@@ -0,0 +1,27 @@
+---
+'@objectstack/rest': patch
+---
+
+fix(rest): twenty more REST write routes answer a sandboxed hook's refusal in the hook's own words (#22719)
+
+Clause-②: no
+
+**What was wrong.** When a sandboxed hook refuses a write (`throw new Error('Locked rows cannot be changed here.')`), the error that reaches the route carries the QuickJS debug wrapper on `.message` (`hook 'guard' threw: Error: …`) and the sentence on `.innerMessage`. Twenty write routes built their error answer by hand from `.message`, so they shipped the wrapper, while the other write doors answer the sentence. Sixteen of them also answered the refusal as a server fault (`500`).
+
+**What changes on the wire, for a sandboxed hook's refusal.**
+
+| routes | before | after |
+| --- | --- | --- |
+| `POST /sharing/rules`, `DELETE /sharing/rules/:idOrName`, `POST /sharing/rules/:idOrName/evaluate` | `500 RULE_*_FAILED`, flat `{ code, error }`, the wrapper | `400 VALIDATION_ERROR`, nested `{ success: false, error: { code, message } }`, the sentence |
+| `POST /security/suggested-bindings/:id/confirm` and `/dismiss`, `POST /security/permission-sets/:id/discard-overlay` | `500 SUGGESTION_*_FAILED` / `500 INTERNAL`, the wrapper | `400 VALIDATION_ERROR`, same nested `{ error: { code, message } }` shape, the sentence |
+| the nine `POST /approvals/requests/:id/*` writes (`approve`, `reject`, `recall`, `revise`, `resubmit`, `reassign`, `remind`, `request-info`, `comment`) | `500 APPROVAL_*_FAILED`, flat `{ code, error }`, the wrapper | `400 VALIDATION_ERROR`, nested, the sentence |
+| `POST /packages/publish` | `500 INTERNAL_ERROR`, the wrapper | `400 VALIDATION_ERROR`, the sentence |
+| `POST /datasources/:name/external/tables/:remote/draft` and `/import`, `/external/refresh-catalog`, `/external/validate` | `400 EXTERNAL_DATASOURCE_ERROR` / `400 EXTERNAL_IMPORT_ERROR`, the wrapper | the same status and code, the sentence |
+
+A refusal that declares its own `code` keeps it (an unregistered spelling rides `declaredCode`), a refusal that declares its own `status` is answered at that status, and a `userMessage` the hook set rides the answer, as on every other write door.
+
+**Also moved, on the sharing-rule, suggested-binding and approval routes.** These routes now ask the same classification as the `/data` door before their `500` arm. So a refusal from the service that declares its own `status` (or `statusCode`) and `code`, and that no route-specific arm reads, is answered at that status, in the nested envelope, instead of `500` with the route's own code. The external-datasource routes keep answering every refusal at `400` with their own code, and `POST /packages/publish` already answered a declared status.
+
+**Unchanged.** A plain fault keeps each route's own `500` answer and code. The route-specific refusals (`VALIDATION_FAILED`, `PERMISSION_DENIED`, `RULE_NOT_FOUND`, `SHARING_NOT_ENABLED`, the approval prefixes, the typed security errors) answer exactly as before.
+
+**Upgrading.** A client that reads both envelopes, as `@objectstack/client` does, needs no change. A client of the sharing-rule or approval routes that reads a string `body.error` reads `body.error.message` for these answers.
@@ -71,6 +71,7 @@ import {
 } from '@objectstack/types';
 import type { DroppedFieldsEvent } from '@objectstack/spec/data';
 import type { ErrorCode } from '@objectstack/spec/api';
+import { standardErrorCodeForHttpStatus } from '@objectstack/spec/api';
 import { logError } from './log.js';
 
 export {
@@ -677,6 +678,61 @@ export function classifiedRefusalAnswer(
     return resolved.status < 500 ? resolved : undefined;
 }
 
