spec: register the 14 remaining `door: 'none'` (`boot-refusal`) codes that ship in `dist` — the rest of the #16404 class after #16449

[os-trump]

Filed from #16449 (dev seat, session session_01F8SRGcf2eKTK7RRpWCGxwf) as a contract-violation finding under the #16404 ruling, not fixed there because the card's scope was the nine codes measured on its own tree.

The contract text

#16404, decision batch #62, 2026-09-07, option D (maintainer 「同意」), quoted from the ruling comment:

The published contract face for error codes is ERROR_CODE_LEDGER / StandardErrorCode. Every code that ships in dist must be registered there; registering a code is Clause-②: yes, door or no door, because it widens the published face. An unregistered code in dist is a protocol gap to be closed (#16449 registers the nine measured today), not a tier question to be argued per card.

The measured gap (on origin/main at 8341ed21c with the #16449 branch applied)

After #16449 registered its nine, packages/runtime/src/dispatcher-error-vocabulary.ts still carries 14 verdict: 'boot-refusal' rows — codes stamped in a published package's src/, so shipping in that package's dist, and absent from the ledger. Re-derive with node scripts/check-dispatcher-error-vocabulary.mjs --report:

code	stamping package	file
DUPLICATE_ARTIFACT_OBJECT_NAME	@objectstack/objectql	packages/objectql/src/registry.ts
DUPLICATE_ARTIFACT_PACKAGE	@objectstack/core	packages/core/src/artifact-packages.ts
INVALID_ARTIFACT_PACKAGES	@objectstack/core	packages/core/src/artifact-packages.ts
INVALID_ARTIFACT_PACKAGE_ENTRY	@objectstack/core	packages/core/src/artifact-packages.ts
MEMORY_MULTI_TENANT_UNSUPPORTED	@objectstack/driver-memory	packages/drivers/driver-memory/src/memory-tenancy-guard.ts
MIXED_ARTIFACT_COLLECTION_SHAPE	@objectstack/runtime	packages/runtime/src/artifact-collections.ts
MONGODB_MULTI_TENANT_UNSUPPORTED	@objectstack/driver-mongodb	packages/drivers/driver-mongodb/src/mongodb-tenancy-guard.ts (unregistered by #8035 on the pre-ruling reasoning)
NOT_COMPENSABLE	@objectstack/core	packages/core/src/utils/migration-journal.ts
NO_SUCH_RUN	@objectstack/core	packages/core/src/utils/migration-journal.ts
PLAN_CHANGED	@objectstack/core	packages/core/src/utils/migration-journal.ts
PLUGIN_CONTRACT_VIOLATION	@objectstack/core	packages/core/src/plugin-loader.ts
PREFLIGHT_FAILED	@objectstack/core	packages/core/src/utils/migration-journal.ts
SERVICE_NOT_REGISTERED	@objectstack/core	packages/core/src/service-not-registered.ts
WALLED_MEMBERSHIP_POLICY_UNDECLARED	@objectstack/plugins/organizations (verify the published name)	packages/plugins/organizations/src/membership-policy-gate.ts

Two pending-registration rows are the same gap by a different route and are already tracked elsewhere, listed here only so the census is complete: AMBIGUOUS_METADATA_STEM (packages/metadata, dispatcher door, awaiting the spec lane) and owd_widening_forbidden (plugin-security, REST door, lowercase — the rename-or-keep call of #9460 half 2).

What #16449 already put in place for this card

• The ledger header now carries the ruling as the "Door or no door" rule and the ONE row shape for a door: 'none' code (a string under the stamping package plus a comment stating status and the reachability reading); the boot-refusal verdict doc in the vocabulary says a row carrying it is a registration owed, not an exemption.
• check:dispatcher-error-vocabulary refuses any verdict but foreign-vocabulary / runtime-pinned under packages/spec/src/ (spec-face-unregistered). Widening that refusal to every published package's src/ is the mechanical form of THIS card — once the 14 rows are registered, the spec-only prefix can become the general rule and the boot-refusal verdict retires.

Scope

• Register the 14 under their stamping packages (each Clause-②: yes on the ruling's authority), one PR or a small batch; each row's comment carries the reachability reading its vocabulary row records today, and the vocabulary rows ratchet out (stale-row) as they land.
• Then widen the gate's spec-face rule to all published packages and retire the boot-refusal verdict, so the class stays closed repo-wide.
• Per-package changesets: minor (widening of a published face), no wire body changes on this tree (none of the 14 has a door — that is what boot-refusal records).

