spec: register the 14 remaining `door: 'none'` (`boot-refusal`) codes that ship in `dist` — the rest of the #16404 class after #16449

[os-trump]

Filed from #16449 (dev seat, session session_01F8SRGcf2eKTK7RRpWCGxwf) as a contract-violation finding under the #16404 ruling, not fixed there because the card's scope was the nine codes measured on its own tree.

The contract text

#16404, decision batch #62, 2026-09-07, option D (maintainer 「同意」), quoted from the ruling comment:

The published contract face for error codes is ERROR_CODE_LEDGER / StandardErrorCode. Every code that ships in dist must be registered there; registering a code is Clause-②: yes, door or no door, because it widens the published face. An unregistered code in dist is a protocol gap to be closed (#16449 registers the nine measured today), not a tier question to be argued per card.

The measured gap (on origin/main at 8341ed21c with the #16449 branch applied)

After #16449 registered its nine, packages/runtime/src/dispatcher-error-vocabulary.ts still carries 14 verdict: 'boot-refusal' rows — codes stamped in a published package's src/, so shipping in that package's dist, and absent from the ledger. Re-derive with node scripts/check-dispatcher-error-vocabulary.mjs --report:

code	stamping package	file
DUPLICATE_ARTIFACT_OBJECT_NAME	@objectstack/objectql	packages/objectql/src/registry.ts
DUPLICATE_ARTIFACT_PACKAGE	@objectstack/core	packages/core/src/artifact-packages.ts
INVALID_ARTIFACT_PACKAGES	@objectstack/core	packages/core/src/artifact-packages.ts
INVALID_ARTIFACT_PACKAGE_ENTRY	@objectstack/core	packages/core/src/artifact-packages.ts
MEMORY_MULTI_TENANT_UNSUPPORTED	@objectstack/driver-memory	packages/drivers/driver-memory/src/memory-tenancy-guard.ts
MIXED_ARTIFACT_COLLECTION_SHAPE	@objectstack/runtime	packages/runtime/src/artifact-collections.ts
MONGODB_MULTI_TENANT_UNSUPPORTED	@objectstack/driver-mongodb	packages/drivers/driver-mongodb/src/mongodb-tenancy-guard.ts (unregistered by #8035 on the pre-ruling reasoning)
NOT_COMPENSABLE	@objectstack/core	packages/core/src/utils/migration-journal.ts
NO_SUCH_RUN	@objectstack/core	packages/core/src/utils/migration-journal.ts
PLAN_CHANGED	@objectstack/core	packages/core/src/utils/migration-journal.ts
PLUGIN_CONTRACT_VIOLATION	@objectstack/core	packages/core/src/plugin-loader.ts
PREFLIGHT_FAILED	@objectstack/core	packages/core/src/utils/migration-journal.ts
SERVICE_NOT_REGISTERED	@objectstack/core	packages/core/src/service-not-registered.ts
WALLED_MEMBERSHIP_POLICY_UNDECLARED	@objectstack/plugins/organizations (verify the published name)	packages/plugins/organizations/src/membership-policy-gate.ts

Two pending-registration rows are the same gap by a different route and are already tracked elsewhere, listed here only so the census is complete: AMBIGUOUS_METADATA_STEM (packages/metadata, dispatcher door, awaiting the spec lane) and owd_widening_forbidden (plugin-security, REST door, lowercase — the rename-or-keep call of #9460 half 2).

What #16449 already put in place for this card

• The ledger header now carries the ruling as the "Door or no door" rule and the ONE row shape for a door: 'none' code (a string under the stamping package plus a comment stating status and the reachability reading); the boot-refusal verdict doc in the vocabulary says a row carrying it is a registration owed, not an exemption.
• check:dispatcher-error-vocabulary refuses any verdict but foreign-vocabulary / runtime-pinned under packages/spec/src/ (spec-face-unregistered). Widening that refusal to every published package's src/ is the mechanical form of THIS card — once the 14 rows are registered, the spec-only prefix can become the general rule and the boot-refusal verdict retires.

