@@ -0,0 +1,19 @@
+---
+'@objectstack/types': patch
+'@objectstack/objectql': patch
+'@objectstack/core': patch
+---
+
+fix(types): a unique refusal tells the user which field by its label, never by its API key
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+A create or update refused by a single-column unique index answered `409 UNIQUE_VIOLATION` with a user-facing `error` that named the field by its API key ("A record with this gsku already exists"), while `developerMessage` named it by its label. The split was inverted: the developer read the label and the end user read `gsku`.
+
+- **The user-facing `error` names the field by its label.** For a field labelled `Global SKU`, the body now reads `"error": "A record with this Global SKU already exists"`. `field` still carries the API key (`gsku`) for programs, and `code`, the status and `developerMessage` are unchanged.
+- **In the writer's locale.** The label is read the same way the record validator and the `DELETE_RESTRICTED` refusal read theirs: the translation bundle for the request's locale, then the declared `label`. That one label feeds both the user-facing sentence and the engine's own `message` (the `developerMessage` on the wire). A request in `zh-CN` against a translated object reads its labels in `zh-CN` in both. The sentence around the label stays English.
+- **No label, no name.** When the field declares no label and the bundle holds none, the sentence is the generic `"A record with this value already exists"`, and `field` still names the key. The same applies to a raw driver unique error that no engine write door wrapped, since it carries no schema to read a label from, and to `sanitizeRowError` (`@objectstack/core`), the import runner's text cleaner. The composite-index answer is unchanged.
+- **`DuplicateRecordError` gains `fieldLabel`** (`@objectstack/objectql`): the conflicting field's display name in the writer's locale, set only when the field has one. `envelopeUniqueViolation` takes the write's message context as an optional fourth argument, and every engine write door passes it.
+
+If a client matched the old sentence text to find the field, read `field` instead. It has carried the API key on this body all along.
@@ -4531,7 +4531,7 @@
       "title": "Field-level `unique` on the write path: colliding writes refused 409 UNIQUE_VIOLATION on both driver families, NULL-distinct, organization-scoped by default, whole-batch refusal, autonumber resync converges",
       "since": "v17",
       "status": "active",
-      "revision": 11,
+      "revision": 12,
       "priority": "P1",
       "surface": "api",
       "personas": [
@@ -4560,9 +4560,9 @@
       ],
       "acceptance": [
         {
-          "clause": "a colliding create is REFUSED, not landed: status 409, code UNIQUE_VIOLATION (ADR-0112 envelope), whose developerMessage NAMES THE OBJECT by its declared label ('Duplicate record refused on 'LABEL': …'), by its API name ('qa_unique') only where the object declares no label, and states 'No record was written.', while the user-facing `error` stays generic ('A record with this value already exists'); NEITHER carries a driver prefix, a driver statement or bound values — and the row count is unchanged. On the live SQLite leg the field is named only when the driver reports a single offending column (a tenant-scoped unique index is composite, so the sentence reads 'a unique constraint already holds these values'); the `object.field` wording is the memory driver's and stays a memory-pin assertion",
+          "clause": "a colliding create is REFUSED, not landed: status 409, code UNIQUE_VIOLATION (ADR-0112 envelope), whose developerMessage NAMES THE OBJECT by its declared label ('Duplicate record refused on 'LABEL': …'), by its API name ('qa_unique') only where the object declares no label, and states 'No record was written.', while the user-facing `error` names the field by its label ('A record with this LABEL already exists') where a single offending column is reported and the field has a label, and is otherwise generic ('A record with this value already exists') — never by its API key, which stays on `field`; NEITHER carries a driver prefix, a driver statement or bound values — and the row count is unchanged. On the live SQLite leg the field is named only when the driver reports a single offending column (a tenant-scoped unique index is composite, so the sentence reads 'a unique constraint already holds these values'); the `object.field` wording is the memory driver's and stays a memory-pin assertion",
           "oracle": "api",
-          "verify": "the refusal body — status, code, and the developerMessage naming the object, read from developerMessage, not from the generic `error` — + a post-refusal count; the SQL-family envelope is single-sourced at packages/objectql/src/duplicate-record-error.ts (buildDuplicateMessage / envelopeUniqueViolation); the memory driver's `object.field` sentence (memory-unique-constraint.ts uniqueViolationError) is asserted by memory-unique-constraint.test.ts, not live",
+          "verify": "the refusal body — status, code, and the developerMessage naming the object, read from developerMessage, not from the user-facing `error` — + a post-refusal count; the SQL-family envelope is single-sourced at packages/objectql/src/duplicate-record-error.ts (buildDuplicateMessage / envelopeUniqueViolation); the memory driver's `object.field` sentence (memory-unique-constraint.ts uniqueViolationError) is asserted by memory-unique-constraint.test.ts, not live",
           "evidence": "refusal response + before/after counts"
         },
         {
@@ -4607,7 +4607,7 @@
       ],
       "automated": {
         "kind": "dogfood",
