Repository navigation
[Decision] Is ADR-0112's declaredCode channel in scope for 5xx sanitisation at all — and the answer must be applied to all three doors at once #12509
Description
Filed by the domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd, as option C of the fork the #12405 dev raised on PR #12508 and correctly reported rather than decided. That card shipped A under this seat's ruling; this is the follow-up A was ruled without prejudice to.
The question
When a 5xx has its prose withheld, should the producer's demoted declaredCode be withheld with it?
Today the answer is "no" at every door, and at none of them is that a decision anyone made — it is what each door's structure produces.
Measured (on origin/main, by the #12405 dev)
A bare driver error (code: 'SQLITE_ERROR' or '42P01', no declared status) resolves to status 500 / code INTERNAL_ERROR with demotedDeclaredCode = the driver's own string. The door then withholds the leaky message (#8086) and puts SQLITE_ERROR on the wire in declaredCode.
/data door does not produce that combination — but for a structural reason, not a decision. Its thrownCodeFields is reached only on the declared-5xx passthrough arm, while a bare driver error falls to DATA_STORE_FAULT's fixed body. resolveThrownHttpError's fallback-to-500 is what creates the shape, and it creates it at the nested door only.
⇒ Three doors, one of which can emit a driver dialect on the wire in a channel the other two cannot reach — and the difference is an accident of control flow.
Why it is a decision card and not a fix
The disclosure is real but narrow: SQLITE_ERROR vs 42P01 names the backend, which is one of the two things the message withhold exists to protect (the other, identifiers, is already covered). Against that:
- ⛔ Withholding at one door invents a third rule and re-creates the divergence rest:
package-routes'sendThrownErrorresolves aThrownHttpErrorand then drops itsdeclaredCode— the one unfenced nested-envelope call site that already holds a producer spelling #12405 just closed. - ⛔ Withholding at all doors silently drops the author-authored channel for exactly the metadata-app 5xx refusals ADR-0112's amendment wrote it for.
That is a scope question about the ADR's channel, not a bug in any one registrar.
⭐ Sequencing note — this is the CODE axis of a question already open on the PROSE axis
#12281 asks whether errorResponseBase should adopt /data's "withhold every declared 5xx" rule for the message. This card asks the same shape of question one channel over, for declaredCode. Both are cross-door 5xx-sanitisation scope questions; both carry needs:contract-review; and an answer to either that ignores the other is how the doors end up disagreeing on a new axis. They should be read together, and probably ruled together.
Not established here
- Whether a driver errno can reach a producing seam at all. ⭐ At rest:
package-routes'sendThrownErrorresolves aThrownHttpErrorand then drops itsdeclaredCode— the one unfenced nested-envelope call site that already holds a producer spelling #12405's four seams it cannot:PackageServicediscriminates on the status channel, never.code, precisely so driver faults are not re-thrown as refusals. That measurement is what makes today'snosafe rather than merely consistent —⚠️ and it is a premise that can rot. The other doors' seams are unmeasured. - Severity not judged.
Region
packages/rest/src/package-routes.ts (sendThrownError) · packages/rest/src/error-response.ts (thrownCodeFields, the declared-5xx arm) · packages/runtime/src/http-dispatcher.ts (errorFromThrown) — and packages/types/src/thrown-http-error.ts, which owns the fallback-to-500 that creates the shape.
packages/rest/src/rest-server.ts is held by open PR #12421 (#11926).
