t-7 QA f4.1: ADR-0023 says invalid ids return GraphIdInvalid

[randlee]

Fixes comp-t-7.group-qa-f4.1 (sanity finding on f4). This is the one sentence you authorized: a BeadId, GraphRef or StepId that fails its newtype rule returns GraphIdInvalid (exit 2), not RequestDeserializationFailed. That matches FUZZ-021 (#702) and #706. Rebased by the stack writer (44667de -> dfdf4aa).

🤖 Generated with Claude Code

[randlee]

QA fix verification: comp-t-7.group-qa-f4.1-qa (D1-F1) at dfdf4aa

Verdict: PASS. 1 carried finding verified fixed.

Finding	Disposition
D1-F1	fixed

req-qa, locked to D1-F1, confirmed ADR-0023 now gives one mapping for an invalid ref, step or bead id: GraphIdInvalid (refused, exit 2), stated in lines 325-327 and consistent with the table row (299), the id rule (360) and the loop/expand rows. Other malformed requests keep exit 3. FR-23.8/FR-23.10 and the bead manual (line 370) do not contradict it.

Reviewer notes, not gating: line 227 still says the id newtypes use serde try_from (type-level only); the ADR does not say how the typed field/value survives a try_from failure (the manual does); the table recovery text says only "ref or step id"; the decision is recorded as the normative sentence, not a decision-log entry.

Disclosures: the filing checker is dev-sanity (sc-sanity-llm), not a QA reviewer, so I hand-dispatched req-qa as the document verifier. The reviewer read the worktree (HEAD equals the pinned commit) and did not run the code; shipped behaviour (FUZZ-021 / typed-parent-id fixes) was verified in their own QA rounds. CI not checked (rate-limit rule).

[randlee]

QA fix verification: comp-t-7.group-qa-f4-qa (qa1-f4) at dfdf4aa

Verdict: PASS. 1 carried finding verified fixed.

Finding	Disposition
qa1-f4	fixed

req-qa, locked to qa1-f4, verified both halves of the deliverable at the pinned content:

• Id-error mapping: ADR-0023 (errors table line 299, id rule 358-360, try_from sentence 325-327, request-error list 318-324), FR-23.10 (defers to the ADR) and the bead manual (line 370) all map an invalid ref, step or bead id to GraphIdInvalid (refused, exit 2); other malformed requests keep exit 3.
• Race paragraph (lines 480-485 and Context 38-42): sc-compose does not serialize concurrent attaches, bd may refuse or accept, the created/existing classification is not guaranteed under a race; no promise that bd refuses the second plan.
• The decision is recorded as normative ADR text.

Reviewer notes, not gating: the relation-validation table (line 493) does not say an invalid id inside step:<id>/bead:<id> is GraphIdInvalid (covered by implication); line 227 says try_from, which needs lines 325-327 to read correctly.

Disclosures: the reviewer read the worktree and could not run git (I confirmed the worktree HEAD equals the PR head dfdf4aa). Shipped behaviour was fixed by the FUZZ-021 and typed-parent-id fixes, verified in their own rounds. CI not checked (rate-limit rule).