[objectstack-fleet]

Fixes #21274

Clause-②: no

What this changes

A driver error that leaves the ObjectQL engine is now cut the way the engine's own log line has long been cut: the bound statement and the caller's values are removed. Its class, codes and the database's own diagnostic are kept. The cut runs once, at the engine boundary, through one helper, redactPropagatedDriverFault, in packages/objectql/src/driver-fault-redaction.ts. Every consumer that logs a propagated error gets it, and the auth library is the one measured.

⛔ No edit to plugin-auth source, its ObjectQL adapter, or its logger wiring. Its only change is one new test file.

Security handling: this PR body, the commits, the changeset and the test names carry classes and positions only. Every pin uses a synthetic sentinel and asserts that it is absent.

Measured driver shapes (H2)

Measured off thrown errors (knex 3.3, better-sqlite3 13, node-postgres 8 on PostgreSQL 16, mysql2 3 on MySQL 8.0.46). The families were unknown column on insert, update and select; unique; not-null; type error; value too long.

Driver	Carries the statement or a caller value (cut)	Carries the class and code (kept)
better-sqlite3 SqliteError	message, stack (knex inlines the bound values)	class, code
node-postgres DatabaseError	message, stack (the statement with placeholders; the value itself for 22P02); detail (unique: key-shaped line; not-null: the failing row); where (a bound value once the server enables log_parameter_max_length_on_error, measured both ways); internalQuery (statement text)	class, name, code, severity, routine, file, line, position, schema, table, column, dataType, constraint, hint
mysql2 (plain Error)	message, stack, sql; sqlMessage (value-bearing for 1062 and 1366)	code, errno, sqlState

Each property has one cut rule, kept in one table in the helper:

• message and stack take the shared statement cut.
• sql and internalQuery become the statement marker.
• sqlMessage takes the existing measured value templates.
• A key-shaped pg detail keeps its identifier half (Key (cols)=( plus the value marker); any other detail and every where become a marker.
• cause is cut recursively, to depth 4, the depth the shared predicates read to.

The Postgres-generic names (detail, where, internalQuery) are cut only on an error carrying pg's severity. The result is a native Error with the input's prototype and every own property, symbol-keyed and non-enumerable ones included, with enumerability kept. The input is never mutated. Nothing to cut returns the same reference, and the cut is idempotent.

One measured fork from the ruling's wording, reported rather than chosen silently

The ruling says the propagated error "carries the same redaction the engine's own log line already applies". The cut is literally the same function: splitDriverDump is shared by both faces, and the log helper's output is byte-identical (its existing 50+ case suite is green). The presentation differs. The log line appends the marker. The propagated message keeps the statement's position and its leading verb: VERB [statement and bound values redacted] - DIAGNOSTIC. The verb names the statement's kind only, with no identifier and no value.

The reason is measured (H4). The propagated message is read by classifiers the log line never feeds. For 9 families on each of 3 dialects (26 raised errors), I compared the REST answer (mapDataError: status, code, field) for the raw message, the appended form and the verb-head form:

Form	Answers moved (of 26)
appended marker (the log line's form)	6: SQLite unique-violation field lost (2; the column reader reads to end of line); pg 22P02 and 22001, MySQL 1366 and 1406 move from 500 DATABASE_ERROR to 500 INTERNAL_ERROR (the leak predicate recognised them only by the statement's leading verb)
verb-head (this PR)	0: every status, code, field and leak verdict is equal

If the maintainer prefers the appended form, the cost is those six answers.

Every engine site where a driver error leaves the engine (H1)

Positions are packages/objectql/src/engine.ts at this PR's head.

