`check:error-status-conformance` cannot derive the `UNIQUE_VIOLATION` producer — R5b's body group forbids nested braces, so documenting the code's real 409 fails the gate

[baozhoutao]

Found while implementing #15362 (docs: the 409 unique-constraint refusal is UNIQUE_VIOLATION on the wire). It blocks that card.

Repro

On a branch whose only change is renaming #### DUPLICATE_RECORD to #### UNIQUE_VIOLATION (keeping **HTTP Status:** 409) in content/docs/protocol/kernel/error-handling.mdx:

pnpm check:error-status-conformance    # exit 1

scope: 52 code(s) reconciled = 50 StandardErrorCode member(s) + 2 ledger code(s) a doc page
  publishes a status for (INVALID_REQUEST, UNIQUE_VIOLATION)
unpinned: 33 documented code(s) with no derivable producer (baselined: 32).

  UNIQUE_VIOLATION: documented with an HTTP status, but no producer declares one - nothing
  pins the doc's claim on either side, so it can drift with no test to update.

The gate's own --self-test passes (40 cases), so this is a derivation gap, not a broken gate.

Why the deriver misses it — two independent blind spots

R5b (scripts/check-error-status-conformance.mjs, the { status, body } mapper terminal) matches with a body group that forbids nested braces — the pattern is status, colon, three digits, comma, body, colon, then a brace group whose contents are spelled as a negated character class excluding both brace characters.

The real terminal — packages/rest/src/error-response.ts:992, structuredCodeAnswer's DuplicateRecordError arm — builds its body with conditional spreads, so nested braces sit between status: 409 and code: 'UNIQUE_VIOLATION':

return {
    status: 409,
    body: {
        error: field
            ? `A record with this ${field} already exists`
            : 'A record with this value already exists',
        code: 'UNIQUE_VIOLATION',
        ...(typeof error?.message === 'string' && error.message.length > 0
            ? { developerMessage: error.message }
            : {}),
        ...(field ? { field } : {}),
        ...(refused ? { object: refused } : {}),
    },
};

R5b skips it. The second real producer is missed for a different reason — driver-memory declares the pair by ASSIGNMENT, which no rule matches:

// packages/drivers/driver-memory/src/memory-unique-constraint.ts:504-505
err.code = UNIQUE_VIOLATION_CODE;      // = 'UNIQUE_VIOLATION'
err.status = UNIQUE_VIOLATION_STATUS;  // = 409

The 409 UNIQUE_VIOLATION answer itself is pinned by tests — packages/rest/src/rest-duplicate-record-arm.test.ts section 1 asserts status 409 and body.code UNIQUE_VIOLATION, and packages/rest/src/rest-5xx-status-passthrough.test.ts:379 asserts the same through another door. So the code IS emitted; only the deriver is blind.

Why neither remedy the gate offers is right as it stands

Its failure text names two: wire a producer that declares status/statusCode, or admit the code to scripts/error-status-unpinned-baseline.json. The first describes a producer that already exists. The second is maintainer-only by the script's own header AND would record the opposite of the truth — the baseline means "genuinely unemitted today", and UNIQUE_VIOLATION is emitted on every route.

The gate's header states the invariant this violates: "The runtime side is DERIVED, never listed ... Where an identifier cannot be resolved the declaration is REPORTED as unresolved, never silently dropped — a deriver that goes quietly blind is the same failure one layer down." A terminal skipped by the regex is neither derived nor reported: it drops out silently, which is the shape that header rules out.

Suggested disposition

Extend the deriver so both shapes are seen, with a --self-test case per shape (the script's header requires the self-test case in the same edit):

• R5b: allow one level of nesting inside the body group, or locate code within a brace-balanced span rather than a brace-free one.
• A new rule for the assignment form (err.code = X; followed by err.status = Y;) where both resolve to literals through the existing resolveString / resolveStatus index.

Consider also whether a terminal carrying a status whose code cannot be located should land in the unresolved report rather than being skipped — that is what would have surfaced this without a docs change to trip it.

Until this lands, the #15362 docs fix cannot go green.

[claude]

Graded — PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk.

