service-datasource still reads the retired turso `config.timeout`, so a datasource authored with the canonical `timeoutMs` is dropped at the seam that builds the driver config

[os-sales]

Surfaced while implementing #15682 (stack card 6/6 of #14478). Not in that card's scope — it lands in packages/services/service-datasource, and the card owns the gate's population plus @objectstack/driver-turso. Filed bare for triage.

What was measured

packages/services/service-datasource/src/turso-driver-config.ts:170:

  timeout: ({ config }) => (typeof config.timeout === 'number' ? config.timeout : undefined),

This is the reader table that turns a DatasourceConnectionSpec into a libSQL driver config — the ONE place both loaders go through since #7314. It reads the authored key config.timeout.

#15680 (stack card 5/6) renamed that authored key: packages/spec/src/data/driver/turso.zod.ts now declares timeoutMs, and timeout is a retiredKey() tombstone. So the spelling this reader consults is the one the authoring contract now refuses, and the canonical spelling is the one it does not read.

Why nothing catches it

Three things, each of which would normally have:

1. No typecheck. TursoConfigSource.config is declared as a bare string-keyed bag (Record, values unknown) at :94, "narrowed to a bag so each reader can type-test its own key" — so config.timeout compiles whatever the schema says.
2. The test authors the retired spelling. src/__tests__/turso-driver-config.test.ts passes config: { … timeout: 9000 } at :47 and timeout: 0 at :100, and asserts it flows through. It is green, and it stays green for exactly the behaviour that is now wrong — a canonical timeoutMs has no case at all.
3. The ADR-0087 conversion makes it worse, not better. turso-config-timeout-to-timeout-ms (protocol 18, registered on the same stack) rewrites a stored config.timeout to timeoutMs on load. So after the conversion replays, the bag holds timeoutMs and this reader finds nothing — the conversion and the reader now disagree by construction.

Blast radius today

Bounded, and worth stating precisely rather than overstating: TursoDriverConfig.timeout is itself never forwarded to @libsql/client (a separate finding, filed alongside this one), so no operation changes its timeout as a result. What is broken is the seam: the reader table's whole design property — "read every key, enforced by a mapped type over Required of the config" — is true of the KEY LIST and silent about the SPELLING each reader consults, and this is the first spelling to move.

Suggested repair

Read config.timeoutMs, and give the test a case authored the canonical way. Whether the retired spelling should still be read as a fallback for stored rows that never met the conversion is the actual decision here — the sibling authToken reader keeps a legacy arm on purpose and documents why (#8152), so this is not obvious either way and belongs to whoever owns the seam.

Related: #14478 · #15680 · #15682

[claude]

Repaired on PR #15988 (stack card 5/6, the branch that made the rename) at commit
808691883, not in a PR of its own — the defect and its cause land on the same branch, so
it is repaired before that PR merges rather than after.

⛔ Deliberately no closing keyword here: this issue stays open until #15988 merges, and
the PM closes it from there.

The reader. service-datasource/src/turso-driver-config.ts:170 now reads
config.timeoutMs. Reproduced before fixing, against the seam's source, with the reader
reverted to the pre-fix blob and restored under a trap (blob-hash proved both ways):

BEFORE  authored { url, timeoutMs: 9000 } -> {"url":"libsql://app.turso.io"}          .timeout = undefined
        authored { url, timeout:   9000 } -> {"url":"libsql://app.turso.io","timeout":9000}
AFTER   authored { url, timeoutMs: 9000 } -> {"url":"libsql://app.turso.io","timeout":9000}
        authored { url, timeout:   9000 } -> {"url":"libsql://app.turso.io"}          .timeout = undefined

The driver-side key stays spelled timeout — TursoDriverConfig.timeout is
published-but-inert (#16024), and renaming an inert key ratifies it as real.

The decision you flagged as the actual one — no legacy arm. Your report is right that
authToken's legacy arm made it non-obvious, so it was decided from the seam's own
precedent rather than invented: default-datasource-driver-factory.ts answers it twice
already, for sqlite ("filename is the whole contract … so no ?? tolerance survives
here") and for mongo ("url is the one spelling"), both citing the same
datasource-config-driver-key-aliases conversion. A renamed datasource config key arrives
canonical from two directions: authoring refuses the retired spelling at the door, and a
stored sys_metadata row replays the full ADR-0087 chain — retiredFromLoadPath entries
included — at loadDatasourceRows / loadDatasourceRow in datasource-admin-plugin.ts,
which is in this very package. So the conversion you name in point 3 is not "the reader
and the conversion disagreeing"; it is what makes the fallback unnecessary. authToken is
not a counter-precedent: its arm exists for a LIVE route (host boot translating
OS_DATABASE_AUTH_TOKEN into a config that never meets the authoring schema).

Point 2 of your report — the test — is fixed as the class, not the instance. The three
sites that authored the retired spelling now author the canonical one, and the file gains
cases derived from TursoConfigSchema's own retiredKey() tombstones: every canonical
replacement must be consulted by some reader, and no retired spelling may be. Against the
unfixed reader they fail with no reader consults the canonical timeoutMs (retired: timeout) — the rename moved the authoring contract and left this seam behind. They hold
for the next rename without being edited.

Your "blast radius" framing was the useful part and it held up. A sweep of all eight
keys the rename card moved, for readers going through an untyped bag or a string key
across every workspace package, found TursoConfig.timeout was the only one with a
live string-keyed consumer; the other seven measured zero. Full table in the PR comment.

check:duration-unit-keys still reads 215 among 838, zero offenders, exit 0 — a reader
fix did not move it.

---

Generated by Claude Code