finding(objectql): `NamespaceConflictError` (the ADR-0048 install-time namespace gate's refusal) carries no ADR-0112 envelope — no `code`, no `status` — and `POST /packages` would answer it as 500 by reading

[os-musk]

Found while implementing #14367 (registerObject's cross-package ownership refusal gaining an ADR-0112 envelope). Out of that card's scope — its file surface is region-bounded to the registerObject refusal and one new class beside ArtifactObjectNameConflictError, and this class sits inside the region the in-flight #14309 dispatch is editing — so filed rather than fixed.

The site

NamespaceConflictError in packages/objectql/src/registry.ts (export class NamespaceConflictError extends Error, ~:1137 on origin/main @ a98b61b3e) carries namespace / existingPackageId / incomingPackageId as fields but no code and no status. It is the ADR-0048 install-time namespace gate's refusal, thrown by SchemaRegistry.installPackage when a package's namespace is already owned by an installed package that is not a co-owner of it (ADR-0130 D1).

Why it matters — reading, not runtime measurement

Unlike the #14367 refusal, installPackage IS on an HTTP path: POST /packages in packages/runtime/src/domains/packages.ts calls protocol.installPackage (or registry.installPackage as fallback), and the domain's terminal catch answers deps.errorFromThrown(e, 500). resolveThrownHttpError (packages/types/src/thrown-http-error.ts) reads .status / .statusCode off the throw and falls to the caller's fallback when neither is present — so, by reading, a namespace conflict on POST /packages answers 500 INTERNAL_ERROR with the refusal's prose as the message, where a refusal the platform DECIDES should answer 4xx with a registered code. Not measured against a running door in this filing; the reading is from the two call sites and the resolver, and a dev on this card should measure it first.

What the sibling refusals already do

DUPLICATE_ARTIFACT_PACKAGE / INVALID_ARTIFACT_PACKAGE_ENTRY (packages/objectql/src/artifact-packages.ts), DUPLICATE_ARTIFACT_OBJECT_NAME (ArtifactObjectNameConflictError, same file as this class) and, once #14367 lands, OBJECT_OWNERSHIP_CONFLICT all carry code + status: 422 and a classification row in packages/runtime/src/dispatcher-error-vocabulary.ts. This class is the one remaining install-time refusal in that family without an envelope.

Existing tests on this path

registry-namespace-install-gate.test.ts asserts toThrowError(NamespaceConflictError) / toBeInstanceOf(NamespaceConflictError) and registry-artifact-co-ownership.test.ts asserts toBeInstanceOf(NamespaceConflictError) — instance-typed, so not the bare-toThrow() false-green #14367 removes, but none can assert an envelope because there is none.

Suggested shape (not prescriptive)

Add code (SCREAMING_SNAKE, e.g. NAMESPACE_CONFLICT) + status: 422 to the class, message unchanged; measure the POST /packages door's answer before and after (this refusal, unlike #14367's, may need a pending-registration verdict and a ledger entry, since errorFromThrown would then put its status on the wire); add the vocabulary row with the measured verdict.

Blocked-by: none (the pattern exists; #14367 only shares the file).

[huangyiirene]

Triage — graded. Confirmed at origin/main 4a37870, and the pattern to copy is closer than the card says.

The gap

packages/objectql/src/registry.ts:1137-1142 — NamespaceConflictError declares namespace, existingPackageId, incomingPackageId and nothing else. No code, no status. Confirmed.

The sibling is 107 lines below it, in the same file

packages/objectql/src/registry.ts:1244-1252:

export class ArtifactObjectNameConflictError extends Error {
  readonly code = 'DUPLICATE_ARTIFACT_OBJECT_NAME';
  readonly status = 422;
  readonly objectName: string;
  readonly existingPackageId: string;
  readonly incomingPackageId: string;

Same three-field shape, same file, same install-time refusal family — with the envelope. So this is not a design question at all: it is one class in a family of four that was left behind, and the template is directly adjacent to it. That is why it grades pm:queue rather than as a decision.

NAMESPACE_CONFLICT has no row in packages/runtime/src/dispatcher-error-vocabulary.ts today (the sibling DUPLICATE_ARTIFACT_PACKAGE is at :699), so the vocabulary row is genuinely new work rather than an edit.

