POST /repos/objectstack-ai/objectstack/issues/23174/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). Labels: zero writes (a changeset exists, so no skip-changeset; the dispatch names no other label). git push of the branch (not REST): 5 landed, plus 1 refused by the pre-push hook before anything was published.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed · packages/services/service-storage/src/metadata-store.ts StorageMetadataStoreError's doc says its message reaches the operator 'through the REST layer's 500 body and through whatever logs the host keeps'; for the storage routes only the log half is now true. In PR #23346 Acceptance notes.",
    "carrier: 承接者:无 · noted, not filed · the share-link door's catch-all keeps err?.code ?? 'INTERNAL', so a throw with a code and no status still answers 500 with that code; whether such a code leaves the ADR-0112 vocabulary at this door is read-only inference, unmeasured. In PR #23346 Acceptance notes.",
    "carrier: 承接者:无 · noted, not filed · (carried from the first dev) the runtime dispatcher's i18n domain still relays an undeclared 5xx's text unless it looks like a leak, while the plugin mount now withholds it; safer direction, a divergence only. In PR #23346 Acceptance notes."
  ]
}

Generated by Claude Code

os-dev-report

{
  "issue": 23174,
  "status": "done",
  "branch": "claude/issue-23174-nested-fault-writer",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23346",
  "session": "session_01BRQ9Mp1yH7R1az6MaUM18H",
  "premise_still_valid": true,
  "round": "patch round (seat order): one docblock made true; head fd5162d10 -> 3e9d931731fe31bf6b1bc3bbf029e617b2b764ff",
  "summary": "packages/services/service-storage/src/metadata-store.ts, StorageMetadataStoreError docblock only (no code): it said the message reaches the operator 'through the REST layer's 500 body and through whatever logs the host keeps'; it now says that on the storage routes the message reaches the operator through the server-fault log (the catch-all hands the caught error to sendServerFault) and the caller gets the route's generic text, because the Cause: tail carries the engine's own message. PR #23346 body updated once: the file is named under the storage bullet, the Acceptance-notes item is dropped, a 'Patch round' section records this round's gates and typecheck, and the branch-base note now covers 17 files. Former out-of-scope finding 1 is closed by this round.",
  "tests": "@objectstack/service-storage typecheck (tsc --noEmit, the scripts program, check:test-typecheck: 0 file(s) / 0 error(s)) under the lock, joined with && after the workspace build: 'turbo run build --filter=!@objectstack/docs --concurrency=2' Tasks 74 successful / 74 total (65 cached), VERDICT command-exit 0 covering both. No test re-run: the diff is a comment inside a docblock (git diff: 5 insertions, 2 deletions, all comment lines); no ablation, nothing executable changed. Worktree recreated at ../objectstack-issue-23174 from the local branch at fd5162d10 (== origin); origin/main (3490bf5fa) touches none of the 17 files, so not merged.",
  "gates": "Derived for the path: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack packages/services/service-storage/src/metadata-store.ts -> 48 commands, on 3e9d93173. All 48 :: exit 0, each recorded before any pipe (dist-reading families measured: the workspace was built first). Reconcile --ran with the same path: 'Run reconciliation — 48 derived, 48 run, 0 NOT-MEASURED, 0 UNRUN.' / '✓ dispatch-gates --ran: 48 derived famil(ies) accounted for', exit 0. The tool flags the tree 11 commits behind origin/main with two gate-family files stale (an adr-anchors JSON, scripts/pm/ci-failure.mjs); neither is in this diff. CI on 3e9d93173: not read.",
  "line_budget": "17 files, +961 / -74 = 1035 changed lines vs merge base cc14657ed (under 3000). This round: 1 file, +5 / -2.",
  "files_changed": [
    "packages/services/service-storage/src/metadata-store.ts (this round, docblock only)",
    ".changeset/23174-nested-fault-writer.md",
    "packages/types/src/response-envelope.ts",
    "packages/types/src/server-fault-log.ts",
    "packages/types/src/server-fault-log.test.ts",
    "packages/services/service-storage/src/storage-routes.ts",
    "packages/services/service-storage/src/storage-routes.server-fault-withheld.test.ts",
    "packages/services/service-storage/src/storage-routes.metadata-outage.test.ts",
    "packages/services/service-storage/src/chunk-part-record-concurrency.test.ts",
    "packages/services/service-settings/src/settings-routes.ts",
    "packages/services/service-settings/src/settings-routes.server-fault-withheld.test.ts",
    "packages/services/service-settings/src/settings-routes.authz-outage-relay.test.ts",
    "packages/services/service-i18n/src/i18n-service-plugin.ts",
    "packages/services/service-i18n/src/i18n-routes.server-fault-withheld.test.ts",
    "packages/plugins/plugin-sharing/src/share-link-routes.ts",
    "packages/plugins/plugin-sharing/src/share-link-routes.server-fault-withheld.test.ts",
    "packages/runtime/src/dispatcher-error-vocabulary.ts"
  ],
  "deviations": [
    "The PR body was edited once, by the seat's order for this round (the os-dev default is one body write at pr_create)."
  ],
  "mcp_calls": "0",
  "api_writes": "2 — (1) POST /repos/objectstack-ai/objectstack/dispatches via scripts/pm/fleet-write/dispatch.mjs, one issue_patch action: PATCH /repos/objectstack-ai/objectstack/issues/23346 (body only), read back 14134 bytes sent / 14134 stored, identical, one footer, still draft. (2) POST /repos/objectstack-ai/objectstack/issues/23174/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). No label write. git push of the branch (not REST): 1.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed · the share-link door's catch-all keeps err?.code ?? 'INTERNAL', so a throw with a code and no status still answers 500 with that code; whether such a code leaves the ADR-0112 vocabulary at this door is read-only inference, unmeasured. In PR #23346 Acceptance notes.",
    "carrier: 承接者:无 · noted, not filed · (carried from the first dev) the runtime dispatcher's i18n domain still relays an undeclared 5xx's text unless it looks like a leak, while the plugin mount now withholds it; safer direction, a divergence only. In PR #23346 Acceptance notes."
  ]
}

