[objectstack-fleet]

Requested by Elon · project thread
Fixes #27672

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：钩子用自由文本中止写入且没声明错误码时，包发布与 runtime /actions 两类门现在也答 HOOK_ABORTED，与 /api/v1/data 一致，不再答 VALIDATION_ERROR。
• 为什么改：error codes: an undeclared hook onError abort answers the data door with a code-less 400; give it a ledgered ADR-0112 code (#27508 code half) #27597 只让 /data 答 HOOK_ABORTED，其它从 resolveThrownHttpError 取码的门仍按 400 推导，客户端按码分支时得先知道是哪个门。
• 风险与回滚：只换这一种中止的码（状态、文案不变）；声明了码的照旧，崩溃仍是 500。回滚即 revert 本 PR。
• 先看：packages/types/src/thrown-http-error.ts（undeclaredHookAbort 一段）、packages/types/src/data-error-classification.ts（搬出 sandboxBusinessMessage）、packages/runtime/src/domains/actions-undeclared-hook-abort-code.test.ts。
• 两分钟验证：pnpm --filter @objectstack/runtime exec vitest run src/domains/actions-undeclared-hook-abort-code.test.ts，预期 7 个全绿。
• 需要你做的：无，席位落地。

What changes

• resolveThrownHttpError (@objectstack/types) now answers UNDECLARED_HOOK_REFUSAL_CODE (HOOK_ABORTED) for a sandboxed body's refusal that declared no code, at a 4xx status. It is the one constant /api/v1/data has read since error codes: an undeclared hook onError abort answers the data door with a code-less 400; give it a ledgered ADR-0112 code (#27508 code half) #27597, now declared beside the resolver; sandboxRefusalCodeFields reads the same constant.
• So the doors that take their code from the resolver answer the same code as /data: POST /api/v1/packages/publish (@objectstack/rest, sendThrownError) and the runtime /actions doors (errorFromThrown). No route source changes; both already call the resolver.
• sandboxBusinessMessage (with its private isScriptFaultMessage) moved verbatim to packages/types/src/sandbox-business-message.ts: data-error-classification.ts imports thrown-http-error.ts, so the resolver could not read it from there without a cycle. data-error-classification.ts re-exports it, so @objectstack/types exports the same names as before. The platform-checklist anchor for it follows the move.
• Unchanged: a declared code is kept (registered → its own code; unregistered → declaredCode beside the derived code); declaredCode stays absent for an undeclared abort; a non-sandbox producer, a crash, and a sandboxed refusal resolved at a 5xx answer as before.

Tests

• New: packages/types/src/thrown-http-error-undeclared-hook-abort.test.ts (resolver, §1 the card, §2 controls), packages/rest/src/package-door-undeclared-hook-abort-code.test.ts (publish door), packages/runtime/src/domains/actions-undeclared-hook-abort-code.test.ts (/actions: an action body's throw, a hook abort relayed through an action body, a declared 4xx status; controls).
• Flipped on purpose from VALIDATION_ERROR to HOOK_ABORTED, each with a [#27672] FLIPPED note: the publish row of rest-write-route-hook-refusal-sentence.ledger.test.ts; the four rows of actions-hook-refusal-sentence.ledger.test.ts; nested-hook-refusal-is-a-rejection.test.ts ("matches /data", which it does again); the thrown-Error control in sandbox-plain-object-throw-client-sentence.test.ts; throw '' and throw Object.create(null) in sandbox-unreadable-rejection-door.test.ts.

Acceptance notes

• Premise measured: the dispatch placed resolveThrownHttpError in packages/rest/src/error-response.ts; it is defined in packages/types/src/thrown-http-error.ts (rest imports it). The fix is there, per the ruling ("resolveThrownHttpError answers HOOK_ABORTED"); the seat amended the claim's file surface. logUnexpectedRouteError (rest: a hook onError abort answers the data door with a 400 that carries no error code, and the server logs it as an unhandled SandboxError #27508) is untouched.
• The wrapper fallback in classifyDataError (an abort whose SandboxError instance was lost, no innerMessage) keeps answering the constant through sandboxRefusalCodeFields, because the resolver has no marker to read there.

Verification

Ablation (resolver arm removed, types rebuilt) → restore

• Ablated: types new pin 2 failed / 6 passed; rest (new publish pin + publish ledger row + /data pins) 3 failed / 603 passed, the /data pins staying green; runtime (5 touched files) 11 failed / 21 passed. Every control stayed green.
• Restored + rebuilt: types 8/8, rest 606/606, runtime 32/32.

Suites on the final tree (after merging main)

• @objectstack/types: Test Files 32 passed, Tests 817 passed.
• @objectstack/rest: Test Files 353 passed, Tests 7025 passed | 350 skipped.
• @objectstack/runtime: Test Files 484 passed, Tests 8784 passed | 19 skipped.
• Other readers of the resolver's code, before the merge: @objectstack/metadata-protocol 21822 passed | 26 skipped, @objectstack/service-automation 2795 passed, @objectstack/plugin-hono-server 448 passed, @objectstack/cloud-connection 758 passed. No pin moved there.

