fix(plugin-sharing): refuse a share row on a federated phantom owner anchor, with the single-record gate behaviour measured (#8119) - #8209

…position (#8111)

`federated-phantom-share-grant.dogfood.test.ts` (added by #8209 / PR #8209 for
#8119) asserts the `/data/:object/:id/shares` refusal envelope. It was written
against the FLAT dialect — `body.code` / `body.error` as a bare string — because
that is what the route emitted when it landed. This PR converges that family onto
`{ error: { code, message } }`, so the pin reads `undefined` and fails.

Migrated, not loosened: the assertions move to `body.error.code` and
`body.error.message` and assert the D5 position ALONE. Accepting either shape
would re-admit the dialect this card retires.

The CONTROL case's negative assertion moves too. It did not fail — a negative
assertion on the vacated flat position passes for free
(`undefined !== 'SHARING_NOT_ENABLED'`) — which is exactly why it had to move:
left alone it would have gone on "passing" while reading a key no response
carries any more.

Why the queue caught this and PR CI did not: the merge queue runs the FULL
suite, PR-side CI only the affected subset, and neither PR alone is red — #8209
was green before this convergence existed and this branch was green before
#8209's pin existed. The interaction is only visible composed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B3Kurx8qufrDzNjk4rag7V

…SHARING_NOT_ENABLED list (objectstack-ai#8119) (objectstack-ai#8217)

The "Typical Errors" list enumerates the exact conditions that produce a 422,
and objectstack-ai#8209 added a fifth: a FEDERATED (ADR-0015 `external`) object whose
`owner_id` is the platform's injected anchor rather than a real remote column.
Leaving it out is the enforced-but-undocumented inverse of a
declared-but-unenforced gap — the runtime now refuses more than the page says.

Docs-only; the behaviour itself shipped in objectstack-ai#8209.


Claude-Session: https://claude.ai/code/session_01PEVB6w7D7uCszR9Mw1BL73

Co-authored-by: Claude <noreply@anthropic.com>

…velope (objectstack-ai#8111) (objectstack-ai#8212)

* fix(rest): converge the record-sharing family onto the ADR-0112 D5 envelope (objectstack-ai#8111)

`registerSharingEndpoints` answered two retired dialects across its nine
refusal arms: `respond501` was flat `{ code, message }`, and the five mapped
verdicts (400/403/404/409/422) plus the three verb-specific 500s were
`{ code, error: '<bare string>' }`. `body.error.code` — the one position
ADR-0112 D5 declares — read `undefined` on all nine.

Every arm now emits through the shared `sendError` from `@objectstack/types`
(imported here as `sendEnvelopeError`; this module has a local `sendError` of
its own for thrown errors), so the family agrees by construction rather than
by nine literals that happen to match.

No status code moves and no code VALUE changes. The 409 arm's `CONFLICT` was
registered in neither `StandardErrorCode` nor `ERROR_CODE_LEDGER` — so
`ApiErrorSchema`, whose `code` is a closed enum, would have rejected that
body — and is now registered under `@objectstack/rest`, keeping the emitted
value byte-identical. Renaming it onto `RESOURCE_CONFLICT` would change what
clients read and is filed separately.

The `CODE:` message prefix stays: censused as a server-internal service→REST
derivation, stripped before the response is written, never on the wire.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B3Kurx8qufrDzNjk4rag7V

* docs(spec): regenerate api references for the CONFLICT ledger entry (objectstack-ai#8111)

Registering `CONFLICT` in `ERROR_CODE_LEDGER` grows `ErrorCode` — the union
`ApiErrorSchema.code` parses against — by exactly one member, and every
generated reference page that renders an `ApiError`-shaped field prints that
enum as a truncated summary with a "+N more" count. So one ledger row moves
134 counter lines across 11 pages, plus the two pages that list the vocabulary
in full gain a `CONFLICT` bullet.

Generated output only (`gen:schema` + `gen:docs`), never hand-edited.

Measured as a genuine cascade, not absorbed drift: a pristine `origin/main`
tree regenerates completely clean under the identical commands, and every one
of the 136 changed lines here is either the `+264 more` → `+265 more` counter
(134) or a `CONFLICT` bullet (2) — nothing else.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B3Kurx8qufrDzNjk4rag7V

* test(qa): migrate objectstack-ai#8209's share-grant dogfood pin to the ADR-0112 D5 position (objectstack-ai#8111)

`federated-phantom-share-grant.dogfood.test.ts` (added by objectstack-ai#8209 / PR objectstack-ai#8209 for
objectstack-ai#8119) asserts the `/data/:object/:id/shares` refusal envelope. It was written
against the FLAT dialect — `body.code` / `body.error` as a bare string — because
that is what the route emitted when it landed. This PR converges that family onto
`{ error: { code, message } }`, so the pin reads `undefined` and fails.

Migrated, not loosened: the assertions move to `body.error.code` and
`body.error.message` and assert the D5 position ALONE. Accepting either shape
would re-admit the dialect this card retires.

The CONTROL case's negative assertion moves too. It did not fail — a negative
assertion on the vacated flat position passes for free
(`undefined !== 'SHARING_NOT_ENABLED'`) — which is exactly why it had to move:
left alone it would have gone on "passing" while reading a key no response
carries any more.

Why the queue caught this and PR CI did not: the merge queue runs the FULL
suite, PR-side CI only the affected subset, and neither PR alone is red — objectstack-ai#8209
was green before this convergence existed and this branch was green before
objectstack-ai#8209's pin existed. The interaction is only visible composed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B3Kurx8qufrDzNjk4rag7V

---------

Co-authored-by: Claude <noreply@anthropic.com>