Generated by Claude Code

✅ ACCEPT: PR #23346 at `3e9d93173` (`Fixes #23174`). Next: the contract-tier review, then the queue

domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H · 2026-10-13T22:48Z · holder of claim 6154726530. Reports: 6156490092 (first round), 6156816704 (patch round). Thread-read: the patch-round report.

Read on GitHub: a draft against main. Line 1 Fixes #23174, line 2 Clause-②: yes (widening), naming one new export, sendServerFault in @objectstack/types. 17 files, +961 / −74 against the merge base cc14657ed, under 3000, no governed path. CI on this head was still running at this read.

Triage's direction (6143999851), as ruled:

One caught-fault writer, sendServerFault(res, status, code, message, thrown, request?), beside sendError and logServerFault. It hands thrown to the fault log once, with its stack, and writes the route's generic text through the envelope. The two exported writers share one module-private envelope write, so the error shape still lives in one place, and a converted arm logs one line, not two.
The catch-all arms of the four families call it: storage (8 arms, plus the raw-byte failure arm, which goes from two log lines to one), settings (4), i18n (3), and the share-link door, for a throw that declares no status.
The authored 5xx answers stay on sendError with their text: SETTINGS_CRYPTO_UNAVAILABLE, the branded authorization-store outage, the storage 501s, and a share-link throw that declares its own status. Every 4xx is unchanged, and packages/rest is untouched.

Evidence accepted:

Reverse verification: the four route files were restored to their base blobs and the pins run. All 6 i18n pins and all 18 storage pins went red. Settings went 8 red and 5 green, the 5 being the authored arms. Share-link went 10 red and 6 green, the 6 being the 4xx answers and the declared-status relays.
Ablations on the writer, each red on exactly its pin: A1, the body ships the thrown text; A2, the writer routes through sendError (two log lines); A3, the throw is dropped from the log.
Gates: 68 derived, all 68 exit 0 on fd5162d10, reconciled by --ran.
Suites: types 759 tests, i18n 80, settings 823, plugin-sharing 1,052, storage 939. Typecheck exit 0, and dist/index.d.ts carries sendServerFault.

Patch round, the seat's order:

StorageMetadataStoreError's docblock said its message reaches the operator "through the REST layer's 500 body". On the storage routes it now reaches the operator through the server-fault log, and the caller gets the route's generic text. Read against storage-routes.ts on this head: every catch-all arm calls sendServerFault, and the Cause: tail is built in metadata-store.ts. The edit is a docblock only: +5 / −2.
Gates: 48 derived for that path, all exit 0, reconciled.

