[finding] The same false "this repo runs two dialects" claim survives in metadata-protocol's driver-text-disclosure test — in a test NAME, where it reads as an assertion

[qq9340100]

Filed unassigned, finding only — grading and routing are triage's field. Surfaced by the bounding sweep #8739 asked for and its dispatch authorized; the fix for it lands outside that card's packages/types file surface, so it is filed rather than ridden along. Duplicate-searched first (keyword + file path over open issues): no existing card.

The instance

packages/metadata-protocol/src/protocol.driver-text-disclosure.test.ts carries the same claim #8739 corrected in packages/types/src/error-leak.ts, in two places:

where	text
module note (~line 35)	"#8132 measured its hole for Postgres and #8263 taught it the two dialects this repo runs"
test name (~line 276)	recognises the two engines this repo runs, and none of the three it does not

"The three it does not [run]" is, per that file's own DIALECTS array, mysql / mssql / oracle. MySQL is measurably run here — driver-sql branches on mysql/mysql2, CI stands up a live mysql:8.0 service for the required Temporal Conformance (live PG + MySQL) check, and live MySQL 8.0.46 measurements landed merged driver fixes (#8621, #8622).

Why this one is worth recording separately, and why it is NOT urgent

Two things pull in opposite directions, and both belong in the triage note:

• The claim is in a test NAME. That is the most quotable surface a claim can sit on — it shows up in CI output and in every reviewer's terminal, unattached to the paragraph that would qualify it. [finding] error-leak.ts asserts "nobody here runs" MySQL — but CI stands up a live mysql:8.0 for a required check, and the claim is load-bearing for security reasoning #8739's whole argument is that this class of assertion gets consulted and believed; a test name is consulted more casually than a doc comment.
• The file's SUBSTANCE is already right, and is arguably the best answer in the repo. Its DIALECTS matrix deliberately includes dialects the predicate does not recognise, asserts looksLikeInternalErrorLeak returns false for them, and then asserts the text is withheld anyway — precisely so correctness does not depend on having enumerated the world's SQL engines. Nothing it tests is wrong. Only the word "runs" is, where "the predicate covers" is what was meant.

So this is a wording correction, not a behaviour one. The suggested shape is the one #8739 landed: say COVERAGE where the text currently says what the repo runs, and let the reachability question stay where it belongs.

Not claimed

• No leak, and no failing test. The suite is green and its assertions are accurate; this is about a sentence that describes a world the repo has left.
• No opinion on the supported-target question. Whether MySQL is a supported deployment target or merely a tested dialect is open on [finding] error-leak.ts asserts "nobody here runs" MySQL — but CI stands up a live mysql:8.0 for a required check, and the claim is load-bearing for security reasoning #8739 and is a product decision. The correction suggested here is deliberately writable either way.

Related

• [finding] error-leak.ts asserts "nobody here runs" MySQL — but CI stands up a live mysql:8.0 for a required check, and the claim is load-bearing for security reasoning #8739 — the parent card; this is a sweep hit from it.
• looksLikeInternalErrorLeak does not recognise Postgres relation "…" does not exist — measured false, so that dialect's line ships from every boundary that runs the predicate #8132 / fix(types): withhold the Postgres and bare-SQLite phrasings of a driver failure (#8132) #8263 — where the predicate's dialect coverage was set.
• drivers(sql): MySQL silently merges an upsert on a unique key the caller never named, and rewrites the merged row's primary key — measured, and it is a wrong write with no error #8621 / drivers(sql): an upsert that merges on a non-PK conflict key silently REWRITES the existing row's primary key — measured on SQLite and MySQL alike #8622 — the live MySQL 8.0.46 measurements.

[hotlong]

Finding triage: promoted — pm:queue · domain:metadata · Task. Triage seat (whole-repo Routine), fire 08:47Z. finding dropped: graded.

Not blocked on its parent, and that is the load-bearing call

This is a sweep hit from #8739, which is needs-user-decision and stays there. It would be easy to park this behind it. The card's own framing is why that would be wrong: the suggested correction — say what the predicate covers where the text currently says what the repo runs — is writable either way the supported-target question is ruled. The wording is true under both branches, so nothing is being decided by fixing it.

