feat(spec): register the 9 unregistered REST wire codes the #8885 sweep found; pin the ADR-0106 D6 tier-3 emission

[os-zhuang]

Fixes#8885

Premise re-verified before implementing (rule: the issue body is a lead, not a spec)

The card's table had two rows; both moved:

• FIELD_VISIBILITY_UNRESOLVED — registered by PR feat(spec): register the dispatcher conformance gate's reported error codes in ERROR_CODE_LEDGER #9170 (merged 19:08Z) under @objectstack/rest. What remained was the card's second half: the tier-3 pin, delivered here.
• RECORD_NOT_ACCESSIBLE — the card's row was a measurement error. The code has been a StandardErrorCode member (Authorization block, "Sharing rule restriction", errors.zod.ts line 81) since before the card's own measured commit cc5c07b80 — verified with git show cc5c07b80:packages/spec/src/api/errors.zod.ts. The sys_comment has no record-level authorization: any org member reads and writes comments on records they cannot see #4630 emitter comment ("uses the STANDARD catalog code") is correct as written. The register-or-collapse fork the card and the dispatch priced as a maintainer decision dissolves: there is nothing to register (the admission gate refuses codes that shadow the standard catalog) and nothing to collapse (it already IS the catalog code, so no wire change is on the table). A pin now records the membership so the premise cannot be re-reported.

Population sweep (the card's warning was right — the population was larger than two)

Swept every non-test source under packages/rest/src for codes reaching an error envelope, across four spellings: code: 'LITERAL' sites, helper-call literals (respondError(...), sendEnvelopeError(...), mapping tables), ternaries, and template literals. Result: 9 codes on the wire in neither StandardErrorCode nor ERROR_CODE_LEDGER, all in the approvals family, all with live emitters:

code	emitted by	status
THROTTLED	handleApprovalError mapping table; producer: plugin-approvals remind() cool-down, documented in the spec contract (contracts/approval-service.ts)	429
APPROVAL_APPROVE_FAILED, APPROVAL_REJECT_FAILED	decisionRoute terminal catch (template literal)	500
APPROVAL_REVISE_FAILED, APPROVAL_RESUBMIT_FAILED	flowMoveRoute terminal catch (template literal)	500
APPROVAL_REASSIGN_FAILED, APPROVAL_REMIND_FAILED, APPROVAL_REQUEST_INFO_FAILED, APPROVAL_COMMENT_FAILED	threadRoute terminal catch (template literal)	500

Root cause of the gap: the route factories spell the terminal code as a template (backtick APPROVAL_${action}_FAILED), so the literal-grep pass that registered the family's literal-spelled siblings (APPROVAL_RECALL_FAILED, APPROVAL_ACTIONS_FAILED, APPROVAL_REQUEST_GET_FAILED, APPROVAL_REQUEST_LIST_FAILED) could not see these eight; THROTTLED is a single word, which the multi-token sweep shape missed.

All 9 are registered, not renamed — no wire behavior changes; the accepted set widens to match what the wire already carries, the same shape as #9170/#8846. None trips the #8211 synonym detector (APPROVAL_ carries a token no standard member has; THROTTLED is neither an HTTP reason phrase nor a token-subset of any member — deliberately kept: a per-action business cool-down, not an API quota, and the value is spec-contract vocabulary). Provenance comments follow #9170's rows.

Pins

• rest-field-visibility-fault-envelope.test.ts — the tier-3 pin the deployment docs' advertised signal never had: sendFieldVisibilityFault answers 503 + code: FIELD_VISIBILITY_UNRESOLVED, the pair parses through ApiErrorSchema's closed union, and a control case proves the union is closed (an invented spelling fails parse). The pin also records the ruled sendError 的显式状态直通覆盖 400–599,5xx 的原始驱动报错绕过全部泄漏启发式直达客户端(metadata-protocol 有活体产出方) #5437 behavior that the emitter's prose is withheld from the wire (client reads INTERNAL_ERROR_MESSAGE; the text goes to the operator log). Plus the RECORD_NOT_ACCESSIBLE characterization baseline (403 + code + error.object preference through mapDataError's sys_comment has no record-level authorization: any org member reads and writes comments on records they cannot see #4630 branch) and the premise-falsifying membership pin.
• rest-approvals-wire-codes.test.ts — live emissions through the real routes (remind cool-down 429 THROTTLED; unmapped fault on approve 500 APPROVAL_APPROVE_FAILED), and a class pin: it enumerates the registered POST /approvals/requests/:id/{action} routes and asserts the code each catch arm would generate — derived with exactly the production template, single-occurrence dash replace included — parses against the closed union. A tenth action route whose generated code nobody registers goes red here mechanically; the same gap cannot reopen.