Refs
- rest:
package-routes'sendThrownErrorresolves aThrownHttpErrorand then drops itsdeclaredCode— the one unfenced nested-envelope call site that already holds a producer spelling #12405 / PR fix(rest): the package door carries the demoted producer code ondeclaredCode(#12405) #12508 — where the fork was raised, and where option A is pinned as a live case - runtime: a declared 5xx carrying NO
codekeeps its prose on/analytics/querywhere/datawithholds it unconditionally #12281 — the prose axis of the same cross-door question - The direct-mount package door ships 5xx messages verbatim — no leak heuristic, unlike the dispatcher twin and unlike rest-server's own /data exit #8086 ·
/analytics/query仍把 RLS 策略字段名回显给调用方 —— read-scope 拒收的泄漏在姐妹面上没堵,#5367 只堵了 dataset 路由 #5811 — the message withhold and why it was made structural - ADR-0112 · [Decision] The dispatcher's
error.codehas a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 · finding:packages/rest's flatsendThrownErrorstill puts a thrown error'scodeon the wire un-narrowed — ADR-0112's closure does not reach that door #9232 — the channel and the two doors that already emit it
Activity
os-support-ai commentedon Aug 26, 2026
Triage (triage seat, hourly round 2026-08-26, session
session_01DoScS7Ei3iWc39AgGN36wU): re-gradedpm:queue→needs-user-decision, type Task;domain:cliandneeds:contract-reviewkept. The card is a [Decision] by its own text — an ADR-0112 scope question ("isdeclaredCodein scope for 5xx sanitisation, answered at all three doors at once"), which sits on the manual floor (public-contract change class);pm:queuesays "dispatchable, no open question", which contradicts the card's own body. No dispatch may pick it up while this label stands. Pairing note for the maintainer: #12281 is the prose axis of the same cross-door question and the two should be read/ruled together (this card's own ⭐ sequencing note); #12281 stays in the cli lane's queue because its first step is a measurement, but the ruling here should be written so it covers both channels.os-decision-facets
SQLITE_ERROR/42P01这类驱动方言放上 wire,等于向调用方点名后端(message withhold 要保护的两件事之一);同时该通道的正当用途(metadata-app 作者自声明的 5xx 拒绝码)是 ADR-0112 修正案专门写进去的,全量吞掉会伤到真实用户场景。package-routes'sendThrownErrorresolves aThrownHttpErrorand then drops itsdeclaredCode— the one unfenced nested-envelope call site that already holds a producer spelling #12405 的四个 seam 测过,另两门未测);把裁决落成结构性判据 + pin,出错方向从「静默泄露」变为「响亮拒绝」。declaredCode保留;在共享 resolver 一处实现,三门继承;与 runtime: a declared 5xx carrying NOcodekeeps its prose on/analytics/querywhere/datawithholds it unconditionally #12281 的 prose 轴同一次裁决落地。codekeeps its prose on/analytics/querywhere/datawithholds it unconditionally #12281 的人口测量(无 code 的 declared 5xx 生产者是否存在)未做 —— D 若裁定,实施卡应先补这三个读数。Generated by Claude Code
os-zhuang commentedon Aug 27, 2026
Maintainer ruling recorded — Option D: split by provenance; one rule at the shared resolver, three doors inherit — and the ruling covers #12281's prose axis
Provenance: maintainer, 2026-08-27, PM chat decision-inbox batch 3 (adjudication session
session_01DKWDdUJ2XNRESVVWUvcpnh), verbatim: 「同意」 — accepting the triage recommendation D (2026-08-26T07:17Z facet block). ⛔ A (record the leak as a decision), B (withhold the author channel too), and C (a per-door rule) are all declined for the reasons on the card.Ruled, as ADR-0112 scope: in 5xx sanitisation, a DEMOTED code — one the fallback-to-500 picked up from an undeclared producer (
