Sloth-ninja tightens error handling without exposing the machinery

Production incident 04/08/2026: real Supabase errors were invisible.
safeErrorLog/safeErrorMessage flattened PostgrestError plain objects to
the literal "Unexpected error", and 56 route/middleware sites sent the
raw DB/provider error message to the browser while logging nothing
server-side.

- safeError.ts: extract message/code/details/hint from non-Error
  message-bearing objects (known string fields only, always redacted);
  new GENERIC_ERROR_DETAIL constant and failRequest() helper (log
  redacted server-side + fixed generic client detail).
- asyncHandler.ts: use the shared constant.
- middleware/auth.ts: failure paths now console.error (devLog was
  dev-only, so production logged nothing); fixed 401/500 details.
- routes/{chat,projects,documents,tabular,workflows,user}.ts: every
  DB/provider-originated `detail: error.message` send converted to
  failRequest; user.ts 500-status errorMessage catches now log via
  safeErrorLog and send the fixed generic detail.
- New lib/safeError.test.ts: 17 tests pinning extraction, redaction,
  fallbacks and failRequest behaviour.

Hand-written validation details, multer 400s, MCP-connector actionable
errors and redacted SSE stream events left unchanged by design.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- safeErrorMessage: revert the object-message widening - extraction is
  LOG-ONLY (all call sites are client-facing SSE/persisted text and libs
  rethrow raw Supabase plain objects); non-Error objects keep the fallback.
  safeErrorLog extracts independently, unchanged.
- routes/user.ts errorMessage(): Error instances keep their actionable
  message (redacted, string code appended); plain objects/strings degrade
  to GENERIC_ERROR_DETAIL - never join details/hint, never JSON.stringify.
  Fixes raw Postgrest text leaking through the MCP-connector 400/404
  sites. Exported for tests; follow-up: retire in favour of safeError.
- safeErrorLog: redact the code field before using it as name.
- middleware/auth.ts: 42703 (pre-migration, tolerated) stays at devLog;
  console.error only for real failures.
- Tests updated/added: safeErrorMessage fallback contract, code
  redaction, errorMessage both shapes (623 total).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- user.ts: all 11 sites that passed errorMessage(err) to console.error now
  log safeErrorLog(err) - wave 2 had made plain-object errors log the
  literal generic sentence, strictly worse than main on the log side.
  errorMessage(err) remains only for the client detail at the seven split
  sites.
- errorMessage(): drop the "(code)" suffix entirely - it duplicated the
  sibling code field in user-visible copy on the oauth_required 401, and
  no other caller needs it.
- chatTools.ts tool-loop catch: console.error the ORIGINAL error via
  safeErrorLog before the AssistantStreamError rethrow, so Postgrest
  objects thrown by tools are visible in production logs.
- Tests: new route-level test (GET /user/api-keys) asserting the log
  receives extracted Postgrest diagnostics while the client gets the
  fixed detail; errorMessage suffix expectation updated. 624 total.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Six review findings: Clio tool executors log original failures
([clio/tools], validation errors excluded); null Clio body throws
instead of shaping into an authoritative empty matter list; the
at-least-one-filter guard re-applied to decoded page tokens; query
capped at 256 chars at token mint; stream routes log only name/message
for the AssistantStreamError rethrow wrapper; CLAUDE.md safeError.ts
module-map entry + status sentence. Addendum: all seven real-scrypt
suites get a 120s file-level timeout (contention flakes; DURABLE_LESSONS
2026-08-05).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The 256-char query cap only bounds the common case (reviewer measured
minted tokens over the 1024 decode cap with CJK queries / long cursors):
the mint site now drops any token its own decoder would refuse, keeping
has_more true. findContact and listMatterDocuments get the same
null-body guard as findMatter (deleteTimeEntry untouched - 204 is
success there). CLAUDE.md: stale 604-test figure -> 656 (post-#73),
'#71/#72 deployed' claim corrected to merged-only (deploy pending owner
action), status header date bumped. Three new tests (suite 656).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>