-        "ref": "packages/qa/dogfood/test/field-unique-rest-refusal.dogfood.test.ts, at the REST data doors of a booted stack on the stock SQL family (bootStack's SQLite datasource), on the scratch object the fixtures prescribe (sku unique:true, gsku unique:'global', nick): acceptance[0], negative[0] and negative[1] (a colliding create is 409 UNIQUE_VIOLATION; the developerMessage names the object by its label and says 'No record was written.'; on the tenant-scoped composite index the error is the generic 'A record with this value already exists', on the single-column global index it names the field; no driver prefix, statement or bound value; the colliding row is not stored), acceptance[1] (two rows with no sku both land), acceptance[2] (a PATCH onto a taken value is 409 and the row keeps its value; a PATCH leaving sku alone, or re-sending its own value, is 200) and acceptance[3] with negative[2] at the REST door that stamps one value onto two rows, POST /data/OBJECT/updateMany with options.atomic (its per-row report refuses both, ROLLED_BACK then UNIQUE_VIOLATION, and both rows re-read unchanged; REST has no predicate-update door, so the engine's predicate updateMany stays the memory pin's). packages/drivers/driver-memory/src/memory-unique-constraint.test.ts — acceptance[4]'s memory-family legs (the \"[#13197] scoping matches driver-sql's ADR-0120 D1/D3 rule\" describe), acceptance[5] ('the refusal is recognisable to the ENGINE, so the autonumber resync converges'), negative[2]'s predicate half ('updateMany refuses BEFORE mutating anything — no half-applied batch') and negative[3]'s memory-family half, at the memory driver; + packages/drivers/driver-sql/src/sql-driver-8577-tenant-scoped-declared-unique.test.ts + packages/drivers/driver-sql/src/sql-driver-declared-index-organization-respelling.test.ts — acceptance[4]'s SQL-family legs and negative[3]'s SQL-family half, at SqlDriver over better-sqlite3, through a test-local createAsApi mapping; driver-level evidence beside acceptance[0]–[3], never their pass"
+        "ref": "packages/qa/dogfood/test/field-unique-rest-refusal.dogfood.test.ts, at the REST data doors of a booted stack on the stock SQL family (bootStack's SQLite datasource), on the scratch object the fixtures prescribe (sku unique:true, gsku unique:'global', nick): acceptance[0], negative[0] and negative[1] (a colliding create is 409 UNIQUE_VIOLATION; the developerMessage names the object by its label and says 'No record was written.'; on the tenant-scoped composite index the error is the generic 'A record with this value already exists', on the single-column global index it names the field by its label ('Global SKU'), the API key 'gsku' only on `field`; no driver prefix, statement or bound value; the colliding row is not stored), acceptance[1] (two rows with no sku both land), acceptance[2] (a PATCH onto a taken value is 409 and the row keeps its value; a PATCH leaving sku alone, or re-sending its own value, is 200) and acceptance[3] with negative[2] at the REST door that stamps one value onto two rows, POST /data/OBJECT/updateMany with options.atomic (its per-row report refuses both, ROLLED_BACK then UNIQUE_VIOLATION, and both rows re-read unchanged; REST has no predicate-update door, so the engine's predicate updateMany stays the memory pin's). packages/drivers/driver-memory/src/memory-unique-constraint.test.ts — acceptance[4]'s memory-family legs (the \"[#13197] scoping matches driver-sql's ADR-0120 D1/D3 rule\" describe), acceptance[5] ('the refusal is recognisable to the ENGINE, so the autonumber resync converges'), negative[2]'s predicate half ('updateMany refuses BEFORE mutating anything — no half-applied batch') and negative[3]'s memory-family half, at the memory driver; + packages/drivers/driver-sql/src/sql-driver-8577-tenant-scoped-declared-unique.test.ts + packages/drivers/driver-sql/src/sql-driver-declared-index-organization-respelling.test.ts — acceptance[4]'s SQL-family legs and negative[3]'s SQL-family half, at SqlDriver over better-sqlite3, through a test-local createAsApi mapping; driver-level evidence beside acceptance[0]–[3], never their pass"
       },
       "source": [
         "packages/drivers/driver-memory/src/memory-unique-constraint.ts#scope (#13197/#13249, commit 56c093c — single judgment point; scope table read off driver-sql, arm for arm)",
@@ -4683,6 +4683,12 @@
           "date": "2026-10-27",
           "change": "automated.ref names the dogfood pin that scores acceptance[0]–[3] and negative[0]–[2] over REST on the SQL family (#26573 slice 3); 'NO pin drives a REST door' no longer holds. Measured: the global index names the field in the user-facing error by its API key (gsku) and in developerMessage by its label; the composite tenant index names none. acceptance[3]'s REST door is the atomic updateMany records batch, since REST has no predicate update. kind unit → dogfood. No clause changed",
           "ref": "#26573"
+        },
+        {
+          "revision": 12,
+          "date": "2026-10-27",
+          "change": "acceptance[0].clause: the user-facing `error` NAMES THE FIELD BY ITS LABEL ('A record with this LABEL already exists') where the driver reports a single offending column and the field has a label, and is generic otherwise, where it named the field by its API key ('A record with this gsku already exists') while developerMessage named it by label. The engine's DuplicateRecordError carries the label it resolves for its sentence as fieldLabel (packages/objectql/src/duplicate-record-error.ts, in the writer's locale), and the REST classification names the field by it (packages/types/src/data-error-classification.ts); `field` keeps the API key. automated.ref's sentence follows it, and the dogfood pin's exact body reads 'A record with this Global SKU already exists'. Status 409, code UNIQUE_VIOLATION, developerMessage and the composite-index generic sentence are unchanged",
+          "ref": "#26867"
         }
       ]
     },
 
