@@ -0,0 +1,15 @@
+---
+'@objectstack/spec': patch
+'@objectstack/types': patch
+'@objectstack/rest': patch
+---
+
+fix(rest): a hook that aborts with free text answers the data door with `HOOK_ABORTED` instead of no `code`
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+- **Before.** A sandboxed hook body that aborted a write with free text (`throw new Error('…')`, no `code`, no `refusals` catalogue) answered `/api/v1/data` with `400 {"error":"…","object":"…"}` and no `code`, the one refusal on that door a client could not branch on.
+- **Now.** The same abort answers `400 {"error":"…","code":"HOOK_ABORTED","object":"…"}`; a body that declared a 4xx `status` (or `statusCode`) keeps that status and gains the same code. `HOOK_ABORTED` is registered in the ADR-0112 ledger under `@objectstack/types` (`@objectstack/spec`), stamped by `mapDataError`'s sandbox unwrap door and its wrapper fallback (`@objectstack/types`, exported as `UNDECLARED_HOOK_REFUSAL_CODE`) and by the route door's declared-status passthrough (`@objectstack/rest`).
+- **Moved.** The same undeclared abort also changes value on doors that already carried a code, from the status-derived `VALIDATION_ERROR` to `HOOK_ABORTED`: the nested refusal envelopes of the sharing rules routes (`POST /api/v1/sharing/rules`, `DELETE /api/v1/sharing/rules/:idOrName`, `POST /api/v1/sharing/rules/:idOrName/evaluate`), the security suggested-bindings routes (`POST /api/v1/security/suggested-bindings/:id/confirm`, `…/dismiss`, `…/reopen`), the approvals request routes (`POST /api/v1/approvals/requests/:id/approve`, `…/reject`, `…/recall`, `…/reassign`, `…/comment`, `…/remind`, `…/request-info`, `…/resubmit`, `…/revise`), and each row of the `failures` list that `POST /api/v1/data/import/jobs/:jobId/undo` returns.
+- **Unchanged.** A refusal that declared a code keeps it: a `refusals` catalogue entry still answers `declaredCode` beside the status-derived `code`, and a registered code a body throws is still its own wire `code`. A non-hook producer that declared no code still gets none, and a crashed body is still the sanitised `500 INTERNAL_ERROR`. The server log line for the abort is not changed here.
@@ -164,7 +164,9 @@ nested envelope would nest under `details` rides as **top-level siblings** here.
 - `error` — the human-readable message, **a string**.
 - `code` — the machine-readable code. **Optional**: ADR-0112 invents nothing for the half
   a producer did not name, so a refusal that declared a status but no code arrives with
-  `error` alone. Branch on `code` only after checking it is there.
+  `error` alone. Branch on `code` only after checking it is there. One producer is named
+  instead: a sandboxed hook body that aborts with free text and no code answers
+  `HOOK_ABORTED`, at the 4xx status it declared, else `400`.
 - `object` — the object the refusal is about, when the door knows it.
 - `declaredCode` / `userMessage` — the same two optional channels as above, as top-level
   siblings.
 
@@ -347,7 +347,7 @@ const result = AutomationApiErrorCode.parse(data);
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +351 more>` | ✅ | The inner refusal's code in its WIRE spelling - the ADR-0112 member a record save of the same write answers in `error.code` (e.g. `UNIQUE_VIOLATION`); the closed set `ApiErrorSchema.code` parses against |
+| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +352 more>` | ✅ | The inner refusal's code in its WIRE spelling - the ADR-0112 member a record save of the same write answers in `error.code` (e.g. `UNIQUE_VIOLATION`); the closed set `ApiErrorSchema.code` parses against |
 | **message** | `string` | ✅ | The inner refusal's own diagnostic text, verbatim, without the node and operation prefixes the run's failure text adds |
 
 ### Allowed Values: `FlowInnerRefusal.code`
@@ -520,6 +520,7 @@ const result = AutomationApiErrorCode.parse(data);
 * `FORBIDDEN`
 * `FORM_NOT_FOUND`
 * `FORM_RESOLVE_FAILED`
+* `HOOK_ABORTED`
 * `HOOK_UNSCOPED_DATA_ACCESS`
 * `IMPORT_JOB_CREATE_FAILED`
 * `IMPORT_ROW_FAILED`
 
