docs(core,driver-sql): the three boot-refusal comments state the registered position, not the pre-#16404 one (#17702)

* docs(core,driver-sql): the three boot-refusal comments state the registered position

Three source comments still asserted the pre-#16404 position -- that these
codes are deliberately not wire vocabulary and that registering one is "not
something to start doing at a door". #16649 registered fourteen `door: 'none'`
codes in `ERROR_CODE_LEDGER` under the #16404 door-or-no-door ruling, so each
comment was a confident false statement about the tree at the point a reader
decides whether to act.

Each site keeps its existing reachability sentence -- those readings were
re-measured by the review and are true; none of the fourteen reaches an HTTP
door on this tree. What changes is the justification (registration is done, and
the ledger is where it is recorded) and the dangling pointer at
`dispatcher-error-vocabulary.ts`'s `boot-refusal` verdict, which #16649
ratcheted from fourteen rows to zero.

- `packages/core/src/service-not-registered.ts` -- SERVICE_NOT_REGISTERED
- `packages/core/src/plugin-contract.ts` -- PLUGIN_CONTRACT_VIOLATION
- `packages/drivers/driver-sql/src/dialect-emission-refusal.ts` -- the worked
  example it cites is MONGODB_MULTI_TENANT_UNSUPPORTED, the code #16649
  re-registered; its ledger row already carries the corrected wording, which
  this comment now matches.

Comment-only, proven mechanically: with every comment character removed by the
repo's own `scripts/js-comment-mask.mjs` scanner, the executable token stream of
all three files is byte-identical to 3d262ad (22 / 21 / 30 code lines).

Claude-Session: https://claude.ai/code/session_01RuoNSXUbBoWHkNS4AknTrM
Co-authored-by: Claude <noreply@anthropic.com>

* chore(changeset): patch for the three corrected boot-refusal docblocks

The docblocks ship inside `dist/*.d.ts` for both `@objectstack/core` and
`@objectstack/driver-sql` (measured: the corrected phrase is present in
`dist/index.d.ts` of both, against a positive control of an untouched TSDoc
sentence and a negative control that finds nothing), so this publishes and is
not a `skip-changeset` diff.

Claude-Session: https://claude.ai/code/session_01RuoNSXUbBoWHkNS4AknTrM
Co-authored-by: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-musk

.changeset/16884-boot-refusal-comments-registered.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/core': patch
+'@objectstack/driver-sql': patch
+---
+
+Three source comments now state the registered position for the `door: 'none'` boot-refusal codes instead of the pre-#16404 one
+
+`SERVICE_NOT_REGISTERED`, `PLUGIN_CONTRACT_VIOLATION` and — as the worked
+example the `driver-sql` comment cites — `MONGODB_MULTI_TENANT_UNSUPPORTED` are
+all registered in `ERROR_CODE_LEDGER`. #16649 registered fourteen `door: 'none'`
+codes under the #16404 door-or-no-door ruling, and re-registered the MongoDB one
+that #8035 had removed. Three TSDoc comments still asserted the position that
+preceded that ruling — that these codes are deliberately not wire vocabulary,
+and that registering one is "not something to start doing at a door" — and each
+was false the moment #16649 landed. They also pointed at
+`dispatcher-error-vocabulary.ts`'s `boot-refusal` verdict, which the same PR
+ratcheted from fourteen rows to zero, so the pointer dangled.
+
+These docblocks ship inside each package's `dist/*.d.ts`, which is why this is a
+published change rather than an internal one: the sentence is what an agent or
+an IDE reader sees at the point it decides whether the code needs registering.
+
+⛔ No behaviour changes. Every reachability sentence is kept verbatim — none of
+these codes reaches an HTTP door on this tree — no code is added, removed or
+re-registered, and no gate moves. With every comment character removed by
+`scripts/js-comment-mask.mjs`, all three files' executable token streams are
+byte-identical to the commit this branched from.

