@@ -0,0 +1,18 @@
+---
+'@objectstack/service-datasource': patch
+---
+
+fix(service-datasource)!: Test connection and Save refuse a SQLite filename that is neither `:memory:` nor a usable file path, where Test connection used to pass it
+
+Clause-②: yes (narrowing) — `POST /api/v1/datasources/test`, `POST /api/v1/datasources` and a `PATCH /api/v1/datasources/:name` that touches `config` or `driver` refuse a `sqlite` / `sqlite-wasm` `config.filename` that is empty, starts with `:` without being exactly `:memory:`, or names a path that can be neither opened nor created. The test answered `ok: true` for the first two and the save stored all three; both now answer with the value and the reason (`result.ok: false` from the test, `400 DATASOURCE_ADMIN_ERROR` from the save), the envelope every invalid `config` already gets.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped: SqliteConfigSchema still types filename as a string, and the build and meta doors judge it as before. A stored row keeps loading at boot as it did; only a write through the admin doors that touches its config is judged, so there is nothing at rest for a migration to rewrite. -->
+
+**BREAKING** accept-set narrowing at the datasource admin doors (`@objectstack/service-datasource`): a SQLite filename that names no usable database is refused by Test connection and by Save (#30331).
+
+- **Before.** The New datasource dialog's `:memory:` with a typed path after it (`:memory:/srv/data/parts.db`) tested green. Every layer reads a name that starts with `:` as fileless, so the probe's missing-file check skipped it. Saved, a `sqlite` datasource then opened it as a relative path under the server's working directory whose directory does not exist, so every query failed while the health check answered `false` (which the probe did not read as a failure); a `sqlite-wasm` one opened an ephemeral in-memory database, so writes succeeded and were gone at the next restart. An empty filename tested green too, and a path under a regular file or in a directory the server may not write could be saved.
+- **Now.** Test connection answers `ok: false` and Save answers `400 DATASOURCE_ADMIN_ERROR`, under `Invalid configuration for driver '…'`, with a `config.filename:` line that names the value and why: not `:memory:` and not a file path, empty, or the operating system's reason the file cannot be opened or created.
+- **Unchanged.** Exactly `:memory:` tests green and saves. An existing database file tests green and saves. A creatable path that does not exist yet is still refused by the test (which never creates it, #27512) and accepted by Save, which creates it on connect. `turso` names its target as a url and is not judged here.
+
+**The remedy.** Use exactly `:memory:` for an ephemeral database, or the path of a database file with nothing in front of it.
@@ -0,0 +1,212 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { existsSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { HonoHttpServer } from '@objectstack/plugin-hono-server';
+import type { IDatasourceAdminService } from '../contracts/index.js';
+import { DatasourceAdminServicePlugin } from '../datasource-admin-plugin.js';
+import { registerDatasourceAdminRoutes } from '../admin-routes.js';
+import { createDefaultDatasourceDriverFactory } from '../default-datasource-driver-factory.js';
+import { ENTITLED_CREDENTIAL, createSessionAuthService, createGrantsEngine } from './entitled-caller.fixture.js';
+
+// [#10126] Pay the first transform of the dist-resolved workspace deps at module
+// load, not inside a clocked `it()` (see `scripts/check-test-source-alias.mjs`).
+import '@objectstack/spec/kernel';
+import '@objectstack/driver-sql';
+
+/**
+ * [#30331] A SQLite `config.filename` that is neither exactly `:memory:` nor a
+ * usable file path is refused by Test connection and by Save, with a message
+ * that names the value and says why.
+ *
+ * The value the card measured is `:memory:/…/parts.db`: the dialog's
+ * `:memory:` with a typed path after it. Test connection answered `ok: true`.
+ * Every layer reads a `:`-prefixed name as fileless, so the draft probe's
+ * missing-file refusal skipped it; better-sqlite3 then opened it as a relative
+ * path whose directory does not exist (every query fails, the health check
+ * answers `false`), and sqlite-wasm opened an ephemeral database that loses
+ * everything at the next connect.
+ *
+ * Driven through the real door: the real `HonoHttpServer`, the real admin
+ * routes, the real plugin (its probe and its service) and the default driver
+ * factory. The metadata service is a map, so a Save is observable.
