feat(spec,rest): register READ_BACK_FAILED as a named wire row mapped in handleApprovalError - #13296

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/plugin-approvals, @objectstack/rest, @objectstack/spec, touching 2 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/rest/src/rest-server.ts, packages/spec/src/contracts/approval-service.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via ERROR_CODE_LEDGER (symbol))
• content/docs/api/error-catalog.mdx (via ERROR_CODE_LEDGER (symbol))
• content/docs/api/error-handling-server.mdx (via ERROR_CODE_LEDGER (symbol))
• content/docs/kernel/contracts/data-engine.mdx (via ERROR_CODE_LEDGER (symbol))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx (via ERROR_CODE_LEDGER (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 224fb0f5fbeca161c7dc5bac44c93617c8fd2d71 && git checkout 224fb0f5fbeca161c7dc5bac44c93617c8fd2d71
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 426ad5890e72a128d7fb0e63bfe9ea6cfed0dcbd 5a16c9e104da2b61f1f0c19af2f816271d0957b5 && git checkout -B drift-repro 426ad5890e72a128d7fb0e63bfe9ea6cfed0dcbd && git merge --no-ff 5a16c9e104da2b61f1f0c19af2f816271d0957b5

node scripts/docs-audit/affected-docs.mjs --json 426ad5890e72a128d7fb0e63bfe9ea6cfed0dcbd

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 426ad5890e72a128d7fb0e63bfe9ea6cfed0dcbd → pass the list as
args.docs, on the commit named under Which tree this was computed on.

os-dev-report (patch round)

Patch round on PR #13296 per PM dispatch (main's #13181 landed as b579b038). Two items only, both done.

1) merge main
git merge origin/main --no-edit from branch head 21f8c61a onto origin/main at 289cf91c (which includes b579b038 #13181). Clean merge, zero conflicts (git status empty after merge, nothing to resolve). Merge commit 5d2d08ec.

2) trim the (#12769) tracker-id suffix

• Before merge: grep -n '(#12769)' packages/plugins/plugin-approvals/src/approval-service.ts — 0 hits (the suffix lives on origin/main, brought in by the merge, not on the pre-merge PR branch).
• After merge: same grep — 1 hit, line 4783 (the readBackRequest refusal text). A second, unrelated occurrence at line 4761 is a JSDoc reference in [#12769] bracket form (not the trailing-parens suffix this task targets) — left untouched per "只摘这个尾缀,文案其余部分不动".
• Edit: dropped (#12769) from the end of the thrown READ_BACK_FAILED: message. Substance unchanged.
• After trim: same grep — 0 hits.
• Confirms alignment with this PR's own fixture: packages/rest/src/rest-approvals-wire-codes.test.ts already mocks the read-back message without the suffix (verified by grep before editing), so the trim brings approval-service.ts in sync with what feat(spec,rest): register READ_BACK_FAILED as a named wire row mapped in handleApprovalError #13296's own pin test expected all along.

3) reverify

• Build: pnpm --filter @objectstack/plugin-approvals... build — full dependency closure, green (os-verify-lock VERDICT command-exit 0).
• Tests: pnpm --filter @objectstack/plugin-approvals exec vitest run --maxWorkers=2 — 34 files / 632 tests, all passed. Targeted rerun of approval-service.test.ts alone (verbose reporter): 298/298 passed, including all sys_approval_delegation, quorum, decision_progress and status-mirror suites. (The ERROR-level log lines in the run are expected fault-injection noise from unrelated driver tests, not failures.)
• Gates derived via node scripts/pm/dispatch-gates.mjs for the file actually edited (approval-service.ts): check:nul-bytes, check:keyed-text-bounds, check:dispatcher-error-vocabulary, check:comment-mask-adoption, check:plugin-teardown-shape, check:undeclared-dep-imports, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check:where-matcher, check:spec-parsed-alias, check:i18n-stale-fill — all green (each printed its own PASS marker, joined with &&/checked individually after the tool's pipefail warning on a ;-joined batch).
• check:i18n — NOT MEASURED: it needs the CLI + a 9-package build closure it doesn't otherwise need. Confirmed not applicable to this edit before skipping the build: the trimmed string is a raw throw new Error(...) inside a service method, not present in any *.object.ts metadata declaration or in packages/plugins/plugin-approvals/src/translations/, and the plugin's i18n-extract.config.ts runs --objects-only extraction, which cannot see this string.

Head sha: 5a16c9e104da2b61f1f0c19af2f816271d0957b5 (pushed, no force). Draft state and needs:contract-review label untouched, as instructed.

Generated by Claude Code