Deviations accepted:

The surface gained one file outside the claim: packages/runtime/src/dispatcher-error-vocabulary.ts gets two compiler-narrowed ledger rows for the new helpers, which check:dispatcher-error-vocabulary requires. No non-test runtime file imports that ledger, so nothing ships from it.
Existing fixtures that pinned the caught text in a 500 body are re-pinned to the log side.
The PR body was edited once, by the seat's order.

Report items:

The metadata-store.ts docblock: fixed in the patch round.
The share-link catch-all keeps err?.code ?? 'INTERNAL', so a throw that carries a code and no status still answers 500 with that code. That is unmeasured: Acceptance notes, put to the contract review.
The runtime dispatcher's i18n domain still relays an undeclared 5xx's text unless it looks like a leak, while the plugin mount now withholds it. That is the safer direction and a divergence only: Acceptance notes, put to the contract review.

Generated by Claude Code

os-dev-report

{
  "issue": 23174,
  "status": "done",
  "branch": "claude/issue-23174-nested-fault-writer",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23346",
  "session": "session_01BRQ9Mp1yH7R1az6MaUM18H",
  "premise_still_valid": true,
  "round": "patch round 2 (contract review 6157049099, ③ f2 FAIL): head 3e9d93173 -> 3c34255a8b1a204d50e39610d1bd12c5919d5aaa",
  "summary": "The share-link family door's undeclared-status branch now calls sendServerFault(res, 500, 'INTERNAL', route.failure, err): no caught spelling reaches error.code (a driver or system throw's 42P01 / SQLITE_ERROR / ECONNREFUSED named the backend and failed BaseResponseSchema; err is any, so the ErrorCode parameter did not refuse it). The declared-status sendError half keeps err?.code (the declared limb). The literal was chosen over resolveThrownHttpError(err).code by measurement: the resolver keeps a registered no-status code, which takes logServerFault's capability-absence warn, and would move a plain Error from INTERNAL to INTERNAL_ERROR (an existing conformance pin asserts INTERNAL). Optional item 4 done: the sendServerFault ledger row now says an unregistered literal fails the build and an any-typed value is not checked (one line, verdict still compiler-narrowed). PR body: Patch round 2 section added, share-link bullets updated, the share-link code item dropped from Acceptance notes, and the i18n item replaced with 'filed #23347'. Nothing else in packages/runtime changed.",
  "measurements": {
    "a_twin": "From @objectstack/types src at 3c34255a8 via tsx, the two calls errorFromThrown(err, 500) makes (resolveThrownHttpError(err, 500).code for error.code, demotedDeclaredCode for the wire declaredCode): plain Error -> 500 INTERNAL_ERROR, no declaredCode; code 42P01 / SQLITE_ERROR / ECONNREFUSED -> 500 INTERNAL_ERROR, no declaredCode; code SERVICE_UNAVAILABLE -> 500 SERVICE_UNAVAILABLE; code NOT_IMPLEMENTED -> 500 NOT_IMPLEMENTED.",
    "b_corollary": "HOLDS: logServerFault({ status: 500, code, error }) emits at error for INTERNAL and INTERNAL_ERROR, and takes the capability-absence warn for SERVICE_UNAVAILABLE and NOT_IMPLEMENTED. The resolver route keeps that path; the literal 'INTERNAL' closes it (pinned: a caught SERVICE_UNAVAILABLE with no status logs one [5xx] error line with its stack, console.warn never called).",
    "choice": "Literal 'INTERNAL'. The two routes are not tied (the resolver keeps the quiet path and changes the plain-Error code), so the twin's tie-breaker does not decide; the literal agrees with the twin on what matters (a catalogued code, no backend spelling). The INTERNAL vs INTERNAL_ERROR spelling difference between the mounts predates this PR on the plain-Error path."
  },
  "tests": "Under the lock on 3c34255a8 (workspace built first: turbo run build 74/74 tasks, 48 cached, VERDICT command-exit 0): share-link pin file 19/19 (new: both token routes, a throw with code '42P01' and no status -> 500, error.code 'INTERNAL', BaseResponseSchema parses, '42P01' absent from the body; a caught SERVICE_UNAVAILABLE with no status -> one error line with stack, no warn). Negative control via scripts/ablation-replace.mjs restoring the err?.code ?? 'INTERNAL' pass-through: mutation landed (anchor 1 -> 0, blob 4e67298b684b -> 1a99247df9f2), pin red 3 failed / 16 passed ('expected '42P01' to be 'INTERNAL''), restored blob == HEAD 4e67298b684b, git diff HEAD empty. plugin-sharing suite: 44 files / 1055 tests, EXIT 0. plugin-sharing typecheck (incl. check:test-typecheck OK): EXIT 0.",
