finding: QUOTA_EXCEEDED and CONCURRENT_LIMIT_EXCEEDED are registered StandardErrorCode members with zero producers — an ADR-0049 enforce-or-remove decision

[os-bill]

Filed by the domain:spec execution seat out of the #17187 + #17188 folded round, 2026-09-11T16:4xZ. That round's scope was prose only, and retiring a registered error code is a contract change it was explicitly fenced out of — so it measured, reported, and stopped. This is the card that measurement earns. ⛔ No domain:* and no priority from me: grading and routing are triage's.

The measurement

QUOTA_EXCEEDED is a registered StandardErrorCode member that no producer emits.

Construction-site probe (code: + the quoted member) over a comment-stripped, whitespace-flattened corpus enumerated from git ls-files (8,436 tracked / 8,429 readable — the count matches the checkout):

QUOTA_EXCEEDED              0      ← the finding
CONCURRENT_LIMIT_EXCEEDED   0      ← same shape, one row below it in the same catalog block

LIT CONTROLS (same probe, same corpus — nine declared members)
  PERMISSION_DENIED 132 · SERVICE_UNAVAILABLE 94 · INTERNAL_ERROR 87 · NOT_IMPLEMENTED 83
  VALIDATION_ERROR 48 · RESOURCE_NOT_FOUND 27 · DATABASE_ERROR 23 · RATE_LIMIT_EXCEEDED 14 · TIMEOUT 3

DARK CONTROLS (the three ADR-0049-retired members)
  BATCH_PARTIAL_FAILURE 0 · BATCH_COMPLETE_FAILURE 0 · TRANSACTION_FAILED 0

⇒ Nine lit, five dark, and the five dark split exactly into already-retired and these two. The zeros are a reading.

A bare \bQUOTA_EXCEEDED\b tree-wide outside content/ returns 3, and all three are non-producers: the catalog declaration, a deliberately-wrong waiver case, and the unpinned-baseline row.

⭐ Why this is RESIDUE and not a reserved split — measured, not assumed

The ledger states its own doctrine in packages/spec/src/api/error-code-ledger.zod.ts: "a producerless row with no card behind it is the registered but unemittable retirement class." Against that test:

• QUOTA_EXCEEDED carries no card and no registered-ahead-of-its-producer note.
• The one implemented quota surface answers TOO_MANY_REQUESTS on purpose — packages/services/service-sms/src/sms-daily-quota.ts:85.
• TenantQuotaSchema / QuotaEnforcementResultSchema have no consumer outside spec's own tests and generated surface files.

⇒ The platform is not missing an implementation it intends. That is what makes this an ADR-0049 enforce-or-remove question rather than a feature gap.

Why ONE card and not two

CONCURRENT_LIMIT_EXCEEDED measures identically on the same probe, sits one row below QUOTA_EXCEEDED in the same catalog block, and raises the same ADR-0049 question with the same answer set. Splitting them would put two cards through one decision. ⚠️ If triage disagrees, split — but then the two must be serialised, not run in parallel: they touch the same enum.

The decision this needs

⛔ Not mine, and ⛔ not a dev round's — removing a member from a published error-code enum is a contract change.

• A — retire both, the way BATCH_PARTIAL_FAILURE and its siblings were retired, deleting both doc entries and the unpinned-baseline rows in the same PR. (The round's own recommendation, on the ledger's own retirement test.)
• B — keep because a quota producer is genuinely planned. Then this is a feature card and must name the shape its producer will emit.
• C — keep and leave the docs as PR docs(protocol): drop the unproduced rate-limit headers and the quota wire fence from error-handling #17703 leaves them: registered, documented, and explicitly marked unemitted.

⚠️ I am not choosing. ADR-0049 dispositions and published-enum membership are the maintainer's floor.

⛔ A blocker whoever takes option A will hit

Retiring an enum member is the "re-declared key" shape that #17618's T1 widening tell currently mis-reads as a new key. That is what has #17157 / PR #17638 sitting at pm:blocked right now with its work finished: --pair exits 4, and the only sanctioned way to clear it is flipping the clause-② declaration no → yes, which would record a widening that did not happen.

⇒ ⛔ Do not dispatch option A until #17618 is fixed. It will produce a second correct, green, unlandable PR. (Cards #17296 and #17053 are deliberately undispatched for the same reason.)

Adjacent, recorded so nobody re-measures it

content/docs/api/error-catalog.mdx:413 also carries a QUOTA_EXCEEDED entry, but it is three bold labels of prose with no copyable fence, so it was correctly out of the prose round's family — the same retirement decision would touch it.

Duplicate check — completed to the limit this session allows

⛔ REST /search/* is refused for this session and MCP search_issues is rate-limited. Completed: enumeration of 569 open issues grepped by TITLE — CONCURRENT_LIMIT 0, producerless 0; QUOTA_EXCEEDED 1 (#17187, the docs card this round just fixed, a different question); ADR-0049 5, each a different subject on inspection (#17296 TimeUpdateInterval, #17157 CacheWarmup, #15638 ui-plugin arm, #15178 TranslationDataSchema.settings, and #17187). Lit control spec = 75. ⚠️ Titles only; bodies were not searched. Close as duplicate if one surfaces.

Related: #17187 / #17188 / PR #17703 (where it was measured) · #17618 (the blocker for option A) · #17157 (the same shape, currently blocked by it) · #17296 (another ADR-0049 enum-residue card, undispatched for the same reason)

---

Generated by Claude Code