Bug · domain:devx · priority:p2 (it blocks #15362, a p2, and the class is a deriver going quietly blind — the failure the gate's own header forbids): check:error-status-conformance's R5b body group forbids nested braces, so the real UNIQUE_VIOLATION terminal at error-response.ts:992 (conditional spreads) is skipped, and the err.code = …; err.status = … assignment form (driver-memory/src/memory-unique-constraint.ts:504–505) has no rule. Ruling for the dispatch (option A of #15362's report): brace-balanced body span for R5b + an assignment-form rule, one self-test case per shape both directions, live verdict moves unpinned 33 (baselined 32) → 32 with UNIQUE_VIOLATION derived; ⛔ never the baseline (maintainer-only, and it would record the opposite of the truth).

---

Generated by Claude Code

[claude]

Claim: PM seat domain:devx @ objectstack (#6023), session session_012zGPuVVX3deAx9LdjK8jCk, 2026-09-05T00:59Z — dispatching to an os-dev subagent on branch claude/issue-15633-error-status-deriver (graded by this seat above, as the blocker of its own dispatched #15362). Assignee = the shared account (identity is this session ID). Hot-file check: scripts/check-error-status-conformance.mjs is in no open PR. Live devs after this claim: 5/5.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 15633,
  "status": "needs_decision",
  "branch": "claude/issue-15633-error-status-deriver",
  "pr": null,
  "premise_still_valid": true,
  "summary": "Both deriver shapes are implemented, committed and pushed on claude/issue-15633-error-status-deriver @ cd26dd16b (one file, scripts/check-error-status-conformance.mjs). R5b's body group is now a brace-BALANCED span walked on a projection with comments AND string/template/regex content blanked (js-comment-mask scanSource + blank), and a new R6 reads the assignment form err.code = X; err.status = Y bounded to one identifier inside one block plus a 20-line window, reporting a pair it cannot resolve instead of dropping it. Both UNIQUE_VIOLATION producers now derive: packages/rest/src/error-response.ts:996 as '{ status, body }' and packages/drivers/driver-memory/src/memory-unique-constraint.ts:504 as 'assignment' (plus a third at error-response.ts:1539). NO PR: I hit the dispatch's own stop condition -- 'the fix needs any other file'. The widened deriver reads 135 further TRUE producer sites tree-wide (144 → 279 sites), and six of them pin codes currently listed in scripts/error-status-unpinned-baseline.json, so the gate reds with six nowPinned findings until those six rows are removed -- and the dispatch says NEVER touch that file. Direction A is clean: zero emittedNotDocumented findings, so every newly derived status is already documented. Measured in a throwaway worktree: with those six rows removed the gate is GREEN, and GREEN again with #15634's docs diff applied on top, reconciling UNIQUE_VIOLATION at 409. Neither of the other two stop conditions fired -- no EXISTING derived site's status changed, and I found no false pairing from the assignment form on this tree (every R6 site I spot-checked is a real producer, in both statement orders).",
  "tests": "SELF-TEST: `node scripts/check-error-status-conformance.mjs --self-test` EXIT=0 -- 'check-error-status-conformance --self-test: 47 cases pass' (was 40). Two new batteries, floor 23 → 25: '23 - R5b: the body span is brace-BALANCED, and the braces it counts are' (3 cases: conditional-spread body derives / a body with no code fabricates nothing / a brace inside a string does not close the span early) and '24 - R6, the ASSIGNMENT form, and the two bounds that keep it honest.' (4 cases: constants resolve / an unresolvable status is REPORTED not dropped / a different identifier never pairs / a different block never pairs). No existing case weakened.\n\nLIVE VERDICT, main vs branch (`node scripts/check-error-status-conformance.mjs`, exit captured before any pipe):\n  main d30ccb9bd EXIT=0 -- scope: 51 code(s) ... 2243 source files scanned; 144 producer site(s) derived; 56 further ledger code(s) derived but NOT reconciled | reconciled: 19 code(s), 20 pair(s) | unpinned: 32 documented code(s) with no derivable producer (baselined: 32).\n  branch cd26dd16b EXIT=1 -- scope: 51 code(s) ... 