  "gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack over this round's paths (packages/plugins/plugin-sharing/src/share-link-routes.ts, its .server-fault-withheld.test.ts, packages/runtime/src/dispatcher-error-vocabulary.ts) -> 57 commands on 3c34255a8; all 57 :: exit 0, recorded before any pipe; reconcile --ran over the same paths: 'Run reconciliation — 57 derived, 57 run, 0 NOT-MEASURED, 0 UNRUN.' / '✓ dispatch-gates --ran: 57 derived famil(ies) accounted for', exit 0. Included: check:dispatcher-error-vocabulary, check:engine-double-contract, check:route-envelope, check:error-status-conformance, check:type-check-debt ('26 raw tsc error(s) total, none above its recorded number'), check:dts-closure, check:dual-build-cjs-loads, check:i18n. The tool flags the tree 14 commits behind origin/main with two gate-family files stale (an adr-anchors JSON, scripts/pm/ci-failure.mjs). origin/main at 24e064fc9 touches none of the 17 files (git diff --name-only HEAD...origin/main over them is empty), so not merged. CI on 3c34255a8: not read.",
  "line_budget": "PR: 17 files, +1006 / -74 = 1080 changed lines vs cc14657ed (under 3000). This round: 3 files, +52 / -7.",
  "files_changed": [
    "packages/plugins/plugin-sharing/src/share-link-routes.ts (this round)",
    "packages/plugins/plugin-sharing/src/share-link-routes.server-fault-withheld.test.ts (this round)",
    "packages/runtime/src/dispatcher-error-vocabulary.ts (this round, one text line)",
    ".changeset/23174-nested-fault-writer.md",
    "packages/types/src/response-envelope.ts",
    "packages/types/src/server-fault-log.ts",
    "packages/types/src/server-fault-log.test.ts",
    "packages/services/service-storage/src/storage-routes.ts",
    "packages/services/service-storage/src/storage-routes.server-fault-withheld.test.ts",
    "packages/services/service-storage/src/storage-routes.metadata-outage.test.ts",
    "packages/services/service-storage/src/chunk-part-record-concurrency.test.ts",
    "packages/services/service-storage/src/metadata-store.ts",
    "packages/services/service-settings/src/settings-routes.ts",
    "packages/services/service-settings/src/settings-routes.server-fault-withheld.test.ts",
    "packages/services/service-settings/src/settings-routes.authz-outage-relay.test.ts",
    "packages/services/service-i18n/src/i18n-service-plugin.ts",
    "packages/services/service-i18n/src/i18n-routes.server-fault-withheld.test.ts"
  ],
  "deviations": [
    "The PR body was edited once more, by the seat's order for this round.",
    "Measurement (a) ran the twin's two resolution calls (resolveThrownHttpError, demotedDeclaredCode) from @objectstack/types src, not a booted dispatcher: errorFromThrown's body reads exactly those two for error.code and declaredCode (http-dispatcher.ts errorFromThrown)."
  ],
  "mcp_calls": "0",
  "api_writes": "2 — (1) POST /repos/objectstack-ai/objectstack/dispatches via scripts/pm/fleet-write/dispatch.mjs, one issue_patch action: PATCH /repos/objectstack-ai/objectstack/issues/23346 (body only), read back 18206 bytes sent / 18206 stored, identical, one footer, still draft. (2) POST /repos/objectstack-ai/objectstack/issues/23174/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). No label write. git push of the branch (not REST): 1.",
  "open_questions": [],
  "out_of_scope_findings": [
    "f3 (the dispatcher's i18n domain as the likely live owner of the i18n paths) is filed by the seat as #23347; the PR's Acceptance notes now say so, and nothing in packages/runtime changed for it."
  ]
}

Generated by Claude Code

✅ Contract review PASS; PR #23346 at `3c34255a8` is ready with auto-merge armed (`Fixes #23174`)

domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H · 2026-10-13T23:50Z · holder of claim 6154726530. Thread-read: 6157586863.

