okengine 0.18.4 → 0.19.0

package/src/kernel/errors-live-resume.ts

@@ -1,5 +1,5 @@
 /**
- * OKE1014 — kept off the Store-only `oke()` graph.
+ * OKE1210 — kept off the Store-only `oke()` graph.
  *
  * Signal drivers throw this when a Last-Event-ID is missing from the tape.
  * Loaded via computed `import.meta.require` from {@link lookupOkeError}.
@@ -9,7 +9,8 @@ import type { OkeErrorDefinition } from "./errors.ts";
 
 /** Last-Event-ID is missing from the retained live tape. */
 export const LIVE_RESUME_GAP: OkeErrorDefinition = {
-  code: 1014,
+  code: 1210,
+  domain: "signal",
   cause: 'Cursor "{afterId}" missing on "{signal}".',
   fix: "Reconnect without Last-Event-ID.",
 };

package/src/kernel/errors-tenant.ts

@@ -1,5 +1,5 @@
 /**
- * OKE1015–1017 — kept off the Store-only `oke()` graph.
+ * OKE1810–1830 — kept off the Store-only `oke()` graph.
  *
  * Tenant KV/vault and membership failures. Loaded via computed
  * `import.meta.require` from {@link throwOke} / {@link lookupOkeError}.
@@ -9,21 +9,24 @@ import type { OkeErrorDefinition } from "./errors.ts";
 
 /** Tenant-scoped op ran with no resolved `fx.tenant.id`. */
 export const TENANT_REQUIRED: OkeErrorDefinition = {
-  code: 1015,
+  code: 1810,
+  domain: "mcp_tenancy",
   cause: "This operation needs a tenant, but none is resolved for this request.",
   fix: "Call fx.auth.switchTenant(id), send a signed tid claim, or pass the tenant header.",
 };
 
 /** Client-supplied tenant id is not a real membership. */
 export const TENANT_NOT_MEMBER: OkeErrorDefinition = {
-  code: 1016,
+  code: 1820,
+  domain: "mcp_tenancy",
   cause: 'The caller is not a member of tenant "{tenant}".',
   fix: "Pick a tenant from fx.auth.listTenants() or add the user as a member.",
 };
 
 /** Tenant role mapped an invented or operator-plane scope. */
 export const TENANT_UNKNOWN_SCOPE: OkeErrorDefinition = {
-  code: 1017,
+  code: 1830,
+  domain: "mcp_tenancy",
   cause: 'Tenant role scope "{scope}" is not a declared application scope.',
   fix: "Use a name from this app's Manifest catalog (never console:*).",
 };

