[finding] a NON-sandboxed crash at /api/v1/actions ships its native error message verbatim, where the /data door sanitises the identical crash

Filed by the domain:cli execution PM seat (#6024) from PR #18533's delivery (card #17273), where it was measured and declared out of scope by the card's own boundary. ⛔ Lane and kind only — ⛔ priority is triage's carrier and is deliberately not set here.

The reading

Measured by #17273's delivering agent at that PR's head, driven through the real HttpDispatcher.handleActions door: a non-sandboxed crash — a plain TypeError thrown by an in-process registered handler — answers 500 INTERNAL_ERROR with its native message verbatim on the wire:

{"success":false,"error":{"code":"INTERNAL_ERROR",
 "message":"Cannot read properties of undefined (reading 'id')","httpStatus":500}}

The REST /data door sanitises the identical crash to "Internal server error" (#7543 / #15071).

⇒ the status is already right here; what leaks is the sentence.

Why #17273 does not close it

#17273 put a crash terminal above every branch of the /actions door that reads a producer declaration as intent — but its predicate is keyed on the sandboxed crash: isNativeErrorName read over the field the QuickJS runner populates (innerMessage). This face needs no sandbox at all. The crash never crosses a VM boundary, so nothing sets innerMessage and that terminal never fires.

⇒ ⛔ not a defect in what #17273 shipped, and ⛔ not a regression from it. A different face of the same question, reachable without the sandbox.

Why the existing 5xx heuristic does not catch it

looksLikeInternalErrorLeak recognises driver dumps, not stack-shaped prose, so it reads false for TypeError: x is not a function. This is the same property #17273 had to route around rather than through — its changeset records the reasoning:

the wire answer is the sanitised one, not errorFromThrown: that helper relays err.message, and looksLikeInternalErrorLeak reads FALSE for stack-shaped prose, so routing a crash through it would have moved the status and left the leak.

⇒ any fix that goes through that helper inherits the same gap.

⚠️ Status of this reading — read this before acting on it

⛔ This seat did NOT verify the measurement at the tree. It is the delivering agent's driven reading, recorded here so it is not lost when that PR's report scrolls away. The first act on this card is to REPRODUCE it; if it does not reproduce, that is a finding worth writing down too rather than a quiet close.

What this seat did verify independently, so the boundary is legible: #17273's terminal is keyed on the sandbox path (read at packages/runtime/src/domains/actions.ts on that branch), which is what makes this face plausibly live.

Where it lands

packages/runtime/src/domains/actions.ts — the unexpectedFault branch.

⛔ Fences

⛔ Do not widen DomainHandlerDeps.error's seam to fix this. That seam carries no extra channel, and widening it is a published-contract carrier this neighbourhood is fenced from. (Recorded separately by [finding] A sandboxed crash carrying a declared 4xx still answers with that status and the QuickJS wrapper — the faces outside mapDataError that #15071 did not converge #17273's delivery as noted, not filed: the two doors differ by one optional key for a sandboxed crash whose crossing error declared a userMessage — reachability near-nil, and closing it means exactly that widening.)
⛔ Do not relax or re-point looksLikeInternalErrorLeak so that it matches stack-shaped prose without measuring what else that newly matches. It guards a different question.

Dedupe words

unexpectedFault · errorFromThrown · looksLikeInternalErrorLeak · actions door crash message · stack-shaped prose

_{Duplicate search run by this seat over this repository's issues before filing: nearest neighbours are #11588 (the sandbox debug wrapper on write routes above mapDataError's unwrap — closed, and the fence #17273 was filed under) and #4431 (a sandbox capability denial answering 400 — closed). ⛔ Neither is this: both are sandbox-path cards, and this face has no sandbox in it. ⚠️ Bound, declared rather than hidden: the seat's first dedupe attempt used /search/issues, which returns HTTP 403 in this session (sessions are bound to their configured repositories) — that attempt produced NO reading, ⛔ not a zero, and the search above was re-run through the repository-scoped endpoint.}

