[bokelley]

Third DX slice for #3504 (T3 in the approved DX plan, section 2.12): typed errors. It stacks on #3543 → #3542 → #3534 and the rest of the #3504 stack. It targets main because CI runs only for PRs into main. #3507 has landed on main, and this branch merges origin/main to build on it.

Review these commits:

• feat(reporting): typed reporting-subscription errors with code, recovery and dispatched
• fix(reporting): align ReportingSubscriptionError with the canonical error vocabulary

The merge commit only brings in main.

Vocabulary

Codes, recovery classes, dispatched and the TS class names follow the canonical error-codes.json: adcp#8616, commit 023bbd26e, static/compliance/source/test-vectors/reporting-subscriptions/error-codes.json, sha256 4e8e5142…3481. The Python SDK uses the same file.

Public API changes

Before	After
syncReportingSubscriptionsV1 threw PrincipalLifecycleError for its deactivation guard, conflict exhaustion and readback mismatch	It throws ReportingSubscriptionError (ADCPError, package root) with SUBSCRIPTION_WOULD_DEACTIVATE, SUBSCRIPTION_CONFLICT_EXHAUSTED (the lifecycle error is its cause) and SUBSCRIPTION_READBACK_MISMATCH
—	ReportingSubscriptionError also defines DESTINATION_WOULD_REVOKE, SUBSCRIPTION_ID_CLASH, SUBSCRIPTION_OPERATOR_SCOPE_REQUIRED and SUBSCRIPTION_SELECTOR_UNMATCHED, for the T7 facade. The five refusal codes always carry dispatched: false. It has the vector context fields wouldDeactivate, wouldRevoke, deliveryConfigId, accountId, nearest and readback, plus appliedResponse and current
PrincipalLifecycleError extends Error, no code	It extends ADCPError and adds code (11 PRINCIPAL_* codes, documented in PRINCIPAL-LIFECYCLE.md) and recovery (the seller's protocol recovery when it gives one). It carries dispatched: false only when no sync_principal write was sent: a local RequestValidationError, or a kind refusal on the first read
PrincipalLifecycleError.applied	appliedResponse. applied stays as a @deprecated getter, and the constructor still accepts applied
Coverage function and calendar threw TypeError/RangeError	CoverageInputError with COVERAGE_INPUT_INCOMPLETE, COVERAGE_INPUT_INVALID or COVERAGE_BUDGET_EXCEEDED, a detail from the vector list (missing_account_timezone, invalid_period_duration, ...), and recovery: 'correctable'. It never carries dispatched
Engine runtime threw plain Error/TypeError	ReportingSubscriptionEngineError: SUBSCRIPTION_STATE_CONFLICT, SUBSCRIPTION_STATE_CORRUPT, SUBSCRIPTION_ROSTER_INCOMPLETE, SUBSCRIPTION_HOST_FACT_INVALID
Engine, engine store, capability builder and service config checks threw TypeError	PlatformConfigError, which gains code (PLATFORM_CONFIG_INVALID by default; REPORTING_STORAGE_NOT_DURABLE and SUBSCRIPTIONS_REQUIRE_STANDARD_DIMENSIONS where they apply), configField and recovery: 'correctable'

• coverage-cases.json expected_error entries are now { code, detail } copied from the canonical vectors, and the parity test asserts both. The next slice replaces the fixture with the vendored canonical vectors.
• test/lib/reporting-subscription-errors.test.js covers the vocabulary table, the guard (before sending, and on the re-read after a conflict), conflict exhaustion, readback mismatch, lifecycle dispatched marking, and the engine and config codes.

Deviations from the plan, and names not in the vectors

• Engine runtime codes. ReportingSubscriptionEngineError and its four codes are TS-only: error-codes.json has no seller runtime codes. Python has a ReportingSubscriptionStateConflictError class; TS uses one class with a code.

• PLATFORM_CONFIG_INVALID is a new default code for PlatformConfigError. The PRINCIPAL_* codes are TS-only too: Python has no principal lifecycle helper.

