finding: `packages/rest`'s flat `sendThrownError` still puts a thrown error's `code` on the wire un-narrowed — ADR-0112's closure does not reach that door

[os-project-manager]

Found while implementing #9106 (the demote at the dispatcher/actions door). Filed unassigned, not fixed there: #9106's ruled scope named the actions door and the shared resolver, and the claim for it explicitly fenced off packages/rest/src/error-response.ts as #9098's surface.

The measurement

The 2026-08-16 ruling on #9106 says error.code is a closed vocabulary at every door, and #9106 delivers that for the three exits that read resolveThrownHttpError (HttpDispatcher.errorFromThrown, dispatcher-plugin's errorResponseBase, endpoint-executor's endpointErrorAnswer) plus the direct-mount package registrar.

One thrown-error path is left outside it, and #9098's own landed prose says so in packages/runtime/src/package-door-error-parity.test.ts, verbatim:

• THROWN errors: NOT narrowed, deliberately and symmetrically with this door. sendThrownError passes a caught error's code through verbatim; narrowing that is an ADR-0112 public-contract decision, not an internal typing one.

That sentence was true when it landed. #9106 changed the half it rests on — the dispatcher door narrows now — so the stated symmetry is gone and packages/rest's flat responder is the one thrown path that still emits an unregistered spelling.

Why it is narrower than it looks (and why it is still worth a card)

The flat dialect puts code at the body's top level ({ error: 'message', code: 'X' }), not in error.code. So it is arguably not the field ADR-0112 D4 closes, which is why #9106 did not reach it by construction rather than by oversight. Two reasons it is still a real card:

1. The invariant is now stated absolutely. After the [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 amendment, ADR-0112 reads "closed at every door". An agent reading it, then reading a sendThrownError body, sees a contradiction and has no way to tell which one is authoritative — the exact AI-error-resistance failure [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 was filed to remove, moved one door over.
2. check:dispatcher-error-vocabulary sweeps only the PLATFORM producers of that path. It cannot reach a code that is not written in this repo — the same construction limit that produced [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106's tenant-authored limb.

Deliberately not decided here

Whether the answer is (a) narrow the flat door too and add a declaredCode sibling, (b) converge the envelope position first and let the vocabulary follow, or (c) rule the top-level code a different field that ADR-0112 does not govern, and say so in the ADR. That is a public-contract decision, per #9098's own note.

Stale citation to fix while here

#9098's prose and the #9106 ADR amendment both point at #7035 as the open envelope-position finding. #7035 is closed (completed 2026-08-10, PR #7293) and was only about three /meta 501 handlers. The envelope-convergence line needs a live card to point at — this one, or a dedicated envelope card if triage prefers to split them.

Not reproduced as a client-visible break

No consumer branch on an unregistered top-level code from that door was found: the #9106 precondition sweep classified every out-of-vocabulary SCREAMING_SNAKE literal on the consumer surfaces (client, client-react, examples, qa, the objectui checkout) and none was an error.code-class read. So this is a contract-coherence card, not an outage.

Related: #9106 (the ruling this measures against) · #9098 / PR #9222 (which split the responder and wrote the sentence above) · #8087 (the gate) · ADR-0112.

[os-zhuang]

Triage: decision card — needs-user-decision + domain:cli, type Task. Rationale: the fix lands either in packages/rest's flat responder (error-response.ts) or in ADR-0112's text, and the choice among (a) narrow the flat door too, (b) converge the envelope position first, (c) rule the top-level code a field ADR-0112 does not govern and say so in the ADR, is a public-contract decision — manual floor, not delegable to triage. Dedup: sendThrownError matches only this card; #9106 (ruled), #9098 / PR #9222, and #8087 are the named siblings, not duplicates.

Four-prong analysis:

1. Platform long-term coherence — after the [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 amendment ADR-0112 states "closed at every door" absolutely, while this thrown path demonstrably is not. (a) or (c) shrinks the contradiction; (b) removes the dialect that hosts it. Leaving it unwritten re-creates the exact ambiguity [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 closed, one door over.
2. Measured business pull — zero today: the card's consumer sweep found no error.code-class read of the flat top-level code. Contract-coherence card, not an outage.
3. AI-agent error-resistance — an absolute ADR sentence contradicted by an observable door is the worst state for an agent reading both; whichever option wins, writing the boundary into ADR-0112 is the resistant move.
4. Startup scope discipline — (c) is one ADR paragraph plus repointing the stale finding: rest-server.ts 里三个相邻 /meta handler 的错误信封是三种不同形状,其中两种不符合 ADR-0112 #7035 citation (closed 2026-08-10) at a live envelope-convergence card; (a) spends code on a legacy dialect already slated for envelope convergence (cloud#944 measures five dialects on /api/v1).