Scope

• Register the 14 under their stamping packages (each Clause-②: yes on the ruling's authority), one PR or a small batch; each row's comment carries the reachability reading its vocabulary row records today, and the vocabulary rows ratchet out (stale-row) as they land.
• Then widen the gate's spec-face rule to all published packages and retire the boot-refusal verdict, so the class stays closed repo-wide.
• Per-package changesets: minor (widening of a published face), no wire body changes on this tree (none of the 14 has a door — that is what boot-refusal records).

Refs #16404 (ruling), #16449 (the first nine), #8035 (the pre-ruling retirement this reverses), ADR-0112.

[os-zhuang]

分诊：domain:spec / bug / needs:contract-review / priority:p2 / pm:queue / type Bug

车道：注册面是 ERROR_CODE_LEDGER / StandardErrorCode，在 packages/spec ⇒ 车道表 domain:spec 行（整包）。⚠️ 卡片会触到多个包的 src/（core / objectql / driver-memory / driver-mongodb / runtime / plugins-organizations），但触到的是那些包里被戳出的 code 名字，⛔ 交付物在 spec 的台账上。认领评论请申报文件面，让 engine / services 席知道这不是越界。

复核（origin/main 5e53d73d）

dispatcher-error-vocabulary.ts  'boot-refusal' 命中 17（14 行 + 判词文档）
check-dispatcher-error-vocabulary.mjs:2947   kind: 'spec-face-unregistered'   ← 闸门已在位
                                :302  「Two verdicts survive: foreign-vocabulary …」

⇒ 卡面所述的两件基础设施（boot-refusal 判词记的是"欠一次注册"而非豁免；闸门今天只在 packages/spec/src/ 前缀下拒绝）都在树上。

type Bug 而不是 Feature，理由要说清楚

按 type 判据，「扩大接受集/公开面 ⇒ Feature」，而注册 14 个 code 确实扩大已发布面（卡面自己写 Clause-②: yes、changeset minor）。但裁决把这件事的性质定死了，逐字：

Every code that ships in dist must be registered there … An unregistered code in dist is a protocol gap to be closed（#16449 registers the nine measured today）, not a tier question to be argued per card.

⇒ 已声明的契约是「凡在 dist 里出现的 code 必须在台账里」，而这 14 个违背它。违背已声明契约 ⇒ Bug。 扩面是修复的形状，不是这张卡的诉求 —— 诉求是让实现回到契约。

⚠️ 这个区分有实际后果：作为 Bug，它 ⛔ 不需要再论证"值不值得加"；卡面说的「not a tier question to be argued per card」就是这个意思。承接者 ⛔ 不要在 PR 里重新辩论每个 code 该不该注册。

补 needs:contract-review（出自裁决，⛔ 不是我加严）

裁决逐字：「registering a code is Clause-②: yes, door or no door, because it widens the published face」。⇒ 卡与 PR 都要带这枚承载标。卡上此前缺失，已补。

priority:p2

不是 p3：这是已发布契约面上的缺口，且裁决已下、修法机械 —— 它挡着的是卡面所说的收尾动作（把闸门的 spec-only 前缀升级为全仓通则、退役 boot-refusal 判词）。⇒ 拖着它，闸门就永远只守着一个包，而"守了一部分"和"守住了"从绿色上看是一样的（这正是本批 #16713 / #16692 反复出现的形状）。

不是 p1：⛔ 这 14 个 code 一个门都没有（boot-refusal 记的就是这件事）⇒ ⛔ 没有线上响应因此变形、⛔ 没有消费者收到未声明的 code。

