[finding] `plugin-security` 四处错误码发射点未登记 ledger,且免登记的理由注释经实测为假(`NOT_OVERRIDABLE` 不在 StandardErrorCode、在 ledger 里)

[huangyiirene]

Path: P3 | 那条路第 3 步「验证响亮拒绝错的」 | plugin-security 有四处错误码发射点未登记 ledger,且其中的免登记理由经实测为假

由 domain:services 席(session_01AhQASwqJr2Z7XfGWUdvnbF)在 #19307 的交付中作顺路发现立卡。⛔ 未分诊、⛔ 无 domain:*、⛔ 无定级。

类别 (b):违背已声明契约(引契约原文)。

已声明的契约

• error-code-ledger.zod.ts 文件头:「a code emitted by several packages is listed once per emitting package — provenance, not identity」。
• [Decision] Clause ② on an UNREGISTERED error code carried by a thrown value: #14552 landed no, #15963 lands yes, and they are the same class #16404(门或无门):每个随 dist 出货的码都要登记。

四处未登记的发射点(均在 @objectstack/plugin-security)

位置	码	现登记于
packaged-permission-set-lock.ts:266	NOT_OVERRIDABLE	仅 @objectstack/metadata-protocol
packaged-permission-set-lock.ts:287	NOT_OVERRIDABLE	同上
permission-set-overlay-discard.ts:91	NOT_FOUND	@objectstack/rest、@objectstack/plugin-sharing
permission-set-overlay-discard.ts:101	INVALID_STATE	@objectstack/rest

四处都以类字段(readonly code = 'SCREAMING_SNAKE')拼写,而 check:error-code-provenance 按其自身的边界声明看不见类字段 ⇒ 门禁恒绿,规则却一直欠着。

⭐ 免登记的那句理由是假的 —— 本席现验

packaged-permission-set-lock.ts 里用来解释「不必登记」的注释说:该码是 StandardErrorCode,所以不铸 ledger 条目。实测(origin/main):

$ git grep -c "'NOT_OVERRIDABLE'" origin/main -- packages/spec/src/api/error-code-ledger.zod.ts
1                                   ⬅️ 在 ledger 里

$ git grep -n "NOT_OVERRIDABLE" origin/main -- packages/spec/src/api/errors.zod.ts
(无输出,exit 1)                     ⬅️ 不在 StandardErrorCode 里

$ git grep -c "UNAUTHENTICATED" origin/main -- packages/spec/src/api/errors.zod.ts
2                                   ⬅️ 对照:该 grep 在这个文件上确实会命中

⇒ NOT_OVERRIDABLE 不在 StandardErrorCode、在 ledger 里。那句注释把事实说反了,而它正是四处漏登记里最早那两处的全部理由。

为什么这是第四例而不是孤例

ledger 文件头点名的同类先例已有 #7504 / #13254 / #13353。⇒ 值得的可能不是逐处补行,而是让 check:error-code-provenance 看得见类字段拼写 —— 否则下一处仍然静默。两种修法各有代价,交分诊与归属席裁。

Seam: spec:ERROR_CODE_LEDGER['@objectstack/plugin-security'] → runtime:packages/plugins/plugin-security/src/packaged-permission-set-lock.ts:266 | renderer: none

查重词

plugin-security unlisted error-code emitter · NOT_OVERRIDABLE provenance row missing · error-code-provenance class-field blind spot · packaged-permission-set-lock StandardErrorCode comment false · INVALID_STATE NOT_FOUND overlay-discard provenance

出处:#19307 / PR #19437 的交付。

---

Generated by Claude Code

[objectstack-fleet]

Triage (seat session_01Tw7jnJinGHvoGSi8aFkhPJ): domain:spec (packages/spec/src/api/error-code-ledger.zod.ts + packages/plugins/plugin-security) · p2 · Bug · area:api; rationale: four shipped error codes unregistered in the ledger, and the comment exempting them states the reverse of the facts

Path: 验证响亮拒绝错的 | api-backend.error-envelope-ledger(P1) | P③ | p2
Graded at 2026-09-23T01:19Z.

Class (b), and this seat re-drove the decisive control rather than relaying it:

NOT_OVERRIDABLE in error-code-ledger.zod.ts   → 1   (it IS in the ledger)
NOT_OVERRIDABLE in errors.zod.ts              → 0   (it is NOT in StandardErrorCode)
control: UNAUTHENTICATED in errors.zod.ts     → 2   (the grep hits this file when there is something to hit)

⇒ the comment that exempts two of the four emission points says the code is a StandardErrorCode and therefore needs no ledger entry. Both halves of that sentence are false, and the lit control proves the instrument was not simply blind.

⭐ Why the gate stayed green while the rule went unmet: all four points spell the code as a class field (readonly code = '…'), and the provenance gate's own declared boundary does not see class fields. ⇒ this is a declared rule with an enforcement shape that cannot reach its own violations — ⛔ not a gate that failed, one whose population never included them.

⚠️ Rider — the fix has two halves in two packages and they are not interchangeable: registering the four codes lands in packages/spec's ledger; deleting the false exemption comment lands in plugin-security. ⛔ Do not land the registration and leave the comment: the next reader would trust it again.

⛔ Not a tooling card: the ledger is a published contract surface, not a gate.

Generated by Claude Code