@@ -18,6 +18,12 @@
  *   face 1 — `uniqueViolationColumn` (`@objectstack/types`), the column answer;
  *   face 2 — `sanitizeRowError` (this package), the sentence the importer shows.
  *
+ * [#26867] Face 2 no longer names the column for ANY conflict: the column is
+ * the field's API key, and the end user's sentence names a field only by its
+ * label, which a driver's text never carries. So a sample whose face 1 answers
+ * a column still expects the unnamed sentence on face 2 — the two faces now
+ * disagree on purpose, and the table keeps both so neither drifts.
+ *
  * A dialect that regresses on either goes red here, and teaching one face a
  * dialect without the other cannot go green. The table lives in this package
  * for the same reason #6250's does: `@objectstack/types` cannot import
@@ -51,7 +57,7 @@ interface DialectSample {
   readonly conflict: boolean;
   /** Face 1: the column `uniqueViolationColumn` must name, or `undefined`. */
   readonly column: string | undefined;
-  /** Face 2: the exact sentence the importer must show. */
+  /** Face 2: the exact sentence the importer must show — never the column (#26867). */
   readonly sanitized: string;
 }
 
@@ -75,15 +81,15 @@ const DIALECT_SAMPLES: readonly DialectSample[] = [
       "('a@b.com', 'zhoujunyi', '13800000000') - UNIQUE constraint failed: sys_user.phone_number",
     conflict: true,
     column: 'phone_number',
-    sanitized: 'A record with this phone_number already exists.',
+    sanitized: UNNAMED_CONFLICT,
   },
   {
     dialect: 'sqlite',
     label: 'UNIQUE constraint failed — bare driver message',
     message: 'UNIQUE constraint failed: sys_user.email',
     conflict: true,
     column: 'email',
-    sanitized: 'A record with this email already exists.',
+    sanitized: UNNAMED_CONFLICT,
   },
   // Composite: no single offending column, so naming the first would point the
   // form at `tenant_id` when what was typed twice is `email`.
@@ -182,7 +188,7 @@ const DIALECT_SAMPLES: readonly DialectSample[] = [
       `Detail: Key (email)=(${OFFENDING_VALUE}) already exists.`,
     conflict: true,
     column: 'email',
-    sanitized: 'A record with this email already exists.',
+    sanitized: UNNAMED_CONFLICT,
   },
   {
     dialect: 'postgres',
@@ -192,7 +198,7 @@ const DIALECT_SAMPLES: readonly DialectSample[] = [
       `Detail: Key ("emailAddress")=(${OFFENDING_VALUE}) already exists.`,
     conflict: true,
     column: 'emailAddress',
-    sanitized: 'A record with this emailAddress already exists.',
+    sanitized: UNNAMED_CONFLICT,
   },
   // No DETAIL line: the only identifier present is the constraint (index) name.
   // Before #6544 this fell through to the SQL backstop and echoed the driver's
 
