Spec half of #16146, split by director ruling (decision batch #58, 2026-09-06, option C — the refusal/fault distinction is a producer-side declaration on the published envelope, not a status heuristic and not a second allow-list).
Why
declaredServerFaultAnswer (packages/rest/src/error-response.ts) withholds the message of every error that declares status >= 500. declaresServerFault (packages/types/src/error-leak.ts) is status >= 500 && code — a deliberate refusal such as the /references 501 written under ADR-0110 D3 also satisfies it, so switching the gate to declaresServerFault (the reframing in triage comment 5556832849) withholds exactly the same messages. Nothing on the wire today lets a producer say "this 5xx is a refusal whose prose is for the caller". PR #16143 patched one route locally; #16146 shows the class recurs on every gate.
Scope
Consumer half
#16146 (relay change in error-response.ts, retire the route-local patch from #16143) is pm:blocked on this card. #14656's logging question is expected to fall out of the same field.
Acceptance
Spec half of #16146, split by director ruling (decision batch #58, 2026-09-06, option C — the refusal/fault distinction is a producer-side declaration on the published envelope, not a status heuristic and not a second allow-list).
Why
declaredServerFaultAnswer(packages/rest/src/error-response.ts) withholds the message of every error that declaresstatus >= 500.declaresServerFault(packages/types/src/error-leak.ts) isstatus >= 500 && code— a deliberate refusal such as the/references501 written under ADR-0110 D3 also satisfies it, so switching the gate todeclaresServerFault(the reframing in triage comment 5556832849) withholds exactly the same messages. Nothing on the wire today lets a producer say "this 5xx is a refusal whose prose is for the caller". PR #16143 patched one route locally; #16146 shows the class recurs on every gate.Scope
disclose: trueorrefusal: true) meaning: the producer authored this message for the caller; boundaries keep it verbatim./analytics/query仍把 RLS 策略字段名回显给调用方 —— read-scope 拒收的泄漏在姐妹面上没堵,#5367 只堵了 dataset 路由 #5811 / fix(service-analytics,rest): analytics dimension 的源字段闸门 —— 不存在的 dimension 答 400 INVALID_FIELD,dataset 500 不再回显 SQL (#5520) #5667 behaviour: an undeclared or fault-declared 5xx has its detail withheld from the body and logged for the operator.Consumer half
#16146 (relay change in
error-response.ts, retire the route-local patch from #16143) ispm:blockedon this card. #14656's logging question is expected to fall out of the same field.Acceptance