rest: a cached GET /meta/object/:name that carries disabledActions is never answered 304 — fold the switched-off names into the ETag so object reads revalidate again

domain:spec#4 · marchtian · session_017ihL2fi9zfJhUTubyJYb6V

Filing gate: ② a cost the contract review escalated to the maintainer on PR #27964 (#27842), triage record 6515936468 ③ "The 304 trade on objects". The maintainer approved #27964 as built (2026-10-30T10:29Z) and asked that 304s on object reads be won back by a separate card. This is that card. Filed by domain:spec seat 4 · marchtian · session session_017ihL2fi9zfJhUTubyJYb6V. ⛔ Not a claim. No grade and no lane: triage sets both (the code is packages/rest, with a possible touch in packages/metadata-protocol).
Reader: the lane triage assigns; one small PR.
Dedupe (open AND closed): semantic search "object metadata read ETag 304 disabledActions switched-off actions fingerprint cached GET meta object" → 7 hits. #27842 is the card that adds the key; #16525 is the organization-scope fold, closed; #25783 is metadata read CPU, closed. None folds the activation projection into the validator. New.
reach: read in code at PR #27964 head b3d92fee, not driven through a public door. Every console that opens an object on a deployment where the activation ledger is attached, which is the default: PlatformObjectsPlugin registers sys_metadata_activation, and ObjectQLPlugin attaches the ledger on every such boot.

What the code does after #27964

GET /api/v1/meta/object/:name through the cached door serves disabledActions beside the item. The key is read live on every call and kept out of the ETag, so a read that carries it is answered 200 with the full body and never 304 Not Modified (the docblocks on GetMetaItemResponseSchema and GetMetaItemCachedResponseSchema say so). On a default deployment that means every cached object read: objects are the console's hottest metadata read, so revalidation stops saving anything there.

Wanted

Fold the object's switched-off action names into the REST validator the way visibility, runtime-view, intake and audience fingerprints already are (packages/rest/src/meta-item-read-routes.ts, the nested foldVisibilityFingerprintIntoEtag calls). Then an unchanged object with an unchanged switch set answers 304 again, and an administrator's switch under Setup › Packaged automation moves the ETag.
The fold uses the same per-object answer the response carries (the names in item.actions that the projection switches off), so the validator describes the representation actually served (the getMetaItemCached folds the SUPPLIED organization scope into the ETag, but the effective scope can differ — a cache validator may not describe the representation actually served #16525 lesson). Absent versus [] must fold differently.
Pins: a 304 on a repeat read with no switch change; a 200 with a new ETag after a switch flips; the list read (GET /meta/object) if its cached door shares the rule.
Correct the two docblocks' "never answered 304" sentence in the same PR. That is a published schema docblock, so it owes a contract review.

Clause-②: no (the accept set and the response shape do not change; only the validator does). Metadata-protocol: none. Lands after PR #27964.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: 可对外的 API | none | P②

Triage: p2 · `domain:server` · `area:api` · 2026-10-30T10:57Z

⛔ Not a claim.

Read fresh. The maintainer approved feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 as built and asked for the 304s to be won back. Fold the switched-off action names into the object read's ETag fingerprint, so a cached read revalidates to 304 when nothing changed and to 200 when the activation ledger changed. Pin both.
pm:queue.

Generated by Claude Code

domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL

Claim: PM loop · 2026-10-30T11:31Z · triage first touch 6521021863
Session: session_016WV4d1Np3hU7RQnA13YZcL (seat subagent)
Account: os-elon-musk
Branch: claude/project-thread-kwainq
Worktree: objectstack-issue-28044
Domain: domain:server
Seat: domain:server#4
File surface: packages/rest/src/meta-item-read-routes.ts (fold the switched-off action names into the object read's ETag fingerprint), its tests, .changeset/*; widened 2026-10-30 12:32Z (seat) to packages/spec/src/api/protocol.zod.ts — the GetMetaItemResponseSchema.disabledActions .describe() string, and (widened 12:52Z on contract review 6523188836) the disabledActions passages of the GetMetaItemResponseSchema and GetMetaItemCachedResponseSchema docblocks and the cached disabledActions .describe(), prose only — plus its generated content/docs/references/api/protocol.mdx line, so the published docblock stops saying the list is never part of the ETag (this owes a contract review); ⛔ no other packages/spec line, no metadata-protocol/src/protocol.ts (seat 1 hot file #25467), no governed path
Container & model: S, mode:subagent, model: default (TIER_DEFAULT), effort: medium; no contract review owed unless the diff shows otherwise
Clause-②: no (a cached object read that carries disabledActions revalidates to 304 when nothing changed and to 200 when the activation ledger changed; the body served is unchanged — the dev confirms from the diff)
Metadata-protocol: none
Responsibility: since #27964 a cached GET /meta/object/:name carrying disabledActions is never answered 304, so every revalidation re-downloads the object; the platform path that covers it is the read's ETag fingerprint including the switched-off action names; reached by every console client revalidating an object definition.
Thread-read: 6521021863
Premise: holds (card at origin/main c1b52de2; the maintainer approved #27964 as built and asked for the 304s back)
Serial constraints cleared: no open PR touches packages/rest/src/meta-item-read-routes.ts.

domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL

Dev report · 2026-10-30T12:37Z

reading	value
PR	#28094, head `b45e4528` (main merged at `c4390f73`)
fix	the cached object read folds the served `disabledActions` list into the ETag it already checks; unchanged object + unchanged switch set → 304, a switch change → 200 with a new ETag; absent key → ETag byte-identical to before
spec	the `GetMetaItemResponseSchema.disabledActions` `.describe()` sentence corrected in the same PR (claim 6521616389 widened to that one string); a contract review is owed and claimed
pins	5 new #28044 pins: red before the fix (5 failed), green after (8/8), red again under ablation
suites	`@objectstack/rest` 353 files / 6801 tests passed; typecheck OK; spec `api/protocol*` 225 passed

domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL

ACCEPT → PR #28094 comment 6523772687 · head cd36d210 · 2026-10-30T13:18Z · landing sent (contract review PASS 6523337114). Closes this card.

domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL

Landed · 2026-10-30T13:42Z

reading	value
PR #28094	MERGED 2026-10-30T13:42Z, merge commit `11a7f96a` (merge queue)
this card	closed `completed` by `Fixes #28044`
contract review	PASS 6523337114 on the landed head (after FAIL 6523188836, fixed in the same PR)

State: pm:dispatched removed in this stroke.

Navigation Menu

Repository navigation

rest: a cached GET /meta/object/:name that carries disabledActions is never answered 304 — fold the switched-off names into the ETag so object reads revalidate again #28044

What the code does after #27964

Wanted

Triage: p2 · `domain:server` · `area:api` · 2026-10-30T10:57Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

rest: a cached GET /meta/object/:name that carries disabledActions is never answered 304 — fold the switched-off names into the ETag so object reads revalidate again #28044

Description

What the code does after #27964

Wanted

Activity

objectstack-fleet commented on Oct 30, 2026

Triage: p2 · domain:server · area:api · 2026-10-30T10:57Z

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p2 · `domain:server` · `area:api` · 2026-10-30T10:57Z