+/**
+ * [#22719] {@link classifiedRefusalAnswer}'s answer, re-dressed for a door that
+ * publishes the NESTED ADR-0112 D5 envelope (`{ error: { code, message } }`)
+ * rather than the flat one the classification is phrased in.
+ *
+ * ## Why it exists
+ *
+ * Three hand-built route families in `rest-server.ts` — the sharing-rule, the
+ * suggested-binding / overlay-discard and the approval arms — answered a
+ * refusal their own arms could not read as a server fault, relaying
+ * `.message`. For a sandboxed hook's refusal `.message` is the QuickJS debug
+ * wrapper, so each answered `500` with `hook '<name>' threw: Error: …` where
+ * every conforming write door answers the hook's own sentence
+ * (`rest-write-route-hook-refusal-sentence.ledger.test.ts`). Each family now
+ * asks {@link classifiedRefusalAnswer} — the `/data` door's classification —
+ * before that 500, and emits this through its OWN emitter, so the answer's
+ * position is the family's and its classification is the shared one.
+ *
+ * ## The derivation is the record-share family's
+ *
+ * `respondSharingError` in `rest-server.ts` re-dresses the same answer inline,
+ * and its comments carry the argument for each field; they are not restated:
+ *
+ *  - `code` is REQUIRED by the nested envelope and the flat classification
+ *    legitimately carries none for an undeclared sandbox refusal, so the
+ *    catalog's own floor ({@link standardErrorCodeForHttpStatus}) fills it;
+ *  - `declaredCode` is the CLASSIFICATION's, never the raw thrown field,
+ *    because presence there means demotion;
+ *  - `userMessage` is the classification's, already bounded.
+ *
+ * ⛔ Nothing else rides. The flat body's `issues` and `object` are not
+ * forwarded, the scope that family keeps: `ApiError.details` is a shape
+ * decision, not a rename. `extra` is absent when there is nothing to carry,
+ * so an emitter writes exactly `{ code, message }` for a refusal that declared
+ * nothing.
+ */
+export function nestedRefusalEnvelope(refusal: { status: number; body: Record<string, unknown> }): {
+    status: number;
+    code: ErrorCode;
+    message: string;
+    extra?: { declaredCode?: string; userMessage?: string };
+} {
+    const { status, body } = refusal;
+    const extra = {
+        ...(typeof body.declaredCode === 'string' ? { declaredCode: body.declaredCode } : {}),
+        ...(typeof body.userMessage === 'string' ? { userMessage: body.userMessage } : {}),
+    };
+    return {
+        status,
+        code: typeof body.code === 'string' ? body.code as ErrorCode : standardErrorCodeForHttpStatus(status),
+        message: String(body.error ?? ''),
+        ...(Object.keys(extra).length > 0 ? { extra } : {}),
+    };
+}
+
 /**
  * Whether a mapped data-error status represents an *expected* client/lifecycle
  * outcome (and therefore shouldn't be logged as "[REST] Unhandled error").
 
@@ -16,7 +16,8 @@ import type {
   SchemaValidationReport,
 } from '@objectstack/spec/contracts';
 // The declared envelope is written in ONE place for the whole platform (#3973).
-import { sendOk, sendError } from '@objectstack/types';
+// [#22719] …and so is the read of a sandboxed hook's refusal sentence.
+import { sendOk, sendError, sandboxBusinessMessage } from '@objectstack/types';
 import { mountDirectRoutes, type DirectMountedRoute } from './direct-mount.js';
 
 /**
@@ -382,14 +383,36 @@ export function registerExternalDatasourceRoutes(
   const unavailable = (res: any) =>
     sendError(res, 503, 'SERVICE_UNAVAILABLE', 'The external-datasource service is not available.');
 
+  /**
+   * [#22719] The sentence both catch arms hand the caller: a sandboxed hook's
+   * own words when the refusal came from one, the thrown message otherwise.
+   *
+   * A hook refusing a write the service makes arrives as a `SandboxError`
+   * whose `.message` is the QuickJS debug wrapper and whose `.innerMessage` is
+   * the sentence, so `draft`, `import`, `refresh-catalog` and `validate`
+   * answered `hook '<name>' threw: Error: …` where every conforming write door
+   * answers the hook's own sentence. {@link sandboxBusinessMessage} is that
+   * read, shared rather than re-derived — ⛔ never a strip of the wrapper off
+   * `.message`. It answers `undefined` for anything that is not a sandboxed
+   * refusal, so every other message here is byte-identical.
+   *
+   * ⛔ Only the SENTENCE moves. Both arms keep their status and their code:
+   * `EXTERNAL_IMPORT_ERROR` is what the import route answers for a refusal it
+   * relays from the metadata door (a declared `409 DESTRUCTIVE_CHANGE`
+   * included, which the import dogfood pins at `400`), so this family's status
+   * is its own decision and the shared classification is not asked here.
+   */
+  const refusalSentence = (err: unknown): string =>
+    sandboxBusinessMessage(err) ?? (err instanceof Error ? err.message : String(err));
+
   /**
    * A refusal from the external-datasource service — same code as the
    * admin-routes path (#4249). Named after the service, not one operation:
    * since #4264 every route here except the import (which has its own
    * registered code) answers its catch with this.
    */
   const refused = (res: any, err: unknown) =>
-    sendError(res, 400, 'EXTERNAL_DATASOURCE_ERROR', err instanceof Error ? err.message : String(err));
+    sendError(res, 400, 'EXTERNAL_DATASOURCE_ERROR', refusalSentence(err));
 