Site	Driver calls reached	Verdict
executeWithMiddleware executor, :5164–:5178	find :11768, findOne :12068, count :16991, aggregate :17103 (native and the find fallback), insert :12712 (single, bulkCreate, the autonumber-resync creates), update :13764 (by id and updateMany, prior reads included), delete :16457 (by id and deleteMany, pre-reads included)	redacted now, one site; innermost, so middlewares see the cut error too
execute :17570	driver.execute (raw command, caller params bound)	redacted now (:17618)
ObjectQL.transaction :17668	commit / rollback, and a callback that reached the driver through the handle	redacted now at the rethrow (:17737); a callback error that already crossed a boundary comes back as the same reference
ScopedContext.transaction	the same, scoped face	redacted now (:18632)
resolveSecretField :9027, resolveInternalField :9111	driver.find with record ids bound	redacted now (:9052, :9148)
the three write-door log lines (insert :13689, update :15459, delete :16978)		unchanged: still computed from the raw error, before the boundary
SummaryRecomputeError.failures[].error (recomputeSummaries :10910)	this.update / this.aggregate	already safe by construction: both exit through the seam; pinned
insertMany partial-mode outcomes { ok: false, error }	validation, hooks, secret encryption, autonumber seeding (this.find), reference checks (this.findOne)	already safe by construction: no direct driver call feeds a row error; the reads go through the seam
ScopedContext.beginTransaction :18746 / commitTransaction / rollbackTransaction; ObjectQL.transaction's beginTransaction	BEGIN / COMMIT / ROLLBACK	already safe: those statements bind no caller value
init :9580 (connect), checkDriversHealth :9643, destroy / close	connect, health, disconnect	out of scope: no statement and no caller value
syncSchemas :18030, syncObjectSchema, dropObjectSchema, introspectDatasource :17995	DDL and introspection	out of scope: statements composed from metadata, with no caller-bound value; boot and admin paths
datasource() :18117, getDriverByName, getDriverForObject	hand the raw driver to the caller	out of scope: no engine boundary is crossed

H1–H5

• H1: confirmed. At the base, the three write doors logged a redacted copy and rethrew the raw error, and every other site above rethrew raw.

• H2: confirmed and refined. pg where carries a value only under a server setting (measured both ways). pg's statement text binds by placeholder, so the pg value rides detail, or message for 22P02. The required kept-set (class, codes, identifiers, diagnostic) survives on every measured shape.

• H3: confirmed. DuplicateRecordError.cause carried the raw statement and value out of the engine. It is cut now. field is computed in the engine from the raw error, before the boundary, and REST's envelope arm reads field off the envelope, so it does not move. The readers found are:

  • isUniqueViolationError and uniqueViolationColumn (code, errno, message, pg detail, cause);
  • mapDataError;
  • isMissingTableError (code, errno, message, the targeted-table symbol, cause);
  • sanitizeRowError (import rows);
  • defaultIsTransientError (core bulk-write).

  Each reader's verdict is pinned equal, raw against cut, on every measured shape. sanitizeRowError measured equal on 8 of 10 families; the other 2 are covered under acceptance notes. SummaryRecomputeError's failures are already safe (pinned).

• H4: confirmed. The REST answers do not move. That is pinned per shape (mapDataError status, code and field equal, raw against cut) in the new objectql file. The existing REST pins are listed under Gates.

• H5: confirmed. After the engine fix no carrier shows the sentinel on SQLite, live PostgreSQL or live MySQL. The adapter rethrows the engine's error verbatim, so no plugin-auth source edit was needed.

Pins

• packages/objectql/src/driver-fault-boundary-redaction.test.ts (new):

  • per measured shape: no carrier holds the value; no carrier holds the bound statement (only its kind); class, codes and diagnostic kept; every shared classifier and the REST answer equal raw against cut; idempotent; the input is not mutated;
  • a non-driver error is returned as the same reference;
  • DuplicateRecordError over sqlite, pg and mysql (own fields kept, cause cut);
  • the driver's DATABASE_ERROR read envelope (non-enumerable cause cut, targeted-table symbol kept);
  • 13 engine doors × 3 dialects;
  • the envelope through insert and update;
  • a middleware sees the cut error;
  • SummaryRecomputeError failures;
  • control: the WARN line's meta is byte-identical to writeFailureLogMeta(redactBoundStatement(raw)) on all three doors, and spelled out for three dialects.

• packages/plugins/plugin-auth/src/driver-fault-auth-log-carriers.test.ts (new), on SQLite always and on live PostgreSQL / MySQL when OS_TEST_POSTGRES_URL / OS_TEST_MYSQL_URL are set, each in its own schema or database:

  • a unique index forced on sys_user.name, then two auth-table writes refused by the database: the sign-up user insert, which hits the library's error line plus the error object, and update-user, which hits the router's server-error line plus the error object;
  • no console line carries the sentinel, rendered as console renders it plus the hidden-field inspect, and neither do the engine's or the manager's logs or the HTTP bodies;
  • the envelope's class, code, cause.code and diagnostic survive.

  The live cells mirror the REST and runtime precedent of local env-gated cells, because the driver-sql testkit is test-only and not exported.

