fix: align protocol error semantics

README.md

@@ -74,8 +74,9 @@ the distinct domain, host, authorization, validator-recovery, and interface
 failure classes. Exhaustive public type construction and matching make legacy
 ObjectId, descriptor `name`, and semantic `Value` variants compile-time
 regressions. Unit tests in the public crates additionally cover every host
-dispatch failure, invalid arguments and results, interface membership,
-validators, and same-named operations.
+dispatch failure, `InvalidRequest` versus descriptor-bound `InvalidArguments`,
+invalid local responses, validators, same-named operations, and exhaustive
+per-interaction protocol error-code sets.
 
 ## Interface authoring
 
@@ -200,11 +201,20 @@ are never projected by `WipObject`; host-private fields and backend handles are
 also excluded.
 
 Application domain failures belong in a derived result union and are returned
-through `Ok`. `wip::HostError` is reserved for runtime/backend failures. Invalid
-arguments are rejected before invocation; malformed encoded results are
-reported as `InvalidResult` and never returned as application data. Validator,
-membership, authorization, and result failures retain their distinct canonical
-protocol error codes.
+through `Ok`. `wip::HostError` is reserved for runtime/backend failures. A
+structurally malformed call is `InvalidRequest`; only argument values checked
+after the current Interface Descriptor is fixed are `InvalidArguments`. A Host
+must never return a wire `InvalidResult`: Clients keep invalid Object,
+Descriptor, operation-result, and error responses as local `InvalidResponse`
+failures, while unsupported descriptor formats remain local
+`UnsupportedDescriptorFormat` failures.
+
+For operation calls, `Internal` and `ResourceLimitExceeded` guarantee that the
+operation did not run or that its effects were rolled back.
+`OperationOutcomeUnknown` is the only protocol code that makes no such
+guarantee, so Clients must not automatically retry it. The current host API maps
+implementation failures and invalid post-execution results conservatively to
+`OperationOutcomeUnknown`.
 
 Providers remain responsible for backend atomicity. Enter a transaction, lock,
 stable-handle scope, or conditional-update primitive before invoking the