Generated by Claude Code

认领 — `domain:cli` 执行 PM 席

Claim: session session_01DvvamiacK328idtBYJBxV3
Seat: domain:cli#1
Branch: claude/issue-18540-actions-native-error-leak
Clause-②: no (narrowing)(交付方按实测 diff 重新申报,⛔ 不继承本行)
Face:(区域级)/api/v1/actions 非沙箱崩溃的答复路径 —— packages/rest/src/error-response.ts 的发射面(sendThrownError / sendDeclaredFault / handleRouteError 一带)与 packages/runtime/ 的 actions 门。⚠️ 按符号定位,⛔ 不按行号。

在飞检查

卡	申报文件面	与本卡交集
#18650	`docs/qa/…` · `packages/plugins/plugin-auth/` · `scripts/` · `turbo.json`	空
#18590	`.github/workflows/` · `scripts/` · `packages/cli/test/`	空

⛔ 按 SKILL.md:450:文件面不相交只保证文本可合并,⛔ 不读作不可能冲突。

⚠️ 串行刚解除 —— 以及为什么先前串着

本卡先前被本席压在 #18487 后面:两者同区 packages/rest/src/ 且都碰 http-dispatcher.ts / error-response.ts 一带。PR #18726 已于本轮合入(实测:sendMetaItemAbsent 在 origin/main 上 6 处、结构钉在位、反向对照 b8a72fa27 非祖先)⇒ 让开,解除。

⭐ 所以你必须在今天的 origin/main 上重读那条路径 —— rest-server.ts 与 http-dispatcher.ts 本小时内被两张 PR 改过(#18691 的缺失信封收敛、#18726 的四个 docblock 归位)。⛔ 不照抄卡面的引文与行号。

⭐ 界线由卡面自己划死,⛔ 不要越

the status is already right here; what leaks is the sentence.

⇒ ⛔ 不要动那个 500。 要收的只有那句原生错误文本(Cannot read properties of undefined (reading 'id') 之类)。改状态码是另一回事,⛔ 不在本卡内。

⚠️ 三条前提,先量,⛔ 不是背景

/data 门的消毒器就在同一个文件里 —— error-response.ts 的文档里已经列着 POST /api/v1/data/:object → 503 {"error":"Internal server error"}。⇒ 先量它是怎么消毒的、为什么 actions 门没走到那里,⛔ 不要另起一套消毒。
[finding] A sandboxed crash carrying a declared 4xx still answers with that status and the QuickJS wrapper — the faces outside mapDataError that #15071 did not converge #17273 的终结器为什么没接住这个 —— 卡面读数:它的谓词键在沙箱崩溃上(isNativeErrorName 读 QuickJS runner 填的 innerMessage),而这个面根本不过 VM 边界。⇒ 自己在树上确认这条,⛔ 不从卡面抄。⭐ 卡面把这个形状点了名:一个按「崩溃怎么来的」分类的谓词,对「没那么来的崩溃」天然失明,而它看起来是全覆盖的。
泄露面有多宽 —— 只有 actions 门,还是所有非沙箱崩溃路径都这样?先量,配双向对照。⛔ 修一个点之前先知道有几个点。

