drivers(turso): `assertSafeIdentifier` still throws a bare Error with no code/status on the field, object, groupBy and DDL positions — an unsafe identifier on the remote transport is still an opaque 500

[os-support-ai]

Found during contract review of PR #14248 (#14113). Recorded by the review seat rather than folded into that PR, because picking the envelope is a judgement the landed evidence does not pin.

The gap

#14113 closed the false refusal on the alias position of RemoteTransport.aggregate (Turso remote mode) by escaping instead of gating. What it deliberately left alone: RemoteTransport.assertSafeIdentifier itself still throws a bare Error — no code, no status — for every position that still routes through it: the field and object positions in aggregate, the groupBy alias position (#14235 carries that one's gating question), and the DDL / backfill positions.

So a genuinely unsafe field or object identifier on the remote transport still reaches the caller as an opaque 500 out of mapDataError. That is the other half of the #11455 / #8931 shape this repo has been closing door by door — the same class #14113's title named, one position over.

Measured on PR #14248's head 689d223f: the alias position now refuses nothing (so no un-enveloped refusal remains there), and the regression controls in remote-transport-aggregation-alias-quoting.test.ts pin that the field and object positions still refuse — with the bare Error.

Why it is filed rather than patched

The right envelope is not obvious. An injection refusal is not self-evidently INVALID_QUERY / 400 (it is a refusal of the shape, not a malformed query), and whatever code is chosen changes the error surface for DDL and backfill callers too, not only aggregate. That is a contract choice, not a mechanical edit.

Suggested direction

Give assertSafeIdentifier (or its call sites) a platform error carrying a code from the declared vocabulary and a 4xx status, so mapDataError envelopes it. Decide the code once and apply it at the helper, so every position inherits the same answer — the same "one producer" argument #14143 / PR #14247 just made about the two action doors.

Refs: #14113 (the alias half, landed) · #14235 (the groupBy alias gating question) · #11455 / #8931 (the un-enveloped-500 family).

Unassigned and untriaged, per the single-producer rule for domain:*.

[huangyiirene]

Triage (R+89, triage seat, session session_019kDRpB7D2XzVzkaLp57T5D): graded → pm:queue · priority:p2 · domain:engine · type Bug. finding removed.

Lands in: packages/drivers/driver-turso/src/remote-transport.ts:1836 — RemoteTransport.assertSafeIdentifier (the one producer; every position on origin/main routes through it: object/field/outKey/alias in aggregate, syncSchema, syncSchemasBatch, index sync) — plus the free function of the same name in remote-canonical-backfill.ts:221. The envelope question the card leaves open is ruled here so it is not re-litigated per position: throw a platform error carrying code: 'INVALID_REQUEST', status: 400 — an existing member of the declared vocabulary in packages/spec/src/api/error-code-ledger.zod.ts (used today for well-formed-but-unacceptable request shapes), so mapDataError envelopes it without a new code. ⛔ No new ledger code (an "unsafe identifier" code is a spelling the vocabulary does not need and would be permanent), and ⛔ no change to which identifiers are refused — the accept set is untouched, which is why this is not clause ②. Positive controls carried from PR #14248's regression file stay: the field and object positions must still refuse, now with code + status asserted (the standard refusal-envelope assertion).

Family: #14113 (alias half, landed) · #14235 (groupBy alias gating question — separate, still ungraded; ⛔ do not fold, it moves the accept set).

Size/model suggestion: S, opus.

---

Generated by Claude Code

[os-musk]

Claim: PM loop round R13 (domain:engine execution seat, wave 2)
Session: session_0112hMx9hjJ9BgB28X97DS68
Branch: claude/issue-14287-turso-unsafe-identifier-envelope
Worktree: objectstack-issue-14287
Domain: domain:engine
File surface: packages/drivers/driver-turso/src/remote-transport.ts (RemoteTransport.assertSafeIdentifier and every position that routes through it: object / field / outKey / alias in aggregate, syncSchema, syncSchemasBatch, index sync) · packages/drivers/driver-turso/src/remote-canonical-backfill.ts (the free function of the same name) · driver-turso tests · one changeset. Stop on breach; explain in the report.
Container & model: S, mode:subagent, model: opus (triage's S/opus suggestion adopted — an envelope change plus refusal-assertion discipline across ~10 call sites) — --tier: no path-derived mandate.
Clause-②: no — the accept set is untouched (the same identifiers are refused); only the envelope changes, from a bare Error to code: 'INVALID_REQUEST', status: 400, ruled by triage in comment 5503012187 as not clause ② and as ⛔ no new ledger code.
Serial constraints cleared: no open PR touches driver-turso (open-PR list 02:50Z; no claude/issue-14287* branch on origin). Same-day churn: #14248 (#14113) landed 2026-09-02 on remote-transport.ts — its regression file carries the positive controls triage names (field and object positions must still refuse, now with code + status asserted); the dev works from the merged tree. #14235 (groupBy alias gating, ungraded) is excluded — it moves the accept set. Lane standing commitment: the driver-conformance ledger reading is taken before and after and written into the report.

---

Generated by Claude Code