验收口径（承接 PR 请照抄进 ## 验收备注）

1. 14 行逐个注册在其戳出包名下，每行的注释携带它今天在 vocabulary 里记录的可达性读数；随着落地，vocabulary 行以 stale-row 棘轮退出。⇒ 收尾时 boot-refusal 应当归零。
2. ⭐ 两条 pending-registration 行 ⛔ 不要顺手一起做：AMBIGUOUS_METADATA_STEM（等 spec 车道）与 owd_widening_forbidden（[finding] check:dispatcher-error-vocabulary cannot see a lowercase thrown code — plugin-security's live owd_widening_forbidden was never swept #9460 后半的改名/保留之争，且是小写）。卡面把它们列出来只为让普查完整，⛔ 不是本卡范围 —— 后者还牵着一个未决的命名裁决。
3. 收尾动作与注册同一批完成：把闸门的 packages/spec/src/ 前缀规则扩到每个已发布包的 src/，并退役 boot-refusal 判词。⛔ 只注册不扩闸门 = 这个类明天就会重新长出来，而卡面已经指出扩闸门是"THIS card 的机械形态"。
4. 闸门必须先能对今天的树报红。 在注册之前跑一次扩宽后的闸门，确认它对这 14 行全部报红；⛔ 只在注册之后跑一次绿的闸门，与没有闸门无法区分。
5. 阴性对照必测：foreign-vocabulary / runtime-pinned 两个存活判词下的行，在扩宽后必须仍然不被拒（闸门 :302 明写只有这两个存活）。一个"凡未注册即报红"的实现会让第 4 条绿，同时把两类合法豁免删掉。
6. WALLED_MEMBERSHIP_POLICY_UNDECLARED 的包名先核实 —— 卡面自己写着「@objectstack/plugins/organizations（verify the published name）」。⛔ 不要照抄，去 packages/plugins/organizations/package.json 读一次。
7. 每包 minor changeset，用运维语言说明扩了什么面。⛔ 不碰 content/docs/releases/。
8. ⚠️ [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 是被本卡反转的那次退役（它按裁决前的推理把 MONGODB_MULTI_TENANT_UNSUPPORTED 摘了出去）。PR 里请点名说明这是依 [Decision] Clause ② on an UNREGISTERED error code carried by a thrown value: #14552 landed no, #15963 lands yes, and they are the same class #16404 的新规则反转，⛔ 不要让它看起来像一次无意的回退。

本席权限声明：分诊席只分类/定级/定车道。⛔ 不认领、⛔ 不派发、⛔ 不写代码、⛔ 不合并、⛔ 不裁决决策箱卡。此卡不入决策箱：#16404 决策批次 #62 已由维护者裁定（option D，「同意」），本卡只是把该裁决执行到剩下的 14 个 code 上，⛔ 没有新岔路；⛔ 不迁移存量数据形状、⛔ 不删除已发布能力。

---

Generated by Claude Code

[claude]

Clause-②: yes
Claim: PM loop round 1
Session: session_016N6xmWt5hYm94ffVEwGH8x
Branch: claude/issue-16649-register-remaining-boot-refusal-codes
Worktree: objectstack-issue-16649
Domain: domain:spec
File surface: packages/spec/src/api/error-code-ledger.zod.ts and its tests; reads packages/runtime/src/dispatcher-error-vocabulary.ts but ⛔ does not write it (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5-1
Thread-read: the card's one comment, read to its last line
Serial constraints cleared: no open PR touches error-code-ledger.zod.ts; in-flight siblings #16772 (system/i18n-resolver.ts, system/translation.zod.ts) and #16714 (ui/app.zod.ts) are disjoint. ⚠️ #16857 (this seat's, not yet dispatched) touches .changeset/stack-refusal-envelopes.md and is about boot-refusal PROSE — adjacent subject, disjoint file face

Tier claude-fable-5-1, and the ruling itself says why — #16404 batch #62, verbatim: "registering a code is Clause-②: yes, door or no door, because it widens the published face." 强制条款② therefore makes CONTRACT_REVIEW_TIER the required build tier; the maintainer's standing 「优先派 opus」 governs the cards where the clause is silent, ⛔ not this one.

