---
id: core-fix-display-log-forging
name: Control-char-safe Display for the consumer-string error variants (review 004 item 14)
status: pending
depends_on: []
scope: single
risk: low
impact: isolated
level: implementation
tags: [review-004-fixes, core, errors]
---

## Description

The core error `Display` log-forging risk, per
`docs/reviews/004-pre-release-general-review.md` §"Findings recorded,
not fixed" item 14: `InvalidName`/`ReservedName`/`InvalidSpec`
interpolate raw consumer strings into `Display`; control characters
can forge log lines in naive consumers. Typical-idiom risk, low — but
the fix is small and real.

Fix: escape/sanitize the interpolated payload in the three variants'
`Display` arms (e.g. `char::escape_debug` or a control-char filter) so
the rendered message cannot carry raw newlines/control bytes from
consumer input. The error taxonomy itself is untouched — variants,
kinds, and match sites stay exactly as pinned (ADR-008 §5); only the
rendered text's hygiene changes.

While there: grep the `Error` enum's other `Display` arms for the same
consumer-string interpolation class; if any other variant carries it,
include it in the same fix (and say so in Notes).

## Acceptance Criteria

- [ ] The three variants' `Display` renders consumer strings
      control-char-safe — pinned by test (a name/spec carrying `\n`
      and control bytes renders without any raw control byte)
- [ ] The error taxonomy unchanged (variants, kinds, match sites);
      existing error/validation tests green unchanged
- [ ] Any additional same-class `Display` arms included (or the
      absence recorded in Notes)
- [ ] `cargo test -p alkstore`, clippy `-D warnings`, fmt clean; doc
      gate green

## References

- docs/reviews/004-pre-release-general-review.md §"Findings recorded,
  not fixed" item 14 (the finding)
- docs/architecture/decisions/008-*.md §5 (the error taxonomy — the
  part that must not change)
- alkstore/src/errors (the `Display` arms)

## Notes

> To be filled by implementation agent

## Summary

> To be filled on completion