package/src/kernel/errors.registry-helpers.ts

@@ -0,0 +1,96 @@
+/**
+ * Registry gate helpers — uniqueness, domain-range correctness, lazy discovery.
+ * Used only by `errors.registry.test.ts` (not a public runtime API).
+ */
+
+import { readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { OKE_ERROR_RANGES, type OkeErrorDefinition, type OkeErrorDomain } from "./errors.ts";
+
+const LAZY_FILE_RE = /^errors-.+\.ts$/;
+
+/** True when `value` looks like a full {@link OkeErrorDefinition}. */
+export function isOkeErrorDefinition(value: unknown): value is OkeErrorDefinition {
+  if (value === null || typeof value !== "object") return false;
+  const v = value as Record<string, unknown>;
+  return (
+    typeof v.code === "number" &&
+    Number.isInteger(v.code) &&
+    typeof v.domain === "string" &&
+    typeof v.cause === "string" &&
+    typeof v.fix === "string"
+  );
+}
+
+/** Collect every `OkeErrorDefinition` export from a module namespace. */
+export function collectDefsFromModule(mod: Record<string, unknown>): readonly OkeErrorDefinition[] {
+  const out: OkeErrorDefinition[] = [];
+  for (const value of Object.values(mod)) {
+    if (isOkeErrorDefinition(value)) out.push(value);
+  }
+  return out;
+}
+
+/**
+ * Discover lazy error chunks: every `errors-*.ts` file in `dir`
+ * (excludes `errors.ts` itself via the hyphen requirement).
+ *
+ * @param dir - Absolute directory to scan (typically `import.meta.dir`)
+ */
+export async function discoverLazyErrorDefs(dir: string): Promise<{
+  readonly files: readonly string[];
+  readonly defs: readonly OkeErrorDefinition[];
+}> {
+  const names = (await readdir(dir)).filter((name) => LAZY_FILE_RE.test(name)).sort();
+  const defs: OkeErrorDefinition[] = [];
+  for (const name of names) {
+    const mod = (await import(join(dir, name))) as Record<string, unknown>;
+    defs.push(...collectDefsFromModule(mod));
+  }
+  return { files: names, defs };
+}
+
+/** Return duplicate numeric codes, or an empty array if all unique. */
+export function findDuplicateCodes(defs: readonly OkeErrorDefinition[]): readonly number[] {
+  const seen = new Set<number>();
+  const dupes: number[] = [];
+  for (const def of defs) {
+    if (seen.has(def.code)) dupes.push(def.code);
+    else seen.add(def.code);
+  }
+  return dupes;
+}
+
+/** Return defs whose code falls outside `OKE_ERROR_RANGES[domain]`. */
+export function findOutOfRangeDefs(
+  defs: readonly OkeErrorDefinition[],
+): readonly OkeErrorDefinition[] {
+  const bad: OkeErrorDefinition[] = [];
+  for (const def of defs) {
+    const range = OKE_ERROR_RANGES[def.domain as OkeErrorDomain];
+    if (!range) {
+      bad.push(def);
+      continue;
+    }
+    const [lo, hi] = range;
+    if (def.code < lo || def.code > hi) bad.push(def);
+  }
+  return bad;
+}
+
+/** Throw if any code is duplicated. */
+export function assertUniqueCodes(defs: readonly OkeErrorDefinition[]): void {
+  const dupes = findDuplicateCodes(defs);
+  if (dupes.length > 0) {
+    throw new Error(`Duplicate OKE error codes: ${dupes.join(", ")}`);
+  }
+}
+
+/** Throw if any code is outside its declared domain range. */
+export function assertCodesInDomainRanges(defs: readonly OkeErrorDefinition[]): void {
+  const bad = findOutOfRangeDefs(defs);
+  if (bad.length > 0) {
+    const detail = bad.map((d) => `OKE${d.code} domain=${d.domain}`).join("; ");
+    throw new Error(`OKE error codes outside domain range: ${detail}`);
+  }
+}

package/src/kernel/errors.registry.test.ts

@@ -1,48 +1,147 @@
 /**
- * Error-code registry gate — unique codes, cause/fix/docsUrl shape (§21).
+ * Error-code registry gate — unique codes, domain ranges, lazy discovery (§21).
  *
  * Docs pages (docs/e/{code}.md) are deferred to a dedicated docs prompt;
  * this gate enforces registry invariants only.
  */
 
-import { describe, expect, test } from "bun:test";
-import { OKE_ERRORS, OkeError, lookupOkeError, type OkeErrorDefinition } from "./errors.ts";
+import { afterAll, describe, expect, test } from "bun:test";
+import { unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import {
+  OKE_ERROR_RANGES,
+  OKE_ERRORS,
+  OkeError,
+  lookupOkeError,
+  type OkeErrorDefinition,
+} from "./errors.ts";
 import { LIVE_RESUME_GAP } from "./errors-live-resume.ts";
+import { CHANNEL_SCHEMA } from "./errors-channel.ts";
 import { TENANT_NOT_MEMBER, TENANT_REQUIRED, TENANT_UNKNOWN_SCOPE } from "./errors-tenant.ts";
+import {
+  assertCodesInDomainRanges,
+  assertUniqueCodes,
+  discoverLazyErrorDefs,
+  findDuplicateCodes,
+  findOutOfRangeDefs,
+} from "./errors.registry-helpers.ts";
 