• Re-judged, because they pinned the overturned "rethrown raw" contract. Each now asserts what it protected, not identity:

  • driver-fault-redaction.test.ts, 2 pins: the caller's 400 INVALID_FIELD answer and the unique-violation verdicts;
  • engine-insert-duplicate-record.test.ts, 8 assertion sites;
  • engine-update-duplicate-record.test.ts, 9 assertion sites: cause is the driver error as it leaves (same class, code and cut message), and an envelope still nests one deep.

Reverse verification (one-shot, no permanent file)

node scripts/ablation-replace.mjs (WRAP, trap-restored) rebinds the boundary name in engine.ts to an identity function. That turns all eight boundary sites off and leaves the helper intact.

• Mutation leg: the anchor went from 1 to 0 and the blob changed. objectql was rebuilt, and ablation-dist-preflight.mjs @objectstack/objectql MARKER exited 0.
  • objectql pins: 61 red / 220 green. The 47 engine-door pins and the 14 re-judged pins went red. Every helper-level shape pin and all 16 WARN byte-identity controls stayed green.
  • plugin-auth carrier pin (3 dialects): 6 red / 9 green. Per cell, the two carrier pins went red, while non-vacuity, the engine-log control and the HTTP-answer pins stayed green.
• Restore leg: the blob equals HEAD and git diff HEAD is empty. objectql was rebuilt, and --absent exited 0 with a clean tree. objectql 281/281, plugin-auth 15/15.

Verification at fd19d3661b

Package tests. Each exit was captured before any pipe; heavy runs went through scripts/pm/os-verify-lock.sh.

• pnpm --filter @objectstack/objectql exec vitest run --project local --maxWorkers=2: 361 files, 7242 passed.
• pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2: 117 files, 2489 passed, 10 skipped. The 10 are the new file's live cells, which skip without the env.
• The new carrier pin with OS_TEST_POSTGRES_URL (PostgreSQL 16) and OS_TEST_MYSQL_URL (MySQL 8.0.46): 15/15, with zero sentinel occurrences in the run log. These ran against local servers. No CI job provisions those variables for plugin-auth, so in CI the live cells are red-capable but do not run.
• pnpm --filter @objectstack/driver-sql exec vitest run --maxWorkers=2: 214 files passed, 11 skipped; 3578 passed, 202 skipped (live cells). driver-sql has no dependency path to objectql.
• packages/rest/src/rest-duplicate-record-arm.test.ts: 33/33.
• H3 consumers: every test file that reads a driver error's properties through an ObjectQL engine, 33 files in 10 packages, run at c2cf5b1924. Results: core 23, metadata-protocol 64, plugin-audit 47, plugin-security 86, plugin-sharing 157, rest (local) 94/95, rest (repo) 50, runtime 22, service-automation 31, cli (integration) 7.
  • The one red was rest-duplicate-record-arm.test.ts. Its precondition line asserted that the envelope's cause still carried the value into REST, which is the overturned contract. It is re-judged in fd19d3661b (33/33 above). REST's answer assertions in that test did not change.
• Typecheck: the typecheck script of objectql, plugin-auth, driver-sql and rest, test layer included, is green for each.

Gates:

• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 68 families at fd19d3661b. All 68 ran, and --ran with exit codes recorded reports: 68 run, 0 NOT-MEASURED (a derived zero, since every family recorded an exit code).
• On the first pass, two were red and three needed a second look:
  • check:query-options-erasure was red: the new aggregate door erased its options. It now uses satisfies EngineAggregateOptions, and the ratchet holds.
  • check:dual-build-cjs-loads reported PREREQUISITE NOT MET (nothing measured) until every package had a dist/; the re-run is green (105 entry points across 66 packages load).
  • check:type-check-debt was cut by my 300 s per-gate timeout; the re-run with a longer cap is OK.
• The ratchet and test-reading families (16) were re-run at fd19d3661b; all green.
• The first derivation flagged its tree as behind origin/main with one changed input, scripts/pm/fleet-write/dispatch.mjs, which this diff does not touch. The re-derivation at the final head gave the same 68.

File surface

As claimed, plus two additions, reported here:

• packages/objectql/src/duplicate-record-error.ts: doc comment only. Its cause note promised the driver error "WHOLE and unmodified".
• packages/rest/src/rest-duplicate-record-arm.test.ts: one precondition line re-judged (above). REST source is untouched.

