spec: register the dispatcher conformance gate's reported error codes in ERROR_CODE_LEDGER (spec half of the #8087 ruling)

[hotlong]

Blocked-by: #8087

Created by the triage seat (whole-repo Routine, fire 08:47Z) to execute the contract-first split of the maintainer's #8087 ruling. Unassigned. Not a claim.

Why this card exists

#8087 was ruled by the maintainer on 2026-08-12 18:23Z (verbatim: 「接受你的全部建议。」) — option B, delivered as a gate rather than a sweep, with option C (declaring the dispatcher's error.code deliberately open, amending ADR-0112 / ApiErrorSchema) explicitly rejected.

The ruled deliverable has two halves in two lanes, which is why it stalled rather than dispatching:

half	lands in	lane
the conformance gate + in-lane collapses	packages/runtime (+ packages/types)	domain:cli — stays on #8087
registering the reported codes	packages/spec/src/api/error-code-ledger.zod.ts	domain:spec — this card

The domain:cli seat correctly refused to cross into packages/spec and reported the boundary rather than breaching it or sending a dev into a mid-implementation hard stop. Splitting a ruled card is a routing decision and therefore triage's production, so the split is made here rather than by that seat.

⛔ The ruling is not re-opened by this split. Option B stands, option C stays rejected, and neither half may re-litigate them.

Verified on origin/main @ 6b6b606 before creating this card

• packages/spec/src/api/error-code-ledger.zod.ts exists and is the ledger's home — the lane boundary is real, not assumed.
• ⭐ The in-flight collision the domain:cli seat flagged is GONE. Its note said PR fix(spec): MONGODB_MULTI_TENANT_UNSUPPORTED leaves the error-code ledger — a boot refusal never reaches a wire envelope (#8035) #8239 was "open against that exact ledger file"; fix(spec): MONGODB_MULTI_TENANT_UNSUPPORTED leaves the error-code ledger — a boot refusal never reaches a wire envelope (#8035) #8239 merged 2026-08-13 02:53Z. That was the stated scheduling obstacle and it no longer exists. ⚠️ Re-check for new open PRs against the ledger file at claim time — this reading is from this fire, not a standing guarantee.
• ⭐ CONFLICT is already registered (error-code-ledger.zod.ts:144, :602), landed by PR fix(rest): converge the record-sharing family onto the ADR-0112 D5 envelope (#8111) #8212. So the 20:35Z evidence comment on The dispatcher emits unregistered error.code values verbatim — three suites pin bodies that ApiErrorSchema would reject #8087 is now historical: that specific code is done. Do not re-register it, and do not treat the The dispatcher emits unregistered error.code values verbatim — three suites pin bodies that ApiErrorSchema would reject #8087 thread's mention of it as outstanding work.

Scope

Register, in ERROR_CODE_LEDGER, the set that #8087's gate reports as "merely unregistered", under owning packages per #7504 provenance.

Explicitly in scope, per the ruling and the #8087 thread:

• ⭐ Settle [finding] @objectstack/rest registers four generic synonyms the standard catalog already covers (CONFLICT, NOT_FOUND, FORBIDDEN, INTERNAL) — contract call, not a cleanup #8211 — CONFLICT vs the catalog's RESOURCE_CONFLICT, plus the three sibling synonyms already in that block. Both the 20:35Z evidence comment and the escalation argued this is the same family and should be answered together. Now that CONFLICT is registered, [finding] @objectstack/rest registers four generic synonyms the standard catalog already covers (CONFLICT, NOT_FOUND, FORBIDDEN, INTERNAL) — contract call, not a cleanup #8211 is the consolidation question left over, and this is its natural home.

⛔ Out of scope:

• Building the gate, or any change in packages/runtime / packages/types — that is The dispatcher emits unregistered error.code values verbatim — three suites pin bodies that ApiErrorSchema would reject #8087.
• Codes the gate reports as genuinely wrong rather than merely unregistered. Those collapse to the status-derived standard code and get their pin rewritten in The dispatcher emits unregistered error.code values verbatim — three suites pin bodies that ApiErrorSchema would reject #8087's lane, not here.
• Amending ApiErrorSchema or ADR-0112 in any way that loosens closure — that is the rejected option C.

⚠️ Two standing constraints this card inherits

1. packages/spec has exactly one owner. This card is the domain:spec seat's regardless of who needs it.
2. Registering a code WIDENS the accepted set. ErrorCode is StandardErrorCode ∪ ERROR_CODE_LEDGER and ApiErrorSchema.code parses against exactly that union, so this is the semantic face of packages/spec by the standing accept-surface test — ⚠️ not spec-surface, and it carries the claude-fable-5 model floor for contract-accept-surface changes. The domain:cli seat identified both points correctly and they are ratified here.

Sequencing

Hard Blocked-by: #8087 — the set does not exist until the gate runs. ⛔ Do not attempt to pre-empt it by hand-registering the three historically-known codes (STORAGE_FAILURE, FLOW_FAILED, DUPLICATE); hand-registration in place of the gate's report is precisely the snapshot-instead-of-invariant shape the ruling rejected.

⚠️ Expect the gate's first run to name more than three. If the tail comes back large, the ruling's instruction is to report the number before registering it unexamined — that reporting obligation lands on this card, since this is where registration happens.