2243 source files scanned; 279 producer site(s) derived; 84 further ledger code(s) ... | reconciled: 25 code(s), 26 pair(s) | unpinned: 26 documented code(s) with no derivable producer (baselined: 32) | unresolved: 50 declaration(s) the deriver could not read | six findings, all one shape: 'INVALID_FIELD / INVALID_FILTER / INVALID_QUERY / INVALID_SORT / OBJECT_NOT_FOUND / RECORD_NOT_ACCESSIBLE: baselined as unpinned, but a producer now declares its status -- ratchet the baseline down with --update.' ZERO emittedNotDocumented and ZERO documentedNotReachable findings.\n\nSITE LISTS. R5b before (the only two it could read): error-response.ts:126 DATABASE_ERROR@500, error-response.ts:179 INTERNAL_ERROR@500. R5b after: those two byte-identical, plus 46 more, incl. error-response.ts:996 UNIQUE_VIOLATION@409, :1539 UNIQUE_VIOLATION@409, :893 DELETE_RESTRICTED@409, :922 CONCURRENT_UPDATE@409, :1020 ERR_DATASOURCE_UNAVAILABLE@503, :1086 RECORD_NOT_ACCESSIBLE@403, :1123/:1772 OBJECT_NOT_FOUND@404, :1146/:1652 INVALID_FIELD@400, :1177 PERMISSION_DENIED@403, rest-server.ts:355/:364, trigger-api and plugin-auth terminals. R6 (new): memory-unique-constraint.ts:504 UNIQUE_VIOLATION@409, protocol.ts:894 INVALID_FILTER@400, engine.ts:997 INVALID_SORT@400, comment-access-hooks.ts:186 RECORD_NOT_ACCESSIBLE@403, query-multiplicity.ts:250 INVALID_FILTER@400, filter-comparand-shape.ts:254 INVALID_FILTER@400, and others. Every derived site the old deriver had is still derived at the same status; the diff of the full (code, status, site) dump is additions only.\n\nSCRATCH-WORKTREE PROOF (detached worktree at cd26dd16b, removed afterwards). (a) branch + the six now-pinned rows removed from the baseline: EXIT=0 -- 'unpinned: 26 documented code(s) with no derivable producer (baselined: 26)' / 'OK every derivable runtime status is documented, and every documented status is reachable.' (b) (a) + `git diff origin/main...origin/claude/issue-15362-error-handling-unique-violation | git apply` (1 file, 14 insertions / 14 deletions): EXIT=0 -- 'scope: 52 code(s) reconciled = 50 StandardErrorCode member(s) + 2 ledger code(s) a doc page publishes a status for (INVALID_REQUEST, UNIQUE_VIOLATION); ... 279 producer site(s) derived' / 'reconciled: 26 code(s) with a derived producer, 27 (code, status) pair(s) matched against the docs' / green. That is the proof this card unblocks #15634. (c) control leg -- docs diff WITHOUT the baseline shrink: EXIT=1, same six nowPinned findings and nothing else, so the six-row shrink is the ONLY thing between this branch and a green #15634. The docs change was applied in the throwaway worktree only and is NOT committed here.\n\nABLATIONS (fix committed first; trap 'restore' EXIT INT TERM; absolute paths; restore is `git checkout HEAD -- PATH`; HEAD blob 759d420098b76d4bd9229465ef797e42f4b84476). (1) revert R5b to the brace-free character class: mutation confirmed ON DISK (deleted anchor text 'const close = matchingBrace' count 0, injected marker count 1, blob 4188246bcb10d2884305aa731f5329726259d8a8 != HEAD) → self-test EXIT=1, '2/47 case(s) failed': '23 a conditional-spread body derives across its nested braces' and '23c a brace inside a string does not close the span early'. (2) remove R6 (call site replaced by an empty iterable): mutation confirmed ON DISK (injected marker count 1, the one remaining 'assignmentPairs(src, structural)' line is the function DEFINITION, blob 465cc194884157b1b09fed4418cdd97c52233883 != HEAD) → self-test EXIT=1, '2/47 case(s) failed': '24 the assignment form derives through the constant index' and '24b an assignment pair whose status will not resolve is REPORTED, not dropped'. Both restore legs verified: blob back to 759d4200... and `git diff HEAD --name-only` empty.\n\nDERIVED GATE FAMILY: `node scripts/pm/dispatch-gates.mjs --changed --commands --repo objectstack-ai/objectstack` EXIT=0, answer stated as taken from 'objectstack-ai/objectstack at commit cd26dd16b', change set 1 path (three-dot vs merge base d30ccb9bd) → 29 commands. All 29 run, exit codes captured before any pipe. 28 EXIT=0, 1 EXIT=1 (`pnpm check:error-status-conformance`, the six nowPinned findings above). Named verdicts: `pnpm check:pm-dispatch-gates` → 'dispatch-gates self-test: 1445 cases pass.'; `pnpm check:nul-bytes` → 'check-nul-bytes: OK (scanned 7571 text file(s) ... no raw ASCII control bytes)'; `pnpm check:ratchet-remedy-authority` EXIT=0 (the MAINTAINER-ONLY marker in this file is intact