The re-judged objectql pins (driver-fault-redaction.test.ts, engine-insert-duplicate-record.test.ts, engine-update-duplicate-record.test.ts) are pins in packages/objectql, as claimed. Changeset: .changeset/21274-driver-fault-boundary-redaction.md (@objectstack/objectql patch, Clause-②: no).

Acceptance notes (not filed)

• defaultIsTransientError (core bulk-write) classifies by message text. After the cut it judges only the database's own words, so a bound value or column name in the statement can no longer steer a retry verdict either way.
• Import row text (sanitizeRowError) is unchanged on 8 of 10 measured families. For pg 22P02 and MySQL 1366 the row text used to repeat the caller's rejected value; it now reads the value marker. The changeset says so.
• The engine's Roll-up summary recompute failed warn logs err.message of the failed parent update. That was raw and is now the cut message, because the error arrives after the inner boundary.
• For a nested engine call (a hook's write that fails inside an outer write), the outer door's WARN line is computed from an already-cut error. The log cut is idempotent on the verb-head form, so the line's bytes match the raw-derived line on the measured shapes.
• A pre-existing residue of the shared predicate, for both faces: a dump whose statement opens with a verb outside the predicate's list (with, replace) and whose diagnostic matches no dialect limb is not recognised, so nothing is cut. The engine's own statements open with the four listed verbs, while a raw execute command may not. That was observed and not reproduced through a public door, so it is not filed. The carrier would be the next PR that touches the shared leak predicate.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/objectql, touching 22 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/objectql/src/duplicate-record-error.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/webhooks.mdx (via resolveSecretField (symbol, a method of class ObjectQL))

What this run could not see

• 1 changed file(s) yielded no anchor (packages/objectql/src/duplicate-record-error.ts) — pages documenting those are invisible to this run
• 5 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 17 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 222ecc27f9050857d4620e7010d8b85f9d35e378 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 2b3e3eb671cf020c872d32c817de8bc12da0c476 — the merge of head fd19d3661bcd7a4ccf2ede82eaa1e5a74e59919c into base 222ecc27f9050857d4620e7010d8b85f9d35e378, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 2b3e3eb671cf020c872d32c817de8bc12da0c476 && git checkout 2b3e3eb671cf020c872d32c817de8bc12da0c476
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 222ecc27f9050857d4620e7010d8b85f9d35e378 fd19d3661bcd7a4ccf2ede82eaa1e5a74e59919c && git checkout -B drift-repro 222ecc27f9050857d4620e7010d8b85f9d35e378 && git merge --no-ff fd19d3661bcd7a4ccf2ede82eaa1e5a74e59919c

node scripts/docs-audit/affected-docs.mjs --json 222ecc27f9050857d4620e7010d8b85f9d35e378

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 222ecc27f9050857d4620e7010d8b85f9d35e378 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: fd19d3661bcd7a4ccf2ede82eaa1e5a74e59919c
Local-runs: none

① Derived judgments

Inputs: card #21274 (body; 5943536760, 5943907420, 5946109461, 5946136544), the cross-lane posts 5943919189 (#21118) and 5946141400 (#6024), PR #21335's body, its 10-file list and the net diff against merge base c7396f1a99 (the git three-dot diff equals the API diff: 10 files, +1490/-83), head sources through git show, and the head's check-runs last. Classes and positions only: no statement, value, sentinel or log line is quoted here.

The boundary helper (packages/objectql/src/driver-fault-redaction.ts :889 redactPropagatedDriverFault) is RIGHT.