   /**
    * ONE declaration of this registrar's surface (#5822): the array below is
@@ -466,12 +489,7 @@ export function registerExternalDatasourceRoutes(
           );
           sendOk(res, { object: result }, 201);
         } catch (err) {
-          sendError(
-            res,
-            400,
-            'EXTERNAL_IMPORT_ERROR',
-            err instanceof Error ? err.message : String(err),
-          );
+          sendError(res, 400, 'EXTERNAL_IMPORT_ERROR', refusalSentence(err));
         }
       },
     },
 
@@ -14,8 +14,10 @@ import {
   resolveThrownHttpError,
   demotedDeclaredCode,
   looksLikeInternalErrorLeak,
+  sandboxBusinessMessage,
   INTERNAL_ERROR_MESSAGE,
 } from '@objectstack/types';
+import { classifiedRefusalAnswer } from './error-response.js';
 import { mountDirectRoutes, type DirectMountedRoute } from './direct-mount.js';
 
 /**
@@ -175,13 +177,39 @@ async function refusePackageRequest(
  * client-facing messages at all — which is a separate card. Pinned on the
  * publish route in `package-door-5xx-message-sanitization.test.ts` so it goes
  * red the day either lands.
+ *
+ * ## [#22719] …and a sandboxed hook's refusal answers in the hook's words
+ *
+ * A hook body refusing a write `packageService.publish` makes (`throw new
+ * Error('…')`) arrives as a `SandboxError` whose `.message` is the QuickJS
+ * debug wrapper and whose `.innerMessage` is the sentence. This door read
+ * neither: it declared no status, so it fell to the 500 above, and its message
+ * was the wrapper — `500 INTERNAL_ERROR` with `hook '<name>' threw: Error: …`,
+ * where every conforming write door answers `400` with the hook's own
+ * sentence. Two shared reads now close it, and nothing else moves:
+ *
+ *  - the STATUS the door falls back to is the `/data` door's classification
+ *    ({@link classifiedRefusalAnswer}) when it has one. It answers only a
+ *    refusal that declared an envelope — whose own status outranks any
+ *    fallback here anyway — or a sandboxed refusal, so an undeclared sandbox
+ *    refusal takes its `400` and every other undeclared throw keeps the `500`;
+ *  - the SENTENCE is {@link sandboxBusinessMessage}, the read every
+ *    conforming door makes, so a refusal that declared its own status keeps it
+ *    and loses only the wrapper. The leak predicate still reads the RAW
+ *    message, the input it was calibrated on.
+ *
+ * `code`, `declaredCode`, `userMessage` and `details` stay this door's own
+ * mapping, which is why the classification's body is not re-dressed here the
+ * way the hand-built families in `rest-server.ts` re-dress it: their 500 arm
+ * read nothing, this door already reads everything but the sandbox.
  */
 function sendThrownError(res: any, error: unknown): void {
-  const thrown = resolveThrownHttpError(error);
-  // The dispatcher twin's expression, byte for byte — one rule, two doors.
+  const thrown = resolveThrownHttpError(error, classifiedRefusalAnswer(error)?.status ?? 500);
+  // The dispatcher twin's withhold, byte for byte — one rule, two doors. Its
+  // other limb is the shared sandbox read (#22719), not the raw message.
   const message = thrown.status >= 500 && looksLikeInternalErrorLeak(thrown.message)
     ? INTERNAL_ERROR_MESSAGE
-    : thrown.message;
+    : sandboxBusinessMessage(error) ?? thrown.message;
   // [#12405] The producer's OWN spelling, when the closed vocabulary did not
   // admit it — the same demote the dispatcher twin serving this very path has
   // emitted since #9106 (`errorFromThrown` in
 