-const LAZY_DEFS: readonly OkeErrorDefinition[] = [
-  LIVE_RESUME_GAP,
-  TENANT_REQUIRED,
-  TENANT_NOT_MEMBER,
-  TENANT_UNKNOWN_SCOPE,
-];
+const KERNEL_DIR = import.meta.dir;
+const PROBE_FILE = "errors-__probe__.ts";
+const PROBE_PATH = join(KERNEL_DIR, PROBE_FILE);
 
 describe("OKE error-code registry", () => {
-  test("every code is unique", () => {
-    const codes = [
-      ...Object.values(OKE_ERRORS).map((d) => d.code),
-      ...LAZY_DEFS.map((d) => d.code),
-    ];
-    expect(new Set(codes).size).toBe(codes.length);
+  test("every code is unique across main + discovered lazy defs", async () => {
+    const { defs: lazy } = await discoverLazyErrorDefs(KERNEL_DIR);
+    const all = [...Object.values(OKE_ERRORS), ...lazy];
+    expect(findDuplicateCodes(all)).toEqual([]);
+    assertUniqueCodes(all);
   });
 
-  test("every entry has non-empty cause and fix templates", () => {
+  test("every code falls within its declared domain range", async () => {
+    const { defs: lazy } = await discoverLazyErrorDefs(KERNEL_DIR);
+    const all = [...Object.values(OKE_ERRORS), ...lazy];
+    expect(findOutOfRangeDefs(all)).toEqual([]);
+    assertCodesInDomainRanges(all);
+  });
+
+  test("OKE_ERROR_RANGES matches the locked domain scheme", () => {
+    expect(OKE_ERROR_RANGES.kernel).toEqual([1000, 1099]);
+    expect(OKE_ERROR_RANGES.store).toEqual([1100, 1199]);
+    expect(OKE_ERROR_RANGES.signal).toEqual([1200, 1299]);
+    expect(OKE_ERROR_RANGES.clock).toEqual([1300, 1399]);
+    expect(OKE_ERROR_RANGES.gate).toEqual([1400, 1499]);
+    expect(OKE_ERROR_RANGES.vault).toEqual([1500, 1599]);
+    expect(OKE_ERROR_RANGES.channel).toEqual([1600, 1699]);
+    expect(OKE_ERROR_RANGES.ai).toEqual([1700, 1799]);
+    expect(OKE_ERROR_RANGES.mcp_tenancy).toEqual([1800, 1899]);
+    expect(OKE_ERROR_RANGES.compiler).toEqual([1900, 1999]);
+  });
+
+  test("lazy discovery finds live-resume, channel, and tenant modules without a hand list", async () => {
+    const { files, defs } = await discoverLazyErrorDefs(KERNEL_DIR);
+    expect(files).toContain("errors-live-resume.ts");
+    expect(files).toContain("errors-channel.ts");
+    expect(files).toContain("errors-tenant.ts");
+    const codes = defs.map((d) => d.code);
+    expect(codes).toContain(1210);
+    expect(codes).toContain(1605);
+    expect(codes).toContain(1810);
+    expect(codes).toContain(1820);
+    expect(codes).toContain(1830);
+  });
+
+  test("adversarial: out-of-range synthetic def fails range check", () => {
+    const bad: OkeErrorDefinition = {
+      code: 1999,
+      domain: "kernel",
+      cause: "probe",
+      fix: "probe",
+    };
+    expect(findOutOfRangeDefs([bad])).toEqual([bad]);
+    expect(() => assertCodesInDomainRanges([bad])).toThrow(/outside domain range/);
+  });
+
+  test("adversarial: duplicate synthetic def fails uniqueness check", () => {
+    const clone: OkeErrorDefinition = {
+      ...OKE_ERRORS.UNDECLARED_READ,
+      cause: "dup",
+      fix: "dup",
+    };
+    expect(findDuplicateCodes([OKE_ERRORS.UNDECLARED_READ, clone])).toEqual([1001]);
+    expect(() => assertUniqueCodes([OKE_ERRORS.UNDECLARED_READ, clone])).toThrow(/Duplicate/);
+  });
+
+  test("adversarial: filesystem probe is discovered and fails range/uniqueness", async () => {
+    await writeFile(
+      PROBE_PATH,
+      [
+        'import type { OkeErrorDefinition } from "./errors.ts";',
+        "export const PROBE_OUT_OF_RANGE: OkeErrorDefinition = {",
+        "  code: 1999,",
+        '  domain: "kernel",',
+        '  cause: "adversarial probe",',
+        '  fix: "delete this file",',
+        "};",
+        "",
+      ].join("\n"),
+      "utf8",
+    );
+    try {
+      const { files, defs } = await discoverLazyErrorDefs(KERNEL_DIR);
+      expect(files).toContain(PROBE_FILE);
+      const probe = defs.find((d) => d.code === 1999);
+      expect(probe).toBeDefined();
+      const all = [...Object.values(OKE_ERRORS), ...defs];
+      expect(findOutOfRangeDefs(all).some((d) => d.code === 1999)).toBe(true);
+      expect(() => assertCodesInDomainRanges(all)).toThrow(/OKE1999/);
+    } finally {
+      await unlink(PROBE_PATH).catch(() => undefined);
+    }
+  });
+
+  afterAll(async () => {
+    await unlink(PROBE_PATH).catch(() => undefined);
+  });
+
+  test("every entry has non-empty cause and fix templates", async () => {
+    const { defs: lazy } = await discoverLazyErrorDefs(KERNEL_DIR);
     for (const [key, def] of Object.entries(OKE_ERRORS)) {
       expect(def.cause.trim().length, `${key}.cause`).toBeGreaterThan(0);
       expect(def.fix.trim().length, `${key}.fix`).toBeGreaterThan(0);
       expect(Number.isInteger(def.code), `${key}.code`).toBe(true);
       expect(def.code, `${key}.code`).toBeGreaterThan(0);
+      expect(def.domain, `${key}.domain`).toBeTruthy();
     }
-    expect(LIVE_RESUME_GAP.cause.trim().length).toBeGreaterThan(0);
-    expect(LIVE_RESUME_GAP.fix.trim().length).toBeGreaterThan(0);
-    for (const def of LAZY_DEFS) {
+    for (const def of lazy) {
       expect(def.cause.trim().length, `${def.code}.cause`).toBeGreaterThan(0);
       expect(def.fix.trim().length, `${def.code}.fix`).toBeGreaterThan(0);
     }
   });
 