+ */
+
+const authService = createSessionAuthService();
+const grantsEngine = createGrantsEngine();
+
+async function mountDoor() {
+  let admin: IDatasourceAdminService | undefined;
+  const rows = new Map<string, unknown>();
+  const metadata = {
+    get: async (_type: string, name: string) => rows.get(name),
+    list: async () => [...rows.values()],
+    register: async (_type: string, name: string, record: unknown) => {
+      rows.set(name, record);
+    },
+    unregister: async (_type: string, name: string) => {
+      rows.delete(name);
+    },
+  };
+  const ctx: any = {
+    getService: (name: string) => {
+      if (name === 'metadata') return metadata;
+      throw new Error(`no service ${name}`);
+    },
+    registerService: (name: string, svc: unknown) => {
+      if (name === 'datasource-admin') admin = svc as IDatasourceAdminService;
+    },
+    trigger: async () => {},
+    logger: { warn() {}, info() {} },
+  };
+  await new DatasourceAdminServicePlugin({ driverFactory: createDefaultDatasourceDriverFactory() }).init(ctx);
+
+  const server = new HonoHttpServer(0);
+  registerDatasourceAdminRoutes(
+    server,
+    {
+      getService: vi.fn((name: string) =>
+        name === 'auth'
+          ? authService
+          : name === 'objectql' || name === 'data'
+            ? grantsEngine
+            : name === 'datasource-admin'
+              ? admin
+              : undefined,
+      ),
+    } as any,
+    '/api/v1',
+  );
+  const app = server.getRawApp();
+  const send = async (method: string, path: string, body: unknown) => {
+    const res = await app.fetch(
+      new Request(`http://local/api/v1/datasources${path}`, {
+        method,
+        headers: { 'content-type': 'application/json', authorization: ENTITLED_CREDENTIAL },
+        body: JSON.stringify(body),
+      }),
+    );
+    return { status: res.status, body: (await res.json()) as any };
+  };
+  return {
+    rows,
+    test: async (draft: Record<string, unknown>) => {
+      const res = await send('POST', '/test', { name: 'draft', ...draft });
+      expect(res.status).toBe(200);
+      return res.body.data.result as { ok: boolean; error?: string };
+    },
+    create: (draft: Record<string, unknown>) => send('POST', '', draft),
+    update: (name: string, patch: Record<string, unknown>) => send('PATCH', `/${name}`, patch),
+  };
+}
+
+let root: string;
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'ds-30331-'));
+});
+afterEach(() => {
+  rmSync(root, { recursive: true, force: true });
+});
+
+/** Both drivers that open `config.filename`. */
+const DRIVERS = ['sqlite', 'sqlite-wasm'] as const;
+
+function expectRefusal(res: { status: number; body: any }, value: string, why: RegExp) {
+  expect(res.status).toBe(400);
+  expect(res.body.success).toBe(false);
+  // The envelope and code every bad config already answers with (#4410).
+  expect(res.body.error.code).toBe('DATASOURCE_ADMIN_ERROR');
+  expect(res.body.error.message).toContain('Invalid configuration for driver');
+  expect(res.body.error.message).toContain(value);
+  expect(res.body.error.message).toMatch(why);
+}
+
+describe('#30331 — a filename that is neither `:memory:` nor a usable path is refused', () => {
+  for (const driver of DRIVERS) {
+    describe(driver, () => {
+      it('`:memory:/…` is refused by Test connection, naming the value and why', async () => {
+        const door = await mountDoor();
+        const value = `:memory:${join(root, 'parts.db')}`;
+
+        const result = await door.test({ driver, config: { filename: value } });
+
+        expect(result.ok).toBe(false);
+        expect(result.error).toContain(value);
+        expect(result.error).toMatch(/neither ':memory:' nor a file path/);
+        expect(readdirSync(root)).toEqual([]);
+      });
+
+      it('`:memory:/…` is refused by Save (create and update), and nothing is stored', async () => {
+        const door = await mountDoor();
+        const value = `:memory:${join(root, 'parts.db')}`;
+
+        expectRefusal(await door.create({ name: 'parts', driver, config: { filename: value } }), value, /neither ':memory:' nor a file path/);
+        expect(door.rows.has('parts')).toBe(false);
+
+        const created = await door.create({ name: 'parts', driver, config: { filename: ':memory:' } });
+        expect(created.status).toBe(201);
+        expectRefusal(await door.update('parts', { config: { filename: value } }), value, /neither ':memory:' nor a file path/);
+        expect((door.rows.get('parts') as any).config.filename).toBe(':memory:');
+      });
+
+      it('an unusable path is refused by Test connection and by Save', async () => {
+        const door = await mountDoor();
+        writeFileSync(join(root, 'blocker'), 'a regular file');
+        const value = join(root, 'blocker/parts.db');
+
+        const result = await door.test({ driver, config: { filename: value } });
+        expect(result.ok).toBe(false);
+        expect(result.error).toContain(value);
+        expect(result.error).toMatch(/cannot be/);
+
+        expectRefusal(await door.create({ name: 'parts', driver, config: { filename: value } }), value, /cannot be/);
+        expect(door.rows.has('parts')).toBe(false);
+        expect(readdirSync(root)).toEqual(['blocker']);
+      });
+
+      it('an empty filename is refused by Test connection and by Save', async () => {
+        const door = await mountDoor();
+        const result = await door.test({ driver, config: { filename: '' } });
+        expect(result.ok).toBe(false);
+        expect(result.error).toMatch(/'' is empty and names no database file/);
+        expectRefusal(await door.create({ name: 'parts', driver, config: { filename: '' } }), "''", /is empty/);
+      });
+
+      // Controls: what was right stays right.