• One rule, no copy. Both faces split the dump through the same splitDriverDump (:738), the same statementCut (:979: the last separator, or the last measured head, so a value that contains the separator can only over-redact, never expose), the same redactDiagnosticValues (:1009) and the same redactStack (:1067: the header is rebuilt from the first frame line, so a multi-line statement cannot survive in the stack). The log face redactStatementFromMessage (:711) was refactored onto splitDriverDump and is equivalent to its base form by inspection.
• Each per-shape cut is right. better-sqlite3: message and stack, its only carriers. node-postgres: message and stack; detail, where a key-shaped line keeps its identifier half so uniqueViolationColumn still names the column and any other line is replaced whole; where and internalQuery replaced whole; the three pg-generic names gated on severity. mysql2: sql to kind-plus-marker, sqlMessage through the measured value templates. The property rules run regardless of the leak predicate, so on a shape whose message is not recognised the properties are still cut; only message and stack depend on recognition (see ③). The cause chain is cut to depth 4 (:859), the depth the shared predicates read. Nothing statement-bearing is left on any measured shape: hint, the pg identifier fields, code, errno and sqlState are value-free as kept.
• The copy keeps the prototype and every own key (symbol-keyed and non-enumerable included, enumerability preserved), is a native Error, never mutates the input, returns the same reference when nothing is cut, and is idempotent on its own output. All pinned in driver-fault-boundary-redaction.test.ts across 15 shapes.
• driver-sql's own envelopes (packages/drivers/driver-sql/src/sql-driver.ts :1061, :1126, :1165, :1307) attach code, status, a non-enumerable cause and symbol-keyed flags only; there is no own sql, bindings or query property there for the helper to miss.

The sites are RIGHT; no engine exit is missed. Verified on head engine.ts by placing every driver call inside an executor closure: find :11878 in [:11862 to :11941]; findOne :12154 in [:12135 to :12209]; insert :13508, :13511 and :13525 (the autonumber-resync creates live in createWithAutonumberResync :6404, called only from :13525) in [:12745 to :13694]; update :14355 and :14478 (the prior reads), :15000 and :15297 in [:14022 to :15464]; delete :16660, :16800, :16853 and :16883 in [:16516 to :16986]; count :17030 in [:17027 to :17036]; aggregate :17507 and :17551 in [:17452 to :17553]; insertMany :13727 delegates to insert. The seam's catch is :5166 to :5177. Outside the seam every driver call is wrapped or classified as the PR's table says: resolveSecretField :9052, resolveInternalField :9148, execute :17616 to :17618 (the await sits inside the try), ObjectQL.transaction :17737, ScopedContext.transaction :18632. BEGIN, COMMIT and ROLLBACK at :17714 and :18767 to :18804 bind no caller value, and driver-sql declares no deferrable constraint, so a commit cannot surface a row. Connect and disconnect (:9589, :10469) and the DDL and introspection paths are outside the ruling's class. The "already safe" rows hold: SummaryRecomputeError failures and insertMany row outcomes exit through the seam, both pinned. The one other driver call in the package, lifecycle/lifecycle-service.ts :899 count, binds nothing. The getDriverForObject out-of-scope row is right as an engine-boundary judgment; its one consequence is flagged in ③.

The engine's WARN lines are CONFIRMED unchanged: :13690, :15460 and :16979 still pass redactBoundStatement(raw) to writeFailureLogMeta inside the executor, before the seam's catch; the control suite pins the meta equal to the raw-derived line on 3 doors by 5 shapes and spells the logged message out for three dialects.

REST answers are CONFIRMED: mapDataError status, code and field are pinned equal raw-versus-cut on all 15 shapes and on the three envelope cases; every shared classifier (looksLikeInternalErrorLeak, isUniqueViolationError, uniqueViolationColumn, isMissingTableError) is pinned equal too; rest-duplicate-record-arm.test.ts keeps its 409, DUPLICATE_RECORD and field answer unchanged.

DuplicateRecordError.cause is RIGHT: field is computed in the engine from the raw error before the seam, the envelope's own fields are carried, and the cut cause keeps its class and code, pinned over sqlite, pg and mysql. duplicate-record-error.ts :51 to :57 is a doc edit only.

The re-judged pins are RIGHT; nothing is weakened beyond the overturned identity contract. The two driver-fault-redaction.test.ts pins now assert both sentinels absent from message and stack, the diagnostic and code kept, and the 400 INVALID_FIELD answer, which is stronger than before. The insert and update suites replace raw identity with prototype, cut-message and code equality through expectDriverErrorAsItLeaves; the two nested-envelope pins keep the one-envelope-deep protection (instanceof, field, cause not an envelope); the update statement regex flips from must-match to must-not-match with an exact cut form. Counted on the diff: 8 assertion sites in insert, 9 in update, 2 pins in the redaction suite, consistent with the seat's correction of the PR body.