-  test("OkeError docsUrl matches docs origin /e/{code}", () => {
-    for (const def of [...Object.values(OKE_ERRORS), ...LAZY_DEFS] as OkeErrorDefinition[]) {
+  test("OkeError docsUrl matches docs origin /e/{code}", async () => {
+    const { defs: lazy } = await discoverLazyErrorDefs(KERNEL_DIR);
+    for (const def of [...Object.values(OKE_ERRORS), ...lazy] as OkeErrorDefinition[]) {
       const err = new OkeError(def);
       expect(err.docsUrl).toBe(`https://oke.omqkhafi.dev/e/${def.code}`);
       expect(err.message).toContain(err.docsUrl);
@@ -52,12 +151,27 @@ describe("OKE error-code registry", () => {
   });
 
   test("lookupOkeError finds the lazy LIVE_RESUME_GAP entry", () => {
-    expect(lookupOkeError(1014)).toEqual(LIVE_RESUME_GAP);
+    expect(lookupOkeError(1210)).toEqual(LIVE_RESUME_GAP);
+  });
+
+  test("lookupOkeError finds the lazy CHANNEL_SCHEMA entry", () => {
+    expect(lookupOkeError(1605)).toEqual(CHANNEL_SCHEMA);
   });
 
   test("lookupOkeError finds lazy tenant entries", () => {
-    expect(lookupOkeError(1015)).toEqual(TENANT_REQUIRED);
-    expect(lookupOkeError(1016)).toEqual(TENANT_NOT_MEMBER);
-    expect(lookupOkeError(1017)).toEqual(TENANT_UNKNOWN_SCOPE);
+    expect(lookupOkeError(1810)).toEqual(TENANT_REQUIRED);
+    expect(lookupOkeError(1820)).toEqual(TENANT_NOT_MEMBER);
+    expect(lookupOkeError(1830)).toEqual(TENANT_UNKNOWN_SCOPE);
+  });
+
+  test("lookupOkeError finds UNDECLARED_EMBED at 1009 (not tenant)", () => {
+    expect(lookupOkeError(1009)).toEqual(OKE_ERRORS.UNDECLARED_EMBED);
+    expect(OKE_ERRORS.UNDECLARED_EMBED.code).toBe(1009);
+    expect(TENANT_REQUIRED.code).toBe(1810);
+  });
+
+  test("NO_EFFECTS_DECLARED owns 1020 after renumber (was UNDECLARED_EMBED)", () => {
+    expect(OKE_ERRORS.NO_EFFECTS_DECLARED.code).toBe(1020);
+    expect(OKE_ERRORS.UNDECLARED_EMBED.code).toBe(1009);
   });
 });

package/src/kernel/errors.ts

@@ -30,13 +30,46 @@ function loadFailureMessage(): typeof import("../i18n/failure-message.ts") {
   }
 }
 
