docs(spec): record the second FLOW_DISABLED / FLOW_NO_START_NODE emitter

[os-elon]

Fixes#9586

What changed

Comment-only update to packages/spec/src/api/error-code-ledger.zod.ts (under
@objectstack/runtime). The FLOW_DISABLED and FLOW_NO_START_NODE provenance
notes named only respondToFlowTrigger (the trigger door) as the emitter. Since
#9446 (PR #9584), POST /api/v1/actions/:object/:action also emits both codes,
through dispatchFlowAction (packages/runtime/src/action-execution.ts), reading
the same engine classification via the shared classifyFlowRefusal table
(flow-dispatch-status.ts) and serving the throw through errorFromThrown.

Both notes now record the second emitter, following this file's own
PACKAGE_DELETE_PARTIAL / WRITABLE_PACKAGE_REQUIRED precedent shape
("Second EMITTER of the code ... Provenance, not identity").

FLOW_FAILED's note already named both doors and was left untouched.

Scope

Comment text only, inside the two ledger entries. The registration rows
themselves (code / status / package) are byte-for-byte unchanged — verified via
git diff below — so no code is registered or unregistered and
pnpm check:dispatcher-error-vocabulary stays green.

+ // [#9446] Second EMITTER of the code: `POST /api/v1/actions/:object/:action`
+ // answers the same 409 through `dispatchFlowAction`
+ // (`packages/runtime/src/action-execution.ts`), reading the same
+ // engine `AutomationResult.code` via the shared `classifyFlowRefusal`
+ // table (`flow-dispatch-status.ts`) and serving the throw through
+ // `errorFromThrown` — the two doors now state the same refusal the same
+ // way. Provenance, not identity (see above).
'FLOW_DISABLED',
...
+ // [#9446] Second EMITTER of the code: `POST /api/v1/actions/:object/:action`
+ // answers the same 422 through `dispatchFlowAction`
+ // (`packages/runtime/src/action-execution.ts`), reading the same
+ // engine classification via the shared `classifyFlowRefusal` table
+ // (`flow-dispatch-status.ts`) and serving the throw through
+ // `errorFromThrown` — the two doors now state the same refusal the same
+ // way. Provenance, not identity (see above).
'FLOW_NO_START_NODE',

Premise verification (done before editing, on origin/main)

• (a) Confirmed both notes named only the trigger door before this change.
• (b) Confirmed the second door emits both codes: dispatchFlowAction
  (packages/runtime/src/action-execution.ts, classifyFlowRefusal call and
  the err.code = refusal.code throw) reads refusal.code from the shared
  FlowRefusalCode table in packages/runtime/src/flow-dispatch-status.ts,
  which enumerates 'FLOW_DISABLED' | 'FLOW_NO_START_NODE' | 'FLOW_FAILED' and
  maps the engine's AutomationResult.code to the same status/code pairs the
  trigger door uses (409/FLOW_DISABLED, 422/FLOW_NO_START_NODE). The route
  serves the throw through errorFromThrown, per the function's own docstring.

Docs regeneration

content/docs/references/api/error-code-ledger.mdx is generated from this
file's top-level module docstring plus the flat ErrorCode enum-value list —
neither includes per-entry // comments on individual ledger array items, so
regenerating produces no diff (verified: check:generated / check:docs
green with no working-tree changes after running the generator).

Changeset

None. This is a comment-only provenance note with no user-visible or
wire-visible change — the registration rows (and therefore the published
ErrorCode union and its runtime behavior) are byte-for-byte unchanged. Per
this repo's changeset-check exemption ("this PR declares no release of its
own"), skip-changeset is the right mechanism here; left for the PM to apply
per this card's dispatch instructions.

Tests / gates

All run against 764d2ef (this branch's head). See the issue comment report
for full command output. Summary: spec package rebuilt;
check:dispatcher-error-vocabulary, check:cross-package-test-inputs,
check:empty-state, check:liveness, check:strictness-ledger,
check:variant-docs, check:merge-driver, check:spec-parsed-alias,
check:type-source-resolution, check-dev-prereqs --self-test (matching this
gate's own CI invocation), check-affected-docs, check:error-code-casing,
check:doc-formula-expressions, error-code-ledger.test.ts (17 passed),
spec typecheck, check:generated (13/13 artifacts current), check:docs,
and check-nul-bytes.mjs all green.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 2 documentable anchor(s).

5 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/error-catalog.mdx(via ERROR_CODE_LEDGER (symbol))
• content/docs/api/error-handling-server.mdx(via ERROR_CODE_LEDGER (symbol))
• content/docs/automation/flows.mdx(via /api/v1/actions/:object/:action (route))
• content/docs/kernel/contracts/data-engine.mdx(via ERROR_CODE_LEDGER (symbol))
• content/docs/ui/actions.mdx(via /api/v1/actions/:object/:action (route))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ERROR_CODE_LEDGER (symbol), /api/v1/actions/:object/:action (route))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

Coarse fallback — 115 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 10bbc1971e1d8ac4a2c76e9548a75ad71b96502e → packageMentionDocs.

Which tree this was computed on

This run read content/docs from abcf915d48f0de430cf0f31d8e06f4fc8695adc8 — the merge of head 764d2eff9b4b1440783bf02894fe21fd5453862b into base 10bbc1971e1d8ac4a2c76e9548a75ad71b96502e, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin abcf915d48f0de430cf0f31d8e06f4fc8695adc8 && git checkout abcf915d48f0de430cf0f31d8e06f4fc8695adc8
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 10bbc1971e1d8ac4a2c76e9548a75ad71b96502e 764d2eff9b4b1440783bf02894fe21fd5453862b && git checkout -B drift-repro 10bbc1971e1d8ac4a2c76e9548a75ad71b96502e && git merge --no-ff 764d2eff9b4b1440783bf02894fe21fd5453862b
node scripts/docs-audit/affected-docs.mjs --json 10bbc1971e1d8ac4a2c76e9548a75ad71b96502e

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 10bbc1971e1d8ac4a2c76e9548a75ad71b96502e → pass the list as
args.docs, on the commit named under Which tree this was computed on.