docs(rest): correct the packages envelope suite's stale note on the code vocabulary (#3843 follow-up)

.changeset/packages-envelope-suite-comment.md

@@ -0,0 +1,14 @@
+---
+---
+
+Comment-only correction in `packages/rest/src/package-envelope.conformance.test.ts`
+(#3843 follow-up). Deliberately empty frontmatter: this releases nothing.
+
+Two sentences in that suite's header were written while #3841 was still undecided —
+"why #3841 still owns the vocabulary" (ADR-0112 has since closed it) and "this
+module needed MINTED codes" (true only of the four registered ones; the three
+generic conditions reuse the standard catalog). `package-routes.ts` already carried
+the corrected note; this was the test file missed beside it.
+
+No published behaviour, type, or wire shape changes, so there is nothing for a
+consumer to read in a CHANGELOG.

packages/rest/src/package-envelope.conformance.test.ts

@@ -16,10 +16,18 @@
  *     res.status(400).json({ success: false, failed, cleanups });
  *     res.status(400).json({ success: false });
  *
- * i.e. a caller was told it failed and never told why. Those two are the reason
- * this module needed MINTED codes rather than carried-over ones: there was
- * nothing to carry. See `sendError`'s note in `package-routes.ts` for why the
- * SCREAMING_SNAKE dialect was chosen and why #3841 still owns the vocabulary.
+ * i.e. a caller was told it failed and never told why. They are also why this
+ * module had no codes to carry over: its `error` strings were human messages, so
+ * every code here had to be chosen rather than re-spelled.
+ *
+ * ADR-0112 (#3841) settled the vocabulary, so the choice was not free. Generic
+ * conditions reuse the STANDARD catalog — `MISSING_REQUIRED_FIELD`,
+ * `RESOURCE_NOT_FOUND`, `INTERNAL_ERROR` — and only the package-specific outcomes
+ * are registered in `ERROR_CODE_LEDGER` (`PACKAGE_MANIFEST_INVALID`,
+ * `PACKAGE_PUBLISH_FAILED`, `PACKAGE_DELETE_PARTIAL`, `PACKAGE_DELETE_FAILED`);
+ * see `sendError`'s note in `package-routes.ts`. `ApiErrorSchema.code` is a closed
+ * union now, so an unregistered code fails parse — which is what makes the
+ * `BaseResponseSchema.safeParse` assertions below catch an invented one.
  *
  * The three bodies that already had the flag kept their payload as SIBLINGS of
  * it (`{ success: true, message, package }`); the assertions below pin that they