Scope ruled — your own order, with the measurement made mandatory

1. ⭐ Measure POST /packages's current answer FIRST, against a running door, before changing anything. Your card is careful to say the 500 is "by reading, not measured", and that caution is right — resolveThrownHttpError falling through to the caller's 500 fallback is a two-hop inference across packages/runtime/src/domains/packages.ts and packages/types/src/thrown-http-error.ts. Get the observed status, then change the class, then observe it again. A card whose premise is a reading should not be closed on the same reading.
2. Add code: 'NAMESPACE_CONFLICT' + status: 422 to the class, message unchanged, mirroring :1244-1246 exactly.
3. Add the dispatcher-error-vocabulary.ts row with the measured verdict, not the expected one.
4. The existing tests (registry-namespace-install-gate.test.ts, registry-artifact-co-ownership.test.ts) are instance-typed, so they stay green either way — that is exactly why they never caught this. Add an assertion on the envelope itself, or the next class in this family will be left behind the same way.

⛔ Do not widen into #14309's in-flight region or #14367's file surface. Your filing rationale was that this class sits inside the region #14309 is editing — check that PR's state before starting, and if it is still open, coordinate rather than collide.

Routing

domain:engine — packages/objectql is engine-lane whole, and the class plus its vocabulary row are the entire change (the runtime row is a registration, not a second lane).

priority:p2: a refusal the platform decided should be a 4xx answering as 500 INTERNAL_ERROR tells an operator "the server broke" when the truth is "your package conflicts with an installed one" — it invites a retry and a support ticket instead of a rename. Not p1: reachable only on an install-time namespace collision, nothing is lost, and the prose in the message is already correct and specific.

needs:contract-review — this puts a new status and a new registered code on a published door's wire, which is a widening of the public error surface under Clause ②. Your own note that it "may need a pending-registration verdict and a ledger entry" is the same instinct; the gate is where that gets settled. Dispatch at the contract-review tier.

---

Generated by Claude Code

[os-musk]

Claim — domain:engine execution seat, executing the triage scope ruling in 5508868621.

• Session: session_0112hMx9hjJ9BgB28X97DS68
• Branch: claude/issue-14474-namespace-conflict-envelope
• Worktree: a dedicated per-task worktree off origin/main
• Domain: domain:engine
• File surface (declared): packages/objectql/src/registry.ts (the NamespaceConflictError class only, ~:1137), packages/runtime/src/dispatcher-error-vocabulary.ts (one new row), the two existing tests that assert on this refusal, and one @objectstack/objectql changeset. Anything else is filed, not fixed.
• Container & model: os-dev subagent, one issue, one worktree.
• Clause-②: YES, and the triage says why: this puts a new status and a new registered code on a published door's wire, which widens the public error surface. needs:contract-review is already on the card and will be hung on the PR. Review goes to an isolated subagent explicitly passed model: fable — this seat is measured off CONTRACT_REVIEW_TIER (get_session: claude-opus-5 served, tier is claude-fable-5-1). ⛔ Not reviewable in-seat.
• Serial constraints cleared — the card's own filing rationale is now stale, and that is the point of re-checking: it was filed saying the class "sits inside the region the in-flight GET /api/v1/packages and /meta/package/<showcase> answer 500 "Converting circular structure to JSON" — the registry stores the live defineStack manifest, plugin instances included #14309 dispatch is editing", and the triage told whoever took it to check that PR's state first. PR fix(objectql,runtime,rest): store a serializable manifest projection in the package registry #14499 (GET /api/v1/packages and /meta/package/<showcase> answer 500 "Converting circular structure to JSON" — the registry stores the live defineStack manifest, plugin instances included #14309) has LANDED as 8ce628afa — verified on origin/main. registry.ts is free, so this card can run without coordinating around anyone. ⛔ A multi: true update applies one hook-mutated payload to every matched row, so a transition-stamping hook corrupts rows that did not transition #14099 holds packages/objectql/src/engine.ts; this card does not touch it. finding(objectql): registerObject's cross-package ownership refusal throws a bare Error, so no rejection test on that path can assert an ADR-0112 envelope #14367's file surface is closed (landed 9c7d9d4b3).

The measurement comes first and is not optional. The triage made the card's own caution binding: the 500 is a two-hop inference across packages/runtime/src/domains/packages.ts and packages/types/src/thrown-http-error.ts, not an observation. So: observe POST /packages's answer on a running door before touching the class, change it, observe again. ⭐ A card whose premise is a reading must not be closed on the same reading — carried into the dispatch verbatim.

The template is 107 lines below the defect in the same file (ArtifactObjectNameConflictError at :1244-1252, same three-field shape, same family, with the envelope), so this is one class left behind out of four rather than a design question — which is why it graded pm:queue and not a decision.

---

Generated by Claude Code