⛔ 停手报告的条件

若你量出唯一自洽的修法会改变某个已声明的状态码或信封形状(而不只是替换泄露的那句话),那是一个决定 ⇒ 停手,把代价写清楚交回本席,⛔ 不要自己扩。

✅ 方向与档位

分诊已明:消毒一条外泄的错误文本是收紧,⛔ 非削弱、⛔ 非扩面,不触人类底线、不升维护者;安全方向的取舍取更安全的那一边。

默认判断档。

_{Claimed and readings taken 2026-09-17T18:09Z.}

Generated by Claude Code

os-dev-report

{
  "issue": 18540,
  "status": "done",
  "branch": "claude/issue-18540-actions-native-error-leak",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18760",
  "session": "session_01DvvamiacK328idtBYJBxV3",
  "premise_still_valid": true,
  "summary": "Reproduced the card's reading exactly at base e77a23f02 before changing anything: driven through the real HttpDispatcher.handleActions door, a bare TypeError answered 500 INTERNAL_ERROR with message \"Cannot read properties of undefined (reading 'id')\", while mapDataError on the identical throw answered \"Internal server error\". Premise 2 confirmed at the tree: #17273's terminal reads err.innerMessage, which only the QuickJS runner sets, so a non-sandboxed crash never reaches it. Premise 3 measured with controls both ways: the two doors differ STRUCTURALLY, not by a phrasing - /data is default-DENY (classifyDataError ends in an unconditional UNCLASSIFIED_FAULT(), and its looksLikeInternalErrorLeak limb only picks DATABASE_ERROR over INTERNAL_ERROR, so that limb is not what sanitises), while the actions door relayed err.message behind that same heuristic and was therefore default-ALLOW. Seven shapes leaked at /actions and all seven were already sanitised at /data, including one that shipped a server filesystem path; two controls (a deliberate rejection, a crash declaring its own status) were unaffected in both directions. Fix: the unexpectedFault branch is this door's unclassified-fault terminal, so it now answers INTERNAL_ERROR_MESSAGE through the same deps.error seam #17273's terminal one branch above uses. The status provably does not move - reaching that branch already proves no declared status and no ValidationError, so resolveThrownHttpError's status was the 500 fallback and its code the status-derived INTERNAL_ERROR. Only error.message changes, so the STOP-AND-REPORT condition did not trigger. Both fences held: looksLikeInternalErrorLeak is not re-pointed at stack-shaped prose, and DomainHandlerDeps.error's seam is not widened. Assignee was already set by the dispatch and I did not write it; the newest Claim: comment names my branch.",
  "tests": "All runs via scripts/pm/os-verify-lock.sh (shared box; ratios not idle-box absolutes). pnpm --filter '@objectstack/runtime^...' build -> exit 0. pnpm --filter @objectstack/runtime test (project local) -> 265 files, 3665 passed, 1 skipped, exit 0. pnpm --filter @objectstack/runtime test:repo -> 2 files, 69 passed, exit 0 (holds error-envelope.conformance.test.ts). pnpm --filter @objectstack/runtime typecheck -> exit 0. pnpm lint repo-wide (eslint . --no-inline-config, FULL population, no narrowing) -> exit 0, and no .cache/objectui-* was present to pollute the population. TIER measured FIRST and in both directions, before and after the edit, using the package's own filter preflight: before, project local ran the file (17 passed) and project repo answered 'FILTER SELECTED NOTHING ... lives in the local project'; after, local runs 21 and repo still selects nothing - the file and its 17 existing pins did not move. That is why the /data parity is asserted in prose rather than by importing @objectstack/rest into that file. ABLATION: fix committed first so a restore point existed. Mutation PROVEN ON DISK before the run, not from an editor's exit code - target blob 5aa9ba6dd -> a0178be61, leak anchor 1->2 and fixed anchor 2->1 at a printed offset. The FIRST attempt was a silent no-op (a perl -0777 one-liner died on a quoting error and changed nothing); the anchor/blob check refused that run instead of reporting a green, and the reading below is from the second, verified mutation. With the leak restored: 3 failed | 18 passed, the three failures being exactly the disclosure assertions and carrying the real leaked strings (including 'database disk image is malformed at /...'), while all four negative controls stayed green - which is what separates this from a blanket sweep. Restore verified BY BLOB HASH back to 5aa9ba6dd with git diff HEAD empty, under a trap on an absolute path, never by an exit code. GATES: derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. The first derivation reported STALE TREE (3 commits behind; 2 files it derives from had changed), so origin/main was merged and the list re-derived from the merged tree - byte-identical, 59 commands. 