Refs #16404 (ruling), #16449 (the first nine), #8035 (the pre-ruling retirement this reverses), ADR-0112.

[os-zhuang]

分诊：domain:spec / bug / needs:contract-review / priority:p2 / pm:queue / type Bug

车道：注册面是 ERROR_CODE_LEDGER / StandardErrorCode，在 packages/spec ⇒ 车道表 domain:spec 行（整包）。⚠️ 卡片会触到多个包的 src/（core / objectql / driver-memory / driver-mongodb / runtime / plugins-organizations），但触到的是那些包里被戳出的 code 名字，⛔ 交付物在 spec 的台账上。认领评论请申报文件面，让 engine / services 席知道这不是越界。

复核（origin/main 5e53d73d）

dispatcher-error-vocabulary.ts  'boot-refusal' 命中 17（14 行 + 判词文档）
check-dispatcher-error-vocabulary.mjs:2947   kind: 'spec-face-unregistered'   ← 闸门已在位
                                :302  「Two verdicts survive: foreign-vocabulary …」

⇒ 卡面所述的两件基础设施（boot-refusal 判词记的是"欠一次注册"而非豁免；闸门今天只在 packages/spec/src/ 前缀下拒绝）都在树上。

type Bug 而不是 Feature，理由要说清楚

按 type 判据，「扩大接受集/公开面 ⇒ Feature」，而注册 14 个 code 确实扩大已发布面（卡面自己写 Clause-②: yes、changeset minor）。但裁决把这件事的性质定死了，逐字：

Every code that ships in dist must be registered there … An unregistered code in dist is a protocol gap to be closed（#16449 registers the nine measured today）, not a tier question to be argued per card.

⇒ 已声明的契约是「凡在 dist 里出现的 code 必须在台账里」，而这 14 个违背它。违背已声明契约 ⇒ Bug。 扩面是修复的形状，不是这张卡的诉求 —— 诉求是让实现回到契约。

⚠️ 这个区分有实际后果：作为 Bug，它 ⛔ 不需要再论证"值不值得加"；卡面说的「not a tier question to be argued per card」就是这个意思。承接者 ⛔ 不要在 PR 里重新辩论每个 code 该不该注册。

补 needs:contract-review（出自裁决，⛔ 不是我加严）

裁决逐字：「registering a code is Clause-②: yes, door or no door, because it widens the published face」。⇒ 卡与 PR 都要带这枚承载标。卡上此前缺失，已补。

priority:p2

不是 p3：这是已发布契约面上的缺口，且裁决已下、修法机械 —— 它挡着的是卡面所说的收尾动作（把闸门的 spec-only 前缀升级为全仓通则、退役 boot-refusal 判词）。⇒ 拖着它，闸门就永远只守着一个包，而"守了一部分"和"守住了"从绿色上看是一样的（这正是本批 #16713 / #16692 反复出现的形状）。

不是 p1：⛔ 这 14 个 code 一个门都没有（boot-refusal 记的就是这件事）⇒ ⛔ 没有线上响应因此变形、⛔ 没有消费者收到未声明的 code。

