decompose review-004 recorded findings: 15 disposition tasks + the review-004-fixes gate (sqlite seam panic-safety, watcher-death subscribe + initial-stat, bridge alignment, scheduler classification, substrate SAFETY delta; pg forwarder hardening + diagnosability, BIGINT stamp decision + fix, log-facade decision; core offset pin + Display forging, mem doc notes, pg identifier note, tokio dev-dep normalization) — taskgraph validate green (95)

tasks/core-fix-display-log-forging.md

@@ -0,0 +1,59 @@
+---
+id: core-fix-display-log-forging
+name: Control-char-safe Display for the consumer-string error variants (review 004 item 14)
+status: pending
+depends_on: []
+scope: single
+risk: low
+impact: isolated
+level: implementation
+tags: [review-004-fixes, core, errors]
+---
+
+## Description
+
+The core error `Display` log-forging risk, per
+`docs/reviews/004-pre-release-general-review.md` §"Findings recorded,
+not fixed" item 14: `InvalidName`/`ReservedName`/`InvalidSpec`
+interpolate raw consumer strings into `Display`; control characters
+can forge log lines in naive consumers. Typical-idiom risk, low — but
+the fix is small and real.
+
+Fix: escape/sanitize the interpolated payload in the three variants'
+`Display` arms (e.g. `char::escape_debug` or a control-char filter) so
+the rendered message cannot carry raw newlines/control bytes from
+consumer input. The error taxonomy itself is untouched — variants,
+kinds, and match sites stay exactly as pinned (ADR-008 §5); only the
+rendered text's hygiene changes.
+
+While there: grep the `Error` enum's other `Display` arms for the same
+consumer-string interpolation class; if any other variant carries it,
+include it in the same fix (and say so in Notes).
+
+## Acceptance Criteria
+
+- [ ] The three variants' `Display` renders consumer strings
+      control-char-safe — pinned by test (a name/spec carrying `\n`
+      and control bytes renders without any raw control byte)
+- [ ] The error taxonomy unchanged (variants, kinds, match sites);
+      existing error/validation tests green unchanged
+- [ ] Any additional same-class `Display` arms included (or the
+      absence recorded in Notes)
+- [ ] `cargo test -p alkstore`, clippy `-D warnings`, fmt clean; doc
+      gate green
+
+## References
+
+- docs/reviews/004-pre-release-general-review.md §"Findings recorded,
+  not fixed" item 14 (the finding)
+- docs/architecture/decisions/008-*.md §5 (the error taxonomy — the
+  part that must not change)
+- alkstore/src/errors (the `Display` arms)
+
+## Notes
+
+> To be filled by implementation agent
+
+## Summary
+
+> To be filled on completion