@@ -28,7 +28,7 @@ const result = ApiErrorSchema.parse(data);
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +351 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
+| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +352 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
 | **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
 | **message** | `string` | ✅ | Readable error message |
 | **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
@@ -208,6 +208,7 @@ const result = ApiErrorSchema.parse(data);
 * `FORBIDDEN`
 * `FORM_NOT_FOUND`
 * `FORM_RESOLVE_FAILED`
+* `HOOK_ABORTED`
 * `HOOK_UNSCOPED_DATA_ACCESS`
 * `IMPORT_JOB_CREATE_FAILED`
 * `IMPORT_ROW_FAILED`
 
@@ -375,6 +375,7 @@ const result = ErrorCode.parse(data);
 * `FORBIDDEN`
 * `FORM_NOT_FOUND`
 * `FORM_RESOLVE_FAILED`
+* `HOOK_ABORTED`
 * `HOOK_UNSCOPED_DATA_ACCESS`
 * `IMPORT_JOB_CREATE_FAILED`
 * `IMPORT_ROW_FAILED`
 
@@ -8,9 +8,12 @@
 // deliberate business rule (e.g. referential-integrity "记录被引用,删除被
 // 阻断"). The console shows the REST body's `error` string verbatim in its
 // toast, so that string must be ONLY the author's message — not the sandbox
-// debug wrapper (`hook 'x' threw: Error: …`, which belongs in server logs)
-// and not a `code` field: `throw new Error(...)` declares no code, and
-// ADR-0112 invents nothing for a producer that declared none.
+// debug wrapper (`hook 'x' threw: Error: …`, which belongs in server logs).
+//
+// [#27597] The body still carries a `code`, and not one the hook declared:
+// `throw new Error(...)` declares none, so the abort answers the ledgered
+// `HOOK_ABORTED`, the one code a client branches on for "a hook refused this
+// write in its own words". It used to carry no `code` at all.
 //
 // [#7543] Non-default error names (`TypeError: …`) are the OPPOSITE case, and
 // this file used to assert they were KEPT on the wire "as useful context". They
@@ -115,10 +118,10 @@ describe('objectstack verify: sandboxed hook error message format (#hef)', () =>
     // The console toast renders this string verbatim — it must be exactly
     // what the hook author threw.
     expect(body.error).toBe(BUSINESS_MSG);
-    // No sandbox debug wrapper, no branding, and no `code` — the hook threw
-    // no code, and ADR-0112 invents nothing for a producer that declared none.
+    // No sandbox debug wrapper and no branding. [#27597] The hook threw no
+    // code, so the abort answers the ledgered `HOOK_ABORTED`.
     expect(JSON.stringify(body)).not.toMatch(/threw:|hook '|\[ObjectStack\]/);
-    expect(body.code).toBeUndefined();
+    expect(body.code).toBe('HOOK_ABORTED');
   });
 
   it('ground truth: the blocked delete did not remove the record', async () => {
 
@@ -65,6 +65,7 @@ import {
     mapDataError,
     resolveThrownHttpError,
     sandboxBusinessMessage,
+    sandboxRefusalCodeFields,
     structuredCodeAnswer,
     thrownCodeFields,
     truncateClientMessage,
@@ -585,11 +586,20 @@ function resolveErrorResponse(error: any, object?: string): { status: number; bo
         // route that passes nothing still answers exactly the bytes it answers
         // today (`classifiedRefusalAnswer` calls this door with no object at
         // all, and its families' key sets are unmoved).
+        //
+        // [#27597] A sandboxed body's refusal that declared no code answers
+        // `UNDECLARED_HOOK_REFUSAL_CODE`, read through the same
+        // `sandboxRefusalCodeFields` the unwrap door in `mapDataError` reads,
+        // so a hook that sets `status` and the one that sets `statusCode` (or
+        // neither) still answer one code. Every other producer keeps
+        // `thrownCodeFields`' answer, which invents nothing.
         return withDeclaredUserMessage(error, {
             status: error.status,
             body: {
                 error: safeMsg,
-                ...thrownCodeFields(error, error.status),
+                ...(businessMessage !== undefined
+                    ? sandboxRefusalCodeFields(error, error.status)
+                    : thrownCodeFields(error, error.status)),
                 ...(Array.isArray(error.issues) ? { issues: error.issues } : {}),
                 ...(object ? { object } : {}),
             },
 