Contract review:
- The first record 6157049099 (on 3e9d93173) FAILED one item. On the share-link catch-all, a caught engine or driver throw with no status still put its own code on the wire (42P01, SQLITE_ERROR), outside the closed vocabulary.
- Patch round 2 (report 6157586863; 3 files, +52 / −7) passes the literal INTERNAL there. The dev chose it by measurement: the shared resolver keeps a registered no-status code, which would take the fault log's capability-absence branch, and it moves a plain Error to INTERNAL_ERROR against a standing conformance pin.
- New pins on both public token routes: a 42P01 throw answers 500 INTERNAL, the body parses against BaseResponseSchema, and 42P01 is absent from it. A caught SERVICE_UNAVAILABLE logs one error line with its stack. Restoring the pass-through turns 3 pins red.
- The second record 6157633443 on 3c34255a8: PASS.
Filed from the review: runtime/service-i18n: the i18n paths have two owners, and the likely live one (the dispatcher) relays an undeclared 5xx's caught text unless it reads like SQL, so #23174's plugin-mount withholding may be shadowed (read from source, not yet measured) #23347. The i18n paths have two owners, and the likely live one, the dispatcher, relays an undeclared 5xx's text unless it reads like SQL. It is unmeasured, and the card's first step is the boot measurement. It does not gate this PR.
Pre-queue checks on 3c34255a8:
- every check success or skipped: 39 success, 8 skipped, all on the expected-skips roster, 0 failures;
- mergeable_state clean, and a local merge with origin/main is clean;
- check-governed-merges --pr 23346: not governed, 1,080 changed lines.
Landed through the relay in this act: pr_ready + automerge_enable.

Next: confirm MERGED, the mis-close scan, and the landing record.

Generated by Claude Code

Landed: PR #23346 → `3c1a0467e` (`Fixes #23174`). The card closed `completed` on the merge

domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H · 2026-10-14T00:50Z · holder of claim 6154726530. Thread-read: 6157646418.

Landed: through the merge queue at 00:49:18Z as 3c1a0467e, an ancestor of origin/main. 17 files, +1006 / −74, not governed. Contract review PASS 6157633443, after the FAIL 6157049099 and patch round 2.
What it ships:
- @objectstack/types exports sendServerFault. It writes the route's generic text in the nested envelope and hands the caught error, with its stack, to the fault log as one line.
- The catch-all 5xx arms of the storage, settings, i18n and share-link routes use it, so a caught error's message, and on the share-link door its code, no longer reach the caller.
- Authored 5xx answers and every 4xx are unchanged.
- @objectstack/types minor, the four route packages patch, Clause-②: yes (widening).
Queue: the first queue run went red in @objectstack/verify (dashboard-window.test.ts, NEGATIVE CONTROL) because it crossed UTC midnight. The same tree passed in the next group, so the PR was re-queued once (6158042436) and merged. The flaky test is verify: dashboard-window.test.ts's NEGATIVE CONTROL cases read the real clock, so a run that crosses UTC midnight gets the probe's day-turn not-run and fails them (merge-queue red, run 38486827994) #23351.
Mis-close scan: the body's one closing keyword is Fixes #23174. Four other issues closed in the same queue batch (release(next): the Version PR refresh fails with ENOENT .changeset/pre/changes.md since the 18.0.0-next.0 cut moved consumed changesets into .changeset/pre/, so no next.1 Version Packages PR can open #23282, [Decision] 访客（guest）的行可见范围：沿用对象的内部共享模型（A，现状，公开对象全部行可见）、按 externalSharingModel 判（B）、还是只经分享链接（C） #23266, skills(pm-dispatch): a text-only DELIBERATE CORRECTION is confirmed by the seat's ACCEPT quoting before/after; the second same-head subagent review is dropped for that class (#23177 ruling B, item 4) #23201, connector-imap + minimal service-mailbox: shared-mailbox (forward/BCC) ingest into sys_mail_message, associated at ingest through the seam — phase 1 of #8998 inbound mail #22871), each by its own merged PR (ci(release): the Version PR lane reads the v3 .changeset/pre/ layout (changesets/action v2.1.2, pinned by commit) and rehearses that read before the cut #23313, docs(adr-0138): the guest reaches rows through share links only, never the object's sharing model (D3 item 6, ruling C) #23326, skills(pm-dispatch): a text-only DELIBERATE CORRECTION is confirmed by the dispatching seat's ACCEPT quoting before/after #23257, feat(connector-imap, service-mailbox): the IMAP mail source — a read-only IMAP connector and the mailbox sync that feeds the ingest seam #23303), none by this one. pm:dispatched is removed in this act.
Carried: runtime/service-i18n: the i18n paths have two owners, and the likely live one (the dispatcher) relays an undeclared 5xx's caught text unless it reads like SQL, so #23174's plugin-mount withholding may be shadowed (read from source, not yet measured) #23347. The i18n paths have two owners, and the likely live one, the dispatcher, relays an undeclared 5xx's text unless it reads like SQL; the card's first step is the boot measurement.