demotedDeclaredCode, e.g. a driver errno such asSQLITE_ERROR/42P01) — is withheld along with the prose; an AUTHOR-DECLAREDdeclaredCodesurvives. Implemented once at the shared resolver layer so all three doors inherit one rule; ⛔ no per-registrar variants.Same ruling, prose axis (#12281): the dispatcher door's
errorResponseBaseadopts the structural withhold for EVERY declared 5xx message, aligning to/data— the author's user-facing text channel isuserMessage(#9934), never the raw message. #12281 stays in the cli lane's queue with its measurement-first step; its ruling is this one.Dispatch constraints: Clause-②: yes (⚠️
needs:contract-reviewon the card) — contract-review tier. The implementing dispatch's FIRST readings are the three named gaps: (a) driver-errno reachability at the other two doors' seams; (b) whether any consumer depends on demoted strings currently on the wire; (c) #12281's population measurement (declared-5xx-no-code producers).packages/rest/src/rest-server.tsis held by open PR #12421 — serial constraint at dispatch.State:
needs-user-decision→pm:queue.Generated by Claude Code
os-litant commentedon Aug 28, 2026
🔒 Claimed —
domain:cli席位 (#6024), R47。Clause-②: yesSession
session_01UjujZN219uFzBhSYfMykCd,identityos-litant。Branchclaude/issue-12509-demoted-code-withhold。⭐ Clause-② 声明 = yes,按总监席 2026-08-28 执行的 #12887 裁定:该标签只在存在可评审契约增量时挂,⇒ PR 一开,
needs:contract-review自动重挂,由合约评审层处理。⛔ 本席位不清除、也不预挂。围栏实测 @⚠️ 卡上 2026-08-27 那条「被 PR #12421 持有」的提示已过期 —— ⛔ 别照抄它,自己在第一次编辑前重推一遍(并记下你推的时刻)。
08:09:29Z,origin/main=aef1b7e64(16 个开放 PR / 560 文件并集):packages/rest/src/rest-server.ts与packages/rest/src/error-response.ts均自由。Ruling 1 · 维护者已裁 Option D,⛔ 你不做取舍
裁定(2026-08-27,adjudication
session_01DKWDdUJ2XNRESVVWUvcpnh,「同意」):Ruling 2 · ⭐ 同一条裁定也覆盖 #12281,而它不是本卡的一部分
裁定原话:#12281 的散文轴由这一条裁定管 —— dispatcher 门对每一个已声明 5xx 消息采用结构性扣留,向
/data对齐;作者面向用户的通道是那个专用字段,⛔ 从来不是原始 message。Ruling 3 · ⛔ 三个读数是裁定点名的第一步,不是可选的背景调查
裁定写明实施派发的首要读数就是这三个缺口:
codekeeps its prose on/analytics/querywhere/datawithholds it unconditionally #12281 的人口测量(无 code 的已声明 5xx 生产者是否存在)。⇒ ⭐ 先给这三个读数,再动代码。 ⛔ 若第 2 项测出有消费方,停下并报告 —— 那会改变裁定的适用范围。
Ruling 4 · 判据:一处规则,三门继承 —— 可证伪
⛔ 判据:改完之后,「降级 vs 作者声明」这个区分在全仓只有一处实现,三个门都从它继承。⭐ 带阳性对照,且对照不能是被测词的子串。
git grep只读被跟踪的文件 —— 若你新建了共享模块还没git add,扫描会返回干净的零,而那是死扫描不是「只有一份」。⭐ 上一位 dev 正是靠对照也为零才发现的。⇒ 用工作树扫描(含未跟踪),或先 add。Ruling 5 · 反空转
git checkout HEAD --接绝对路径(⛔ 绝不裸--),trap在EXIT INT TERM,以 blob 哈希与空git diff HEAD证明,⛔ 绝不用退出码。Ruling 6 · Standing
content/docs/releases/**。⛔ Worktree 优先。⛔ 绝不git stash(栈在本仓所有 worktree 间共享)。FETCH_HEAD也是共享状态 —— 读 PR 一律git fetch origin pull/N/head:refs/pm/prN --force用具名 ref(本席位实测被自己的后台 fetch 覆盖过,据此读错过一次)。packages/client/src/index.ts(PR #12885);packages/runtime/src/app-plugin.ts(PR #12878);任何package.json/CHANGELOG.md(PR #11336)。OS_VERIFY_LOCK_SLOT=issue-12509 bash scripts/pm/os-verify-lock.sh -c "…"。⛔ exit 99 / 143 都表示什么都没跑;⛔ 退出码在任何管道之前取。check-half-states.mjsexit 3 = NOT MEASURED,⛔ 不是红。Generated by Claude Code
fix(types): withhold a demoted `declaredCode` on an undeclared 5xx (A…
os-litant commentedon Aug 28, 2026
os-dev-report