The auth-library carrier pin (packages/plugins/plugin-auth/src/driver-fault-auth-log-carriers.test.ts) PROVES the ruling's pin: a synthetic sentinel bound through sign-up and update-user against a database-enforced unique index; every console carrier rendered the way console renders it plus hidden-field inspect at depth 8; the error objects' properties inspected the same way; the control keeps class, code, cause.code and the diagnostic, and the engine WARN carries the marker; the HTTP bodies are checked. SQLite always runs; pg and mysql are describe.skipIf on OS_TEST_POSTGRES_URL and OS_TEST_MYSQL_URL with a named skip, each in its own schema or database. @objectstack/driver-sql and @objectstack/objectql are already devDependencies of plugin-auth, with five sibling tests as precedent. No plugin-auth source edit, as declared on #21118.

② Semver level

.changeset/21274-driver-fault-boundary-redaction.md: @objectstack/objectql patch, Clause-②: no. RIGHT. redactPropagatedDriverFault is exported from its module only; neither published entry (src/index.ts, src/core.ts; package.json exports . and ./core) re-exports it, so no public export is added and the minor precedent does not apply. The prose is accurate against the diff (the site list, the cut and kept sets, the identity note on cause, the import-row note) and holds no value: it names the marker and property names only. One wording note, not a defect: "every REST answer keeps its status, code and field" is a claim over the measured set (26 raised errors, 15 pinned shapes) stated as universal.

③ Boundary flags

The dev's open question (A, B, C): A is right, and the fork is declared, not silent. The ruling's first bullet asks for no statement and no bound values. A keeps one token from a closed four-entry vocabulary (STATEMENT_KIND :755, captured by alternation so no other text can ride along): the operation kind, which the door the caller invoked and the error code already disclose; it carries no table, no column and no value, and the shared predicate recognises a dump by exactly that token. In substance the bullet is met. In letter the propagated message is not identical to the log line (it leads with the kind where the log line appends the marker), so "the same redaction" holds for the cut and not for the presentation. B's measured cost (6 of 26 answers relabelled, the SQLite field lost) contradicts the ruling's third bullet, and C grows a list the predicate's header rules frozen. The seat's answer A stands; the maintainer may overturn it at the stated cost.

Deviations: accepted as recorded in 5946136544. duplicate-record-error.ts is a doc comment only; the rest test change is one precondition re-judged in the ruling's direction with REST source untouched, declared on #6024; the live databases under /tmp are reported stopped by recorded PID and removed, which a diff cannot verify, and the stop-first rule the seat restated applies to the next card.

The out-of-scope note needs a card. The residue is real and read-only: looksLikeInternalErrorLeak (packages/types/src/error-leak.ts :226 to :238) recognises a dump by four leading verbs or a dialect limb, so a raw execute (:17616) whose command opens with another verb and whose diagnostic matches no limb is cut on neither face. It is bounded: the property cuts run regardless, so the residue is message and stack only, through the execute door only, because the engine composes its own statements with the recognised verbs. It is still a contract gap inside the ruling's class with a named position, and "the next PR that touches the shared leak predicate" is an unscheduled carrier; Prime Directive #10 says file it. One shape for the fix: the execute door knows it bound a statement, so its cut need not consult the predicate. Not a FAIL condition here: pre-existing on both faces, and the measured path is closed.

One further read-only finding, outside the ruling's class, for a card. packages/objectql/src/lifecycle/lifecycle-service.ts archiveObject (:1236) reaches the cold store directly through getDriverForObject with row data bound (cold.upsert :1405, hot.find :1373); a driver fault there never crosses a door, and the sweep's caller writes the error's message into the report and a warn line (:683 to :686). Same disclosure class, different route. No auth object declares an archive policy at this head, so it is not p1. The PR's out-of-scope row is right for the engine boundary; the consumer bypassing it is the position to file.

Check-runs on the head (read last, 2026-10-02T05:43:38Z): all seven required contexts conclude success: Lint & Repo Gates (05:37:25Z), TypeScript Type Check (05:39:00Z), Test Core (05:41:25Z, its six shards all success), Dogfood Regression Gate (05:29:21Z), Build Core (05:24:55Z), Temporal Conformance (live PG + MySQL) (05:31:04Z), Governed Surface Queue Guard (05:22:25Z). At an earlier read (05:41:10Z) the Test Core rollup was still in_progress; it is no longer. No run on the head failed, was cancelled or timed out; nothing is still queued; the combined status is success.

Implemented-by: claude/issue-21274-driver-fault-boundary-redaction
Reviewed-by: session_017xfMoEjKUuSh2xYB8sCozp

VERDICT: PASS

---

Generated by Claude Code