@@ -0,0 +1,12 @@
+---
+'@objectstack/spec': patch
+---
+
+feat(spec): register `PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE`, the code the package disable door answers when an enabled package's validation rule reads a field the package adds
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+The error-code ledger (`ERROR_CODE_LEDGER`, and so `ErrorCode`) gains one `@objectstack/runtime` code. `PATCH /api/v1/packages/:id/disable` will answer it with `409` when a validation rule of a package that stays enabled (any severity, an app's `.custom` pair included) reads a field the package being disabled adds through `objectExtensions`. Disabling the package would withhold that field, and every write to the object would then fail that rule. The refusal names each package, object and rule it found, and there can be several. To go ahead, disable or change the reading rule first, or keep the package enabled.
+
+Registration only: the disable door does not answer this code yet. It starts to when the door's dependent scan lands. No existing code changes, and no standard-catalog member is shadowed, so no synonym waiver is needed.
@@ -417,7 +417,7 @@ const result = AutomationApiErrorCode.parse(data);
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +360 more>` | ✅ | The inner refusal's code in its WIRE spelling - the ADR-0112 member a record save of the same write answers in `error.code` (e.g. `UNIQUE_VIOLATION`); the closed set `ApiErrorSchema.code` parses against |
+| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +361 more>` | ✅ | The inner refusal's code in its WIRE spelling - the ADR-0112 member a record save of the same write answers in `error.code` (e.g. `UNIQUE_VIOLATION`); the closed set `ApiErrorSchema.code` parses against |
 | **message** | `string` | ✅ | The inner refusal's own diagnostic text, verbatim, without the node and operation prefixes the run's failure text adds |
 
 ### Allowed Values: `FlowInnerRefusal.code`
@@ -671,6 +671,7 @@ const result = AutomationApiErrorCode.parse(data);
 * `OS_PROTOCOL_INCOMPATIBLE`
 * `PACKAGE_DELETE_FAILED`
 * `PACKAGE_DELETE_PARTIAL`
+* `PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE`
 * `PACKAGE_MANIFEST_INVALID`
 * `PACKAGE_PUBLISH_FAILED`
 * `PASSWORD_ALREADY_SET`
 
@@ -28,7 +28,7 @@ const result = ApiErrorSchema.parse(data);
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +360 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
+| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +361 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
 | **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
 | **message** | `string` | ✅ | Readable error message |
 | **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
@@ -289,6 +289,7 @@ const result = ApiErrorSchema.parse(data);
 * `OS_PROTOCOL_INCOMPATIBLE`
 * `PACKAGE_DELETE_FAILED`
 * `PACKAGE_DELETE_PARTIAL`
+* `PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE`
 * `PACKAGE_MANIFEST_INVALID`
 * `PACKAGE_PUBLISH_FAILED`
 * `PASSWORD_ALREADY_SET`
 
@@ -456,6 +456,7 @@ const result = ErrorCode.parse(data);
 * `OS_PROTOCOL_INCOMPATIBLE`
 * `PACKAGE_DELETE_FAILED`
 * `PACKAGE_DELETE_PARTIAL`
+* `PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE`
 * `PACKAGE_MANIFEST_INVALID`
 * `PACKAGE_PUBLISH_FAILED`
 * `PASSWORD_ALREADY_SET`
 
@@ -41,13 +41,15 @@ const codeIsTyped: [
 ] = [false, false, false];
 const standardCode: ApiError = { code: 'VALIDATION_ERROR', message: 'x' };
 const registeredCode: ApiError['code'] = 'INVALID_ARTIFACT_PACKAGES';
+// The package disable door's 409 for a dependent validation rule: a ledger row the type accepts.
+const disableRefusalCode: ApiError['code'] = 'PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE';
 // @ts-expect-error -- `code` is a vocabulary member, not a number.
 const numericCode: ApiError = { code: 42, message: 'x' };
 // @ts-expect-error -- nor a string outside the vocabulary.
 const inventedCode: ApiError = { code: 'NOT_A_REGISTERED_CODE', message: 'x' };
 // @ts-expect-error -- the same `code` reaches every envelope built on `BaseResponseSchema`.
 const envelopeNumericCode: BaseResponse = { success: false, error: { code: 42, message: 'x' } };
-void [codeIsTyped, standardCode, registeredCode, numericCode, inventedCode, envelopeNumericCode];
+void [codeIsTyped, standardCode, registeredCode, disableRefusalCode, numericCode, inventedCode, envelopeNumericCode];
 
