Surfaced by the widened check:dispatcher-error-vocabulary scan (#9460, half 1). Filed unassigned — registering or renaming a code is the packages/spec lane's call, and #9460's triage ruled that a registration sweep coming out of the widened report is a new card in that lane rather than work done on the gate card. The gate card records the measurement only; nothing here has been decided.
Both are recorded in packages/runtime/src/dispatcher-error-vocabulary.ts as verdict: 'pending-registration', which is what took PENDING_LEDGER_REGISTRATION from 0 to 2. That list is the #8846 hand-off.
1. FLOW_CONVERSION_CONFLICT — a live 409, straightforwardly registrable
packages/metadata-protocol/src/protocol.ts refuses a metadata write whose token is already a live name in the environment:
const err = new Error(`[flow_conversion_conflict] ...`);
(err as any).code = 'FLOW_CONVERSION_CONFLICT';
(err as any).status = 409;
throw err;
Already SCREAMING_SNAKE, so ADR-0112 D1 is satisfied and this is an ordinary ledger admission. It was invisible until now because the assign shape demanded a bare identifier to the left of .code and this site writes a cast, putting a ) where the anchor wanted a word character.
Note the message prefix spells the code lowercase while the stamp spells it SCREAMING — worth a glance when registering, since the prefix is what a human reads in a log.
2. owd_widening_forbidden — a live 403 that D1 forbids as spelled
packages/plugins/plugin-security/src/object-posture-gate.ts throws the ADR-0090 D7 / ADR-0086 D1 refusal through a code-carrying helper. It reaches the wire verbatim: packages/rest/src/meta-object-owd-gate.test.ts drives PUT /api/v1/meta/object/:name and asserts a 403 whose body code is this exact lowercase string.
This is the producer #9460 and #9459 both attest. The open question is only what to do about the spelling, and it is genuinely a fork:
⚠️B is not what happens today on this route. The #9460 issue body states the flat door already demotes it, but on origin/main at 65d4fff the REST meta door does not go through the demoting dispatcher — the test above asserts the raw lowercase code on the wire, and a search of the history finds no commit carrying that change. So the body is currently one ApiErrorSchema cannot parse. Whichever way this goes, that is the fact to start from.
pending-registration is the only honest verdict the current vocabulary offers for it (foreign-vocabulary would be false — it is a request refusal on a wire; boot-refusal would be false — it crosses an HTTP boundary), but it is strictly a record that a live wire code is outside the vocabulary, not a vote for option A.
Related: #9460 (the gate widening that measured this) · #9459 · #8846 (the registration batch) · #9106 (the demote rule).
Surfaced by the widened
check:dispatcher-error-vocabularyscan (#9460, half 1). Filed unassigned — registering or renaming a code is thepackages/speclane's call, and #9460's triage ruled that a registration sweep coming out of the widened report is a new card in that lane rather than work done on the gate card. The gate card records the measurement only; nothing here has been decided.Both are recorded in
packages/runtime/src/dispatcher-error-vocabulary.tsasverdict: 'pending-registration', which is what tookPENDING_LEDGER_REGISTRATIONfrom 0 to 2. That list is the #8846 hand-off.1.
FLOW_CONVERSION_CONFLICT— a live 409, straightforwardly registrablepackages/metadata-protocol/src/protocol.tsrefuses a metadata write whose token is already a live name in the environment:Already SCREAMING_SNAKE, so ADR-0112 D1 is satisfied and this is an ordinary ledger admission. It was invisible until now because the
assignshape demanded a bare identifier to the left of.codeand this site writes a cast, putting a)where the anchor wanted a word character.Note the message prefix spells the code lowercase while the stamp spells it SCREAMING — worth a glance when registering, since the prefix is what a human reads in a log.
2.
owd_widening_forbidden— a live 403 that D1 forbids as spelledpackages/plugins/plugin-security/src/object-posture-gate.tsthrows the ADR-0090 D7 / ADR-0086 D1 refusal through a code-carrying helper. It reaches the wire verbatim:packages/rest/src/meta-object-owd-gate.test.tsdrivesPUT /api/v1/meta/object/:nameand asserts a 403 whose bodycodeis this exact lowercase string.This is the producer #9460 and #9459 both attest. The open question is only what to do about the spelling, and it is genuinely a fork:
OWD_WIDENING_FORBIDDEN), fix the producer, and let the row ratchet out. Costs a wire-visible code change on a route whose test pins the current string.error.codehas a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106/finding:packages/rest's flatsendThrownErrorstill puts a thrown error'scodeon the wire un-narrowed — ADR-0112's closure does not reach that door #9232 demote answer it (code: PERMISSION_DENIEDwithdeclaredCodepreserving the producer's spelling), and record the site under a verdict that says so. [finding]check:dispatcher-error-vocabularycannot see a lowercase thrown code —plugin-security's liveowd_widening_forbiddenwas never swept #9460's triage notes zero consumers branch on it.origin/mainat 65d4fff the REST meta door does not go through the demoting dispatcher — the test above asserts the raw lowercase code on the wire, and a search of the history finds no commit carrying that change. So the body is currently oneApiErrorSchemacannot parse. Whichever way this goes, that is the fact to start from.pending-registrationis the only honest verdict the current vocabulary offers for it (foreign-vocabularywould be false — it is a request refusal on a wire;boot-refusalwould be false — it crosses an HTTP boundary), but it is strictly a record that a live wire code is outside the vocabulary, not a vote for option A.Related: #9460 (the gate widening that measured this) · #9459 · #8846 (the registration batch) · #9106 (the demote rule).