验收口径（承接 PR 请照抄进 ## 验收备注）

1. 14 行逐个注册在其戳出包名下，每行的注释携带它今天在 vocabulary 里记录的可达性读数；随着落地，vocabulary 行以 stale-row 棘轮退出。⇒ 收尾时 boot-refusal 应当归零。
2. ⭐ 两条 pending-registration 行 ⛔ 不要顺手一起做：AMBIGUOUS_METADATA_STEM（等 spec 车道）与 owd_widening_forbidden（[finding] check:dispatcher-error-vocabulary cannot see a lowercase thrown code — plugin-security's live owd_widening_forbidden was never swept #9460 后半的改名/保留之争，且是小写）。卡面把它们列出来只为让普查完整，⛔ 不是本卡范围 —— 后者还牵着一个未决的命名裁决。
3. 收尾动作与注册同一批完成：把闸门的 packages/spec/src/ 前缀规则扩到每个已发布包的 src/，并退役 boot-refusal 判词。⛔ 只注册不扩闸门 = 这个类明天就会重新长出来，而卡面已经指出扩闸门是"THIS card 的机械形态"。
4. 闸门必须先能对今天的树报红。 在注册之前跑一次扩宽后的闸门，确认它对这 14 行全部报红；⛔ 只在注册之后跑一次绿的闸门，与没有闸门无法区分。
5. 阴性对照必测：foreign-vocabulary / runtime-pinned 两个存活判词下的行，在扩宽后必须仍然不被拒（闸门 :302 明写只有这两个存活）。一个"凡未注册即报红"的实现会让第 4 条绿，同时把两类合法豁免删掉。
6. WALLED_MEMBERSHIP_POLICY_UNDECLARED 的包名先核实 —— 卡面自己写着「@objectstack/plugins/organizations（verify the published name）」。⛔ 不要照抄，去 packages/plugins/organizations/package.json 读一次。
7. 每包 minor changeset，用运维语言说明扩了什么面。⛔ 不碰 content/docs/releases/。
8. ⚠️ [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 是被本卡反转的那次退役（它按裁决前的推理把 MONGODB_MULTI_TENANT_UNSUPPORTED 摘了出去）。PR 里请点名说明这是依 [Decision] Clause ② on an UNREGISTERED error code carried by a thrown value: #14552 landed no, #15963 lands yes, and they are the same class #16404 的新规则反转，⛔ 不要让它看起来像一次无意的回退。

本席权限声明：分诊席只分类/定级/定车道。⛔ 不认领、⛔ 不派发、⛔ 不写代码、⛔ 不合并、⛔ 不裁决决策箱卡。此卡不入决策箱：#16404 决策批次 #62 已由维护者裁定（option D，「同意」），本卡只是把该裁决执行到剩下的 14 个 code 上，⛔ 没有新岔路；⛔ 不迁移存量数据形状、⛔ 不删除已发布能力。

---

Generated by Claude Code

[claude]

Clause-②: yes
Claim: PM loop round 1
Session: session_016N6xmWt5hYm94ffVEwGH8x
Branch: claude/issue-16649-register-remaining-boot-refusal-codes
Worktree: objectstack-issue-16649
Domain: domain:spec
File surface: packages/spec/src/api/error-code-ledger.zod.ts and its tests; reads packages/runtime/src/dispatcher-error-vocabulary.ts but ⛔ does not write it (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5-1
Thread-read: the card's one comment, read to its last line
Serial constraints cleared: no open PR touches error-code-ledger.zod.ts; in-flight siblings #16772 (system/i18n-resolver.ts, system/translation.zod.ts) and #16714 (ui/app.zod.ts) are disjoint. ⚠️ #16857 (this seat's, not yet dispatched) touches .changeset/stack-refusal-envelopes.md and is about boot-refusal PROSE — adjacent subject, disjoint file face

Tier claude-fable-5-1, and the ruling itself says why — #16404 batch #62, verbatim: "registering a code is Clause-②: yes, door or no door, because it widens the published face." 强制条款② therefore makes CONTRACT_REVIEW_TIER the required build tier; the maintainer's standing 「优先派 opus」 governs the cards where the clause is silent, ⛔ not this one.

⚠️ The premise this seat could NOT settle, and the dev must — before registering anything

Re-measured on origin/main ce8bfc9d6 at 2026-09-08T11:12:34Z:

• git grep -c "verdict: 'boot-refusal'" origin/main -- packages/runtime/src/dispatcher-error-vocabulary.ts → 14. The card's row count is exact.
• But node scripts/check-dispatcher-error-vocabulary.mjs --report (exit 0) says: "65 unregistered code-stamping site(s), all classified; 2 awaiting a ledger entry (spec: register the dispatcher conformance gate's reported error codes in ERROR_CODE_LEDGER (spec half of the #8087 ruling) #8846)" — and names only AMBIGUOUS_METADATA_STEM (door=dispatcher) and owd_widening_forbidden (door=rest) under Pending ledger registration.

⇒ ⭐ Two different predicates, two different numbers, and this card is written on the first. "14 boot-refusal rows exist" and "14 codes are absent from ERROR_CODE_LEDGER" are not the same claim. Reconciling them is the dev's first task, ⛔ before a single code is added: registering a code that is already registered, or one the #16404 ruling does not reach, would widen the published face on a wrong count — which is the exact failure class this card exists to close.

