[LeeroyHannigan]

Summary

Fixes #365. An attribute name is at most 65,535 bytes of UTF-8, at every depth. ExtendDB enforced the limit only on the put paths, after the table lookup, with its own wording; UpdateItem and the Update member of TransactWriteItems stored a 65,536-byte name with HTTP 200, and a long name that arrived only through a condition's ExpressionAttributeNames was accepted on PutItem, DeleteItem and every transaction member.

What the service does

Measured on Amazon DynamoDB (us-east-1) on 2026-10-21 at 65,535 and 65,536 bytes: 35 wire cases at 23:40 UTC and a 91-row probe at 23:52 UTC.

• A 65,536-byte name is refused with a ValidationException on PutItem, UpdateItem, DeleteItem, TransactWriteItems and BatchWriteItem; 65,535 bytes is accepted. The limit counts bytes: 32,768 two-byte characters are refused, 32,767 of them plus one ASCII character are accepted.
• The wording follows the request form. PutItem (name in the item), UpdateItem (map key in a value, AttributeUpdates), and PutItem or DeleteItem (map key in a condition value): 1 validation error detected: Attribute name is too large, must be less than 65536 bytes. PutItem, UpdateItem and DeleteItem for an ExpressionAttributeNames value: the same message followed by for key #n. Any TransactWriteItems member for an ExpressionAttributeNames value: ExpressionAttributeNames contains invalid value: Attribute name is too large, must be less than 65536 bytes for key #n; for a map key inside an ExpressionAttributeValues value: ExpressionAttributeValues contains invalid value: ... for key :v. A TransactWriteItems Put or a BatchWriteItem PutRequest for a name in the item: Attribute name is too large, must be less than 65536 bytes. A transaction fails as a whole with no CancellationReasons.
• Every ExpressionAttributeNames value is checked, including one no expression uses.
• Position. The name check runs ahead of the table lookup on every request. In a transaction it runs for every member before any member's table lookup: [Put on a missing table, Update with a long #n] answers the Update member's name refusal. In a batch it runs before the table lookup and the key check: a PutRequest item with a long name and no key answers the name refusal. UpdateItem and a transacted Update report the name ahead of an UpdateExpression syntax error, a failing condition and a secondary-index key type mismatch.
• Order with two long names at once. UpdateItem reports the ExpressionAttributeNames placeholder before a map key in a value; PutItem reports the item before the ExpressionAttributeNames placeholder. A transaction member reports a map key in a value first, then the ExpressionAttributeNames placeholder, then (Put) the item.

Changes

• crates/core/src/validation/mod.rs: AttributeNameRequestForm { SingleItem, TransactionMember, BatchRequest } selects the wording and the order of the two expression maps. validate_attribute_name_sizes takes it; new validate_expression_attribute_name_sizes (names half and values half, ordered by form) and validate_attribute_updates_name_sizes. validate_put_item no longer checks names (the handler does, earlier). Unit tests for every form and both orders.
• crates/engine/src/put_item.rs: item names, then the expression maps, right after deserialization and before the table lookup.
• crates/engine/src/update_item.rs: expression maps and AttributeUpdates checked after validate_table_name, before the table lookup.
• crates/engine/src/delete_item.rs: expression maps checked after validate_table_name, before the table lookup.
• crates/engine/src/transact_write_items.rs: validate_member_attribute_name_sizes runs for every member in request order before prepare_write_op (expression maps, then a Put member's item); the per-arm checks are removed.
• crates/engine/src/batch_write_item.rs: every PutRequest item checked in a pass before the per-table loop; the per-request check is removed.
• crates/engine/src/import_export.rs: passes SingleItem; the error is only logged.
• docs/dynamodb-limits.md: Attribute name size row Partial to Enforced, with the wording, position and order per form; summary counts updated.
• tests/test_attribute_name_limit_on_update.py: 49 dual-target cases.

No storage crate changes: every path reaches the checks through the engine, so Cassandra receives them too.