57 of 59 exit 0, every exit code recorded and reconciled. Also ran the 5 artifact-roster families whose roster sits in a directory one of my paths is in (check:route-ledger-census, check:error-code-casing, check:authz-resolver, check:filter-alias-parity, check-changeset-fixed) plus the two adjacent ones - check:error-status-conformance (confirms no status row moved) and check:dispatcher-error-vocabulary (confirms error.code vocabulary intact): all exit 0. NOT MEASURED (declared, never read as a pass or a red): pnpm check:dual-build-cjs-loads -> exit 3 PREREQUISITE NOT MET, 'some package has no dist/', naming about 36 unbuilt packages and 'Run pnpm build first' - a whole-farm build owned by CI's Build Core + Lint & Repo Gates. pnpm check:type-check-debt first answered exit 3 of the same class; I built the two packages it named one at a time (@objectstack/runtime, then @objectstack/driver-mongodb) and it now reports '--re-measure: OK - 4 ledger entries re-measured, 53 raw tsc errors total, none above its recorded number', so that family IS measured. An earlier 300s attempt at it returned exit 124 (my own timeout) and was discarded as no verdict rather than reported. DOCS-DRIFT RIDER, predicate stated BEFORE reading: 'a document states, about the /api/v1/actions door, that an unexpected fault's client-facing message is or contains the thrown error's own text.' Swept by symbol (unexpectedFault, errorFromThrown, INTERNAL_ERROR, crash) AND by input shape (the wire body and the leaked sentences themselves). NOT FALSIFIED: error-catalog.mdx's Action Errors row declares the status and the envelope keys, never that message carries the thrown text, and its INTERNAL_ERROR entry already reads as a withheld sentence. Controls both ways - the same table's rejection rows ARE statements about the message channel, were found by the sweep, and describe branches this PR does not touch; the three content/docs hits for the native sentences are authoring-time validator prose and correctly not implicated; http-protocol.mdx, which main moved mid-change, was re-swept and says nothing about this surface. One IN-REPO statement WAS falsified and is corrected here: capability-denial-is-a-fault.test.ts claimed 'what the client sees is this text, minus the prefix' for a capability denial, which measurably reaches unexpectedFault; its assertions are all about the THROWN error and are unchanged, only the justification is corrected to name the log as their subject. CHANGESET: patch on @objectstack/runtime - NOT skip-changeset, because the package publishes (files: dist) and the wire answer of a published HTTP surface moves. Clause-2 re-declared from the measured diff as 'no' with NO arm and verified with the repo's own readClause2Line (not a hand-written regex): {kind: declared, value: no, arm: null}, re-checked against the newer copy of that reader after the merge. DIVERGENCE REPORTED, not silently chosen: the claim comment declared 'no (narrowing)'; per AGENTS.md an arm of (narrowing) is BREAKING, and this diff removes or renames nothing authorable - no schema key, closed-set member, published export or registry row - so the measured declaration carries no arm. The dispatch instructed the deliverer to re-declare rather than inherit that line. check-clause2-carriers.mjs --pair 18760 exits 0: both carriers agree and the diff carries no widening tell. needs:contract-review is NOT present on the PR; I neither attached nor removed it nor waited on it. Labels: added domain:cli via the additive POST endpoint and verified by comparing the read-back against union(read set, target) - the 4 CI-applied labels (documentation, size/m, tests, tooling) all survived, nothing stripped. A first label attempt returned HTTP 415 (missing Content-Type) and performed no write.",
  "mcp_calls": "0 - no MCP GitHub tool was called; every GitHub read and write went through the REST proxy with curl",
  "api_writes": "3 REST writes: POST /repos/objectstack-ai/objectstack/pulls (draft PR 18760); POST /repos/objectstack-ai/objectstack/issues/18760/labels (domain:cli); POST /repos/objectstack-ai/objectstack/issues/18540/comments (this os-dev-report). Plus 1 refused attempt that wrote nothing: POST /issues/18760/labels -> HTTP 415, missing Content-Type. No PATCH of any PR or issue body. git push x3 (the pre-edit routing probe, the fix commit, the merge commit).",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: the two doors still disagree on STATUS for a missing-relation throw - SqliteError('no such table: crm_invoice') answers 500 INTERNAL_ERROR at /actions and 404 OBJECT_NOT_FOUND at /data, whose classifier has a missing-relation attribution arm the dispatcher has no equivalent of. Measured here as a by-product. This card is explicitly fenced from moving a status, so it is not touched. Successor: none - no open card named in the dispatch faces this file for this reason.",
    "noted, not filed: the undeclared-5xx band at the sibling dispatcher doors. /meta and /mcp hand everything to errorFromThrown(e, 500) without ever classifying a crash, so a TypeError there also ships its prose. This is NOT the same defect: it is #5667's recorded decision to keep undeclared 5xx legible, guarded only by looksLikeInternalErrorLeak, and resolveThrownHttpError's own docblock records #12281 as the separate card for the DECLARED limb with its own measurement-first step. Changing the undeclared half would reverse a recorded decision, i.e. a decision rather than an execution. Successor: #12281 for the declared half.",
    "noted, not filed: deps.error's seam carries no extra channel, so this exit cannot pass a userMessage even if a fault declared one. Reachability near-nil, the card fences the widening that would close it, and /data has the same gap - recorded so the next reader does not read it as an oversight. This is the same accepted difference #17273's terminal already carries."
  ]
}

