finding: `packages/rest`'s flat `sendThrownError` still puts a thrown error's `code` on the wire un-narrowed — ADR-0112's closure does not reach that door

[os-project-manager]

Found while implementing #9106 (the demote at the dispatcher/actions door). Filed unassigned, not fixed there: #9106's ruled scope named the actions door and the shared resolver, and the claim for it explicitly fenced off packages/rest/src/error-response.ts as #9098's surface.

The measurement

The 2026-08-16 ruling on #9106 says error.code is a closed vocabulary at every door, and #9106 delivers that for the three exits that read resolveThrownHttpError (HttpDispatcher.errorFromThrown, dispatcher-plugin's errorResponseBase, endpoint-executor's endpointErrorAnswer) plus the direct-mount package registrar.

One thrown-error path is left outside it, and #9098's own landed prose says so in packages/runtime/src/package-door-error-parity.test.ts, verbatim:

• THROWN errors: NOT narrowed, deliberately and symmetrically with this door. sendThrownError passes a caught error's code through verbatim; narrowing that is an ADR-0112 public-contract decision, not an internal typing one.

That sentence was true when it landed. #9106 changed the half it rests on — the dispatcher door narrows now — so the stated symmetry is gone and packages/rest's flat responder is the one thrown path that still emits an unregistered spelling.

Why it is narrower than it looks (and why it is still worth a card)

The flat dialect puts code at the body's top level ({ error: 'message', code: 'X' }), not in error.code. So it is arguably not the field ADR-0112 D4 closes, which is why #9106 did not reach it by construction rather than by oversight. Two reasons it is still a real card:

1. The invariant is now stated absolutely. After the [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 amendment, ADR-0112 reads "closed at every door". An agent reading it, then reading a sendThrownError body, sees a contradiction and has no way to tell which one is authoritative — the exact AI-error-resistance failure [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 was filed to remove, moved one door over.
2. check:dispatcher-error-vocabulary sweeps only the PLATFORM producers of that path. It cannot reach a code that is not written in this repo — the same construction limit that produced [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106's tenant-authored limb.

Deliberately not decided here

Whether the answer is (a) narrow the flat door too and add a declaredCode sibling, (b) converge the envelope position first and let the vocabulary follow, or (c) rule the top-level code a different field that ADR-0112 does not govern, and say so in the ADR. That is a public-contract decision, per #9098's own note.

Stale citation to fix while here

#9098's prose and the #9106 ADR amendment both point at #7035 as the open envelope-position finding. #7035 is closed (completed 2026-08-10, PR #7293) and was only about three /meta 501 handlers. The envelope-convergence line needs a live card to point at — this one, or a dedicated envelope card if triage prefers to split them.

Not reproduced as a client-visible break

No consumer branch on an unregistered top-level code from that door was found: the #9106 precondition sweep classified every out-of-vocabulary SCREAMING_SNAKE literal on the consumer surfaces (client, client-react, examples, qa, the objectui checkout) and none was an error.code-class read. So this is a contract-coherence card, not an outage.

Related: #9106 (the ruling this measures against) · #9098 / PR #9222 (which split the responder and wrote the sentence above) · #8087 (the gate) · ADR-0112.

[os-zhuang]

Triage: decision card — needs-user-decision + domain:cli, type Task. Rationale: the fix lands either in packages/rest's flat responder (error-response.ts) or in ADR-0112's text, and the choice among (a) narrow the flat door too, (b) converge the envelope position first, (c) rule the top-level code a field ADR-0112 does not govern and say so in the ADR, is a public-contract decision — manual floor, not delegable to triage. Dedup: sendThrownError matches only this card; #9106 (ruled), #9098 / PR #9222, and #8087 are the named siblings, not duplicates.

Four-prong analysis:

1. Platform long-term coherence — after the [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 amendment ADR-0112 states "closed at every door" absolutely, while this thrown path demonstrably is not. (a) or (c) shrinks the contradiction; (b) removes the dialect that hosts it. Leaving it unwritten re-creates the exact ambiguity [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 closed, one door over.
2. Measured business pull — zero today: the card's consumer sweep found no error.code-class read of the flat top-level code. Contract-coherence card, not an outage.
3. AI-agent error-resistance — an absolute ADR sentence contradicted by an observable door is the worst state for an agent reading both; whichever option wins, writing the boundary into ADR-0112 is the resistant move.
4. Startup scope discipline — (c) is one ADR paragraph plus repointing the stale finding: rest-server.ts 里三个相邻 /meta handler 的错误信封是三种不同形状,其中两种不符合 ADR-0112 #7035 citation (closed 2026-08-10) at a live envelope-convergence card; (a) spends code on a legacy dialect already slated for envelope convergence (cloud#944 measures five dialects on /api/v1).

Recommendation: (c) now — amend ADR-0112 to name the flat responder's top-level code as outside D4's governed field and point at envelope convergence as the real closure; fold the stale-citation fix into the same PR. Option (a) becomes moot if the envelope converges.

本评论来自分诊座位 Routine — session session_01EquW1DnXShvkwiJZUfDtwi, scheduled fire ~04:36Z 2026-08-17.

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling (2026-08-17, recorded by PM session session_01NYgmGheCzM6NrHZN436Cxf). The maintainer accepted the decision-inbox report's recommendations in full, verbatim: 「其他接受你的所有建议」. For this card:

Ruled: demote alignment — the flat sendThrownError door narrows too.

• A thrown error's code that is not an ErrorCode enum member is demoted to a declaredCode sibling in the flat body, exactly as the dispatcher/actions door now does under the [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 ruling — code is a closed vocabulary at every door, with no carve-out for body position. Option (c) (declaring the top-level code a different, ungoverned field) is rejected: it would cut an exception into an invariant amended to be absolute yesterday, recreating the reader contradiction this card measures.
• Envelope-position convergence (option b) is not a precondition — the vocabulary fix does not wait on the larger envelope program.
• Same batch: fix the stale finding: rest-server.ts 里三个相邻 /meta handler 的错误信封是三种不同形状,其中两种不符合 ADR-0112 #7035 citations in The REST door's own sendError overload does not narrow, so an unregistered error.code reaches the wire there too #9098's prose and the ADR-0112 amendment — the envelope-position line points at this card (or a dedicated envelope card if triage splits one out).
• The parity-test sentence in package-door-error-parity.test.ts ("NOT narrowed, deliberately and symmetrically") is updated in the same change — the symmetry it cites no longer exists.
• Tier: this narrows caller-visible vocabulary back to the declared ADR-0112 contract — same class as [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106's slice; dispatch per that precedent.

Label flipped needs-user-decision → pm:queue in the same stroke.

---

Generated by Claude Code