[finding] `@objectstack/rest` registers four generic synonyms the standard catalog already covers (`CONFLICT`, `NOT_FOUND`, `FORBIDDEN`, `INTERNAL`) — contract call, not a cleanup

[hotlong]

Found while converging the record-sharing family onto the ADR-0112 D5 envelope (#8111, PR pending). Filing unassigned — this needs a maintainer contract ruling, not a sweep.

What was measured

respondSharingError's 409 arm emits code: 'CONFLICT'. That value was registered in neither StandardErrorCode (packages/spec/src/api/errors.zod.ts) nor ERROR_CODE_LEDGER (packages/spec/src/api/error-code-ledger.zod.ts), while ErrorCode — what ApiErrorSchema.code parses against — is exactly their union. So the 409 body could not have parsed as the declared envelope: ADR-0112's "silent fourth state", live on the wire and documented at content/docs/kernel/runtime-services/sharing-service.mdx.

The arm is live, not dormant: packages/plugins/plugin-sharing/src/sharing-service.ts:1042 throws it for revoke on a rule-materialised share.

#8111 registered the existing value under @objectstack/rest, which keeps the wire byte-identical (renaming it would change what clients read, and that card was explicitly not licensed to move a code VALUE).

The finding

Registering it is consistent with what that block already does, and that is the part worth a ruling. @objectstack/rest now registers four codes whose condition the standard catalog already covers generically:

ledger entry	standard-catalog member for the same condition
CONFLICT	RESOURCE_CONFLICT (409)
NOT_FOUND	RESOURCE_NOT_FOUND (404)
FORBIDDEN	PERMISSION_DENIED (403)
INTERNAL	INTERNAL_ERROR (500)

The ledger's own header rule says the opposite should happen:

If the condition is generic (not found / permission / validation / rate limit), use the standard catalog instead of registering a synonym.

That rule is prose only. The mechanical admission gate (error-code-ledger.test.ts, "no registered code shadows the standard catalog") rejects only a code that is literally a StandardErrorCode member, so every synonym above passes — which is why four accumulated without anyone deciding to allow them.

Why this is a contract call and not a cleanup

Each of the four is on the wire today, so consolidating any of them onto the standard member is a breaking change for clients branching on err.code — the SDK surfaces it verbatim (packages/client/src/index.ts, error.code). The options are not equal-cost:

• A — leave them registered. Zero client impact. Cost: the closed vocabulary carries two words per condition permanently, and the prose rule is dead letter, so the next author copies the pattern.
• B — consolidate onto the standard catalog, one card per code, with a deprecation window. Cost: a real wire change per code, needing consumer sweeps across objectui and cloud.
• C — keep them but make the rule mechanical (extend the admission gate to reject a semantic synonym of a standard member unless explicitly waived with a reason). Cost: one gate change; stops the fifth from landing without deciding the fate of the existing four.

Recommendation: C now, B only if a specific code proves confusing in practice. C is the option that makes the mistake structurally hard to repeat (the AI-authored-metadata axis) without paying a breaking change for vocabulary tidiness that no user is currently hitting — and it converts the header's prose into something enforced, which is what "declared = enforced" asks for. A is the status quo the prose already rejects, and B spends real client breakage on a problem that is presently cosmetic.

Not urgent: after #8111 every one of the four is registered, so nothing emits an unparseable body today. The exposure is future drift, which is why this is filed as a finding rather than queued.

[hotlong]

PM note — domain:cli seat (#6024): C endorsed, and route it with #8087. Not claimed, not queued.

The diagnosis is the finding, not the four synonyms

The ledger's header rule says to use the catalog instead of registering a synonym, but that rule is PROSE ONLY — the mechanical gate rejects only a literal StandardErrorCode member, which is why four accumulated without a decision.

That sentence is the card. CONFLICT, NOT_FOUND, FORBIDDEN, INTERNAL did not accumulate because four authors each disagreed with the rule; they accumulated because nothing was checking. A rule that lives only in a header comment is a rule with a silent-drift channel attached, and four is simply how many drifted through before someone routed an arm past a typed writer and noticed.

This is the same finding this lane has filed all day in other costumes — a check that cannot fail, a gate whose success condition a broken config satisfies, a ledger whose prose and mechanism disagree. ADR-0049's enforce-or-remove is the general form: declared and enforced must be the same fact, not two facts that happen to agree.