+      it('control: exactly `:memory:` still tests ok and saves', async () => {
+        const door = await mountDoor();
+        expect((await door.test({ driver, config: { filename: ':memory:' } })).ok).toBe(true);
+        expect((await door.create({ name: 'scratch', driver, config: { filename: ':memory:' } })).status).toBe(201);
+      });
+
+      it('control: an existing database file still tests ok and saves', async () => {
+        const door = await mountDoor();
+        const file = join(root, 'existing.db');
+        const { SqlDriver } = await import('@objectstack/driver-sql');
+        const seed = new SqlDriver({ client: 'better-sqlite3', connection: { filename: file }, useNullAsDefault: true } as any);
+        await seed.connect();
+        await seed.disconnect();
+
+        expect((await door.test({ driver, config: { filename: file } })).ok).toBe(true);
+        expect((await door.create({ name: 'existing', driver, config: { filename: file } })).status).toBe(201);
+      });
+
+      it('control: a creatable path that does not exist keeps today\'s answers', async () => {
+        const door = await mountDoor();
+        const file = join(root, 'missing/dir/new.db');
+
+        // Test connection: refused, and nothing created (#27512).
+        const result = await door.test({ driver, config: { filename: file } });
+        expect(result.ok).toBe(false);
+        expect(result.error).toContain('does not exist');
+        expect(existsSync(file)).toBe(false);
+
+        // Save: accepted.
+        expect((await door.create({ name: 'fresh', driver, config: { filename: file } })).status).toBe(201);
+        expect((door.rows.get('fresh') as any).config.filename).toBe(file);
+      });
+    });
+  }
+});
@@ -44,6 +44,7 @@ import { redactDatasourceConfig, restoreRedactedConfig } from './datasource-conf
 import { planCredentialMigration } from './datasource-credential-migration.js';
 import { borrowedConnectorOf } from './datasource-connector-credential.js';
 import { ROUTE_SHADOWED_DATASOURCE_NAMES } from './datasource-route-reserved-names.js';
+import { sqliteDatabaseFilenameIssue } from './sqlite-database-filename.js';
 import type {
   IDatasourceAdminService,
   DatasourceDraft,
@@ -804,7 +805,7 @@ export class DatasourceAdminService implements IDatasourceAdminService {
     // report a green "Connection successful" for a datasource that points
     // somewhere else entirely — the wizard's version of #4410's core bug.
     try {
-      this.assertValidConfig(input.driver, input.config);
+      await this.assertValidConfig(input.driver, input.config);
     } catch (err) {
       return { ok: false, error: err instanceof Error ? err.message : String(err) };
     }
@@ -851,7 +852,7 @@ export class DatasourceAdminService implements IDatasourceAdminService {
     this.assertNoUndeclaredTopLevelKey(`Invalid datasource '${input.name}'.`, input);
     assertNoInlineSslKey(`Invalid datasource '${input.name}'.`, input);
     if (!input.driver) throw new Error('A driver is required to create a datasource.');
-    this.assertValidConfig(input.driver, input.config);
+    await this.assertValidConfig(input.driver, input.config);
     // The wizard is a publish door for `pool` too (#5714). Rejected BEFORE the
     // record is persisted: `tryRegisterPool` swallows its failures into a
     // warning, so a datasource saved with an unhonourable pool would sit in the
@@ -941,7 +942,7 @@ export class DatasourceAdminService implements IDatasourceAdminService {
     // #4410 would otherwise become uneditable, including the `active: false`
     // that takes a misconfigured datasource out of service.
     if (patch.config !== undefined || patch.driver !== undefined) {
-      this.assertValidConfig(merged.driver, merged.config);
+      await this.assertValidConfig(merged.driver, merged.config);
     }
     // Same judgement, same "only when this write touches the pairing" rule
     // (#5714): a new `pool`, or a new `driver` that reinterprets the stored
@@ -1366,14 +1367,23 @@ export class DatasourceAdminService implements IDatasourceAdminService {
    *
    * A driver the platform ships no contract for passes untouched, matching the
    * spec gate's boundary rather than inventing a stricter one for the UI.
+   *
+   * [#30331] A SQLite `config.filename` that is neither `:memory:` nor a
+   * usable file path is refused here too, in the same envelope: the contract
+   * types it as a string, and this is the one judgement the test, the create
+   * and the update doors share (see {@link sqliteDatabaseFilenameIssue}).
