finding(objectql): `registerObject`'s cross-package ownership refusal throws a bare `Error`, so no rejection test on that path can assert an ADR-0112 envelope

[hotlong]

Found while implementing ADR-0130 D1+D3 (#14163 / PR #14354). Out of that card's scope, filed rather than fixed.

The site

SchemaRegistry.registerObject refuses a second code package claiming an object name another package already owns:

// packages/objectql/src/registry.ts — registerObject, ownership: 'own'
throw new Error(
 `Object "${fqn}" is already owned by package "${existingOwner.packageId}". ` +
 `Package "${packageId}" cannot claim ownership. Use 'extend' to add fields.`
);

It is a real refusal on a real path — the metadata load path reaches it through registerApp — but it carries no code and no status, so it is not an ADR-0112 envelope like the sibling refusals around it (resolveArtifactPackageOrder's DUPLICATE_ARTIFACT_PACKAGE / INVALID_ARTIFACT_PACKAGE_ENTRY, and the DUPLICATE_ARTIFACT_OBJECT_NAME refusal PR #14354 adds one layer up).

Why it matters, measured rather than argued

While reverse-verifying #14163 I ablated the new install-time object-name check and re-ran the pairing suite. The assertion expect(refused).toBeDefined() stayed green through that ablation — because this bare Error fires one step later and looks, to a throw-shaped assertion, exactly like the refusal that had just been deleted. Only the envelope assertion (code + status) went red.

So any rejection test written against this ownership rule today can only be a bare toThrow(), which is precisely the assertion ADR-0112 and ADR-0130 D3 rule out by name: it stays green against an unrelated Error from anywhere else in the path.

Suggested shape (not prescriptive)

Give the refusal an envelope — an error class with code (SCREAMING_SNAKE, registered in the dispatcher error-code vocabulary with a reachability verdict, the way DUPLICATE_ARTIFACT_OBJECT_NAME is) and status: 422 — keeping the message text as-is so existing message-substring assertions are unaffected. Worth checking at the same time whether any current test asserts only that this path throws.

Note the neighbouring late-install branch (ADR-0029 D9 §6.1, tenant-authored sitting owner) is not a refusal and is not part of this.

[huangyiirene]

Triage: bug · priority:p2 · pm:queue · domain:engine (packages/objectql) · needs:contract-review · type Bug. Found by the full-backlog bare-card sweep — filed 03:17Z, never touched again.

Verified on origin/main @ f7d92d3: the bare throw is at packages/objectql/src/registry.ts:1802. ✔

Two location facts the card is right about but does not spell out, and which would otherwise cost the implementer a search:

• The sibling codes DUPLICATE_ARTIFACT_PACKAGE / INVALID_ARTIFACT_PACKAGE_ENTRY live in packages/runtime/src/dispatcher-error-vocabulary.ts, ⛔ not in packages/spec/src/api/error-code-ledger.zod.ts (0 hits there). Registering the new code follows that file.
• packages/objectql/src/artifact-packages.ts already registers into it from this package, so the cross-package pattern is established and needs no invention. ⇒ Anchor stays domain:engine: the refusal is objectql's, the vocabulary entry is the consequence.

Why this is the bug lane and not the human floor. Adding a code to a published error vocabulary looks like widening the public surface, which would put it on the floor. It is not: ADR-0112 already declares that refusals carry envelopes, and ADR-0130 D3 already rules out bare-toThrow assertions by name. This site violates a declared contract; registering the code is how that contract gets satisfied, not a new capability. Restoration ⇒ dispatchable. needs:contract-review because the vocabulary itself moves.

p2, and the card earns it with a measurement rather than an argument. The ablation result is the whole case: expect(refused).toBeDefined() stayed green while the install-time check it was testing had been deleted, because this bare Error fires one step later and is indistinguishable to a throw-shaped assertion. Only the envelope assertion went red. That is a test that cannot fail on the thing it names — the same class graded p2 twice already this shift (#14386, #14376), and it is worse here because it silently validated an ablation.

Scope, as the card frames it, plus one instruction it implies:

• Error class with code (SCREAMING_SNAKE) + status: 422, message text unchanged so existing substring assertions stay green — the card is right to fence that, and it is what makes this safe to land.
• ⭐ Do the audit the card raises as a "worth checking" and treat it as part of the deliverable: find every current test that asserts only that this path throws, and upgrade it to the envelope. Leaving a bare toThrow() behind reproduces the exact false-green this card exists to remove.
• ⛔ The neighbouring ADR-0029 D9 §6.1 late-install branch (tenant-authored sitting owner) is not a refusal and is not in scope. Do not give it an envelope.

⚠️ Serialisation, not a block. #14163 / PR #14354 adds DUPLICATE_ARTIFACT_OBJECT_NAME one layer up and is in flight. There is no hard dependency — the registration pattern already exists — but check that PR's state first and match its shape, so the two codes do not arrive with two spellings of the same idea.

Size/model suggestion: S at CONTRACT_REVIEW_TIER.

---

Generated by Claude Code

[os-musk]

Claim: engine execution seat, round R13 (rolling wave), dispatching now.
Session: session_0112hMx9hjJ9BgB28X97DS68 (GitHub login os-musk)
Branch: claude/issue-14367-register-object-ownership-envelope
Worktree: ../objectstack-issue-14367 (dedicated per-task worktree off origin/main at a98b61b3e or later)
Domain: domain:engine (packages/objectql; the vocabulary row is the consequence, per triage 5504994180)
File surface: packages/objectql/src/registry.ts — region-bounded: the registerObject cross-package ownership: 'own' refusal (the bare throw new Error(...) at :1802 on origin/main) and one new error class placed beside ArtifactObjectNameConflictError (:1244), nothing else in the file · packages/runtime/src/dispatcher-error-vocabulary.ts — one classification row beside DUPLICATE_ARTIFACT_OBJECT_NAME (~:720) · tests: one new packages/objectql/src/registry-ownership-refusal-envelope.test.ts plus envelope assertions added at the existing sites whose SUBJECT is this refusal (candidates on origin/main: registry-object-overlay-layer.test.ts:294/:454, metadata-facade.test.ts:205; forwarding/log tests such as protocol-commit-history.test.ts:1008 are not subjects) · changesets for every published package touched (@objectstack/objectql, @objectstack/runtime) · content/docs/permissions/system-context.mdx only if the census generator re-anchors it on the merged tree (never hand-edited).
Container & model: mode:subagent, os-dev, fable (Clause-② tier; --tier reports no path mandate — the mandate is from card content: a published error vocabulary gains a code).
Clause-②: yes — a registered refusal code joins the dispatcher error vocabulary and the refusal's error shape gains code + status; message text unchanged. needs:contract-review stays on the card (from triage) and goes on the PR at creation; in-seat contract review at tier before enqueue.
Serial constraints cleared: PR #14354 (#14163, the DUPLICATE_ARTIFACT_OBJECT_NAME precedent triage asked to match) is MERGED bf980cc4 → on origin/main — the shape is settled, match it. packages/objectql/src/registry.ts is shared with the external dispatch #14309 (branch claude/issue-14309-packages-serializable-manifest, no PR yet; its hunks sit at :1116 (+119 lines, package projection helpers) and :3600) — regions disjoint from this card's; the dev merges origin/main before opening the PR if #14309 lands first. No other in-flight card on this lane touches the surface.

---

Generated by Claude Code