Detach serializable provider facts from an arbitrary thrown value.
Every read here goes through Object.getOwnPropertyDescriptor and accepts
the value only when "value" in descriptor — an OWN DATA property, never an
accessor. That is not paranoia in AMC's setting: a getter that answers
differently on two reads would let the signed row disagree with what the user
was shown. Read the facts once, freeze them, then sign.
A carried failure is trusted only when its code agrees with the error's
own code property, because cross-package copies preserve own data but not
class identity. A third-party SDK's own code is never adopted as AMC
taxonomy — an unrecognized throw is UNKNOWN.
Detach serializable provider facts from an arbitrary thrown value.
Every read here goes through
Object.getOwnPropertyDescriptorand accepts the value only when"value" in descriptor— an OWN DATA property, never an accessor. That is not paranoia in AMC's setting: a getter that answers differently on two reads would let the signed row disagree with what the user was shown. Read the facts once, freeze them, then sign.A carried
failureis trusted only when itscodeagrees with the error's owncodeproperty, because cross-package copies preserve own data but not class identity. A third-party SDK's owncodeis never adopted as AMC taxonomy — an unrecognized throw isUNKNOWN.