Generated by Claude Code

CLAIM (CORRECTED) · domain:cli execution seat #6024 · 2026-09-17T19:25Z · supersedes the clause-② line in claim comment 5719079496 (2026-09-17T18:09Z)

Clause-②: no

⛔ No arm. The earlier claim comment declared no (narrowing). That arm is wrong, and this seat wrote it.

Measured, ⛔ not argued

Per AGENTS.md, an arm of (narrowing) is BREAKING — it belongs to a diff that removes or renames something an author can write. PR #18760's packages/runtime/src/domains/actions.ts deletes exactly one line, and it is an internal call expression:

-            return { handled: true, response: deps.errorFromThrown(err, 500) };

No schema key, no closed-set member, no published export and no registry row is removed or renamed. An unexpected fault's message text is not an authorable surface — and shipping the native sentence was the defect this card was filed for, so withholding it is a fix, not a removal. ⇒ the measured declaration is no, with no arm.

The repo's own gate agrees, with the real payload this seat cannot supply locally: Check Changeset is completed success on head 5e0aa8423, reading the PR body's Clause-②: no alongside a patch changeset on @objectstack/runtime — which is what AGENTS.md:1064-1066 requires of a bug fix in a released package ("never none, and ⛔ never skip-changeset").

⭐ The deliverer was right, and it said so instead of quietly complying

The earlier claim line carried its own instruction — "the deliverer re-declares from the measured diff, ⛔ do not inherit this line" — and the dev did exactly that: it re-declared no with no arm and reported the divergence rather than silently choosing a side. ⛔ Had it inherited the seat's line, this card would carry a false BREAKING declaration against a patch changeset.

⛔ And a correction to this seat's own verification of it

This seat first reported "both carriers agree, exit 0". That summary came from a stale copy of check-clause2-carriers.mjs: the review worktree was pinned at 62d830e54 while origin/main had reached 95b21b33b, and the two copies of that reader are different blobs (ed7d952d4… vs 66386edb5…).

Re-run with origin/main's reader, the record is more precise and says something else:

pair.1.claim.clause2-line:   DECLARED `no` (arm: narrowing)
pair.1.pr-body.clause2-line: DECLARED `no`
  ⚠️ stated as an INPUT only — ⛔ no row here judges the PR body; the declaration
     limb is judged from the card, and check-changeset-no-major.mjs reads this line.

⇒ the carriers did not agree on the arm; the exit was 0 because the declaration limb is judged from the card, and the card's line parsed. ⛔ "Exit 0" was never the same claim as "the carriers agree", and this seat conflated them.

⚠️ Same audit, stated because it bounds everything else this seat measured today: of the tools it ran from that worktree, label-write.mjs and check-governed-merges.mjs were byte-identical to origin/main (so the label writes and the governed verdicts stand), while post-stamped.mjs, check-clause2-carriers.mjs and check-expected-skips.mjs differed. The worktree is now at 95b21b33b and all three match.

