Module error 

The structured isError:true envelope (WBSV-06) — machine-actionable repair payloads that ride in structuredContent, NEVER a JSON-RPC protocol error, and ALWAYS carry the provenance stamp (on the failure path too).

Domain failure vs infrastructure failure (Codex LOW)

to_iserror_result is for domain failures — invalid input, an out-of-range / non-finite output, a strict-constant override. A domain failure returns isError:true INSIDE structuredContent and never a protocol Err: pmcp tool dispatch hardcodes the protocol CallToolResult.is_error to false, so the only machine-actionable error channel is the structured payload.

An infrastructure failure (a poisoned/malformed in-memory bundle state, a resource-handler internal fault, a genuine bug) is a DIFFERENT class and MAY still surface as a protocol Err. This module deliberately does NOT blanket every fault into a domain envelope — only the modelled domain failures route through WorkbookToolError.

The self-repair code table (Gemini)

Every WorkbookToolError code is a STABLE machine-readable string — the primary signal the MCP App widget reads to repair a call. The four codes and their UI self-repair meaning:

code	When	Self-repair fields	UI meaning
invalid_input	arg-parse / dtype / enum-membership failure, or an unknown input field	field, allowed	“this argument is malformed or out of the allowed set — fix it to a listed value”
missing_field	a required input is absent	field, required	“supply the listed required field(s)”
unsupported_option	an override names no manifest cell	field, allowed	“this override is not a known variable-tier parameter — pick a listed one”
strict_constant_override	a BA-governed strict constant supplied as input	field, allowed	“this value is BA-governed and cannot be overridden per-call — set a listed variable-tier parameter instead”

Each code is stable across releases; the allowed/required/range/field repair fields are present only when applicable (“allowed-values live in the error”). The two SHAPE-ONLY deferred codes (stale_oracle, unapproved_assumption) from the lighthouse have NO runtime trigger and are intentionally NOT lifted (STATE.md Deferred Items: “Wire deferred error triggers — Deferred v2.x”).

Structs

WorkbookToolError

One structured tool-execution error (WBSV-06): a machine-actionable repair payload. The agent reads allowed/range/required to repair the call — “allowed-values live in the error”.

Functions

to_iserror_result

Render a WorkbookToolError into the isError:true payload carrying the provenance stamp (on the failure path too). Returned as a bare Value — the widget-meta tool routes it into structuredContent where the isError:true marker + repair fields survive dispatch.