@@ -413,6 +413,7 @@ import {
     mapDataError,
     sandboxBusinessMessage,
     classifiedRefusalAnswer,
+    nestedRefusalEnvelope,
     boundedDeclaredUserMessage,
     boundedDeclaredRefusalMessage,
     declaredHttpStatus,
@@ -12095,6 +12096,26 @@ export class RestServer {
                     msg.replace(/^SHARING_NOT_ENABLED:\s*/, ''),
                 );
             }
+            // [#22719] A refusal none of the prefix arms above can read is asked
+            // of the `/data` door's own classification before the 500 below
+            // relays `.message`. For a sandboxed hook's refusal `.message` is
+            // the QuickJS debug wrapper, so `POST /rules`, `DELETE
+            // /rules/:idOrName` and `POST .../evaluate` answered `500` with
+            // `hook '<name>' threw: Error: …` where every conforming write door
+            // answers the hook's own sentence. A refusal that DECLARED its
+            // envelope (`status`/`statusCode` + `code`) is answered at its own
+            // status too, as on every door that asks this.
+            //
+            // AFTER the prefix arms, deliberately: each of them answers a 4xx
+            // this family already publishes, and none can read a sandbox error
+            // (its `.message` opens with the wrapper, never a prefix), so asking
+            // here moves only what used to reach the 500. Emitted in the nested
+            // envelope like `SHARING_NOT_ENABLED` above, for that arm's reason.
+            const refusal = classifiedRefusalAnswer(err);
+            if (refusal) {
+                const nested = nestedRefusalEnvelope(refusal);
+                return sendEnvelopeError(res, nested.status, nested.code, nested.message, nested.extra);
+            }
             logError(`[REST] sharing-rule ${defaultCode}:`, err);
             return res.status(500).json({ code: defaultCode, error: msg.slice(0, 500) });
         };
@@ -12269,8 +12290,13 @@ export class RestServer {
          * `query-multiplicity.ts`; that helper is shared with the whole file
          * and stays the reference point rather than being re-implemented here.
          */
-        const respondError = (res: any, status: number, code: string, message: string) =>
-            res.status(status).json({ error: { code, message } });
+        // [#22719] `extra` carries the declared channels of a classified refusal
+        // (`declaredCode`, `userMessage`) inside the same `error` object; every
+        // other arm passes none and writes exactly `{ code, message }`.
+        const respondError = (
+            res: any, status: number, code: string, message: string,
+            extra?: { declaredCode?: string; userMessage?: string },
+        ) => res.status(status).json({ error: { code, message, ...extra } });
         const respond501 = (res: any) => respondError(
             res, 501, 'NOT_IMPLEMENTED', 'Security service is not configured on this deployment',
         );
@@ -12283,6 +12309,20 @@ export class RestServer {
                 // unchanged — only the position of the code moves.
                 return respondError(res, status, err?.code ?? defaultCode, String(err?.message ?? err));
             }
+            // [#22719] A refusal the typed arm cannot read is asked of the
+            // `/data` door's own classification before the 500 below relays
+            // `.message`. A sandboxed hook's refusal carries no `statusCode`
+            // (the sandbox lifts `status` only), so `confirm`, `dismiss` and
+            // `discard-overlay` answered `500` with the QuickJS debug wrapper
+            // where every conforming write door answers the hook's own
+            // sentence; a refusal declaring `status` + `code` is answered at
+            // its own status too. The typed arm above is untouched, and the
+            // answer leaves through this family's one emitter.
+            const refusal = classifiedRefusalAnswer(err);
+            if (refusal) {
+                const nested = nestedRefusalEnvelope(refusal);
+                return respondError(res, nested.status, nested.code, nested.message, nested.extra);
+            }
             logError(`[REST] suggested-bindings ${defaultCode}:`, err);
             // The 500 arm keeps its 500-char cap: an unexpected fault's message
             // is not a contract, and truncating it stays a sanitization step.
@@ -12513,6 +12553,27 @@ export class RestServer {
                     return true;
                 }
             }
+            // [#22719] A refusal no prefix above matches is asked of the `/data`
+            // door's own classification before the caller's outer 500 relays
+            // `.message`. For a sandboxed hook's refusal `.message` is the
+            // QuickJS debug wrapper, so all nine write routes here answered
+            // `500 APPROVAL_*_FAILED` with `hook '<name>' threw: Error: …` where
+            // every conforming write door answers the hook's own sentence; a
+            // refusal declaring `status`/`statusCode` + `code` is answered at
+            // its own status too.
+            //
+            // AFTER the mapping, deliberately: every row above answers a code
+            // this family publishes, and none can read a sandbox error (its
+            // `.message` opens with the wrapper), so asking here moves only what
+            // used to reach the 500. Nested envelope, for the reason the
+            // sharing-rule family's `SHARING_NOT_ENABLED` arm gives: a new arm
+            // does not copy the flat `{ code, error }` dialect.
+            const refusal = classifiedRefusalAnswer(err);
+            if (refusal) {
+                const nested = nestedRefusalEnvelope(refusal);
+                sendEnvelopeError(res, nested.status, nested.code, nested.message, nested.extra);
+                return true;
+            }
             return false;
         };