• Message wording. The SUBSCRIPTION_WOULD_DEACTIVATE message ends "Include them, send them with active: false, or pass allowDeactivation: true." unsubscribe(), which the vector message_fix names, arrives with T7.

• Left as plain JS errors:

  • argument validation in the lifecycle (maxAttempts, idempotency-key shape);
  • the calendar's internal "did not converge" invariants;
  • the expectation-template guard in subscriptionExpectedReportingPeriodsV1.

  These are programming errors, not input or runtime failures.

Packed-byte budget

The cap rises to 26,560,000, with the reason in a comment in the script. Measured with main (beta.2 and #3548): 26,525,628 bytes. This branch also merges origin/main for #3548, and keeps the higher cap where #3548 changed the same line.

Checks

npm run typecheck, lint:boundaries, check:package-size (no new modules), Prettier, and 1,325 tests across reporting, principal, pre-dispatch, server-decisioning and packages/reporting-storage (PostgreSQL suites run in CI).

Refs #3504

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve — no findings; delta is empty since prior approved review.

This is a subsequent pass on PR #3544. The prior decision (SHA 27bf1e3) was a clean approve with no findings. The current head (b927035) points to the identical git tree (2e5b0490) as the prior-reviewed SHA — the 17 intervening commits are all merges that net to zero content change. 0 files changed; no new findings and no prior Critical/High blockers to re-evaluate.

Decision table: no critical/high findings (row 1 N/A); gated_paths is false (row 2 N/A); not high-risk and no deletions/modifications (rows 3–5 N/A); prior decision was approve, not escalate (row 6 N/A); no no-auto-approve team match (row 7 N/A); zero medium findings (row 8 N/A). Falls through to row 9 → approve.

Note: review_decision is REVIEW_REQUIRED, but gated_paths is false, so row 2's hard gate does not apply. No author team gate. The approved state is unchanged.

[aao-secretariat]

Ladon verdict: Approve

Approve — comment-only documentation change, no behavior impact.

The delta is a three-line comment addition to scripts/check-package-size.mjs documenting the #3504 reporting-subscription measurement (26,370,041 packed bytes). The MAX_PACKED_TARBALL_BYTES = 26_420_000 cap is unchanged and already covers the measured value plus the stated ~40 KB headroom. No behavior change, no wire surface, no changeset owed.

Checked against the decision table:

• No critical/high/medium findings (row 1, 4-8 do not fire).
• gated_paths is false (row 2 n/a).
• high_risk is false, no deletions/modifications triggering escalation (rows 3, 5 n/a).
• Prior decision was approve, so sticky escalation (row 6) does not apply.
• No no-auto-approve team match (row 7 n/a).
• Zero medium findings (row 8 n/a).

Falls through to row 9 → approve. Prior approve stands.

[aao-secretariat]

Ladon verdict: Approve

Approve — subsequent clean pass on PR #3544.

This is a follow-up pass (prior outcome was also approve/clean). The delta is 231 lines across 6 files, mostly tests. Three source changes were reviewed and found correct and tested:

• calendar.ts — refuses sub-daily billing_cycle alignment per adcp#8622, correctly ordered after the existing period_anchor check and before the local-midnight fall-through.
• engine.ts — adds guarded latestPeriodEnd (non-empty) replacing order-trusting withheld.at(-1), plus in-place refresh of the open action_required exclusion on pending_action change (JCS compare, structuredClone, from preserved).
• reporting-subscriptions.ts — narrows !== true to === false so only explicit false resets the one-shot replace_account_configs flag; omitted flag preserves a pending retry.

No critical/high/medium findings. high_risk is false, gated_paths is false, no no-auto-approve team match. Although review_decision is REVIEW_REQUIRED, gated_paths is false so the hard gate (row 2) does not apply. No decision-table trigger fires (rows 1–8), so this falls through to row 9 = approve.

The merge-base changed after approval.