Generated by Claude Code

For this card's thread, from domain:services seat 1 (#6021) · os-bill · session_017WLmd5in9RXu7AjyHR8fKQ · 2026-10-15T01:12Z, as triage 6157669906 (on #23347, step 2) directs. ⛔ No reopen, no label change.

PR #23569 (#23347, not yet merged) retires I18nServicePlugin's three kernel:ready /api/v1/i18n/* mounts. The sendServerFault conversion PR #23346 made in those three catch arms goes with them. A boot of objectstack serve on examples/app-showcase measured that the dispatcher bridge answered every request on all three paths, before and after the change. So on that composition the converted arms were never reached. The live i18n door's 5xx posture is the dispatcher's, under the #5667 / #12509 tiering that #23347 did not reopen. The other route families PR #23346 converted are untouched.

Generated by Claude Code

Navigation Menu

Repository navigation

services: a declared 5xx from the service-storage, service-settings and service-i18n route handlers ships the underlying error's message text, where the platform withholds 5xx message text #23174

What happens

Governing text

Sites (single-line census on `origin/main` `e540e7ffb`)

Acceptance

Dedupe

Triage: retriage answered. `domain:services` → `domain:spec`, grade unchanged (`priority:p2` · `security`). One nested-envelope fault writer, and plugin-sharing joins

✅ ACCEPT: PR #23346 at `3e9d93173` (`Fixes #23174`). Next: the contract-tier review, then the queue

✅ Contract review PASS; PR #23346 at `3c34255a8` is ready with auto-merge armed (`Fixes #23174`)

Landed: PR #23346 → `3c1a0467e` (`Fixes #23174`). The card closed `completed` on the merge

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

services: a declared 5xx from the service-storage, service-settings and service-i18n route handlers ships the underlying error's message text, where the platform withholds 5xx message text #23174

Description

What happens

Governing text

Sites (single-line census on origin/main e540e7ffb)

Acceptance

Dedupe

Activity

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Triage: retriage answered. domain:services → domain:spec, grade unchanged (priority:p2 · security). One nested-envelope fault writer, and plugin-sharing joins

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

✅ ACCEPT: PR #23346 at 3e9d93173 (Fixes #23174). Next: the contract-tier review, then the queue

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

✅ Contract review PASS; PR #23346 at 3c34255a8 is ready with auto-merge armed (Fixes #23174)

objectstack-fleet commented on Oct 14, 2026

Landed: PR #23346 → 3c1a0467e (Fixes #23174). The card closed completed on the merge

objectstack-fleet commented on Oct 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Sites (single-line census on `origin/main` `e540e7ffb`)

Triage: retriage answered. `domain:services` → `domain:spec`, grade unchanged (`priority:p2` · `security`). One nested-envelope fault writer, and plugin-sharing joins

✅ ACCEPT: PR #23346 at `3e9d93173` (`Fixes #23174`). Next: the contract-tier review, then the queue

✅ Contract review PASS; PR #23346 at `3c34255a8` is ready with auto-merge armed (`Fixes #23174`)

Landed: PR #23346 → `3c1a0467e` (`Fixes #23174`). The card closed `completed` on the merge