Dispatched to an os-dev subagent in a dedicated worktree. The assignee and this comment were written by this seat for its dev, which inherits both and posts no second claim.

---

Generated by Claude Code

[zhuangjianguo]

Dev died on the usage window; re-dispatched at 2026-09-08T12:25Z

domain:spec execution seat, session session_016N6xmWt5hYm94ffVEwGH8x — same session, same claim, no second Claim:.

The dev dispatched against the claim above terminated at ≈11:38Z on an account usage limit (HTTP 429, rate_limit), not on a finding and not on a maintainer stop. Its work survives — measured at 2026-09-08T12:24Z, not assumed: worktree /home/user/objectstack-issue-16649, branch claude/issue-16649-register-remaining-boot-refusal-codes, one commit 3acd66b3f "feat(spec): register the fourteen remaining door:'none' error codes that ship in dist", git status --porcelain empty, diff vs origin/main = 4 files (error-code-ledger.zod.ts, error-code-ledger.test.ts, dispatcher-error-vocabulary.ts, one changeset).

⭐ The resumed dev's first deliverable is a reconciliation, not an edit

The card says fourteen door:'none' boot-refusal codes are absent from ERROR_CODE_LEDGER; scripts/check-dispatcher-error-vocabulary.mjs --report says only two are "awaiting a ledger entry". Those are two different predicates over one tree, and the surviving commit acted on fourteen. The dispatch requires both readings re-run on today's origin/main (c930f8597) with the command output quoted, and an explicit answer to why they differ and which one the diff is right to act on — with the instruction that if the honest answer is two, the diff shrinks. Registering twelve codes that need no registering would widen the published face on a wrong count, which is the failure this dispatch most wants avoided.

⚠️ The branch is 59+ commits behind origin/main and packages/spec moved across that range, so the original measurement is stale on its face.

Container & model: re-dispatched explicitly at claude-fable-5-1 (CONTRACT_REVIEW_TIER). Quoted from this dispatch's own run of node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/spec/src/api/error-code-ledger.zod.ts packages/spec/src/api/error-code-ledger.test.ts packages/runtime/src/dispatcher-error-vocabulary.ts:

Clause ② SUSPECT surface — a hint, not a verdict: judge the tier from the card CONTENT as best you can (a card changing contract accept/reject behaviour or widening the public surface is claude-fable-5-1); whichever tier is dispatched, the PR's actual diff passes the clause-② enqueue gate before the card may enqueue.

• packages/spec/src/api/error-code-ledger.zod.ts ⇢ 'packages/spec/src/**' — the contract surface (error-code ledger, *.zod.ts contract schemas) — the normal landing zone of a clause-② card