packages/core/src/plugin-contract.ts

@@ -112,11 +112,12 @@ import type { Plugin } from './types.js';
  * The FIRST issue only: a boot refusal is read by a human reading one log
  * line, and the first violated key is the one to fix.
  *
- * ⚠️ The code is spelled the ADR-0112 way and is deliberately NOT wire
- * vocabulary, exactly like `SERVICE_NOT_REGISTERED_CODE` one module over: it
- * is raised while the kernel is still assembling itself, before any HTTP
- * boundary exists, and `dispatcher-error-vocabulary.ts` classifies it
- * `door: 'none'` / `boot-refusal` for that reason.
+ * The code is spelled the ADR-0112 way and is REGISTERED in
+ * `ERROR_CODE_LEDGER` under `@objectstack/core` (#16649, under the #16404
+ * door-or-no-door rule), exactly like `SERVICE_NOT_REGISTERED_CODE` one module
+ * over. `door: 'none'` on this tree — it is raised while the kernel is still
+ * assembling itself, before any HTTP boundary exists. If a transport ever
+ * ANSWERS with it, `error.code` carries this spelling.
  *
  * ## `version`: the ninth key, and why admitting it refused nothing new
  *

packages/core/src/service-not-registered.ts

@@ -74,13 +74,14 @@
 /**
  * The code carried by the "never registered" rejection.
  *
- * ⚠️ Spelled the ADR-0112 way, but deliberately NOT wire vocabulary: this value
- * is read in-process by the seam that catches the rejection and is never
- * serialized into an `error.code` envelope. `dispatcher-error-vocabulary.ts`
- * classifies it `door: 'none'` / `boot-refusal` for exactly that reason — the
- * same class as the migration-journal runner refusals. If a transport ever
- * needs to ANSWER with this fact, that is a registration question for #8846's
- * ledger, ⛔ not something to start doing at a door.
+ * Spelled the ADR-0112 way and REGISTERED in `ERROR_CODE_LEDGER` under
+ * `@objectstack/core` (#16649, under the #16404 door-or-no-door rule: every
+ * `code` that ships in `dist` carries a ledger row, whether or not a door
+ * answers with it). `door: 'none'` on this tree — this value is read
+ * in-process by the seam that catches the rejection and is never serialized
+ * into an `error.code` envelope, the same reachability as the
+ * migration-journal runner refusals. If a transport ever ANSWERS with this
+ * fact, `error.code` carries this spelling.
  */
 export const SERVICE_NOT_REGISTERED_CODE = 'SERVICE_NOT_REGISTERED';
 

packages/drivers/driver-sql/src/dialect-emission-refusal.ts

@@ -58,14 +58,16 @@
  * ADR-0112 D3 extension code, registered by `@objectstack/driver-sql` in
  * `ERROR_CODE_LEDGER`.
  *
- * Registered rather than parked as a driver-local string because this refusal
- * IS wire-reachable: publishing a drafted object calls `engine.syncObjectSchema`
- * → `SqlDriver.syncSchema` → the DDL gate, on a server that is already serving
- * HTTP. That is the test the ledger applies (the class `MONGODB_MULTI_TENANT_UNSUPPORTED`
- * was UNregistered for failing — a boot refusal the CLI rethrows pre-HTTP, which
- * no response envelope could ever carry). This one can be carried, so it is
- * registered and the door serves it under its own name instead of demoting it
- * to `declaredCode` behind a 500.
+ * Registered from the start rather than parked as a driver-local string, and
+ * this refusal IS wire-reachable: publishing a drafted object calls
+ * `engine.syncObjectSchema` → `SqlDriver.syncSchema` → the DDL gate, on a
+ * server that is already serving HTTP. That was the exact test #8035 applied
+ * when it UNregistered `MONGODB_MULTI_TENANT_UNSUPPORTED` for failing it — a
+ * removal #16649 reversed under the #16404 door-or-no-door rule, which takes
+ * registration out of that test's reach entirely: every `code` that ships in
+ * `dist` carries a ledger row, and wire-reachability now decides only what a
+ * door ANSWERS with. This one can be carried, so the door serves it under its
+ * own name instead of demoting it to `declaredCode` behind a 500.
  *
  * No standard-catalog member covers the condition: `NOT_IMPLEMENTED` says "not
  * yet", and the whole content of the ruling is that this is a decided, stated