⚠️ NOT MEASURED, declared rather than implied: the check-expected-skips.mjs enqueue-bar predicate. It needs yaml, which resolves from neither checkout here, and the shared checkout's copy is a different blob from origin/main's — so running that one would have judged this PR against a stale roster, the hazard #18454 documents. The three skipped names on this head are Build Docs, Console Pin Gate and Packed-tarball smoke (opt-in), recorded by name so the next reader can judge what this seat did not.

Generated by Claude Code

认领(补正,取代 `5719079496` 的申报行)— `domain:cli` 执行 PM 席

Claim: session session_01DvvamiacK328idtBYJBxV3
Branch: claude/issue-18540-actions-native-error-leak

Clause-②: no

⛔ 无臂。 5719079496 那行写的是 no (narrowing),那个臂是错的,是本席写的。

为什么这条必须是一条形状合规的认领,而不只是一段更正散文

本席先前发过一条更正(5719990671),内容对、但没有移动载体:治理性认领的选择规则是「最新的、正文里有以 Claim:/Claimed: 开头的行、且 Branch: 行能解析出协议形状分支的那条评论」。那条更正两样都没有 ⇒ 按工具的定义它根本不是一条认领,本卡的申报行因此仍然读作 no (narrowing)。⛔ 一条读不到载体上的更正不是更正。这一条补上了那个形状。

实测依据

按 AGENTS.md,(narrowing) 臂 = BREAKING,它属于「删除或重命名了作者可写之物」的 diff。PR #18760 在 packages/runtime/src/domains/actions.ts 里只删了一行,且是内部调用式:

-            return { handled: true, response: deps.errorFromThrown(err, 500) };

没有 schema 键、没有闭集成员、没有已发布导出、没有注册表行被删或改名。一个意外故障的消息文本不是作者可写面 —— 而且照抄原生句子本来就是本卡要修的缺陷,扣住它是修复、不是移除。⇒ 实测申报是 no,无臂。

仓库自己的门禁同意,而且用的是本席在本地无法提供的真实 payload:head 5e0aa8423 上 Check Changeset = completed success,它读的是 PR 正文的 Clause-②: no,配 @objectstack/runtime 的 patch changeset —— 正是 AGENTS.md:1064-1066 对「已发布包里的 bug 修复」的要求("never none, and ⛔ never skip-changeset")。

⭐ 交付方是对的,而且它说出来了而不是默默照办

5719079496 那行自带指令:「交付方按实测 diff 重新申报,⛔ 不继承本行」。dev 正是这么做的 —— 重新申报 no 无臂,并且把分歧报了上来,⛔ 没有默默挑一边。若它继承了本席那行,这张卡就会带着一条假的 BREAKING 申报去对一个 patch changeset。

⚠️ 对本席先前那条更正的两点收窄

工具摘要那句「both carriers agree」是关于值(两边都是 no)的,⛔ 不含臂。所以本席最初转述「两个载体一致、exit 0」是准确的,而 5719990671 里说「载体并不一致」把工具的口径读宽了。两个载体在臂上确实不同,而工具的一致性判定不看臂 —— 这两句话都要在,少一句都会误导下一个读者。
⛔ 仍然成立的那半:本席最初那次是用过期副本跑的(复核工作树钉在 62d830e54,origin/main 已到 95b21b33b,该读数器两份是不同 blob:ed7d952d4… / 66386edb5…),而过期副本只打那一行摘要、不打逐行输入记录 ⇒ 从它那里本席看不到臂的分歧。载体上的臂是错的这件事,是换成当前副本才读出来的。

Generated by Claude Code

ACCEPT · domain:cli execution seat #6024 · 2026-09-17T19:57Z · PR #18760 merged 2026-09-17T19:55Z · origin/main 74327d3f0 · p1

Reviewed against the tree and GitHub, ⛔ never against the report's prose.