Verification

Check	Service	SQLite	PostgreSQL	MongoDB	Main (ec81e9d)
tests/test_attribute_name_limit_on_update.py, 49 cases	49 passed (01:05 UTC on 2026-10-22)	49 passed	49 passed	49 passed	32 of the first 35 fail on the base of the earlier rounds; 11 of the 14 later cases fail on the branch before the fold
365-probe.py, 91 rows, compared on status, code, message, stored item	reference	0 differ	1 differs: O05, the control row for an index-key type mismatch alone on UpdateItem, which PostgreSQL on main does not refuse (#416 covers it; not touched here)	0 differ
16 related wire files (item operations, conditional writes, transactions, batch, expression validation, precedence, wording parity)		353 passed	353 passed	353 passed
cargo test -p extenddb-core		524 passed
cargo test -p extenddb-engine		103 passed

Negative controls

Each mutation applied to the committed tree with an anchor occurring once, run, then restored with git checkout; the tree was clean after each.

Mutation	Result
core: SingleItem arm of validate_expression_attribute_name_sizes reverted to names-then-values for every form	unit test transaction_expression_values_are_checked_before_names fails; wire TestTransactUpdate::test_values_map_reported_before_the_names_map fails
core: message text reverted to the old wording; `TransactionMember	BatchRequest` arm given the prefix; map name dropped from the transaction form; values branch forced to the bare sentence
put_item.rs: expression-map check removed	TestPutItem::test_placeholder_name_only_in_the_condition fails (DID NOT RAISE)
put_item.rs: item check moved after the table lookup	TestPutItem::test_reported_ahead_of_a_missing_table fails
delete_item.rs: expression-map check removed	TestDeleteItem::test_placeholder_name_only_in_the_condition fails (DID NOT RAISE)
update_item.rs: expression-map check removed; AttributeUpdates check removed	11 and 2 cases fail (DID NOT RAISE)
transact_write_items.rs: expression-map check removed from the member pass	19 cases fail: every Update, Delete, ConditionCheck and Put-condition refusal
transact_write_items.rs: member pass moved after the prepare_write_op loop	3 cases fail: both missing-table orderings and the Put missing-table case (ResourceNotFoundException)
transact_write_items.rs: Put item check removed from the member pass	TestTransactPut::test_name_over_limit[2] and test_reported_ahead_of_a_missing_table fail
transact_write_items.rs: Put item check swapped ahead of the expression maps	TestTransactPut::test_names_map_reported_before_the_item fails (bare sentence instead of ... for key #n)
transact_write_items.rs: TransactionMember changed to SingleItem in the Put arm; in the Update arm	2 and 11 cases fail on the message
batch_write_item.rs: pre-pass removed; pre-pass moved back into the per-request loop	4 cases fail (2 DID NOT RAISE, missing table, missing key); 2 cases fail (missing table, missing key)
batch_write_item.rs: BatchRequest changed to SingleItem	2 cases fail on the message

Gates

• cargo fmt --all -- --check: clean.
• cargo +1.97.0 clippy -p extenddb-core -p extenddb-engine --all-targets -- -D warnings: clean.
• cargo +1.88.0 build -p extenddb-core -p extenddb-engine: clean.
• cargo test -p extenddb-core: 524 passed. cargo test -p extenddb-engine: 103 passed.
• 16 related wire files on SQLite, PostgreSQL and MongoDB: 353 passed on each.
• No dependency added or removed; notices files unchanged.

Not in this change

• UpdateItem with a secondary-index key type mismatch alone (probe row O05) is accepted by PostgreSQL on main; fix: validate secondary-index keys on UpdateItem and transaction writes the way the service does #416 adds that check. This change's name check runs ahead of it on every backend.
• MongoDB applies no item-size limit on updates (41 failures in tests/test_item_size_at_limit.py on the earlier base, same on main); fix: validate secondary-index keys on UpdateItem and transaction writes the way the service does #416 covers item size.
• The 14 wire cases added in the last round (condition maps on PutItem, DeleteItem and the transaction members; missing-table and missing-key positions; the two-map orders) have not yet been run against the service as pytest cases. Each asserts a probe row the service answered on 2026-10-21.