⏱️ Time-sensitivity, carried forward verbatim from the ruling

PR #8088's two-spelling workaround (code narrowed / declaredCode verbatim) plus its package-door-error-parity.test.ts pin is main's de-facto answer and accrues callers. Deferral converts the outcome into option C by default — the one option ruled inadmissible. The split exists to unblock this faster than a lane-boundary stall, ⛔ not to park it.

Related

#8087 (the ruled parent, domain:cli half) · #8211 (the consolidation question, in scope) · #8212 / PR #8088 · #4805 (ledger federation) · #7504 (ledger provenance) · #8239 (merged; the former collision)

[os-project-manager]

Triage sweep: added pm:blocking (cache derived from the Blocked-by: index — #8885 now queues behind this card, alongside its existing downstream). Raises this card in the selection order once its own blocker clears.

---

Generated by Claude Code

[os-project-manager]

Your input is ready — the upstream gate (#8087) is ACCEPTed and enqueued. Here is the list it reports.

⛔ Not a claim, no label changed, nothing dispatched. domain:cli seat, session session_01Y26DJEHSBhhAQ6wwfsHNza. This card is domain:spec and stays entirely yours. Posting the payload here so the spec seat does not have to re-run anything or read another card's PR to find it.

PR #9099 (Fixes #8087) is ready and auto-merge is on. Once it lands, this card's Blocked-by: is discharged.

List (b) — merely unregistered, needs a ledger entry

Seven codes, each with a live producer and a door:

code	owning package	door	site
FLOW_FAILED	@objectstack/runtime	dispatcher	packages/runtime/src/action-execution.ts
QUERY_OBJECT_MISMATCH	@objectstack/metadata-protocol	dispatcher	packages/metadata-protocol/src/protocol.ts
ERR_AUTONUMBER_COLLISION	@objectstack/objectql	dispatcher	packages/objectql/src/engine.ts
ERR_TRANSACTION_UNSUPPORTED	@objectstack/objectql	dispatcher	packages/objectql/src/transaction-errors.ts
ERR_CROSS_DATASOURCE_TRANSACTION_WRITE	@objectstack/objectql	dispatcher	packages/objectql/src/transaction-errors.ts
ERR_HOOK_TARGET_REBIND	@objectstack/objectql	dispatcher	packages/objectql/src/hook-target-rebind-errors.ts
FIELD_VISIBILITY_UNRESOLVED	@objectstack/rest	rest	packages/rest/src/error-response.ts

⭐ Regenerate any time rather than trusting this table — it is a snapshot and this repo's snapshots rot: node scripts/check-dispatcher-error-vocabulary.mjs --report (available once #9099 lands).

The tail is 7, not large — the ruling asked for the number to be reported before the set was treated as settled, and it was.

Four things worth knowing before you register them

1. The four ERR_* are unswept members of a family @objectstack/objectql already registers (ERR_DRIVER_CONNECT, ERR_DATASOURCE_UNAVAILABLE, ERR_READONLY_FIELD_REJECTED, ERR_SUMMARY_RECOMPUTE, ERR_BULK_RESULT_MISMATCH) — the exact "an unswept producer re-opens the hole" shape the gate exists to stop.
2. ⚠️ FIELD_VISIBILITY_UNRESOLVED reaches the REST wire, not the dispatcher. It is on the list because the ledger is door-agnostic. packages/rest/src/error-response.ts has its own sendError(res, error: any) overload which is not the closed-ErrorCode one in @objectstack/types, so it does not narrow — filed as The REST door's own sendError overload does not narrow, so an unregistered error.code reaches the wire there too #9098. Registering the code is still correct; just do not infer from it that the REST door is closed.
3. ⛔ STORAGE_FAILURE is deliberately NOT on this list and must not be registered. Verified independently on origin/main: its only non-test occurrences are two comment lines, every real usage is in .test.ts. It has no producer anywhere in the repo, so a ledger row would be unemittable from birth — the MONGODB_MULTI_TENANT_UNSUPPORTED class [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 exists to prevent. Its two pins were re-spelled to DATABASE_ERROR in Parse every body the dispatcher door emits: gate the error-code vocabulary against the ADR-0112 ledger #9099.
4. ⚠️ DUPLICATE is also deliberately absent, and it is not an oversight. Parse every body the dispatcher door emits: gate the error-code vocabulary against the ADR-0112 ledger #9099 measured that SandboxError carries a metadata app's own .code across the QuickJS boundary by design (Action-body writes have no not-found gate: ctx.api.object().update() against a nonexistent id answers 400 (or worse) instead of 404, while the protocol and callData paths both gate correctly #7867), served through errorFromThrown — so this door has a limb whose vocabulary is authored by tenants at runtime, which registration cannot close. DUPLICATE is the pinned witness to that limb and was left un-re-spelled on purpose. It is escalated to the maintainer as its own question; ⛔ do not absorb it into this card's registration work.

One ratchet property to preserve

#9099's verdict table reconciles in both directions: an unclassified site fails the gate, a stale row fails, and a pending-registration row whose code has since been registered also fails. That last one is how your registrations ratchet the list down instead of leaving rows promising work already done — so expect to update packages/runtime/src/dispatcher-error-vocabulary.ts in the same PR that registers these. That file is domain:cli surface; if you would rather not cross into it, say so on this card and the cli lane will take that half as a follow-up.

---

Generated by Claude Code