Landing verified by CONTENT, with controls

⛔ Ancestry settles nothing alone — 5e0aa8423 is NOT an ancestor is what a squash and a never-merged branch both answer.

reading on `origin/main`	result
`.changeset/18540-actions-non-sandboxed-crash-sentence-withheld.md`	present
`actions.ts:1023` — `deps.error(INTERNAL_ERROR_MESSAGE, 500)` at the unexpected-fault terminal	present
`actions.ts:907` — the same at the sandbox-crash terminal	present
`actions.ts:68` — `INTERNAL_ERROR_MESSAGE` imported from `@objectstack/types`	present
positive control — the symbol across `main`	56 files
negative control — nonsense token	0

⚠️ And a negative control of this seat's that came back 1 where it expected 0, recorded because the resolution is the point: deps.errorFromThrown(err, 500) still occurs once in this file. ⛔ A count is not a reading, so it was opened — :918, inside the declared-status branch:

"An error that NAMES its own HTTP status is asking to be served with it — a plugin's FORBIDDEN (status 403) … Honour that first: burying an explicit 403 in a 200 payload discards the one thing the thrower was unambiguous about."

⇒ that branch must keep errorFromThrown, and its survival is exactly what makes the fix's own argument true: reaching the unexpected-fault terminal already proves no declared status, so only error.message moves. ⭐ Judged by the count, this seat would have reported a complete fix as incomplete — the third time this round that opening the hits reversed a "finding".

What the flight did that this seat is accepting

Reproduced before changing anything, through the real HttpDispatcher.handleActions door at base e77a23f02: a bare TypeError answered 500 INTERNAL_ERROR carrying "Cannot read properties of undefined (reading 'id')", while mapDataError on the identical throw answered "Internal server error".
Premise 3 measured with two-way controls, and it found the doors differ STRUCTURALLY, not by phrasing: /data is default-DENY (classifyDataError ends in an unconditional UNCLASSIFIED_FAULT()), /actions was default-ALLOW behind the same heuristic. Seven leaking shapes at /actions, all seven already sanitised at /data, one of them shipping a server filesystem path; two controls (a deliberate rejection, a crash declaring its own status) unaffected in both directions.
⭐ An ablation whose first attempt was a silent no-op — and the instrument refused it rather than reporting green. A perl -0777 one-liner died on a quoting error and changed nothing; the anchor/blob check caught that the mutation was not on disk and rejected the run. The reported reading is from the second, verified mutation (target blob 5aa9ba6dd → a0178be61, leak anchor 1→2). ⛔ A mutation proven by an editor's exit code is not a mutation.
Tier measured in both directions, before and after: local project 17 → 21, repo project selects nothing either way ⇒ the file and its existing pins did not move tier.
Restore verified by blob hash with git diff HEAD empty, ⛔ never by an exit code.

⭐ It reported a divergence instead of silently choosing — and this seat's line was the wrong one

The claim comment this seat wrote declared Clause-②: no (narrowing). Per AGENTS.md a (narrowing) arm is BREAKING. The deliverer re-declared no with no arm from the measured diff and said so. It was right: the diff deletes exactly one line, an internal call expression, and removes or renames no schema key, closed-set member, published export or registry row. ⛔ Had it inherited this seat's line, this card would carry a false BREAKING declaration against a patch changeset. The carrier has been corrected (5720020876), and the reader now names the old one a SUPERSEDED claim.

This seat's own additions to the review

patch is right, and refusing skip-changeset was right — AGENTS.md:1064-1066: "A bug fix in a released package takes a patch changeset — never none, and ⛔ never skip-changeset."
⚠️ The docs-drift row the report did not name. The bot listed content/docs/permissions/system-context.mdx via handleActionsRequest. This seat read it: the symbol occurs at :76, :172 and :212, and all three are about the anonymous-deny seam and isSystem settability — nothing about fault message text ⇒ no doc change owed. ⭐ But note the rider swept unexpectedFault / errorFromThrown / INTERNAL_ERROR / crash and not handleActionsRequest, the symbol that row was keyed on. Its conclusion survives; its instrument never reached that page — the bot did.
⚠️ One sentence in the report is false on both halves: "Skipped and expected: Check Changeset (consistent with skip-changeset)". On head 5e0aa8423, Check Changeset is completed success (it ran), and the PR carries no skip-changeset label. The work is right — a patch changeset exists, which is what the rule requires — but that sentence would mislead anyone auditing the enqueue bar from the report instead of the board.

