docs(spec): STORED_TYPE_NOT_CANONICAL ledger comment names both producers and their atomicity

[os-steve]

Fixes#9361

What changed

One comment line at packages/spec/src/api/error-code-ledger.zod.ts:381. STORED_TYPE_NOT_CANONICAL had a second producer land under PR #9360 (#9174, merged 2416dd588), and the comment still named only the first.

Before:

'STORED_TYPE_NOT_CANONICAL', // [#8908] a package draft is stored under a non-canonical metadata type (pre-#7894 second-namespace residue) — refused at the publish pre-flight, batch-atomic

After:

'STORED_TYPE_NOT_CANONICAL', // [#8908] a package draft is stored under a non-canonical metadata type (pre-#7894 second-namespace residue) — refused at the publish pre-flight, batch-atomic; [#9174] also refused on `revertCommit`'s restore limb, per-item on `failed[]`, NOT batch-atomic

Verification against merged code (not the issue's prose)

Both producer claims were checked against main directly, not assumed from the issue body:

• Publish pre-flight — packages/metadata-protocol/src/protocol.ts:14432, inside publishPackageDrafts. The refusal is pushed into preflightViolations, and protocol.ts:14475 short-circuits the whole call with publishedCount: 0 when that array is non-empty — batch-atomic, confirmed.
• revertCommit restore limb — packages/metadata-protocol/src/protocol.ts:16399, inside the per-item restore loop. The refusal does failed.push({ ..., code: 'STORED_TYPE_NOT_CANONICAL' }); continue; — per item, into failed[], and the loop proceeds to the next item rather than aborting the batch — NOT batch-atomic, confirmed. Matches the method's own JSDoc at protocol.ts:16193-16202, which documents this refusal as landing under finding: revertCommit has no STORED_TYPE_NOT_CANONICAL pre-flight, so a non-canonical stored item degrades to a console.warn where the sibling doors give a wire-visible code #9174.

Option 3 from the issue (deriving the producer list with a gate) is explicitly out of scope per the triage grading (2026-08-17T22:13Z) and PM claim comment (2026-08-17T23:22Z) — this PR is option 1 only, no behavior change, no other lines touched.

Gates run (all green, HEAD 494d2a71f)

• pnpm --filter @objectstack/spec build — clean
• pnpm --filter @objectstack/spec test — 408 files / 10898 tests passed
• pnpm --filter @objectstack/spec typecheck — clean (tsc, scripts, test-typecheck debt unchanged)
• pnpm --filter @objectstack/spec run check:generated — all 13 generated artifacts up to date; none changed by this comment edit
• pnpm check:changeset-gate-self-tests
• pnpm check:cross-package-test-inputs
• pnpm check:dispatcher-error-vocabulary
• pnpm --filter @objectstack/lint run check:doc-formula-expressions
• pnpm --filter @objectstack/spec run check:empty-state
• pnpm check:error-code-casing
• pnpm --filter @objectstack/spec run check:liveness
• pnpm check:merge-driver
• pnpm check:objectui-changeset
• pnpm check:spec-parsed-alias
• pnpm --filter @objectstack/spec run check:strictness-ledger
• pnpm check:type-source-resolution
• pnpm --filter @objectstack/spec run check:variant-docs
• node scripts/check-adr-0087-registration.mjs
• node scripts/check-changeset-no-major.mjs
• node scripts/check-cross-package-test-inputs.mjs
• node scripts/check-dev-prereqs.mjs --self-test (CI's own lint.yml invokes this script's self-test half only, never the full-workspace scan half — see the script's own header and lint.yml's "Self-test the dev-prereqs gate" step)
• node scripts/check-empty-changeset.mjs
• node scripts/docs-audit/check-affected-docs.mjs
• node scripts/check-nul-bytes.mjs (both changed files)

Changeset: @objectstack/spec patch, text face (accept/reject unchanged) — .changeset/error-code-ledger-stored-type-not-canonical-two-producers.md.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 1 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

Coarse fallback — 113 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json origin/main → packageMentionDocs.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.