 // ── `makeApiErrorSchema`: standard catalogue ∪ the caller's codes ─────────────────────────────
 
@@ -87,6 +89,7 @@ describe('ApiError.code is typed as the vocabulary its schema parses against', (
   it('every body the type admits parses', () => {
     expect(ApiErrorSchema.safeParse(standardCode).success).toBe(true);
     expect(ApiErrorSchema.safeParse({ code: registeredCode, message: 'x' }).success).toBe(true);
+    expect(ApiErrorSchema.safeParse({ code: disableRefusalCode, message: 'x' }).success).toBe(true);
     expect(AcmeApiErrorSchema.safeParse(acmeSupplied).success).toBe(true);
     expect(AcmeApiErrorSchema.safeParse(acmeStandard).success).toBe(true);
   });
 
@@ -290,6 +290,24 @@ describe('ErrorCode (standard ∪ registered)', () => {
     expect(STANDARD_SYNONYM_WAIVERS.map((w) => w.code)).not.toContain(code);
   });
 
+  it('accepts the package disable door\'s dependent-validation-rule refusal code, registered ahead of its runtime producer', () => {
+    // ADR-0141 Open item 4, ruling A on #30379: the disable door answers 409
+    // while an enabled package's validation rule reads a field the package
+    // adds through `objectExtensions`. The door's scan (#30379) stamps it and
+    // asserts this exact string by value — pinned here too.
+    const code = 'PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE';
+    expect(ErrorCode.parse(code)).toBe(code);
+    expect(ERROR_CODE_LEDGER['@objectstack/runtime'], `${code} registered under runtime`).toContain(code);
+    expect(REGISTERED_ERROR_CODES).toContain(code);
+    // PACKAGE and DISABLE are tokens no standard member carries: not a synonym
+    // of DELETE_RESTRICTED or RESOURCE_CONFLICT, and no waiver.
+    expect(standardSynonymOf(code), `${code} needs no waiver`).toBeUndefined();
+    expect(STANDARD_SYNONYM_WAIVERS.map((w) => w.code)).not.toContain(code);
+    // Control leg: the detector still sees the RESTRICTED token, so the
+    // `undefined` above is a verdict, not a detector that went blind.
+    expect(standardSynonymOf('RESTRICTED_DELETE')).toBe('DELETE_RESTRICTED');
+  });
+
   it('accepts the nine-code batch — every code that ships in dist, door or no door (ruled: the ledger is the published face)', () => {
     // The #16404 ruling (director seat, decision batch #62, 2026-09-07, option
     // D): the published face is this ledger, so a code that ships in `dist` is
 
@@ -493,6 +493,26 @@ export const ERROR_CODE_LEDGER = {
     // direct-mount door of the same route; the two doors now state the same
     // failure the same way. Provenance, not identity (see above).
     'PACKAGE_DELETE_PARTIAL',
+    // [ADR-0141 Open item 4, ruling A on #30379] 409 from the package disable
+    // door (`PATCH /packages/:id/disable`, `domains/packages.ts`): the disable
+    // is refused because a validation rule of a package that stays enabled
+    // (any severity; an app's `.custom` pair, where tenant-written rules live,
+    // included) reads a field this package adds through `objectExtensions`.
+    // Disabling it would withhold that field, and every write to the object
+    // would then fail that rule. The refusal names each package · object ·
+    // rule triple it found, one or several. The remedy: disable or change the
+    // reading rule first, or keep this package enabled. A formula over the
+    // field is no reason to refuse: it answers `null`. Registered AHEAD of its
+    // producer (the `ACTION_CONFIRMATION_REQUIRED` split shape): the door's
+    // scan is #30379's and asserts this string by value. ⛔ NOT a `*_DISABLED`
+    // re-spelling: those name WHICH thing is off, and this names WHY a disable
+    // is refused, and the rule it names is what the operator acts on. Nor a
+    // mirror of `DEPENDENCY_MISSING`: no `manifest.dependencies` entry is
+    // read, so "RESTRICTED" (the standard `DELETE_RESTRICTED` word for a 409
+    // refused over a dependent) carries `BY_VALIDATION_RULE` to say which
+    // dependent. PACKAGE and DISABLE are tokens no standard member carries, so
+    // it needs no waiver.
+    'PACKAGE_DISABLE_RESTRICTED_BY_VALIDATION_RULE',
     'PROJECT_MEMBERSHIP_REQUIRED',
     'RECORD_GONE',                // share link resolves but the record was deleted
     'ROUTE_NOT_FOUND',