{ "issue": 12509, "status": "done", "branch": "claude/issue-12509-demoted-code-withhold", "pr": "https://github.com/objectstack-ai/objectstack/pull/12946", "premise_still_valid": true, "summary": "Option D implemented exactly once, in `serverFaultProvenance` (packages/types/src/thrown-http-error.ts), applied inside `demotedDeclaredCode` — the read every door already makes — so NO door file changes and every emitting exit inherits the rule. A demoted code is withheld when the answer is 5xx and the producer declared no status; an author-declared code survives at every status. Three corrections to the card, all measured: (1) the emitting exits are FIVE, not three — the card's three plus `endpoint-executor.endpointErrorAnswer` and `dispatcher-plugin.errorResponseBase`, both of which were putting `SQLITE_ERROR` on the 500 wire; (2) the card's stale fence note is confirmed stale — I re-derived the fence at 2026-08-28T08:23:01Z over 16 open PRs / 562 files and `packages/rest/src/rest-server.ts` is FREE (PR #12421 is closed), and every file I touched was free; (3) the safety premise the card flagged as unmeasured does NOT hold at the dispatcher door — see reading (a). One judgement the ruling's text leaves to the implementation, flagged in open_questions: the discriminator has to be the STATUS channel, and that also withholds an app-authored code thrown with no status. #12281's prose axis is deliberately NOT applied; what it still needs is enumerated in the PR body and pinned as a live expectation in the runtime suite.", "tests": "All measured on the final commit 824007d8f; heavy runs via `OS_VERIFY_LOCK_SLOT=issue-12509 bash scripts/pm/os-verify-lock.sh -c ...`, verdicts read from the wrapper's own VERDICT line, never a bare `$?` after a pipe. REPRODUCED FIRST on origin/main aef1b7e64 by driving real routes (not by reading source): package door `POST /api/v1/packages/publish` -> `500 {\"error\":{\"code\":\"INTERNAL_ERROR\",\"message\":\"Internal server error\",\"declaredCode\":\"SQLITE_ERROR\"}}` and the same with `42P01`; dispatcher-plugin's REAL route `POST /api/v1/analytics/query` -> the same shape; `HttpDispatcher.errorFromThrown` and `endpointErrorAnswer` likewise; author-declared `{status:503, code:'ACME_LEDGER_OFFLINE'}` -> `503 ... declaredCode ACME_LEDGER_OFFLINE` at all of them. AFTER the one edit, same harness: every undeclared-5xx `declaredCode` gone, every author-declared one unchanged. READING (a) driver-errno reachability, real ObjectQL + a driver failing every access with a CODED fault: packages door via real `ObjectStackProtocolImplementation` -> `503 SERVICE_UNAVAILABLE`, no declaredCode (premise HOLDS there even with the errno present); flat `/data` door via the real CRUD routes -> `500 DATABASE_ERROR` / `500 INTERNAL_ERROR` fixed bodies, errno never on the wire (the card's structural claim CONFIRMED by measurement, not inherited); dispatcher door -> errno ON the wire, no producer discriminates in front of `errorResponseBase` ⇒ PREMISE DOES NOT HOLD THERE. READING (b) consumers: nothing in this repo READS `declaredCode` outside the emitting doors, their tests, the spec schema and the generated API reference; nothing branches on a driver-errno literal; `packages/client` has no read of the field ⇒ no consumer dependency, nothing to escalate. Boundary: sibling repos (objectui / hotcrm / cloud) are not in this checkout and were NOT measured. READING (c) #12281 population: NON-EMPTY — 7 declared-5xx-no-code producers, all in packages/runtime/src/action-execution.ts (6x `{statusCode:503, message:'Data service not available'}` + 1x `{statusCode:501, ...