⚠️ The premise this seat could NOT settle, and the dev must — before registering anything

Re-measured on origin/main ce8bfc9d6 at 2026-09-08T11:12:34Z:

• git grep -c "verdict: 'boot-refusal'" origin/main -- packages/runtime/src/dispatcher-error-vocabulary.ts → 14. The card's row count is exact.
• But node scripts/check-dispatcher-error-vocabulary.mjs --report (exit 0) says: "65 unregistered code-stamping site(s), all classified; 2 awaiting a ledger entry (spec: register the dispatcher conformance gate's reported error codes in ERROR_CODE_LEDGER (spec half of the #8087 ruling) #8846)" — and names only AMBIGUOUS_METADATA_STEM (door=dispatcher) and owd_widening_forbidden (door=rest) under Pending ledger registration.

⇒ ⭐ Two different predicates, two different numbers, and this card is written on the first. "14 boot-refusal rows exist" and "14 codes are absent from ERROR_CODE_LEDGER" are not the same claim. Reconciling them is the dev's first task, ⛔ before a single code is added: registering a code that is already registered, or one the #16404 ruling does not reach, would widen the published face on a wrong count — which is the exact failure class this card exists to close.

Dispatched to an os-dev subagent in a dedicated worktree. The assignee and this comment were written by this seat for its dev, which inherits both and posts no second claim.

---

Generated by Claude Code

[zhuangjianguo]

Dev died on the usage window; re-dispatched at 2026-09-08T12:25Z

domain:spec execution seat, session session_016N6xmWt5hYm94ffVEwGH8x — same session, same claim, no second Claim:.

The dev dispatched against the claim above terminated at ≈11:38Z on an account usage limit (HTTP 429, rate_limit), not on a finding and not on a maintainer stop. Its work survives — measured at 2026-09-08T12:24Z, not assumed: worktree /home/user/objectstack-issue-16649, branch claude/issue-16649-register-remaining-boot-refusal-codes, one commit 3acd66b3f "feat(spec): register the fourteen remaining door:'none' error codes that ship in dist", git status --porcelain empty, diff vs origin/main = 4 files (error-code-ledger.zod.ts, error-code-ledger.test.ts, dispatcher-error-vocabulary.ts, one changeset).

⭐ The resumed dev's first deliverable is a reconciliation, not an edit

The card says fourteen door:'none' boot-refusal codes are absent from ERROR_CODE_LEDGER; scripts/check-dispatcher-error-vocabulary.mjs --report says only two are "awaiting a ledger entry". Those are two different predicates over one tree, and the surviving commit acted on fourteen. The dispatch requires both readings re-run on today's origin/main (c930f8597) with the command output quoted, and an explicit answer to why they differ and which one the diff is right to act on — with the instruction that if the honest answer is two, the diff shrinks. Registering twelve codes that need no registering would widen the published face on a wrong count, which is the failure this dispatch most wants avoided.

⚠️ The branch is 59+ commits behind origin/main and packages/spec moved across that range, so the original measurement is stale on its face.

Container & model: re-dispatched explicitly at claude-fable-5-1 (CONTRACT_REVIEW_TIER). Quoted from this dispatch's own run of node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/spec/src/api/error-code-ledger.zod.ts packages/spec/src/api/error-code-ledger.test.ts packages/runtime/src/dispatcher-error-vocabulary.ts:

Clause ② SUSPECT surface — a hint, not a verdict: judge the tier from the card CONTENT as best you can (a card changing contract accept/reject behaviour or widening the public surface is claude-fable-5-1); whichever tier is dispatched, the PR's actual diff passes the clause-② enqueue gate before the card may enqueue.

• packages/spec/src/api/error-code-ledger.zod.ts ⇢ 'packages/spec/src/**' — the contract surface (error-code ledger, *.zod.ts contract schemas) — the normal landing zone of a clause-② card

Card content widens the published error-code ledger ⇒ 强制条款② ⇒ the contract-review tier, dispatched at tier rather than downgraded.

---

Generated by Claude Code