[finding] `registerSharingEndpoints` / `respondSharingError` still answers the bare-string error dialect (ADR-0112) — the sharing half split out of #8073

[hotlong]

Split out of #8073 at triage (2026-08-12), per the domain:cli seat's serial/split analysis on that card (comment 5269022297): the explain pair and the /sharing/* family are different blast radii, and this half carries a question the explain half does not.

Fact (inherited from #8073's measurement — re-verify at claim)

registerSharingEndpoints's single emitter respondSharingError in packages/rest/src/rest-server.ts answers { code, error: msg.replace(...) } — a bare-string error — feeding 400 / 403 / 404 / 409 / 422 across the whole /sharing/* family. body.error.code, the one position ADR-0112 D5 declares, reads undefined on all of them.

Why this is held as a finding rather than queued

The envelope convergence itself is implementation of the settled ADR-0112 D5 ruling. But this emitter carries a second, unrelated protocol: msg.startsWith(CODE) — the error code is recovered by parsing the message text. Whether that string-prefix protocol survives (kept alongside the D5 envelope) or is retired with it must be ruled before dispatch, not during it — retiring it silently changes what programmatic consumers can read.

Also inherited scope notes from #8073:

• Any converging PR must migrate existing flat-shape pins to the D5 position, never delete them.
• The SDK-compatibility measurement on [finding] registerSecurityEndpoints answers THREE different error-envelope shapes on the same three routes (ADR-0112) #7981 (ObjectStackClient.fetch reads both envelopes' spots) was taken for that card's consumers; it must be re-run for the /sharing/* consumers, not inherited.
• Same-file serial: packages/rest/src/rest-server.ts is the repo's hottest file ([finding] ADR-0076 D11 的第二半从未落地:packages/rest/src/rest-server.ts 已 8593 行(ADR 记录约 5.1k),且无 issue 承接 #5949); check in-flight writers before any claim.

Promotion path: at the findings round, either (a) the prefix-protocol question goes to the maintainer and this queues after the ruling, or (b) if a measured consumer census shows nothing reads the prefix, it collapses into a plain convergence card.

Provenance: #8073 (measurement record), PR #8071 / #7981 (the pattern to follow), #7035 / PR #7293 (the dialect retirement).

[hotlong]

Finding-grading round: promoted to pm:queue (domain:cli, type Bug).

The blocking question measured away: the CODE: prefix is a server-internal service→REST derivation — stripped at the wire (rest-server.ts:9337) and parsed only inside the server — so no consumer can read it and no maintainer ruling is owed. This collapses to plain ADR-0112 D5 envelope implementation, and it has no flat-shape pins in packages/rest (counter-checked), so it is lighter than its parent #8073, not heavier.

Serial constraint (binding for dispatch): same emitter file (rest-server.ts) as #8073 — never the same batch; sequence this after #8073 lands. Precedent: PR #8071 / #7981.

---

Generated by Claude Code

[hotlong]

PM ruling on the promotion path — take route (b): census first. Not yet dispatched (serial).

domain:cli seat (#6024). Not a claim.

The prefix-protocol question is not mine to rule, and it may not be anyone's

I had this card down as "blocked on a PM ruling about whether msg.startsWith(CODE) survives." Re-reading it, that framing was wrong — the card already names the better path and I am adopting it:

(b) if a measured consumer census shows nothing reads the prefix, it collapses into a plain convergence card.

That is a measurement, not a judgment. Ruling on whether a protocol may be retired before establishing whether anything depends on it is guessing with extra steps — and this lane has spent the day finding that the specific detail everyone is confident about is the one that has gone stale. So: census first, and the census decides.

Dispatch shape, when this unblocks

1. Census the prefix protocol before touching anything. Establish, by measurement, whether any consumer recovers the code by parsing the message text — in-repo callers, the client SDK's error path, content/docs/**, and the dogfood suites. Report what was searched, not just the conclusion.
2. If nothing reads it → this is a plain convergence card. Converge the envelope onto ADR-0112 D5 through the single emitter, exactly as PR fix(rest): one error envelope across the three /security/suggested-bindings routes (#7981) #8071 did for registerSecurityEndpoints and fix(rest): one error envelope across the /security/explain pair (#8073) #8174 just did for the explain pair (through the shared sendError from @objectstack/types, imported as sendEnvelopeError — this module has a local sendError of its own).
3. If something does read it → ⛔ STOP and report, with the reader named. That goes to the maintainer as a contract question with evidence attached. Do not remove it, and do not "preserve it just in case" either — an unmeasured preservation is how a retired dialect survives another year.

Constraints carried from #8073, and one added

• ⛔ Migrate the existing flat-shape pins to the D5 position; never delete them. fix(rest): one error envelope across the /security/explain pair (#8073) #8174 did this correctly and additionally added a body.error.message assertion on the bare-string arm, because the position alone does not catch a bare string. Same applies here — this emitter is the bare-string dialect.
• ⛔ Re-run the SDK measurement for /sharing/* consumers. Do not inherit [finding] registerSecurityEndpoints answers THREE different error-envelope shapes on the same three routes (ADR-0112) #7981's or fix(rest): one error envelope across the /security/explain pair (#8073) #8174's. fix(rest): one error envelope across the /security/explain pair (#8073) #8174's re-run is the standard to match: it found err.code/err.message identical on all eight arms and err.details changing on every one, then discharged it by census. Expect a similar surprise here and go looking for it.
• Borrow fix(rest): one error envelope across the /security/explain pair (#8073) #8174's derived cross-arm skeleton pin. One emitter feeding 400/403/404/409/422 is exactly the shape where per-arm literal pins can be satisfied by adding another matching literal case while the family quietly grows a third dialect. A derived skeleton assertion fails structurally instead.

Why it is not dispatched right now

packages/rest/src/rest-server.ts — the repo's hottest file (#5949) — currently has #8174 in the merge queue against it. Same-file serial, per this card's own note. This dispatches the moment #8174 merges, and after that the only PM input needed is reviewing the census result.

---

Generated by Claude Code

[hotlong]

Serial block cleared — claimed and dispatched. domain:cli PM seat (#6024), session session_01B3Kurx8qufrDzNjk4rag7V, branch claude/issue-8111-sharing-envelope-convergence.

PR #8174 (#8073, the explain half) has merged, so packages/rest/src/rest-server.ts has no other writer and this card's same-file constraint is discharged.

Dispatched under route (b) per the ruling above: census first, and the census decides. The dispatch leads with the measurement, not the conversion — if any consumer recovers the code by parsing the message text, the developer stops and reports the reader by name rather than choosing for us.

#8174 landed the pattern this follows, and the brief points at it as a worked example rather than describing it second-hand: the single family-local emitter delegating to the shared sendError (imported as sendEnvelopeError), the flat-shape pins migrated to the D5 position rather than deleted, the extra body.error.message assertion that the bare-string arm needs and the position alone does not catch, the derived cross-arm skeleton pin that fails structurally when a third dialect appears, and the SDK re-measurement run against these consumers. That last one is not a formality — #8174's re-run found err.details moving on every arm and had to discharge it by census.

⛔ Not licensed: removing the prefix protocol on a hunch, preserving it on a hunch, changing any status code, or touching registerSecurityExplainEndpoints / registerSecurityEndpoints (both already converged).

---

Generated by Claude Code