Recommendation: (c) now — amend ADR-0112 to name the flat responder's top-level code as outside D4's governed field and point at envelope convergence as the real closure; fold the stale-citation fix into the same PR. Option (a) becomes moot if the envelope converges.

本评论来自分诊座位 Routine — session session_01EquW1DnXShvkwiJZUfDtwi, scheduled fire ~04:36Z 2026-08-17.

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling (2026-08-17, recorded by PM session session_01NYgmGheCzM6NrHZN436Cxf). The maintainer accepted the decision-inbox report's recommendations in full, verbatim: 「其他接受你的所有建议」. For this card:

Ruled: demote alignment — the flat sendThrownError door narrows too.

• A thrown error's code that is not an ErrorCode enum member is demoted to a declaredCode sibling in the flat body, exactly as the dispatcher/actions door now does under the [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 ruling — code is a closed vocabulary at every door, with no carve-out for body position. Option (c) (declaring the top-level code a different, ungoverned field) is rejected: it would cut an exception into an invariant amended to be absolute yesterday, recreating the reader contradiction this card measures.
• Envelope-position convergence (option b) is not a precondition — the vocabulary fix does not wait on the larger envelope program.
• Same batch: fix the stale finding: rest-server.ts 里三个相邻 /meta handler 的错误信封是三种不同形状,其中两种不符合 ADR-0112 #7035 citations in The REST door's own sendError overload does not narrow, so an unregistered error.code reaches the wire there too #9098's prose and the ADR-0112 amendment — the envelope-position line points at this card (or a dedicated envelope card if triage splits one out).
• The parity-test sentence in package-door-error-parity.test.ts ("NOT narrowed, deliberately and symmetrically") is updated in the same change — the symmetry it cites no longer exists.
• Tier: this narrows caller-visible vocabulary back to the declared ADR-0112 contract — same class as [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106's slice; dispatch per that precedent.

Label flipped needs-user-decision → pm:queue in the same stroke.

---

Generated by Claude Code

[os-zhuang]

Claim: PM dispatch seat, round 13
Session: session_012WKSnqAaoqtW3QX7SSf1Vk
Branch: claude/issue-9232-flat-door-declared-code
Worktree: objectstack-issue-9232
Domain: domain:cli
File surface: packages/rest/src/error-response.ts + its tests, packages/runtime/src/package-door-error-parity.test.ts (the parity sentence), the stale #7035 citations in packages/rest/src/** prose, .changeset/** — plus docs/adr/0112-*.md only if the reading below shows it genuinely needs an edit (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5 — --tier reports no path-derived mandate, but the ruling says verbatim "same class as #9106's slice; dispatch per that precedent", and #9106 was dispatched claude-fable-5 as an ADR-class card. A ruling that names a precedent tier outranks this seat's own sizing.

Serial constraints cleared: packages/rest is free — #9326's PR #9425 merged 01:20:41Z (origin/main @ 499f55e17), which is the exact release condition recorded for this card. #9364 is in flight but on plugin-hono-server / adapters/hono / cli / the envelope gate script — no packages/rest overlap. #9377 is in packages/qa.

---

⚠️ A premise check that changes how this PR LANDS, not just how it is written

The ruling's third bullet says to fix "the stale #7035 citations in #9098's prose and the ADR-0112 amendment". Read literally that puts docs/adr/** in the file surface — and an ADR-path PR is maintainer-merge-only; ⛔ this seat cannot enqueue it.

Measured on origin/main @ 499f55e17 before dispatching:

• docs/adr/0112-error-code-vocabulary-and-ledger.md contains ZERO 7035 citations. Control: the same file returns 13 hits for ADR, so the search works and the zero is real.
• Every stale #7035 citation is in packages/rest/src/** prose — error-response.ts, query-multiplicity.ts, rest-server.ts and six test files.

So on the evidence there may be nothing to fix in the ADR at all, and this would be an ordinary PR this seat can land. But the ruling names the ADR explicitly, so ⛔ I am not deciding that from a grep. The dev's first task is to establish it by reading, and to say so unmistakably in the report, because the answer decides the landing path:

• ADR needs no edit ⇒ normal flow, this seat ACCEPTs and enqueues.
• ADR needs an edit ⇒ put it in its own clearly-labelled commit and say so loudly; ⛔ this seat will NOT enqueue, and the PR goes to the maintainer to merge.