Card content widens the published error-code ledger ⇒ 强制条款② ⇒ the contract-review tier, dispatched at tier rather than downgraded.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 16649,
  "status": "done",
  "branch": "claude/issue-16649-register-remaining-boot-refusal-codes",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16879",
  "premise_still_valid": true,
  "summary": "Resumed the predecessor's worktree (one commit 3acd66b3f, clean). The count is settled at fourteen, on origin/main c930f8597 with the checker's own predicate: `--report` (exit 0) derives 66 unregistered sites and lists the fourteen `boot-refusal` sites among them (a site is derived only for a code the registered vocabulary lacks), while its `2 awaiting a ledger entry` line counts only the `pending-registration` verdict — the two are subsets of the same unregistered population under different verdict labels; each of the fourteen has 0 quoted-row hits in the ledger and 0 in StandardErrorCode (controls 2/1/2), and each is present by word-boundary grep in its stamping package's built dist/index.js (positive control 1, negatives 0). So the predecessor's diff acts on the right count and was not shrunk. Merged origin/main (merge commit b3269d5ce, clean, lockfile unmoved), rebuilt spec and the packages main moved under the lock, then ran the derived 78-command gate set plus the roster gates in my paths: two real reds were fixed in a second commit 6738c993e — `check:generated --fix` regenerated the one stale artifact (content/docs/references/api/{contract,error-code-ledger}.mdx: the ErrorCode union +14) and the doc-authoring prose-id baseline shrank by the two ids (#3724 x1, #8035 x6) whose only carriers were the deleted vocabulary rows. Draft PR #16879 opened with `Part of #16649` (not `Fixes`, deliberately — see open_questions), `Clause-②: yes` on its own line, `needs:contract-review` attached via the additive REST endpoint and read back. Two things the PM should know: (1) the claim's file surface said the vocabulary is read, not written, yet the predecessor's commit rewrote it (-309 lines) — this is the gate-forced minimum, not a choice: registering a code removes its site from the scan, so its `boot-refusal` row reds as `stale-row`; the resumption dispatch's tier command already named that file, so I kept the write and explain it here rather than stopping. (2) The card's second bullet (widen the gate's `packages/spec/src/` refusal to every published package and retire the `boot-refusal` verdict; triage items 3/4/5) is NOT in this PR: it is a third file surface outside the claim, and applied verbatim it reds the two `pending-registration` rows the triage's item 2 puts out of scope, so it carries an unsettled contract-shape sub-decision. The commit messages carry no card-relation trailer (RULE 2 extractor: `[]` for all three). Dispatch said main moved 59+ commits; measured 9 (`rev-list ce8bfc9d6..c930f8597`), no effect on the work.",
  "tests": "Tree 6738c993e (origin/main c930f8597 merged). Under scripts/pm/os-verify-lock.sh (OS_VERIFY_LOCK_SLOT=issue-16649): `pnpm --filter @objectstack/spec build` → `VERDICT command-exit 0 · held the lock 145s`; `pnpm --workspace-concurrency=2 --filter '[ce8bfc9d6]' build` (packages main moved; the root package was in the set so its script ran turbo over the tree) → `VERDICT command-exit 0 · held the lock 389s`; stage 1 `pnpm --filter @objectstack/spec test` → `spec-test-exit=0` (Test Files 465 passed, Tests 12967 passed, 384.9s) and `pnpm --filter @objectstack/spec typecheck` → `spec-typecheck-exit=0` (tsc + scripts + check:test-typecheck compiling the test layer under tsconfig.test.json, where the ledger test lives; tsconfig.json excludes **/*.test.ts) → wrapper `VERDICT batch-last-exit 0 · held the lock 441s` (the batch ends in the conjunction of its parts, so last-exit covers both); stage 2 `runtime-typecheck-exit=0 runtime-targeted-exit=0 rest-targeted-exit=0 sdui-targeted-exit=0` — runtime tests importing the vocabulary (error-envelope.conformance, package-door-error-parity, http-dispatcher.error-leak, domains/actions-validation-envelope: 4 files/70 tests), rest (meta-object-owd-gate, package-door-declared-code: 2/47), sdui-parser (dashboard-widget-options: 1/21) → wrapper `VERDICT batch-last-exit 0 · held the lock 52s`. Gate set from `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (78 commands; change set = the 4 committed paths vs merge base c930f8597): 74 exit 0 on the first pass at b3269d5ce; `pnpm check:dispatcher-error-vocabulary` exit 0 — `51 unregistered code-stamping site(s), all classified; 2 awaiting a ledger entry`; `check:doc-authoring` exit 1 → baseline shrink → exit 0; spec `check:docs` exit 1 → `check:generated --fix` (1 of 15 stale) → committed; `check:dual-build-cjs-loads` exit 3 (PREREQUISITE NOT MET, no dist for 37 packages) → after the tree build exit 0 (`104 published require entry point(s) across 67 package(s) load`); `check:type-check-debt` NOT MEASURED — exit 3 twice, tsc --re-measure out of heap under a 4 GB override and under the gate's own pinned 6 GB (whole-tree family, CI runs it). Roster gates in my paths' directories (check-changeset-fixed, spec check:meta-url-spelling, check:spec-changes, check:authz-resolver, check:filter-alias-parity, check:partof-closing-keyword, check:error-status-conformance) exit 0 each. Ratchet re-run on the final head 6738c993e: check:generated 0 (`All 15 generated artifacts are up to date`), check:dispatcher-error-vocabulary 0, check:nul-bytes 0, check:doc-authoring 0, check-changeset-fixed 0, check:error-code-casing 0, spec check:api-surface 0; standalone spec check:docs reds on a stale gitignored json-schema/ tree (its mtime moved by the ablation's restore) and is green inside check:generated which regenerates that tree first — standalone rerun after `pnpm --filter @objectstack/spec gen:schema` exit 0 (`228 generated files in sync with packages/spec`, tree unchanged). RULE 2 via the gate's commitRelations extractor: `[]` for 