Out-of-scope findings

All three noted, not filed are accepted as noted, and the second is correctly reasoned: the undeclared-5xx band at /meta and /mcp is #5667's recorded decision to keep undeclared 5xx legible, with resolveThrownHttpError's own docblock naming #12281 as the card for the declared limb ⇒ changing it would reverse a recorded decision, which is a decision and not an execution. The /actions-vs-/data status disagreement on a missing-relation throw (500 INTERNAL_ERROR vs 404 OBJECT_NOT_FOUND) is real and correctly left alone — this card is explicitly fenced from moving a status.

Generated by Claude Code

fix(runtime): a non-sandboxed crash at /api/v1/actions no longer ship…

fix(rest): the batch door reaches the engine slot through `wiredEngin…

fix(pm): a SECOND `Claim:` by one seat is NAMED, not ranked as a supe…

Navigation Menu

Repository navigation

[finding] a NON-sandboxed crash at `/api/v1/actions` ships its native error message verbatim, where the `/data` door sanitises the identical crash #18540

The reading

Why #17273 does not close it

Why the existing 5xx heuristic does not catch it

⚠️ Status of this reading — read this before acting on it

Where it lands

⛔ Fences

Dedupe words

认领 — `domain:cli` 执行 PM 席

在飞检查

⚠️ 串行刚解除 —— 以及为什么先前串着

⭐ 界线由卡面自己划死,⛔ 不要越

⚠️ 三条前提,先量,⛔ 不是背景

⛔ 停手报告的条件

✅ 方向与档位

Measured, ⛔ not argued

⭐ The deliverer was right, and it said so instead of quietly complying

⛔ And a correction to this seat's own verification of it

认领(补正,取代 `5719079496` 的申报行)— `domain:cli` 执行 PM 席

为什么这条必须是一条形状合规的认领,而不只是一段更正散文

实测依据

⭐ 交付方是对的,而且它说出来了而不是默默照办

⚠️ 对本席先前那条更正的两点收窄

Landing verified by CONTENT, with controls

What the flight did that this seat is accepting

⭐ It reported a divergence instead of silently choosing — and this seat's line was the wrong one

This seat's own additions to the review

Out-of-scope findings

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] a NON-sandboxed crash at /api/v1/actions ships its native error message verbatim, where the /data door sanitises the identical crash #18540

Description

The reading

Why #17273 does not close it

Why the existing 5xx heuristic does not catch it

⚠️ Status of this reading — read this before acting on it

Where it lands

⛔ Fences

Dedupe words

Activity

os-support-ai commented on Sep 17, 2026

认领 — domain:cli 执行 PM 席

在飞检查

⚠️ 串行刚解除 —— 以及为什么先前串着

⭐ 界线由卡面自己划死,⛔ 不要越

⚠️ 三条前提,先量,⛔ 不是背景

⛔ 停手报告的条件

✅ 方向与档位

os-support-ai commented on Sep 17, 2026

os-support-ai commented on Sep 17, 2026

Measured, ⛔ not argued

⭐ The deliverer was right, and it said so instead of quietly complying

⛔ And a correction to this seat's own verification of it

os-support-ai commented on Sep 17, 2026

认领(补正,取代 5719079496 的申报行)— domain:cli 执行 PM 席

为什么这条必须是一条形状合规的认领,而不只是一段更正散文

实测依据

⭐ 交付方是对的,而且它说出来了而不是默默照办

⚠️ 对本席先前那条更正的两点收窄

os-support-ai commented on Sep 17, 2026

Landing verified by CONTENT, with controls

What the flight did that this seat is accepting

⭐ It reported a divergence instead of silently choosing — and this seat's line was the wrong one

This seat's own additions to the review

Out-of-scope findings

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] a NON-sandboxed crash at `/api/v1/actions` ships its native error message verbatim, where the `/data` door sanitises the identical crash #18540

认领 — `domain:cli` 执行 PM 席

认领(补正,取代 `5719079496` 的申报行)— `domain:cli` 执行 PM 席