test(runtime): both swallow-family members in runtime are OUT — pin the delivery, record the census false positive (#13451)

* test(runtime): pin that a refused API-key insert is delivered, not swallowed

The swallow-family census reports `domains/keys.ts` as tier-1 DARK on three
mechanical conjuncts and deliberately leaves the fourth -- "and the caller
still reports success" -- to a person. The answer at this site is no: every
path out of the catch hands the caller a 500 envelope and returns no key
material, which is AGENTS.md's third legal answer and puts the site OUT of
the repair programme rather than in it.

That ruling had nothing holding it up. Pin the delivery instead: the error
envelope (500 / INTERNAL_ERROR), the absence of any key material, and the
non-echo of the driver error the catch discards on purpose. Record the
ruling at the site, including why the FAILURE_PROPAGATION_SITES declaration
belongs to the programme's last step rather than to this one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WkdHQwHr2KQmaX7P1BHzi

* test(runtime): type the objectql slot lookup by inference, not `any`

check:slot-lookup flagged the new helper's `const ql: any = kernel.getService(...)`
as a NEW service-lookup erasure (#4251). The annotation bought nothing — the fake
kernel is already untyped — so the inferred form satisfies the ratchet and the
population returns to its baseline 107 with none new.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WkdHQwHr2KQmaX7P1BHzi

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Elon Musk

packages/runtime/src/domains/keys.ts

@@ -190,6 +190,34 @@ export async function handleKeysRequest(
         inserted = await ql.insert('sys_api_key', row, { context: { isSystem: true } });
     } catch {
         // Never surface the underlying error (could echo row contents).
+        //
+        // [#12981] This catch is silent BY DESIGN and it is NOT a durability
+        // swallow. `scripts/measure-durability-swallow-family.mjs` reports this
+        // site as tier-1 DARK because membership is decided on three mechanical
+        // conjuncts -- silent catch, no rethrow, an awaited write in the `try`
+        // -- and the census deliberately leaves the fourth, "and the caller
+        // still reports success", to a person. Here the answer is NO: every
+        // path out of this catch hands the failure to the caller as a 500
+        // envelope and no key material is returned, so nothing claims to have
+        // persisted and the request does not look normal from the outside.
+        //
+        // AGENTS.md "Degradation log levels" names that the third legal answer
+        // and forbids bolting a `logger.error` onto it: this branch's common
+        // case is a rejected request, and one durability `error` per rejected
+        // request is the mirror-image failure that made the founding incident's
+        // `warn` unreadable in the first place.
+        //
+        // Do NOT "repair" this site by adding a log. The correct declaration is
+        // an entry in check-durability-degradation-log-level.mjs's
+        // FAILURE_PROPAGATION_SITES, keyed `keys.ts::handleKeysRequest`, and it
+        // belongs to the LAST step of the #12981 programme -- the one that
+        // widens DURABILITY_CRITICAL_CALLEES. Declared before that step it would
+        // go red as a STALE entry, because that vocabulary has no `insert` and
+        // so matches no seam in this function today.
+        //
+        // The delivery this ruling rests on is pinned in
+        // `http-dispatcher.keys.test.ts`; if you change what this catch
+        // returns, that pin is what will stop you.
         return { handled: true, response: deps.error('Failed to create API key', 500) };
     }
     const id = inserted?.id ?? (Array.isArray(inserted) ? inserted[0]?.id : undefined);

packages/runtime/src/http-dispatcher.keys.test.ts

@@ -330,3 +330,67 @@ describe('HttpDispatcher.handleKeys — organization inheritance (#8287)', () =>
     expect(res.body.data.active_organization_id).toBeUndefined();
   });
 });
+
+/**
+ * [#12981] The mint path's `ql.insert` catch is SILENT, and that is the correct
+ * shape -- every path out of it hands the failure to the caller. The swallow-
+ * family census (`scripts/measure-durability-swallow-family.mjs`) reports the
+ * site as tier-1 DARK because it decides membership on three mechanical
+ * conjuncts and leaves "and the caller still reports success" to a person; the
+ * answer here is no, which is what puts the site OUT of the repair programme
+ * under AGENTS.md's third legal answer ("a failure handed to the CALLER is not
+ * a degradation at all").
+ *
+ * These pins exist because that ruling is otherwise a JUDGEMENT with nothing
+ * holding it up. The census will keep listing this site as DARK until the
+ * programme's last step, so the next reader arrives at a file the worklist
+ * accuses and a comment that says "not guilty". What makes the difference
+ * measurable is that the delivery is pinned: turn this catch into a real
+ * swallow and these go red, which is precisely the transition -- from
+ * delivering to silent-success -- that the census cannot see and this card
+ * exists to prevent.
+ */
+describe('HttpDispatcher.handleKeys — a refused insert is DELIVERED, never swallowed (#12981)', () => {
+  /** The mint path with a storage layer that refuses every write. */
+  function kernelRefusingInsert(driverMessage: string) {
+    const { kernel, rows } = makeKernel();
+    const ql = kernel.getService('objectql');
+    ql.insert = async () => { throw new Error(driverMessage); };
+    return { kernel, rows };
+  }
+
+  it('answers the ADR-0112 error envelope (500 / INTERNAL_ERROR) rather than reporting success', async () => {
+    const { kernel, rows } = kernelRefusingInsert('connection refused');
+    const res = responseOf(await dispatcher(kernel).handleKeys('POST', { name: 'CI token' }, ctx()));
+
+    // The whole point: the requester was TOLD. Nothing here looks normal from
+    // the outside, so there is no durability degradation to escalate.
+    expect(res.status).toBe(500);
+    expect(res.body.success).toBe(false);
+    expect(res.body.error.code).toBe('INTERNAL_ERROR');
+    expect(res.body.error.httpStatus).toBe(500);
+    expect(rows).toHaveLength(0);
+  });
+
+  it('returns no key material — a caller never holds a credential that was never stored', async () => {
+    const { kernel } = kernelRefusingInsert('connection refused');
+    const res = responseOf(await dispatcher(kernel).handleKeys('POST', { name: 'CI token' }, ctx()));
+
+    // A 201 carrying `data.key` after a refused insert would be the exact
+    // "claims to persist, did not persist" shape #12981 is about.
+    expect(res.body.data).toBeUndefined();
+    expect(JSON.stringify(res.body)).not.toMatch(/osk_/);
+  });
+
+  it('does not echo the driver error — row contents cannot leak through the envelope', async () => {
+    // The reason this catch discards the caught value at all, stated at the
+    // site: a driver error can quote the offending row.
+    const { kernel } = kernelRefusingInsert(
+      'duplicate key value violates unique constraint, row: sentinel-row-content',
+    );
+    const res = responseOf(await dispatcher(kernel).handleKeys('POST', { name: 'CI token' }, ctx()));
+
+    expect(JSON.stringify(res.body)).not.toMatch(/sentinel-row-content/);
+    expect(res.body.error.message).not.toMatch(/duplicate key/);
+  });
+});