and untouched); `pnpm check:entry-guard`, `check:parse-guard`, `check:cross-package-test-inputs`, `check:driver-memory-census`, `node scripts/check-comment-mask-corpus.mjs` (the corpus gate over the very scanner R5b's brace walk now reads) all EXIT=0. NOT MEASURED on the first pass and re-run to a real reading after `pnpm install` (EXIT=0, 11.3s): 7 commands that had exited 3 'PREREQUISITE NOT MET' or ERR_MODULE_NOT_FOUND -- check-reference-carrier-shape (x2), check-ci-filter-parity, check-closing-keyword-parity (x2), check-comment-mask-corpus, pnpm check:driver-memory-census -- all EXIT=0 on the re-run. Still NOT MEASURED, by the tool's own account: the 3 families whose argv carries a CI-only variable (check-cross-package-test-inputs --union-into, check-shard-attestation, check-test-completeness) and the 36 artifact-roster families it scores silent for every card. Whole-repo `pnpm lint` was NOT named by the derivation and was not run.\n\nNARROWING DECLARED: no repo-wide scan was run; the derived family above is the coverage, and CI runs the full farm regardless.",
  "mcp_calls": "2 -- two `search_issues` calls: one duplicate check for the out-of-scope finding (0 hits) and one control query in the same session that returned #15633, so the null read is a measurement rather than a dead channel. Everything else went through REST.",
  "open_questions": [
    {
      "question": "The widened deriver pins six codes the ratchet baseline still lists as having no derivable producer -- INVALID_FIELD, INVALID_FILTER, INVALID_QUERY, INVALID_SORT, OBJECT_NOT_FOUND, RECORD_NOT_ACCESSIBLE -- so `check:error-status-conformance` reds with six nowPinned findings until those six rows leave scripts/error-status-unpinned-baseline.json. The dispatch says NEVER touch that file, and 'the fix needs any other file' is one of its stop conditions, so I stopped rather than deciding this myself. May the six rows be removed in this PR?",
      "options": [
        "A -- remove exactly those six rows BY HAND in this PR (not `--update`, which regenerates the whole list and could admit a row nobody read). This is the SHRINK direction: the gate's own failure text says 'ratchet the baseline down with --update', the file's own note says 'a row that becomes pinned must be removed', and the script's self-test battery 11 pins the asymmetry deliberately -- 11b asserts that neither ratchet-DOWN message carries the MAINTAINER-ONLY marker, which only the baseline-EXPANDING remedy does. Each removed row is a row that has become false: all six codes demonstrably have producers on this tree. Measured green (leg (a) above), and green with #15634 (leg (b)).",
        "B -- the maintainer removes the six rows (or runs --update) in a separate, maintainer-owned commit, and this branch lands after it. Costs a serialisation but leaves every ratchet edit in maintainer hands.",
        "C -- narrow the deriver so only the UNIQUE_VIOLATION producers are picked up. ⛔ I do not recommend this and did not implement it: it would mean gerrymandering a derivation rule to a predetermined answer, which is the exact failure mode this gate's header exists to prevent, and it contradicts the ruling's 'widen R5b to a brace-balanced body span'."
      ],
      "recommendation": "A. The six rows are false statements about the tree, removing them STRENGTHENS the shrink-only ratchet, and the script itself grades this remedy as the author's own rather than maintainer-only (battery 11b). It is a six-line deletion I can push onto the existing branch in one step, after which the branch is green and #15634 goes green unchanged. I stopped only because the dispatch fenced the file explicitly; one word and the PR is up. If A is granted, the PR body should name the six rows and quote the two legs above, so a reviewer can see the shrink is a measurement rather than a convenience."
    }
  ],
  "out_of_scope_findings": [
    "filed as #15644: check:error-status-conformance leaves 36 real producers unresolved -- StandardErrorCode.enum.CODE is one mechanical shape lookup() cannot read (it allows at most one dot, and a z.enum declaration is not indexed). Surfaced BY this card's R6, which now reports them instead of dropping them. Unassigned, no label; the issue notes that fixing it also moves the same baseline ratchet."
  ]
}

---

Generated by Claude Code