@@ -12,7 +12,7 @@ import type { ExecutionContext } from '@objectstack/spec/kernel';
 import type { CreateDataRequest, FindDataRequest, GetMetaItemRequest, UpdateDataRequest, ValidateDataIssue, ValidateDataRequest, ValidateDataResponse } from '@objectstack/spec/api';
 import { isMatchKeySets } from '@objectstack/spec/api';
 import { bulkWrite, withTransientRetry, defaultIsTransientError, type BulkWriteRowResult } from './bulk-write.js';
-import { isUniqueViolationError, uniqueViolationColumn, isEngineDuplicateRecordEnvelope, mapDataError, sandboxBusinessMessage, isSandboxOrigin, isSandboxOwnFault } from '@objectstack/types';
+import { isUniqueViolationError, isEngineDuplicateRecordEnvelope, mapDataError, sandboxBusinessMessage, isSandboxOrigin, isSandboxOwnFault } from '@objectstack/types';
 
 /**
  * import-runner — the shared row-processing core for bulk import.
@@ -327,8 +327,8 @@ function bareColumn(raw: string): string {
 }
 
 /**
- * The sentence used when the row conflicts but no column is determinable
- * (#6544). Deliberately the same wording `mapDataError` puts in the 409
+ * The sentence used when the row conflicts and no field LABEL is in hand
+ * (#6544, #26867). Deliberately the same wording `mapDataError` puts in the 409
  * `UNIQUE_VIOLATION` body, so the importer and the API say one thing about one
  * condition rather than two.
  */
@@ -357,18 +357,21 @@ const UNNAMED_CONFLICT = 'A record with this value already exists.';
  *    index name, so **MySQL rows no longer name a column** — they used to name
  *    the index (`for key 'idx_email_unique'`) as if it were one, pointing the
  *    user at a field that does not exist. See that function's doc comment.
+ *
+ * [#26867] A unique conflict no longer names the column here at all. What the
+ * driver's text names is the column — the field's API KEY — and this function
+ * holds only that text, never the object's schema, so it has no label to name
+ * the field by; the end user's sentence names a field only by its label (the
+ * create door's, adopted whole by {@link toFailedResult} from the engine's
+ * envelope). The row's `field` keeps the API key for programs.
  */
 export function sanitizeRowError(raw: unknown): string {
   const msg = typeof raw === 'string' ? raw.trim() : '';
   if (!msg) return 'Row failed';
 
-  // UNIQUE — surface the offending column when the dialect determinably named
-  // one (it maps to a user-facing import column, so naming it is helpful, not a
-  // schema leak); otherwise say so generically rather than guess.
-  if (isUniqueViolationError(msg)) {
-    const column = uniqueViolationColumn(msg);
-    return column ? `A record with this ${column} already exists.` : UNNAMED_CONFLICT;
-  }
+  // UNIQUE — the generic sentence: the column the driver names is an API key,
+  // not a label, so it is not the end user's word for the field.
+  if (isUniqueViolationError(msg)) return UNNAMED_CONFLICT;
 
   // NOT NULL — a required value is missing.
   const notNull = /not null constraint failed:\s*([^\s,)]+)/i.exec(msg);