}`); every other 5xx-declaring producer found carries a code. My change affects none of them. SUITES: `pnpm --filter @objectstack/types test` 396/396; `@objectstack/rest` 2569/2569 (155 files); `@objectstack/runtime` 2935/2935 (198 files). New pins: 19 + 22 + 45 cases. FIXTURE TRIAGE: 5 pre-existing failures in packages/rest/src/package-door-declared-code.test.ts, all the row that pinned the branch I narrowed — replaced with a declared-500 row (the author limb) plus a comment naming why, and the file's recorded ablation numbers annotated as pre-#12509. TYPECHECK: types + rest + runtime clean, and coverage MEASURED not assumed — `--listFiles` shows the types test IS in its tsc program and the rest test IS in packages/rest/tsconfig.test.json, while @objectstack/runtime excludes `**/*.test.ts` with no sibling test program, so the runtime test is NOT compiled by that script (a standing, already-ledgered gap for that whole package's test layer). GATES: `pnpm lint` WHOLE REPO exit 0, zero findings (`eslint . --no-inline-config`, 92s) — a full scan, not a declared narrowing. `pnpm check:type-check-debt` went RED on this branch first (an unused `vi` import took @objectstack/runtime TEST_DEBT 217 -> 218); fixed by deleting the import, NOT by raising the ledger; now `OK — 31 ledger entries re-measured, none above its recorded number`. Green: check:type-check-coverage, check:engine-double-contract, check:where-matcher, check:cross-package-test-inputs, check:test-source-alias, check:type-source-resolution, check:published-files, check:doc-authoring, check:empty-changeset, check:adr-0087-registration, check:page-declaration-shape, check:slot-lookup, check:query-options-erasure, check:nul-bytes, check-changeset-no-major, check-comment-mask-adoption, check-adr-links, check-plugin-teardown-shape. NOT MEASURED (named, not hidden): nothing — the one prerequisite-blocked gate (check:type-check-debt) was unblocked by building the closure and then run; the full turbo build did hit the container's ~10-minute foreground cap once (exit 143, 56/58 tasks) and was completed by building the 8 remaining packages directly. FALSIFIABLE CRITERION: scan of the WORKING TREE INCLUDING UNTRACKED FILES (`grep -r`, never `git grep`) — term under test `serverFaultProvenance` has ONE executable definition (thrown-http-error.ts:324) and ONE non-test call site (:353, same file, inside demotedDeclaredCode); its other appearances are the test, the ADR anchor, the ADR and the changeset. POSITIVE CONTROL `demotedDeclaredCode` (not a substring of the term under test in either direction): 17 .ts files, and the scan listed the then-untracked new test files ⇒ the dead-scan trap is falsified in both directions. ABLATION (deleting the guard line): PREDICTED BEFORE RUNNING types 7 red / rest 4 red / runtime 10 red, with §1's provenance table and both doors' `wire == shared rule` comparisons staying GREEN (the ablation removes the application, not the judgement, and comparison blocks move with the rule). MEASURED 7 / 4 / 10, failure list matching row for row. Mutation proven on disk before any verdict was read: anchor count 1 -> 0, injected marker 1, worktree blob ded6de18 -> ee521eb7; then rebuilt and `ablation-dist-preflight @objectstack/types ... --absent` proved the compiled guard GONE from packages/types/dist — load-bearing because @objectstack/rest does NOT alias @objectstack/types to source and consumes that artifact (@objectstack/runtime does alias). RESTORE LEG given equal treatment: `git checkout HEAD --` with the absolute path from an `EXIT INT TERM` trap, proven by an empty `git diff HEAD` AND the worktree blob back to ded6de18 AND the preflight showing the guard present again in dist/index.js and dist/index.mjs.", "open_questions": [ { "question": "The ruling says a DEMOTED code is 'one the fallback-to-500 picked up from an undeclared producer'. Spelled as code, the only structural discriminator is `declaredStatus === undefined`, which ALSO withholds an app-authored code thrown with no status (e.g. `{ code: 'WIDGET_REFUSED_THE_WRITE' }` with no `status`). Implemented that way and pinned as a named cost row; flagging for confirmation, NOT blocking.", "options": [ "A (implemented) — structural: provenance = did the producer declare an HTTP status. Withholds a driver errno AND an app code thrown without a status; an author keeps the channel by declaring the status the refusal means. The tenant limb ADR-0112 protects is untouched (SandboxError answers 400, so the DUPLICATE witness rides a 4xx).", "B — inspect the spelling (an errno-shaped heuristic). Rejected: a heuristic over an OPEN channel is the consumer-side tolerance ADR-0112 forbids, and it is unfalsifiable — nothing stops an app spelling SQLITE_ERROR. Pinned against in the types suite §3: the SAME spelling survives when declared and is withheld when not.", "C — gate the code withhold on `looksLikeInternalErrorLeak` actually firing on the message. Rejected: that predicate reads a DIFFERENT channel, so the errno would leak for exactly the dialects whose prose the heuristic misses, and it cannot be implemented once at the resolver without pulling #12281's axis in." ], "recommendation": "A, because it is the only non-heuristic reading of 'undeclared producer' and it makes a 5xx `declaredCode` MEAN 'the producer declared this fault itself' — a stronger contract than the field carried before. If the maintainer reads 'author-declared' as 'spelled a code at all' rather than 'declared the answer', that is a scope change and is one line in `serverFaultProvenance`." } ], "out_of_scope_findings": [ "NOT FILED — the dedup read is 403 from this seat (container `GET /repos/.../issues` answers 'GitHub access is not enabled for this session'), so per the claim comment's archiving discipline these are reported for the PM to file rather than filed blind. (1) `pnpm check:adr-anchors` is RED on origin/main, unrelated to this branch: packages/spec/src/data/object.zod.ts cites `ADR-0006 D4`, and ADR-0006 declares only D1, D1.1, D1.2, D1.3, D2, D3. Untouched by this PR and reproduces on main. Likely interacts with open PR #12908 (ADR-0006 D1 retirement).", "NOT FILED, same 403 reason — observation, not a defect: packages/cloud-connection/src/cloud-connection-plugin.ts:382 emits `declaredCode` DIRECTLY rather than through `demotedDeclaredCode`, a verbatim relay of an upstream RFC 8628 spelling on a hard-coded 400. It never emits the channel at a 5xx so this ruling's scope is not evaded, but it means 'every declaredCode emission goes through the shared rule' is not literally true today." ] }Generated by Claude Code
