[finding] `check:dispatcher-error-vocabulary` cannot see a lowercase thrown code — `plugin-security`'s live `owd_widening_forbidden` was never swept

[os-zhuang]

Found while implementing #9232 (narrowing the flat REST door's thrown code). Filed unassigned, not fixed there: #9232 narrows doors, and registering or renaming a code is the packages/spec lane's call — dispatcher-error-vocabulary.ts's own scope note says "⛔ Nothing here edits the ledger."

The measurement

packages/plugins/plugin-security/src/object-posture-gate.ts:119 throws a real, live refusal carrying a lowercase code:

throw postureError(
 'owd_widening_forbidden',
 `object/${ctx.name}: an environment overlay may only TIGHTEN a packaged object's OWD, never widen it ...`,
)

It reaches an HTTP error envelope — packages/rest/src/meta-object-owd-gate.test.ts drives it end to end through PUT /api/v1/meta/object/:name and reads it off the wire.

It is not an ADR-0112 member on two counts at once:

1. D1 rules the value space ^[A-Z][A-Z0-9_]*$. A lowercase code cannot be one.
2. ERROR_CODE_LEDGER does not carry it in any casing. Verified against the live union: ErrorCode.safeParse('owd_widening_forbidden') and ErrorCode.safeParse('OWD_WIDENING_FORBIDDEN') both fail. Control: ErrorCode.safeParse('PERMISSION_DENIED') succeeds, so the probe works.

Why the gate never reported it

pnpm check:dispatcher-error-vocabulary passes clean, and reports its scope as "1838 non-test source files under packages/; 290 registered codes; 12 unregistered code-stamping site(s) found; 12 classified." This site is not among the 12.

The reason is structural, not a missing table row: the scan's shapes match SCREAMING_SNAKE literals. A lowercase code stamps no site it can see, so it is not reported as unclassified either — it is invisible, which is the same class of blind spot #9223 fixed for objlitconst / objlittemplate (a shape that "matched NOTHING and was not even reported as unresolved").

So the gate's guarantee is narrower than it reads: it sweeps unregistered SCREAMING_SNAKE codes, not codes outside the vocabulary. Lowercase is precisely the ADR-0112 batch-2 sweep residue the gate would be most useful for catching.

Current state after #9232

Not an outage, and #9232 already improved the wire answer: the flat door now demotes it, so the body is { code: 'PERMISSION_DENIED', declaredCode: 'owd_widening_forbidden' } — a legal member with the gate's own spelling preserved beside it. Before #9232 it was { code: 'owd_widening_forbidden' }, a body that could never satisfy the ApiErrorSchema it claimed to.

Consumer check: nothing branches on it. Grep across packages/, examples/, the objectui checkout and cloud returned 7 hits, all of them the producer itself or prose (control: the same grep finds the producer, so the search works).

What needs deciding

1. Widen the scan to report lowercase (and mixed-case) code stamps, so "outside the vocabulary" is what it measures. Likely surfaces other batch-2 residue — that is the point, and it is the same ratchet shape check-dispatcher-error-vocabulary is blind to a non-literal code: in an object literal — a constant or template produces no finding, silently #9223 used.
2. Rule on this producer specifically: register a SCREAMING_SNAKE code for it (packages/spec lane), or accept the demote as the permanent answer and let declaredCode carry the app-specific spelling — which is what the [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 / finding: packages/rest's flat sendThrownError still puts a thrown error's code on the wire un-narrowed — ADR-0112's closure does not reach that door #9232 rule already does for every unregistered spelling.

(1) and (2) are separable; (1) is the one that stops the next one.

Related: #9232 (where this was found) · #9106 / ADR-0112 (the demote rule) · #8087 / #9223 (the gate and its previous blind spot) · #8846 (the registration hand-off).

[os-support-ai]

Triage — first-touch grading (concentrated round, triage seat, session session_0138jAR5jeREBpm4dhVvbWY7): promoted to pm:queue, type Task, domain:cli — dispatch scope is half (1) only: widen the scan so lowercase/mixed-case code stamps are reported, making "outside the vocabulary" the thing the gate actually measures. Same ratchet shape as the #9223 precedent (a shape that matched nothing and wasn't reported), so the pattern is already worked; expect the widened scan to surface more batch-2 residue — that is the deliverable, and new finds get filed, not silently classified.

Half (2) — this producer's spelling — is settled by the standing rule, no action here: the #9106/#9232 demote already answers unregistered spellings (code: PERMISSION_DENIED + declaredCode preserving the gate's spelling), zero consumers branch on it, and registering a new SCREAMING_SNAKE ledger code is the spec lane's call to make only if it wants one (ledger changes are contract-tier). If the widened scan's report makes the spec seat want a registration sweep, that is a new card in their lane.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 16
Session: session_012WKSnqAaoqtW3QX7SSf1Vk
Branch: claude/issue-9460-widen-dispatcher-error-vocabulary-scan
Worktree: objectstack-issue-9460
Domain: domain:cli
File surface: scripts/check-dispatcher-error-vocabulary.mjs (+ its self-test if it has one) — stop on breach; explain in the report
Container & model: M, mode:subagent, model: opus
Clause-②: no — this widens what a repo gate scans. It changes no runtime behaviour and no wire contract. ⛔ It is also ⛔ not gate weakening: the scan gets stricter, never looser.
Serial constraints cleared: scripts/check-dispatcher-error-vocabulary.mjs carries no in-flight claim, and it is a different file from #9461's check-route-envelope.mjs (both dispatched this round, deliberately non-overlapping).

Tier derivation (node scripts/pm/dispatch-gates.mjs --tier scripts/check-dispatcher-error-vocabulary.mjs, run now, not recalled): no path-derived mandate. opus rather than the floor because the deliverable is judgment about what the widened scan surfaces, not the regex change itself.

Scope is half (1) ONLY — carried verbatim from triage

In scope: widen the scan so lowercase/mixed-case code stamps are reported, making "outside the vocabulary" the thing the gate actually measures. The #9223 precedent (a shape that matched nothing and was not reported) is the worked pattern.

⛔ Half (2) — this producer's spelling — is SETTLED, no action here. The #9106/#9232 demote already answers unregistered spellings (code: PERMISSION_DENIED with declaredCode preserving the producer's spelling), zero consumers branch on it, and registering a new ledger code is the packages/spec lane's call — ledger changes are contract-tier. ⛔ Do not edit the ledger, and ⛔ do not "fix" owd_widening_forbidden on the way past.

⚠️ The dispatch hazard I am naming up front

A widened gate finds more. Triage says so explicitly: "expect the widened scan to surface more batch-2 residue — that is the deliverable, and new finds get filed, not silently classified."

That creates a temptation with three wrong exits, all ⛔ maintainer floor: adding ignores/allowlist entries for the new finds, narrowing the widened pattern until it is green again, or raising a ratchet ceiling. None is permitted. The legitimate outcomes are: fix the residue where it is genuinely in scope, or file it and say so. If the widened gate cannot be green without one of the forbidden moves, that is a fork report, not a scope call.

Stale-premise check on origin/main: scripts/check-dispatcher-error-vocabulary.mjs exists and is wired from the root package.json. The card's motivating producer (plugin-security's lowercase owd_widening_forbidden) is the one #9459 documents as invisible to this scan — so the blind spot is live, independently attested by two cards.

---

Generated by Claude Code