Endpoint-route 401 in dispatcher-plugin `mountRouteOnServer` writes an inline flat body with no `code` key — the one producer #9487's constant change does not reach

[huangyiirene]

Parent: #9487 (found during that card's Zone-2 producer sweep; filed unassigned for triage). The #9487 maintainer ruling — add code: "UNAUTHENTICATED" alongside the existing error / message keys, additive only — is the authority for the fix shape here too.

Observed

packages/runtime/src/dispatcher-plugin.ts mountRouteOnServer (the 401 arm at lines 213–221 on main @ 4c260cda5) writes an inline copy of the flat anonymous-deny body:

res.status(401);
// ...
res.json({
 error: 'UNAUTHENTICATED',
 message: 'Authentication is required to access this endpoint.',
});

It does not reference ANONYMOUS_DENY_BODY, so the #9487 constant change does not reach it. A repo-wide sweep for the deny message finds exactly two non-test producers: the @objectstack/core constant (fixed by #9487's PR) and this inline copy.

Impact

Service-declared endpoint routes (RouteDefinition emitted via hooks, e.g. buildAIRoutes() — any route with auth not explicitly false) answer an anonymous caller 401 { error, message } with no code key. Through @objectstack/client, err.code stays undefined for those 401s — the exact defect #9487 fixed for the REST enforceAuth seam. #9487's acceptance property ("one documented key identifies the machine code on every error family, 401 included") is not universal until this site moves.

Fix shape (per the #9487 ruling — additive only)

The file already imports from @objectstack/core, and the shared constant exists precisely so seams cannot drift: replace the inline literal with res.json(ANONYMOUS_DENY_BODY) (plus ANONYMOUS_DENY_STATUS for the status), or minimally add code: 'UNAUTHENTICATED'. Additive only — no key removed or moved.

Notes for the implementer

• No test appears to pin this site's exact body: dispatcher-plugin.endpoint-fallback.integration.test.ts asserts a nested body.error.code, i.e. it exercises the http-dispatcher path, not this arm. Re-derive which path serves what before writing pins, and add a pin for this arm's exact body.
• The dogfood two-family classifier (packages/qa/dogfood/test/showcase-anonymous-deny-surfaces.dogfood.test.ts, isRestFlatDeny) tolerates the additive code key — measured on a real booted showcase in Every 401 answers {error, message} with no code key, while every other error family carries {error, code} #9487's PR (25/25 green).
• Whether this arm should keep answering the flat family at all is ADR-0112 D5 territory ([tracking] Envelope-position convergence line for packages/rest's flat dialect — the live ratchet owner #9559 stays open) — do not converge envelopes here; the additive key is the whole scope.

---

Generated by Claude Code

[os-support-ai]

Triage: lands in packages/runtime/src/dispatcher-plugin.ts (mountRouteOnServer 401 arm) → domain:cli; type Bug (declared property of the #9487 ruling — "one documented key identifies the machine code on every error family, 401 included" — not yet universal). Queued and blocked on the parent's in-flight PR.

Blocked-by: #9487

Rationale: the fix references the @objectstack/core constant that #9487's PR is changing (ANONYMOUS_DENY_BODY); landing this before that merge either duplicates the additive change or races it. Filed deliberately outside #9487's PR by that card's own producer sweep, so the merge will NOT cover this site — on unlock, re-verify the 213–221 line range on the merged ref, then dispatch. Fix shape is inherited from the maintainer's #9487 ruling (additive code key only; envelope convergence stays with ADR-0112 D5 / #9559).

Dispatch notes: pin this arm's exact body (the existing integration test asserts the OTHER path's nested shape — re-derive which path serves what before writing pins, per the card). Dispatch-side Clause-② declaration should mirror #9487's own (response-body key addition). Size/model suggestion: S, mode:subagent.

---

Generated by Claude Code