Generated by Claude Code
os-litant commentedon Aug 28, 2026
✅ ACCEPT — PR #12946。⭐⭐ 「三门继承」被做成了零个门被编辑
对着树和 diff 核验,不是对着报告。8 个文件,
824007d8f。读数取于10:04:33Z。⭐⭐ 裁定说「一处实现,三门继承」;你交的是没有任何门需要被编辑
我复核了 diff:
rest-server/dispatcher-plugin/endpoint-executor/http-dispatcher—— 一个都不在改动清单里。而三道 runtime 门(dispatcher-plugin.ts:611、endpoint-executor.ts:307、http-dispatcher.ts:840)本来就在调用那个共享读取。⇒ ⭐ 你把规则放进了每道门本来就会做的那次读取里面,所以「继承」不是五个套件同意同一个字面量,而是构造上的。⛔ 这比我裁定里写的形状更强,而强的方式恰好是这个仓反复在讲的:结构性 > 约定性。
判据我自核:
serverFaultProvenance一处可执行定义(thrown-http-error.ts:324)、一处非测试调用点(:353);其余出现都是测试、ADR、ADR 锚点、changeset。对照demotedDeclaredCode17 个文件命中 ⇒ 语料是活的。⭐⭐ 三处对卡的更正,而第三处推翻了卡自己的安全前提
⇒ 第 3 条是裁定点名的三个首要读数之一,而答案是否定的。⛔ 若没人去测,这次修复会被当成「补一个理论对齐」,实际上它关的是一个活着的泄露。
读数 (c) 也非空:7 个「已声明 5xx 但无 code」的 producer,全在同一个文件 —— 我复现了那个 7。⇒ #12281 的人口测量有主体,⛔ 不是空集。
⭐⭐ 消融带了 dist 前置检查,而且两个方向都做了
这是本会话第一次有人把 dist/src 陷阱在两个方向上都关掉:
@objectstack/rest不把 types 别名到源码,它消费构建产物 ⇒ 你证明了被消融的守卫确实从 dist 里消失;⛔ 只做前一半,还原腿就是没证据的;只做后一半,消融腿测的可能是没被改到的产物。⭐ 而
@objectstack/runtime确实别名到源码,你把这个差异也说清了 —— 不是一句「无需重建」。预测先写后跑:types 7 / rest 4 / runtime 10,并预测 §1 的 provenance 表与两门的「wire == 共享规则」比较块保持绿(理由:消融移除的是应用不是判断,比较块随规则一起移动)。⭐ 实测逐行吻合。
⭐ 你按我给的方式避开了第七种假零,并且双向证伪了它
⛔ 不是「我用了 grep -r 所以没事」,是证明了那个扫描确实看见了当时未跟踪的文件。⭐ 对照与被测词互不为子串,你也说明了。
其余核对
check:type-check-debt真红过,你删掉那个多余 import 修的,⛔ 不是抬账本。 一个未使用的 import 把某个包的测试层债务从 217 顶到 218 —— ⭐ 而账本的意义正是「任何新增即红」,抬它等于关掉这个能力。pnpm lint跑满、零发现,⛔ 未声称收窄。typecheck 覆盖是测出来的:runtime 那个包排除测试文件、无兄弟程序 ⇒ 该测试未被编译,⭐ 你说了,并指出那是已入账本的整包缺口。裁定 · 开放问题 —— A(照 ship),而且它在裁定的字面之内,⛔ 不是范围变更
裁定原话是「fallback-to-500 从一个 undeclared producer 捡到的」。⭐ 「未声明的 producer」= 没有声明这个答案的 producer,而状态就是对答案的声明。 ⇒ A 是字面读法,不是扩张。
⛔ B(嗅拼写)在一个开放通道上做启发式 —— 而你不只是拒绝它,你把它钉死了:同一个拼写,声明了就活、没声明就被扣。⭐ 那条 pin 让 A 变成可证伪的,而不是一种偏好。⛔ C 读的是另一个通道,会恰好为那些散文启发式漏掉的方言泄露 errno。
⭐ 而最强的论据是你写的:A 让一个 5xx 上的
declaredCode意味着「这个故障是 producer 自己声明的」—— 这是一个比该字段此前所承载的更强的契约。.code上的一个字符串),而作者的补救是一行 —— 声明这个拒绝所意味的状态。⭐ 且你指出 ADR-0112 要保护的租户限走的是 4xx,未被触及。⇒ ⛔ 我不改它。⚠️ 但这条连同它的 cost row 归入合约评审层的输入:
Clause-②: yes,PR 一开标签自动重挂。⭐ 你把它标为 non-blocking 并附了三选项与拒绝理由,是正确的处理形状。你那两条越界发现
check:adr-anchors在origin/main上就是红的,与本分支无关、可在主干复现,且很可能与另一个开放 PR 交互。⇒ 我按主干红处理,单独归档。第二条(某处直接发出该字段而不经共享规则,且只在 4xx 上)按观察归档 —— ⭐ 它不逃避本裁定的范围,但它让「每一次该字段的发出都经过共享规则」在字面上不成立,值得记下来。
Un-drafted,全绿即挂 SQUASH ——⚠️ latest-per-name,⭐ 看分片不看 rollup,且拉全量。
Generated by Claude Code
os-litant commentedon Aug 28, 2026
📌 更正 —— 你那条主干红发现是对的,⛔ 而我不归档,因为它在你跑的期间已经被修掉了
domain:cli席位 (#6024)。读数取于10:06:28Z,origin/main=8beb3deaf。我在上一条验收里说会按主干红归档它。⛔ 收回那句话,并说清为什么 —— ⭐ 结论不是「你测错了」。
实测
check:adr-anchors在当前 mainOK … 29153 citation(s) across 3643 file(s) resolveaef1b7e64上引用 ADR-0006⇒ 提交
750fff559—— "the namespace tombstone stops citing ADR-0006 D4 — a decision letter no version of that ADR declares"(卡 #12917)—— 在你的 base 之后落地,把那处引用删了。⇒ ⭐ 你的读数正确,而这个环已经闭合。 ⛔ 再归档一张就是重复卡。
一个 dev 的正确读数,因为 main 在它的长跑期间前进而变成陈旧:
⭐ 而这和我今天犯的头号错误是同一个机制(拿一个带时间戳的读数回答现在的问题),只有一个差别:你们看不见跑到一半发生的合并,我能重拉却没重拉。
⇒ ⛔ 我不把这归为 dev 的失误,也不要求你们做不到的事。⭐ 可做的是:报告里给出你取该读数时的 base(你给了
aef1b7e64,这正是我能三分钟内查清此事的原因)。⛔ 一个不带 base 的「main 上是红的」我无法判别真伪。第二条我归档
那个直接发出该字段、不经共享规则的位置(只在 4xx 上,⛔ 不逃避本裁定范围)——⭐ 它让「每一次该字段的发出都经过共享规则」在字面上不成立,而下一个人会照字面读。按观察归档。
Generated by Claude Code
fix(types): withhold a demoted `declaredCode` on an undeclared 5xx — …
fix(runtime): withhold the message of every declared 5xx at the dispa…