3acd66b3f, b3269d5ce, 6738c993e. Ablation from the committed state (subject resolves through src: the test imports ./error-code-ledger.zod, no dist in the loop; restore under `trap … EXIT INT TERM` as `git checkout HEAD -- ABSOLUTE_PATH`): HEAD blob a6912719a2cf3e6fc2c6cf80d44c95c3cb26f6ba; deleted the row `'WALLED_MEMBERSHIP_POLICY_UNDECLARED',` — anchor count 1 → 0 on disk, mutated blob 809dde9477… differs from HEAD; mutated `check:dispatcher-error-vocabulary` exit 1 `[unclassified-site] packages/plugins/organizations/src/membership-policy-gate.ts stamps unregistered code 'WALLED_MEMBERSHIP_POLICY_UNDECLARED' (classconst) and … does not classify it`; mutated ledger pin test (under the lock) exit 1 `× accepts the #16649 batch …` (1 failed | 19 passed); restore → `git diff HEAD --stat` empty, `git status --porcelain` empty, restored blob equals HEAD blob, anchor count 1; restored controls gate exit 0, pin test exit 0 (20/20). Ledger-membership readings on origin/main: 0 quoted-row hits for each of the fourteen (controls UNIQUE_VIOLATION 2, PLUGIN_REGISTER_FAILED 1), 0 StandardErrorCode hits (control PERMISSION_DENIED 2); dist word-boundary grep hits core 1·2·1·1·1·1·1·1·3, runtime 1, objectql 1, driver-memory 1, driver-mongodb 1, organizations 1 (positive control UNIQUE_VIOLATION 1; negatives bare MULTI_TENANT_UNSUPPORTED 0, OVERLAY_PERSISTENCE_FAILED 0). PR body read back: byte-equal to what was sent modulo one trailing newline; footer, `Part of #16649` and `Clause-②: yes` present; labels read back ['documentation','needs:contract-review','size/l','tests','tooling'].",
  "mcp_calls": "0 — every GitHub read and write went through repo-scoped REST (curl) and git; no MCP GitHub call was made",
  "open_questions": [
    {
      "question": "The dispatch asked for `Fixes #16649` in the PR body; the PR says `Part of #16649` because the card's second bullet (widen the gate's spec-face refusal to every published package's src/ and retire the `boot-refusal` verdict — triage items 3/4/5) is not in this PR. Which relation should the body carry?",
      "options": [
        "A — keep `Part of #16649`; the ledger half merges, the card stays open, and the gate-widening half is filed as a sub-issue of #16649 (enters the dispatch pool) or continued under this claim on a fresh branch.",
        "B — flip the body to `Fixes #16649` and file the gate-widening half as a separate card before merge, so the card closes on the ledger half alone.",
        "C — have this claim add the gate widening to this PR (third file surface: scripts/check-dispatcher-error-vocabulary.mjs plus the vocabulary's CodeVerdict type), which first needs the sub-decision below."
      ],
      "recommendation": "A, because the card's own Scope lists the widening as a bullet of THIS card and the triage's acceptance items 3/4/5 are written against it; closing the card on half would hide the half the triage called the class's real closure (\"守了一部分\" reads the same as \"守住了\"). The body already states what stays open, so the PM can flip the keyword with one edit if B is preferred."
    },
    {
      "question": "For the gate-widening half: today the spec-face rule refuses every verdict but foreign-vocabulary / runtime-pinned under packages/spec/src/, i.e. it refuses `pending-registration` too. Widened verbatim to every published package, it reds the two `pending-registration` rows (AMBIGUOUS_METADATA_STEM under packages/metadata, owd_widening_forbidden under packages/plugins/plugin-security) that the triage's item 2 puts out of this card's scope. What should the widened rule do with `pending-registration` outside spec?",
      "options": [
        "A — widened rule refuses only the retired `boot-refusal` verdict everywhere (delete it from CodeVerdict and the gate's accepted set) and keeps `pending-registration` allowed outside packages/spec/src/ until #8846 lands; the spec-only prefix stays as-is for the stricter spec face.",
        "B — widened rule applies the spec-face set (foreign-vocabulary / runtime-pinned only) to every published package's src/, and the two pending rows are registered or re-verdicted in the same PR (contradicts triage item 2 and pulls #9460's rename question in).",
        "C — widened rule applies the spec-face set to every published package but carries a shrink-only allowlist naming the two pending rows until #8846 / #9460 resolve them."
      ],
      "recommendation": "A, because it retires the verdict the card names without re-litigating #8846's batch or #9460's rename-or-keep call, and the two remaining rows keep their existing ratchet (`now-registered` reds them the moment they are registered). C is the fallback if the PM wants the published-face rule spelled uniformly now."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: `pnpm check:type-check-debt` (--re-measure) ran out of heap on this container twice, under a 4 GB override and under the gate's own pinned 6 GB, exiting 3 (PREREQUISITE NOT MET, nothing measured); a whole-tree family CI owns, not a defect in the tree. 承接者：无（CI）.",
    "noted, not filed: the claim template's \"reads dispatcher-error-vocabulary.ts, does not write it\" cannot hold for any registration PR — the gate's stale-row rule makes the vocabulary write the mechanical consequence of a ledger write (registration removes the site from the scan, the row that classified it reds). Process note for the PM's file-surface line on this class. 承接者：PM.",
    "noted, not filed: standalone spec `check:docs` reds with \"json-schema is older than src\" whenever a src file's mtime moves after the last gen:schema (here: the ablation's restore); `check:generated` regenerates that gitignored tree first and is the authoritative reading. Documented behaviour (#4711/#4723), not a defect. 承接者：无.",
    "noted, not filed: the resumption dispatch said origin/main moved 59+ commits since the branch started; measured `git rev-list --count ce8bfc9d6..c930f8597` = 9. No effect on the work; a count in the dispatch, not the tree. 承接者：PM."
  ]
}