-/** Numeric OKE error code (permanent once published). */
+/** Numeric OKE error code (stable after the domain-range renumber). */
 export type OkeErrorCode = number;
 
+/**
+ * Error domain — each maps to a fixed numeric range in {@link OKE_ERROR_RANGES}.
+ * Kernel covers Flow/Trigger/Gate-posture (boot structural). Gate sessions/OAuth
+ * live in `gate`; MCP + tenancy share `mcp_tenancy`.
+ */
+export type OkeErrorDomain =
+  | "kernel"
+  | "store"
+  | "signal"
+  | "clock"
+  | "gate"
+  | "vault"
+  | "channel"
+  | "ai"
+  | "mcp_tenancy"
+  | "compiler";
+
+/** Inclusive `[lo, hi]` band for each {@link OkeErrorDomain}. */
+export const OKE_ERROR_RANGES = {
+  kernel: [1000, 1099],
+  store: [1100, 1199],
+  signal: [1200, 1299],
+  clock: [1300, 1399],
+  gate: [1400, 1499],
+  vault: [1500, 1599],
+  channel: [1600, 1699],
+  ai: [1700, 1799],
+  mcp_tenancy: [1800, 1899],
+  compiler: [1900, 1999],
+} as const satisfies Record<OkeErrorDomain, readonly [number, number]>;
+
 /** One registry entry — cause/fix may include `{name}` placeholders. */
 export interface OkeErrorDefinition {
-  /** Permanent numeric code. */
+  /** Permanent numeric code (must fall in {@link OKE_ERROR_RANGES} for `domain`). */
   readonly code: OkeErrorCode;
+  /** Domain that owns this code's numeric range. */
+  readonly domain: OkeErrorDomain;
   /** One-line cause template. */
   readonly cause: string;
   /** Suggested fix template. */
@@ -112,65 +145,97 @@ export interface FailOptions {
 }
 
