feat(spec): register UNIQUE_SCOPE_CONFIRMATION_REQUIRED in ERROR_CODE_LEDGER (#9246)

[os-steve]

Fixes#9246

What

Registers UNIQUE_SCOPE_CONFIRMATION_REQUIRED under @objectstack/cloud-connection in ERROR_CODE_LEDGER (ADR-0112 D3), and — in the same change, per the armed ratchet — deletes the now-discharged pending-registration row from packages/runtime/src/dispatcher-error-vocabulary.ts.

The code is the ADR-0120 D5e posture-gate refusal: the marketplace install seam answers 409 with it when an app declares installation-wide ('global') unique constraints under the isolated tenancy posture. It was already on the wire with a live reader — os package install branches on the literal (packages/cli/src/commands/package/install.ts) to print the per-index decision list — but sat outside the closed vocabulary, invisible until #9223 taught the dispatcher-vocabulary gate to see a constant stamped in an object literal (objlitconst, plugin-route door). PR #9247 landed the classification row; this PR is the registration half of the hand-off.

Changes

• packages/spec/src/api/error-code-ledger.zod.ts — one row under @objectstack/cloud-connection, alphabetical, with a [#9246] provenance comment in the spec: register the dispatcher conformance gate's reported error codes in ERROR_CODE_LEDGER (spec half of the #8087 ruling) #8846-row style. Synonym admission checked: not an HTTP reason phrase, and the token CONFIRMATION appears in no standard-catalog member, so standardSynonymOf cannot flag it.
• packages/runtime/src/dispatcher-error-vocabulary.ts — the stale pending-registration row deleted; the section comment now records the second full ratchet cycle (check-dispatcher-error-vocabulary is blind to a non-literal code: in an object literal — a constant or template produces no finding, silently #9223 report, spec: register UNIQUE_SCOPE_CONFIRMATION_REQUIRED — the install seam's posture-gate refusal reaches a wire unregistered #9246 registration).
• packages/runtime/src/error-envelope.conformance.test.ts — comment-only: the derivation-drive case's prose described a one-member pending list; it now records the discharge. No assertion changed (the pending loops are empty again by design; the gate reconciles both directions mechanically).
• content/docs/references/api/contract.mdx, content/docs/references/api/error-code-ledger.mdx — regenerated via pnpm --filter @objectstack/spec check:generated --fix (gen:docs), never hand-edited. Exactly 2 pages, per the post-fix(spec-docs): the in-shape enum marker stops restating vocabulary cardinality — one new error code touches 2 pages, not 11 #9239 generator; neighbour check: the new code appears in both full-vocabulary lists beside its siblings, and the ApiErrorSchema.code enum counter moved +281 to +282.
• .changeset/register-unique-scope-confirmation-required.md — @objectstack/spec patch, following the feat(spec): register the 9 unregistered REST wire codes the #8885 sweep found; pin the ADR-0106 D6 tier-3 emission #9177/feat(spec): register the dispatcher conformance gate's reported error codes in ERROR_CODE_LEDGER #9170 level convention. No wire behavior changes: the value was already emitted; the schema now accepts what the wire carries.

Verification (at head 318df8bd2, clean tree)

• pnpm check:dispatcher-error-vocabulary — green: 12 unregistered code-stamping sites, all classified, 0 awaiting a ledger entry; the site reclassified cleanly out of the unregistered derivation.
• pnpm check:error-code-casing (4167 files) and pnpm check:error-status-conformance — green.
• pnpm --filter @objectstack/spec check:generated — all 13 artifacts up to date.
• pnpm --filter @objectstack/spec test — 407 files, 10851 tests passed. pnpm --filter @objectstack/runtime test — 165 files, 2464 tests passed. Both packages' typecheck green.
• Path-derived gate sweep (scripts/pm/dispatch-gates.mjs against the actual diff): changeset gates (adr-0087-registration, changeset-no-major, empty-changeset, objectui-changeset, changeset-gate-self-tests), docs gates (quick-reference-counts, role-word, docs-audit-scope, docs-redirects, affected-docs, doc-formula-expressions), spec gates (spec-parsed-alias, type-source-resolution, merge-driver, liveness, strictness-ledger, variant-docs, empty-state), cross-package-test-inputs, nul-bytes, and the test-file convention gates (engine-double-contract, where-matcher, query-options-erasure, type-check-coverage) — all green locally. One local-environment failure: check-dev-prereqs (35+ unrelated packages have no dist in this fresh worktree; CI runs it after a full build).

Out of scope

#9267 remains open — filed from this card's confirmed side observation: the plugin-route door has no envelope guard and nothing parses its bodies against the declared schema. Ruled out of this card's scope by triage; not addressed here.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/runtime, @objectstack/spec, touching 2 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 4 name(s) were too generic to anchor anything (single lowercase words)

Coarse fallback — 117 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json origin/main → packageMentionDocs.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.