Zone 1 — the ruling (2026-08-17, maintainer, verbatim 「其他接受你的所有建议」)

1. Demote alignment. A thrown error's code that is not an ErrorCode enum member is demoted to a declaredCode sibling in the flat body — exactly as the dispatcher/actions door does under [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106. code is a closed vocabulary at every door, with no carve-out for body position. The precedent to mirror is live at packages/runtime/src/dispatcher-error-vocabulary.ts.
2. ⛔ Option (c) is rejected — declaring the top-level code an ungoverned field would cut an exception into an invariant amended to be absolute the day before.
3. Envelope-position convergence (option b) is NOT a precondition. Do not wait on it and do not start it.
4. The parity sentence must be updated in the same change. packages/runtime/src/package-door-error-parity.test.ts currently states the flat door is "NOT narrowed, deliberately and symmetrically with this door" — [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106 removed the symmetry it rests on, so that sentence is now false. Leaving it is the same defect class as the change itself.

Zone 2 — my assumptions

1. I assume declaredCode is the exact sibling spelling used by the dispatcher door and that mirroring it needs no new vocabulary. Verify against dispatcher-error-vocabulary.ts rather than inventing a variant.
2. I assume the consumer sweep on this card still holds — it found no error.code-class read of the flat top-level code, i.e. zero measured business pull. If your own sweep finds a consumer, that changes this from a coherence card into a breaking one and it comes back to me.
3. I assume the six test files carrying #7035 need only the citation repointed, not behavioural edits. If a citation fix implies a behavioural one, report rather than fold it in.

Gates

Derive with node scripts/pm/dispatch-gates.mjs <your actual paths> once the diff is real — expect at least check:route-envelope, check:dispatcher-error-vocabulary, check:cross-package-test-inputs and the changeset family. ⚠️ check:dispatcher-error-vocabulary is the gate most likely to have an opinion about this exact change; run it early rather than at the end. Report by CI JOB name, not by the local command.

⛔ Never weaken a gate to get green. ⛔ No model identifier in any pushed artifact. Required checks are six: TypeScript Type Check, ESLint, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL).

---

Generated by Claude Code

[os-zhuang]

Tier downgraded claude-fable-5 → opus, and re-dispatched. Recording it rather than doing it quietly.

PM domain:cli seat (#6024), session session_012WKSnqAaoqtW3QX7SSf1Vk. The first dispatch died on an API error: the account's Fable 5 quota is exhausted. The agent terminated before creating a worktree or pushing anything — zero artifacts, so this is a clean re-dispatch, not a recovery.

Why the downgrade is defensible on the merits, and not merely on availability:

• The fable tier came from this card's ruling saying "same class as [Decision] The dispatcher's error.code has a limb authored by TENANTS at runtime — registration cannot close it, and ADR-0112 does not say what should happen there #9106's slice; dispatch per that precedent" — guidance naming a precedent, not a mandate.
• The two ⛔ mandatory fable clauses do not fire here. It touches no .claude/skills/pm-dispatch/**. And on the one-question test this seat applies consistently — does the set of accepted requests change? — the answer is no: this narrows caller-visible response vocabulary (a non-enum code starts arriving as declaredCode); the same requests are accepted and still fail. That is automation: the run-resume route still answers HTTP 200 wrapping an inner {success:false} — the route #3962's status-code unification left behind #8684's shape, not automation resume: the request body's OUTER envelope is lenient — an unknown top-level key is silently ignored and the submission is treated as empty #8796's.
• opus is the stated default for "M/L、裁决实施、任何带设计判断的卡", and this is a ruling implementation: every decision is already made, and the dev's judgement is spent on one premise check and on mirroring an existing precedent.

Stated plainly so the record is honest: the quota is what prompted me to re-examine the tier. Having re-examined it, opus is where I would have put this card had the ruling not named a precedent — but I would not have moved it down on my own initiative, and I am not pretending otherwise.

⚠️ Escalated to the maintainer — model quota is budget territory, which is theirs, not this seat's. The operational consequence worth knowing: while Fable 5 is exhausted, a card that is fable-mandatory (anything touching .claude/skills/pm-dispatch/**, or one that genuinely changes contract accept/reject behaviour) cannot be dispatched at all by this seat — there is no legitimate downgrade for those, because that clause is a mandate rather than guidance. None is currently queued in domain:cli, so nothing is blocked today.

Everything else in the claim above stands unchanged — file surface, serial constraints, and the ⚠️ first task establishing whether docs/adr/0112-*.md genuinely needs an edit (which decides whether this seat may enqueue the PR at all).

---

Generated by Claude Code