 /**
- * Permanent error registry. Codes never change meaning once published.
+ * Permanent error registry. Codes are stable within their domain range after
+ * the domain-range renumber; each entry declares `domain` for range guards.
  *
- * Ranges (convention):
- * - `1000–1099` — capability / undeclared-effect violations
- * - `1042` — reserved by unified-theory §21 example (orphan emit)
+ * Ranges:
+ * - `1000–1099` — Kernel (Flow / Trigger / Gate-posture)
+ * - `1100–1199` — Store
+ * - `1200–1299` — Signal
+ * - `1300–1399` — Clock
+ * - `1400–1499` — Gate (sessions / OAuth / API keys)
+ * - `1500–1599` — Vault
+ * - `1600–1699` — Channel
+ * - `1700–1799` — AI
+ * - `1800–1899` — MCP + Tenancy
+ * - `1900–1999` — Compiler / Manifest
  */
 export const OKE_ERRORS = {
   /** Flow reads a store resource not listed in `effects.reads`. */
   UNDECLARED_READ: {
     code: 1001,
+    domain: "kernel",
     cause: 'Flow "{flow}" reads "{resource}" without declaring it.',
     fix: 'Add "{resource}" to this flow\'s effects.reads.',
   },
   /** Flow writes a store resource not listed in `effects.writes`. */
   UNDECLARED_WRITE: {
     code: 1002,
+    domain: "kernel",
     cause: 'Flow "{flow}" writes "{resource}" without declaring it.',
     fix: 'Add "{resource}" to this flow\'s effects.writes.',
   },
   /** Flow emits a signal not listed in `effects.emits`. */
   UNDECLARED_EMIT: {
     code: 1003,
+    domain: "kernel",
     cause: 'Flow "{flow}" emits "{resource}" without declaring it.',
     fix: 'Add "{resource}" to this flow\'s effects.emits.',
   },
   /** Flow sends a channel template not listed in `effects.sends`. */
   UNDECLARED_SEND: {
     code: 1004,
+    domain: "kernel",
     cause: 'Flow "{flow}" sends "{resource}" without declaring it.',
     fix: 'Add "{resource}" to this flow\'s effects.sends.',
   },
   /** Flow asks a prompt not listed in `effects.asks`. */
   UNDECLARED_ASK: {
     code: 1005,
+    domain: "kernel",
     cause: 'Flow "{flow}" asks "{resource}" without declaring it.',
     fix: 'Add "{resource}" to this flow\'s effects.asks.',
   },
   /** Flow reads a secret not listed in `effects.secrets`. */
   UNDECLARED_SECRET: {
     code: 1006,
+    domain: "kernel",
     cause: 'Flow "{flow}" reads secret "{resource}" without declaring it.',
     fix: 'Add "{resource}" to this flow\'s effects.secrets.',
   },
   /** Flow calls another flow not listed in `effects.calls`. */
   UNDECLARED_CALL: {
     code: 1007,
+    domain: "kernel",
     cause: 'Flow "{flow}" calls "{resource}" without declaring it.',
     fix: 'Add "{resource}" to this flow\'s effects.calls.',
   },
+  /** Flow fetches a host not listed in `effects.fetches`. */
+  UNDECLARED_FETCH: {
+    code: 1008,
+    domain: "kernel",
+    cause: 'Flow "{flow}" fetches "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.fetches.',
+  },
+  /** Flow embeds via a model not listed in `effects.embeds`. */
+  UNDECLARED_EMBED: {
+    code: 1009,
+    domain: "kernel",
+    cause: 'Flow "{flow}" embeds with "{resource}" without declaring it.',
+    fix: 'Add "{resource}" to this flow\'s effects.embeds.',
+  },
   /**
    * Flow has no declared `effects` and no Manifest-derived effects were
    * available to stamp at boot (dev+compose / prod — never a silent open token).
    */
   NO_EFFECTS_DECLARED: {
-    code: 1008,
+    code: 1020,
+    domain: "kernel",
     cause: 'Flow "{flow}" has no declared effects and no Manifest to derive them from.',
     fix:
       "Add explicit `effects` to this flow, or boot with a Manifest (`oke build`) / " +
-      "`rootDir` so effects can be derived. dev+compose/prod refuse an open capability token.",
+      "`rootDir` so effects can be derived. If extract failed, ensure `oxc-parser` is " +
+      "installed (okengine dependency). dev+compose/prod refuse an open capability token.",
   },
   /**
    * A `src/flows/<unit>` folder exists on disk but no adopted flow carries
@@ -179,7 +244,8 @@ export const OKE_ERRORS = {
    * route table in a deploy-shaped environment.
    */
   ADOPT_BARREL_STALE: {
-    code: 1009,
+    code: 1030,
+    domain: "kernel",
     cause: "src/flows/{unit} exists on disk but adopted no flows — the .adopt() barrel is stale.",
     fix: "Run `oke dev` or `oke build` to regenerate `src/flows/generated.ts`.",
   },
@@ -187,7 +253,8 @@ export const OKE_ERRORS = {
    * `http.get()` was never stamped from the file tree — refuse a silent `/`.
    */
   HTTP_PATH_UNRESOLVED: {
-    code: 1010,
+    code: 1040,
+    domain: "kernel",
     cause: 'Flow "{flow}" bound {method} with no path — the file-tree stamp never ran.',
     fix: 'Put the file under `src/flows/<unit>/` and import `@/flows/generated`, or pass an explicit path to `http.{method}("/…")`.',
   },
@@ -195,7 +262,8 @@ export const OKE_ERRORS = {
    * Two HTTP bindings share method + path — last-add-wins is the opposite of this DX.
    */
   HTTP_ROUTE_DUPLICATE: {
-    code: 1011,
+    code: 1041,
+    domain: "kernel",
     cause: '{method} {path} is bound twice (flow "{flow}").',
     fix: "Give each HTTP flow a unique method + path.",
   },
@@ -203,7 +271,8 @@ export const OKE_ERRORS = {
    * Adopted HTTP flow still has no name (`flow({ do })` outside a unit).
    */
   HTTP_FLOW_UNNAMED: {
-    code: 1012,
+    code: 1045,
+    domain: "kernel",
     cause: "An HTTP flow on {method} {path} has no name.",
     fix: 'Use `flow("unit.export", {…})` or export it from a `src/flows/<unit>/` file so the tree can stamp `unit.export`.',
   },
@@ -211,7 +280,8 @@ export const OKE_ERRORS = {
    * Two live HTTP exposures of the same signal share gates + match shape.
    */
   LIVE_EXPOSURE_DUPLICATE: {
-    code: 1013,
+    code: 1050,
+    domain: "kernel",
     cause:
       'Live signal "{signal}" is exposed twice with the same gates ({gates}) and match ({match}).',
     fix: "Use a different gate or path-param filter, or drop the extra route.",
@@ -220,7 +290,8 @@ export const OKE_ERRORS = {
    * Two MCP tool bindings share the same exposed tool name.
    */
   MCP_TOOL_DUPLICATE: {
-    code: 1018,
+    code: 1060,
+    domain: "kernel",
     cause: 'MCP tool "{tool}" is bound twice (flow "{flow}").',
     fix: "Give each MCP tool exposure a unique tool name.",
   },
@@ -229,22 +300,24 @@ export const OKE_ERRORS = {
    * Thrown at emit when `optional` is false and nobody is subscribed.
    */
   ORPHAN_EMIT: {
-    code: 1042,
+    code: 1240,
+    domain: "signal",
     cause: 'Flow "{flow}" emits signal "{resource}" with no subscriber.',
     fix: "Add `on({resource}, …)` or mark the signal `{ optional: true }`.",
   },
   /** Emit payload failed the signal's declared Standard Schema. */
   SIGNAL_SCHEMA: {
-    code: 1043,
+    code: 1250,
+    domain: "signal",
     cause: '"{resource}": {detail}',
     fix: "Fix schema payload.",
   },
   /**
    * Domain table/column missing under docker/prod (migrations not applied).
-   * Store/DDL band starts at 1100.
    */
   DOMAIN_SCHEMA_MISSING: {
-    code: 1101,
+    code: 1110,
+    domain: "store",
     cause: "domain table not found — migrations have not been applied.",
     fix: "run `oke db migrate` against this environment.",
   },
@@ -260,7 +333,7 @@ type TenantErrorChunk = {
 };
 