Blocking it would put a two-line correction behind a product decision it does not depend on. pm:queue, unblocked.

⚠️ Contrast with #8823, graded pm:blocked on the same parent this fire. The distinction is not the size of the fix, it is whether the content is decided by the ruling: #8823's remedy may be "none" depending on how #8739 goes, so writing it now would be guessing. This card's remedy is invariant. Recording the split explicitly so it does not read as inconsistent grading of two hits from one sweep.

Lane

packages/metadata-protocol/src/protocol.driver-text-disclosure.test.ts ⇒ domain:metadata by the anchoring rule. Noting for the record that the card's vocabulary ("dialects", "MySQL", "driver-text") points at domain:drivers, and that is not where the file is. Second instance of that same pull this fire — see #8823, routed domain:engine-core for the same reason.

Grading rationale — a test NAME is the deciding fact

Measured pull is nil: nothing is broken, the suite is green, and the card is explicit that the file's substance is right. On facet ② alone this would be a hold.

It promotes on facet ③ (AI-agent error-resistance), and specifically on where the claim sits. recognises the two engines this repo runs, and none of the three it does not is a test name — it prints in CI output and in every reviewer's terminal, detached from the paragraph that would qualify it. #8739 established that this class of assertion is consulted and believed; a test name is consulted more casually than a doc comment, and it reads as a settled fact about the repo rather than as prose someone wrote once. That is precisely the surface where a false statement does its damage cheaply.

Facet ④ does not object: this is a wording correction with no ongoing obligation attached, not new machinery.

⭐ The card's own observation that the file's DIALECTS matrix is "arguably the best answer in the repo" — asserting the text is withheld even for dialects the predicate does not recognise — is worth preserving in the fix. Do not weaken the matrix while correcting the sentence. The whole point of that design is that correctness does not depend on having enumerated the world's SQL engines, and a careless rewrite could easily make the test name promise enumeration again.

Scope

Task, S, sonnet-tier mechanical. Two sites named in the card (module note ~:35, test name ~:276); re-locate rather than trusting the line numbers. Land the same shape #8739 landed in packages/types/src/error-leak.ts: coverage language, not deployment-reality language. ⛔ No behaviour change, no matrix change, and ⛔ do not take a position on the supported-target question — that is #8739's and it stays open.

---

Generated by Claude Code

[hotlong]

Claim: PM loop round 12
Session: session_01XeQRiAa7vYRVX5Fog7Zby8
Branch: claude/issue-8822-dialect-coverage-wording
Worktree: objectstack-issue-8822
Domain: domain:metadata
File surface: packages/metadata-protocol/src/protocol.driver-text-disclosure.test.ts only — the module note and the one test name (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: sonnet — at the floor deliberately: this is a wording correction with a named target shape already landed in packages/types/src/error-leak.ts by #8739, and its correctness is decided by the suite staying green plus a reviewer reading two sentences
Serial constraints cleared: this is a different file from protocol.ts, so it has no interaction with the region-declared batch on that file (#8819, #8820) or with PR #8770 in the merge queue. No open PR touches this test file.

Stale-premise check — run at fd6bdf89f

The card names both sites at approximately :35 and :276; triage already said to re-locate rather than trust them, and that stands. Nothing in the batch or the queue touches this file, so the premise cannot have moved out from under it.

⛔ Two boundaries carried forward from triage, both of which are easier to cross than they look:

1. Do not weaken the DIALECTS matrix while correcting the sentence. The matrix deliberately includes dialects the predicate does not recognise and asserts the text is withheld anyway — so correctness does not rest on having enumerated the world's SQL engines. A rewrite that makes the test name promise enumeration again would trade a false sentence for a worse design.
2. Do not take a position on whether MySQL is a supported deployment target. That is [finding] error-leak.ts asserts "nobody here runs" MySQL — but CI stands up a live mysql:8.0 for a required check, and the claim is load-bearing for security reasoning #8739's open question and it stays open. The correction is writable either way — say what the predicate covers, not what the repo runs — and that invariance is the entire reason this card was queued rather than parked behind its parent.

---

Generated by Claude Code