Gates

• node scripts/pm/dispatch-gates.mjs --ran: 64 derived families accounted for — 63 run (exit 0), 1 NOT MEASURED: pnpm check:dual-build-cjs-loads exit 3 (needs every package's dist; CI builds the whole tree).
• pnpm lint: exit 0.
• check-governed-merges --test on the touched paths: NOT governed.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4d1iG6EQSWf7veWbAar

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/types, touching 5 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/kernel/error-handling.mdx (via HOOK_ABORTED (literal, a string literal in UNDECLARED_HOOK_REFUSAL_CODE))

What this run could not see

• the SDK route bridge reached 58 of 210 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 04740b7c9f55e3c6f69fa65ec0b467732366fe17 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 14226c7c3aaf2863d577fccbce27197724cd8b2b — the merge of head 9a34ac1b8a9aa5c70f587631b179c2352b6e3f5a into base 04740b7c9f55e3c6f69fa65ec0b467732366fe17, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 14226c7c3aaf2863d577fccbce27197724cd8b2b && git checkout 14226c7c3aaf2863d577fccbce27197724cd8b2b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 04740b7c9f55e3c6f69fa65ec0b467732366fe17 9a34ac1b8a9aa5c70f587631b179c2352b6e3f5a && git checkout -B drift-repro 04740b7c9f55e3c6f69fa65ec0b467732366fe17 && git merge --no-ff 9a34ac1b8a9aa5c70f587631b179c2352b6e3f5a

node scripts/docs-audit/affected-docs.mjs --json 04740b7c9f55e3c6f69fa65ec0b467732366fe17

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 04740b7c9f55e3c6f69fa65ec0b467732366fe17 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL

维护者速读

• 改了什么：钩子用一句话拒绝且没声明错误码时，包发布接口和 /actions 接口现在回 HOOK_ABORTED，与 /api/v1/data 自 error codes: an undeclared hook onError abort answers the data door with a code-less 400; give it a ledgered ADR-0112 code (#27508 code half) #27597 起的回答一致，不再回从状态码推出来的 VALIDATION_ERROR。
• 为什么改：同一个钩子拒绝在不同入口得到不同错误码，调用方和代理没法按码处理（rest/runtime: an undeclared hook abort still answers VALIDATION_ERROR on the doors that resolve through resolveThrownHttpError (package publish, /actions) after HOOK_ABORTED lands #27672）。
• 风险与回滚：只改未声明错误码的 4xx 沙箱拒绝；声明了错误码的照旧保留，提示文字不变。sandboxBusinessMessage 原样挪到新文件以避免循环引用，包的导出名不变。回滚即还原本 PR。
• 先看：packages/types/src/thrown-http-error.ts 里 undeclaredHookAbort 那一处。
• 两分钟验证：三个新测试文件（types 8 例、rest 5 例、runtime 7 例）；去掉这一处后 types 2 红、rest 3 红、runtime 11 红。
• 需要你做的：无（非受管、无需契约复审，席位按本任落地授权落地）。

席位意见：ACCEPT。

席位核对

Head-sha: 9a34ac1b8a9aa5c70f587631b179c2352b6e3f5a

• Shape: resolveThrownHttpError answers UNDECLARED_HOOK_REFUSAL_CODE (HOOK_ABORTED, added by PR fix(rest): an undeclared hook abort answers the data door with HOOK_ABORTED #27667) when a sandboxed body refusal carries no declared code at a 4xx status; a registered or declared code still wins. The constant moves beside the resolver; sandboxBusinessMessage and isScriptFaultMessage move verbatim to sandbox-business-message.ts (cycle avoidance), and data-error-classification.ts re-exports sandboxBusinessMessage, so @objectstack/types' public names are unchanged (isScriptFaultMessage stays module-internal: not re-exported from the index). Eight VALIDATION_ERROR pins flip on purpose. Changeset patch types / rest / runtime (the doors' wire answer moves through types), Clause-②: no, Metadata-protocol: none. check-governed-merges --pr 27898: NOT governed, 623 changed lines.
• Premise measured: ablation of the resolver arm (dist rebuilt) turns types 2, rest 3 and runtime 11 red with /data controls green; restored 8/8, 606/606, 32/32; after merging main types 817, rest 7025, runtime 8784 tests green (dev report 6513877120 on rest/runtime: an undeclared hook abort still answers VALIDATION_ERROR on the doors that resolve through resolveThrownHttpError (package publish, /actions) after HOOK_ABORTED lands #27672).
• Gate check-runs on the head: 49 runs, 39 success, 10 skipped, 0 failure/pending; mergeable_state clean. check:dual-build-cjs-loads NOT MEASURED locally (needs whole-tree dist); CI builds cover it.
• Contract review: not owed (an existing code reaches two more doors; no packages/spec, no narrowing, no new public name).
• Accepted deviations: the file surface moved from rest/src/error-response.ts to packages/types (the resolver lives there), amended on the claim before the first push; rest and runtime bump with no source change because their wire answer moves.
• Out of scope: some rest/runtime docblocks still describe the undeclared abort as VALIDATION_ERROR (comment text only; noted, not filed).
• Landing: under the maintainer's landing grant for this seat term (seat 4 thread, 2026-10-29 22:04Z): pr_ready + automerge_enable through the relay.