 /**
- * Load OKE1015–1017. Computed stem so Bun.build cannot inline the chunk.
+ * Load OKE1810–1830. Computed stem so Bun.build cannot inline the chunk.
  */
 function loadTenantErrors(): TenantErrorChunk {
   return lazyRequire(import.meta.dir, ["errors", "tenant"].join("-"));
@@ -289,15 +362,21 @@ export function throwOke(
  * @param code - Permanent numeric code
  */
 export function lookupOkeError(code: OkeErrorCode): OkeErrorDefinition | undefined {
-  if (code === 1014) {
+  if (code === 1210) {
     return lazyRequire<typeof import("./errors-live-resume.ts")>(
       import.meta.dir,
       ["errors", "live", "resume"].join("-"),
     ).LIVE_RESUME_GAP;
   }
-  if (code === 1015) return loadTenantErrors().TENANT_REQUIRED;
-  if (code === 1016) return loadTenantErrors().TENANT_NOT_MEMBER;
-  if (code === 1017) return loadTenantErrors().TENANT_UNKNOWN_SCOPE;
+  if (code === 1605) {
+    return lazyRequire<typeof import("./errors-channel.ts")>(
+      import.meta.dir,
+      ["errors", "channel"].join("-"),
+    ).CHANNEL_SCHEMA;
+  }
+  if (code === 1810) return loadTenantErrors().TENANT_REQUIRED;
+  if (code === 1820) return loadTenantErrors().TENANT_NOT_MEMBER;
+  if (code === 1830) return loadTenantErrors().TENANT_UNKNOWN_SCOPE;
   for (const def of Object.values(OKE_ERRORS)) {
     if (def.code === code) return def;
   }