    */
-  private assertValidConfig(driver: string, config: unknown): void {
+  private async assertValidConfig(driver: string, config: unknown): Promise<void> {
     const result = validateDriverConfig(driver, config);
-    if (!result.known || result.issues.length === 0) return;
-    const detail = result.issues
-      .map((issue) => (issue.path.length ? `config.${issue.path.join('.')}: ${issue.message}` : issue.message))
-      .join('\n');
-    throw new Error(`Invalid configuration for driver '${driver}'.\n${detail}`);
+    const issues = result.known
+      ? result.issues.map((issue) => (issue.path.length ? `config.${issue.path.join('.')}: ${issue.message}` : issue.message))
+      : [];
+    if (issues.length === 0) {
+      const filenameIssue = await sqliteDatabaseFilenameIssue(driver, config);
+      if (filenameIssue) issues.push(filenameIssue);
+    }
+    if (issues.length === 0) return;
+    throw new Error(`Invalid configuration for driver '${driver}'.\n${issues.join('\n')}`);
   }
 
   /**
 
@@ -0,0 +1,71 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { resolveDriverId } from '@objectstack/spec/data';
+
+/** The one name SQLite opens as an ephemeral, fileless database. */
+const IN_MEMORY = ':memory:';
+
+/**
+ * [#30331] Why a SQLite datasource's `config.filename` names no database the
+ * datasource can use, or `undefined` when it does. The value is either exactly
+ * `:memory:` or a file path that exists or can be created; anything else is
+ * refused with the value and the reason.
+ *
+ * Judged where the test, the create and the update doors all judge `config`
+ * (`DatasourceAdminService.assertValidConfig`), so a draft that tests red is
+ * also refused at Save, and one that tests green can be saved.
+ *
+ * ## Why `:memory:/…` passed
+ *
+ * Measured on `main` 8589756a, with `:memory:/tmp/x/parts.db` (the dialog's
+ * `:memory:` value with a typed path after it):
+ *
+ *   - Every layer reads a name that starts with `:` as fileless (driver-sql's
+ *     `sqliteFilename` and `resolveSqliteAbsentFileTarget`, the wasm driver's
+ *     ephemeral check), so the draft probe's missing-file refusal (#27512)
+ *     skipped it and `SqlDriver.connect()` made no directory for it.
+ *   - `sqlite` (better-sqlite3) then opens the name as a relative path under
+ *     the server's working directory, whose `:memory:/…` directory does not
+ *     exist: `connect()` only warns, every query fails with "Cannot open
+ *     database because the directory does not exist", and its health check
+ *     answers `false`, which the probe did not read as a failure.
+ *   - `sqlite-wasm` opens an ephemeral in-memory database: reads and writes
+ *     succeed, and everything is gone at the next connect or restart.
+ *
+ * ## What counts as usable
+ *
+ * The file judgement is driver-sql's write-free one,
+ * `resolveSqliteAbsentFileTarget`, under `'empty-in-memory'`: it throws the
+ * `SqliteDatabaseFileError` naming the file for a path that can be neither
+ * opened nor created (#24961), and answers for an absent one without creating
+ * it. An absent but creatable path is usable: Save keeps creating it on
+ * connect, and the draft probe keeps refusing to (#27512).
+ *
+ * `sqlite` and `sqlite-wasm` only: both open `config.filename`. `turso` names
+ * its target as a url, which libSQL parses itself.
+ */
+export async function sqliteDatabaseFilenameIssue(driver: string, config: unknown): Promise<string | undefined> {
+  const id = resolveDriverId(driver);
+  if (id !== 'sqlite' && id !== 'sqlite-wasm') return undefined;
+  const filename = (config as { filename?: unknown } | null | undefined)?.filename;
+  // Absent is the schema's own `:memory:` default; a non-string is the
+  // driver contract's refusal, already given.
+  if (typeof filename !== 'string' || filename === IN_MEMORY) return undefined;
+  if (filename === '') {
+    return `config.filename: '' is empty and names no database file. Use '${IN_MEMORY}' for an ephemeral `
+      + 'in-memory database, or the path of a database file.';
+  }
+  if (filename.startsWith(':')) {
+    return `config.filename: '${filename}' is neither '${IN_MEMORY}' nor a file path. `
+      + `A name that starts with ':' is not read as a file, so this datasource would store nothing: `
+      + `use exactly '${IN_MEMORY}' for an ephemeral in-memory database, or the path of a database file `
+      + 'with nothing in front of it.';
+  }
+  const { resolveSqliteAbsentFileTarget } = await import('@objectstack/driver-sql');
+  try {
+    resolveSqliteAbsentFileTarget(filename, 'empty-in-memory');
+  } catch (err) {
+    return `config.filename: ${err instanceof Error ? err.message : String(err)}`;
+  }
+  return undefined;
+}