The vocabulary parses map the data-door's flat {code, error} dialect into ApiErrorSchema's {code, message} slots: envelope POSITION is #7035's ratcheted debt and #9098's typing question is the cli lane's — this card owes the VOCABULARY, and both cards remain open (out of scope here: #9098, #7035).

Reverse verification (direction: red, as expected)

Fix committed first, then the ledger ablated back to origin/main's version, spec rebuilt from the ablated source, pins re-run: all 3 approvals cases red (union membership fails for THROTTLED and the generated codes). Restored from the commit, rebuilt, re-run: green. This proves the pins read the rebuilt dist vocabulary, not a cached one. The FIELD_VISIBILITY_UNRESOLVED case is independent of this PR's ledger rows (registered by #9170) and stays green through the ablation, as expected.

Verification at head ed8e77e1d

• pnpm --filter @objectstack/spec test — 406 files / 10817 passed (includes the ledger admission gate accepting all nine rows)
• pnpm --filter @objectstack/rest test — 122 files / 2011 passed; the two new pin files re-run at head: 2 files / 7 passed
• pnpm --filter @objectstack/spec typecheck, pnpm --filter @objectstack/rest typecheck — green
• pnpm --filter @objectstack/spec check:generated — all 13 up to date after gen:docs regenerated content/docs/references/** (the nine codes ripple into the generated API references; committed as its own commit)
• node scripts/check-dispatcher-error-vocabulary.mjs — OK (7 classified sites, 0 awaiting a ledger entry)
• node scripts/pm/dispatch-gates.mjs union over the changed paths — all matched gates green, including check:error-code-casing, check:adr-0087-registration, check:merge-driver, check:cross-package-test-inputs, check:type-check-coverage, check:type-check-debt --re-measure (33 entries, none above recorded), check:engine-double-contract, check:where-matcher, check:query-options-erasure, check:nul-bytes, check:dev-prereqs (after full workspace build)

Changeset: @objectstack/spec patch (matching #9170/#8212 precedent); non-breaking, so no ADR-0087 marker is required and check:adr-0087-registration is green.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec.

106 hand-written doc(s) reference the affected code — list omitted above 15 rows. Re-derive: node scripts/docs-audit/affected-docs.mjs --json origin/main.

⛔ 7 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.

[os-zhuang]

条款②追溯审计 — 结论：通过，无缺陷

性质：本 PR 向 ERROR_CODE_LEDGER 注册 9 码（8 个模板生成 APPROVAL_*_FAILED + THROTTLED），加宽 ApiErrorSchema 接受集——属条款②射程（⇒ claude-fable-5），实际派发档位低于要求档，已合并。维护者裁定：不回滚，做追溯性契约复审档审计。本条即收口记录。

审计席：skills 席 session_017TNzEetykdh7ceZGwuAPLq（契约复审档位，非派发席）。

结论：9 码均有活产源（模板生成臂 + remind 冷却 429）；THROTTLED 与 RATE_LIMit_EXCEEDED 的语义区分理由已记录且成立（按动作的业务冷却，非 API 配额）；RECORD_NOT_ACCESSIBLE 的测量错误修正双向钉住（标准目录成员 + 不得入 ledger），前提不可再报；模板派生 class pin 使第十条 action 路由无法重开同缺口；闭合并集有控制组（杜撰拼写拒解析），绿色是证据非空转。未发现缺陷，无需 findings 卡。 审计范围：packages/** 补丁全文；docs mdx 生成物未逐行审。

制度化修复（入队闸门，防再穿）：#9185。

---

Generated by Claude Code