alkstore/tasks/core-fix-display-log-forging.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
core-fix-display-log-forging	Control-char-safe Display for the consumer-string error variants (review 004 item 14)	pending		single	low	isolated	implementation	review-004-fixes core errors

Description

The core error Display log-forging risk, per docs/reviews/004-pre-release-general-review.md §"Findings recorded, not fixed" item 14: InvalidName/ReservedName/InvalidSpec interpolate raw consumer strings into Display; control characters can forge log lines in naive consumers. Typical-idiom risk, low — but the fix is small and real.

Fix: escape/sanitize the interpolated payload in the three variants' Display arms (e.g. char::escape_debug or a control-char filter) so the rendered message cannot carry raw newlines/control bytes from consumer input. The error taxonomy itself is untouched — variants, kinds, and match sites stay exactly as pinned (ADR-008 §5); only the rendered text's hygiene changes.

While there: grep the Error enum's other Display arms for the same consumer-string interpolation class; if any other variant carries it, include it in the same fix (and say so in Notes).

Acceptance Criteria

• The three variants' Display renders consumer strings control-char-safe — pinned by test (a name/spec carrying \n and control bytes renders without any raw control byte)
• The error taxonomy unchanged (variants, kinds, match sites); existing error/validation tests green unchanged
• Any additional same-class Display arms included (or the absence recorded in Notes)
• cargo test -p alkstore, clippy -D warnings, fmt clean; doc gate green

References

• docs/reviews/004-pre-release-general-review.md §"Findings recorded, not fixed" item 14 (the finding)
• docs/architecture/decisions/008-*.md §5 (the error taxonomy — the part that must not change)
• alkstore/src/errors (the Display arms)

Notes

To be filled by implementation agent

Summary

To be filled on completion