@@ -328,9 +328,12 @@ describe('[#24380] an import undo runs under the object\'s declared controls for
 
     const res = await ctx.undo(jobId);
     expect(res._json).toMatchObject({ success: false, deleted: 0, restored: 0, failed: 2 });
+    // [#27597] The freeze is a sandboxed hook's free-text abort, so each row
+    // carries the ledgered `HOOK_ABORTED` (the status-derived `VALIDATION_ERROR`
+    // before).
     expect(res._json.failures).toEqual([
-      { id: 'c_new', action: 'delete', code: 'VALIDATION_ERROR', error: FROZEN },
-      { id: 'c_old', action: 'restore', code: 'VALIDATION_ERROR', error: FROZEN },
+      { id: 'c_new', action: 'delete', code: 'HOOK_ABORTED', error: FROZEN },
+      { id: 'c_old', action: 'restore', code: 'HOOK_ABORTED', error: FROZEN },
     ]);
     expect(await ctx.record('ou_case', 'c_new')).toMatchObject({ title: 'fresh', status: 'closed' });
     expect(await ctx.record('ou_case', 'c_old')).toMatchObject({ title: 'after', status: 'closed' });
 
@@ -273,17 +273,20 @@ describe('[#27508] a hook `onError: abort` is a refusal the route answered — q
         innerMessage: 'boom abort',
     });
 
-    it('POST /data/:object answers the same code-less 400 and prints no "[REST] Unhandled error"', async () => {
+    it('POST /data/:object answers the same 400 and prints no "[REST] Unhandled error"', async () => {
         const res = await postRecord(serverRejecting(hookAbort()));
         expect(res.statusCode).toBe(400);
-        expect(res.body).toEqual({ error: 'boom abort', object: 'qa_media' });
+        // [#27597] The door adds the ledgered `HOOK_ABORTED` to an undeclared
+        // abort's answer; the log verdict reads the thrown error, so it stays quiet.
+        expect(res.body).toEqual({ error: 'boom abort', code: 'HOOK_ABORTED', object: 'qa_media' });
         expect(unhandledLogs()).toHaveLength(0);
     });
 
     it('the handleRouteError door agrees: same answer it always gave, no unhandled line', async () => {
         const res = await putMeta(serverRejecting(hookAbort()));
         expect(res.statusCode).toBe(400);
-        expect(res.body).toEqual({ error: 'boom abort' });
+        // [#27597] Same door-added code as above.
+        expect(res.body).toEqual({ error: 'boom abort', code: 'HOOK_ABORTED' });
         expect(unhandledLogs()).toHaveLength(0);
     });
 
 
@@ -350,15 +350,15 @@ describe('[#10345] the sandbox unwrap is the branch, and it was never status-sha
 // ---------------------------------------------------------------------------
 
 describe('[#10345] the pinned defaults the fix must not disturb', () => {
-    it('a refusal that declares NO code still carries none — nothing is invented', () => {
-        // ADR-0112 D4 governs the semantic-CODE channel — the producer names
-        // the condition on the CODE axis, and the ADR rules no HTTP status for
-        // an undeclared throw. Narrowing or widening the
-        // vocabulary must never start ADDING codes to bodies that carried none.
+    it('a refusal that declares NO code answers the one ledgered HOOK_ABORTED, and declares nothing', () => {
+        // [#27597] This used to pin `code` absent ("nothing is invented"). The
+        // undeclared abort now answers one registered code naming the event —
+        // a hook aborted with free text — and still no `declaredCode`: the
+        // producer declared none, so nothing was demoted.
         const r = mapDataError(sandboxRefusal('month-end close is in progress'), 'crm_account');
         expect(r.status).toBe(400);
         expect(r.body.error).toBe('month-end close is in progress');
-        expect(r.body).not.toHaveProperty('code');
+        expect(r.body.code).toBe('HOOK_ABORTED');
         expect(r.body).not.toHaveProperty('declaredCode');
     });
 
@@ -426,9 +426,11 @@ describe('[#10345 / #9232] the unwrap door speaks the closed ADR-0112 vocabulary
     });
 
     it('CONTROL — a numeric errno and an empty string are not declarations', () => {
+        // [#27597] So the refusal is an undeclared abort: `HOOK_ABORTED`, never
+        // the errno or the empty string.
         for (const code of [1062, '']) {
             const r = mapDataError(sandboxRefusal('refused', { code, status: 409 }), 'crm_account');
-            expect(r.body.code, String(code)).toBeUndefined();
+            expect(r.body.code, String(code)).toBe('HOOK_ABORTED');
             expect(r.body.declaredCode, String(code)).toBeUndefined();
         }
     });