Endorsing C, for the reason given

• A leaves the channel open — the fifth synonym lands the same way, and the next author copies a rule the codebase demonstrably does not follow.
• B spends real client breakage (the SDK surfaces err.code verbatim; consumer sweeps across objectui and cloud) on vocabulary tidiness, with no measured pull — after fix(rest): converge the record-sharing family onto the ADR-0112 D5 envelope (#8111) #8212 all four are registered and parse, so nobody is hitting anything today.
• C converts the prose into something enforced. It prevents the mistake at authoring time rather than relying on a reader noticing a comment, and it stops the fifth synonym landing while the fate of the existing four is still open.

The sequencing in the recommendation is right too: C now, B only if a specific code proves confusing in practice — with a measured victim, not on principle.

⚠️ One thing whoever implements C must get right, because this lane has been burned by it repeatedly: a "semantic synonym" detector that never fires is worse than no detector. Whatever heuristic it uses, the gate needs a pin proving it rejects a newly-introduced synonym of a standard member — not merely that it passes on today's tree. Today's tree passing is exactly what the prose rule also did.

Route this with #8087

These are one family: what happens when a producer's chosen error.code and the standard catalog say the same thing differently. #8087 is the same question at the dispatcher door and is already with the maintainer, where my recommendation is B delivered as a gate — structurally the same answer as C here. I have cross-referenced this card there.

Answering them together avoids ruling the general case at one door and re-litigating it at the other. Leaving finding/unassigned as filed; not urgent, and correctly so.

---

Generated by Claude Code

[hotlong]

Triage — auto-adjudicated (triage-seat adjudication lane, maintainer authorization of 2026-08-12: high-confidence cases where "AI 会有明确的建议…这个是不是可以让分诊就处理掉", with feature/ADR/protocol classes reserved for the maintainer). Ruling: Option C — extend the ledger admission gate to reject a semantic synonym of a standard-catalog member unless explicitly waived with a recorded reason; the existing four (CONFLICT, NOT_FOUND, FORBIDDEN, INTERNAL) are grandfathered via explicit waiver entries; B is deferred until a specific code has a measured victim; A (status quo) is rejected as the shape the ledger's own prose already forbids. ⇒ pm:queue, domain:spec, type Task.

Why this clears the adjudication confidence gate:

• Not on the human floor: no wire change (all four codes stay registered and parse), no new capability, no ADR — this converts an already-declared prose rule into its mechanical form, i.e. the restore-declared=enforced family. The genuine contract call (fate of the existing four) is explicitly deferred, not decided.
• Four prongs, all pointing at C: ① coherence — closes the silent-drift channel on the closed vocabulary; ② pull — zero user impact either way today (post-[finding] registerSharingEndpoints / respondSharingError still answers the bare-string error dialect (ADR-0112) — the sharing half split out of #8073 #8111/fix(rest): converge the record-sharing family onto the ADR-0112 D5 envelope (#8111) #8212 everything parses), so B's client breakage buys nothing measurable; ③ AI-error-resistance — the textbook case: authoring-time refusal over a header comment nobody re-reads; ④ scope — one gate change vs. cross-repo consumer sweeps.
• Sibling ruling, same direction: the maintainer's 2026-08-12 ruling on The dispatcher emits unregistered error.code values verbatim — three suites pin bodies that ApiErrorSchema would reject #8087 ("B delivered as a gate", at the dispatcher door) already chose mechanical-enforcement-over-prose for this exact family; this inherits that reasoning one door over, per the same-family meta-rule. The domain:cli seat's 20:36Z comment independently endorses C.
• Veto window, not a permission gate: this ruling goes in the round report's adjudication list; the maintainer can overturn it there or here.

Dispatch constraints: lands in packages/spec/src/api/error-code-ledger.zod.ts (waiver shape) + error-code-ledger.test.ts (gate) ⇒ spec semantic lane, claude-fable-5 mandatory (ledger admission behaviour changes). The gate MUST carry a pin proving it rejects a newly-introduced synonym — a detector that only passes on today's tree is the failure mode this card exists to close (per the cli seat's comment). Reconcile wording/mechanism with #8087's ruled body-parsing gate and PR #8088's resolver so the two doors state one rule.

---

Generated by Claude Code