Container & model: M, mode:cloud (resumption), model: claude-fable-5-1 (CONTRACT_REVIEW_TIER, passed explicitly on this dispatch). dispatch-gates --tier for this dispatch printed a "Clause ② SUSPECT surface" block naming packages/spec/src/api/error-code-ledger.zod.ts and …error-code-ledger.test.ts under packages/spec/src/** — *"the contract surface (error-code ledger, .zod.ts contract schemas) — the normal landing zone of a clause-② card", plus "whichever tier is dispatched, the PR's actual diff passes the clause-② enqueue gate before the card may enqueue." Card content widens the published error-code ledger ⇒ 强制条款② ⇒ fable.

---

Generated by Claude Code

[os-zhuang]

Contract review PASS-conditional → landed; the second half's shape ruled (director seat, decision batch #95, 2026-09-08 14:1xZ)

• PR: feat(spec): register the fourteen remaining door:'none' error codes that ship in dist #16879 @ 6738c993e (Part of, the ledger half) — review feat(spec): register the fourteen remaining door:'none' error codes that ship in dist #16879 (comment) (claude-fable-5-1, isolated seat). Fourteen rows measured under their stamping packages (dist NOT MEASURED locally, src proxy + index-graph reachability), vocabulary removal forced by stale-row and reproduced by ablation, the two pending-registration rows untouched, [finding] MONGODB_MULTI_TENANT_UNSUPPORTED may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope #8035 reversal recorded in four places, spec-only minor right in effect (one fixed group). CI 42/42 success or skipped; the only unstable signal is a never-updated Vercel status. Non-governed.
• Handoff by label: needs:contract-review off the PR (already) and now off this card; PR is ready; auto-merge (squash) armed. Card stays open and pm:dispatched for the second half.

Ruling on the second half (reviewer finding 9; provenance: standing delegation 「继续决策」, reversible by the maintainer): widen SPEC_SOURCE_FACE in scripts/check-dispatcher-error-vocabulary.mjs to every published package's src/ and retire the boot-refusal verdict, with the widened rule refusing exactly the verdicts the spec face refuses today except pending-registration, which keeps an allowance outside packages/spec/src/ until #8846 lands (so AMBIGUOUS_METADATA_STEM under packages/metadata and owd_widening_forbidden under plugin-security do not red on a card that is not theirs). The allowance must be a named, dated exception in the gate's header pointing at #8846, not a silent carve-out. Same claim, same seat, one follow-up PR on this card with Fixes #16649; the gate script is inside the file surface for that PR. ⛔ Not ruled: the two pending rows' own dispositions (#8846 / #9460).

Reviewed-by: director seat (contract review tier claude-fable-5-1)
Implemented-by: domain:spec seat (zhuangjianguo, session session_016N6xmWt5hYm94ffVEwGH8x)

---

Generated by Claude Code