fix(rest,runtime,metadata-protocol)!: /published, REST /state, _drafts and the event-door absence body answer a disabled package's item as the by-name read does

[objectstack-fleet]

Part of #24210 (the second half: it closes /published on both transports, REST /meta/object/NAME/state/FIELD, GET /meta/_drafts on both transports, and the event and diff doors' absence body). Non-object ?layers=true and /layers stay on the card for after #23050 slice 13b lands (they sit in G4, which is in flight), so #24210 remains open.

Clause-②: no (narrowing) (owes one CONTRACT_REVIEW_TIER review before the queue)

Implements triage 6239967422 (absence for a non-object type; OBJECT_PACKAGE_DISABLED for an object; no new or generalised code) and the seat's ruling 6241893667 (Q1 A door side, Q2, item 6) under claim 6243792589, dispatched by the domain:engine seat 1 (session_01JtSQQ3EWsbNPzyYMug1tXy), plus the first half's ACCEPT 6243458372 open question A (the event and diff doors' absence is byte-identical with the plain read).

What changed

Since PR #24223 the by-name read answers a disabled package's non-object item as absent, as the list omits it. Four more doors still read past that answer. Each now asks the same disabled-owner question and takes the exit a missing name takes.

1. GET /meta/_drafts, both transports: the producer. listDrafts (packages/metadata-protocol/src/protocol.ts) omits every draft whose row packageId names a disabled package, by the shared predicate isItemOfDisabledPackage (package never hidden). Neither door is edited. The package batch doors (publish-drafts, discard-drafts, the batch closure) read the repository's own listDrafts, not this method, so a disabled package's drafts still publish and discard (pinned as a resolution reader).
2. REST G6, /history, /audit, /diff: the absence body. eventDoorRefusal (the class member) and the /diff branch catch fetchCurrentMetaDocument's withheld-item throw and answer it through sendMetaItemAbsent, recognised by thrownAnswerIsBareNotFound, the same predicate the plain read's catch asks. The answer is now the plain read's nested body, {"error":{"code":"RESOURCE_NOT_FOUND","message":"Metadata item not found or access denied."}}, instead of the flat {"error":"…","code":"RESOURCE_NOT_FOUND"}. fetchCurrentMetaDocument is not edited. A deleted item keeps its answer.
3. REST G7, GET /meta/object/:name/state/:field. Before reading the schema, the door asks the engine registry's isObjectPackageDisabled(name). For such an object it reads the protocol's by-name read, whose 404 OBJECT_PACKAGE_DISABLED the door's own catch renders, byte for byte what GET /meta/object/:name answers. The schema is never read for that name. This is the dispatcher twin's disabledObjectAnswer shape. It closes the interim transport split the first half named.
4. REST G8, GET /meta/:type/:name/published, every type but object and package. Before either exit (the stored published row, or the code/package snapshot), the door reads the plain read's kept protection envelope packageId and asks the engine registry's isPackageDisabled. A disabled owner takes the missing name's exits: no overlay, no snapshot, 404 NOT_FOUND. The registry is reached through wiredEngineOrLoud, so a failed engine is a loud 503, and a host with no engine withholds nothing. Objects keep the layered read's own refusal.
5. Dispatcher /published twin (packages/runtime/src/domains/meta.ts): the same question through deps.getObjectQL and isServiceItemOfDisabledPackage. A disabled owner answers the missing name's 404 RESOURCE_NOT_FOUND "Not found". A throw of that plain read is the item read's answer (errorFromThrown(e, 404)).

The producer getMetaItemLayered is not touched (ruling Q1 A: it keeps serving its resolution reader, the security catalog echo). There is no new public method, spec key, error code or enforcement change.

Mechanism hypotheses (measured before any edit)

• H1, /published's owner: half falsified. On a live pnpm dev:crm --fresh, the layered envelope of a runtime-saved item carries no packageId, and its effective carries no _packageId. The stored row's package_id is grafted only by the plain read (readMetaItem). So the owner comes from the plain read's kept envelope packageId (the field the first half's echo fix reads, and the one the protocol's predicate asks of the resolved item), asked of the registry's isPackageDisabled. A REST door has no registry predicate of its own, so G8 reads the objectQLProvider slot (see Acceptance notes).
• H2, _drafts: holds. repo.listDrafts rows carry packageId. The protocol method has exactly two callers, the two _drafts doors. The three batch doors call the repository directly. So the producer filters, and neither door is edited.
• H3, REST /state: holds. The G7 handler reads ql.registry.getObject directly. The dispatcher's disabledObjectAnswer shape ports as-is, and no schema is read for the name.
• H4, the absence body: holds. sendMetaItemAbsent is reachable from eventDoorRefusal and the /diff branch. The deleted item keeps its answer on all three doors (pinned and measured).

Doors, measured over HTTP

REST: pnpm dev:crm -- --fresh on a real socket. Before is origin/main 2bcd406a2 (full build); after is d78cc5fd (the fix commit; later commits change only tests, changesets and a ledger). Dispatcher: the real store (SqliteWasmDriver) and the real protocol (ObjectQLPlugin) under createHonoApp, driven through its fetch handler (scratch harness, not committed). Writable package app.probe-24210b holds dashboard probe_dash (saved twice), page probe_page, app probe_app (saved twice), object probe_gadget and a draft probe_draft_dash. Control package app.control-24210b holds the same shapes. probe_gone was saved and deleted.

Request, package disabled	REST before	REST after	Dispatcher before	Dispatcher after
/meta/dashboard/probe_dash/history, /audit, /diff; /meta/app/probe_app/history, /diff	404 RESOURCE_NOT_FOUND, flat body	404, the plain read's nested body	not a dispatcher route	n/a
/meta/dashboard/probe_gone/history, /diff (deleted)	200 events; 200 empty diff	unchanged	n/a	n/a
/meta/dashboard/probe_dash/published, /meta/page/probe_page/published, /meta/app/probe_app/published	200, served	404 NOT_FOUND, = missing name	200, served	404 RESOURCE_NOT_FOUND, = missing name
/meta/object/probe_gadget/published	404 OBJECT_PACKAGE_DISABLED	unchanged	(closed by PR #24223)	unchanged
/meta/object/probe_gadget/state/status?from=open	200, served	404 OBJECT_PACKAGE_DISABLED, = GET /meta/object/probe_gadget	(closed by PR #24223)	unchanged
GET /meta/_drafts	lists probe_draft_dash	omits it; ctrl_draft_dash listed	lists it	omits it; control listed
GET /meta/_drafts?packageId=app.probe-24210b	lists it	{"drafts":[]}	lists it	{"drafts":[]}
control: ctrl_dash /history, /diff, /published; ctrl_page/published; ctrl_gadget/state/status	200	200	200	200

Byte equality on REST, compared over status, headers (minus date, request id, timing) and body: the disabled probe_dash by-name read, its /history, /audit and /diff, and probe_app's /history and /diff all equal GET /meta/dashboard/no_such_dash_x. The three disabled /published reads equal GET /meta/dashboard/no_such_dash_x/published. On the dispatcher, both disabled /published reads answer {"success":false,"error":{"code":"RESOURCE_NOT_FOUND","message":"Not found","httpStatus":404}}, the missing name's bytes. Enabled readings after equal enabled readings before on both transports, after normalising timestamps, hashes and actor ids. Re-enabling restores every row on both transports.

Callers of GET /meta/_drafts (objectui at the pinned .objectui-sha 5e15928b, read-only clone)

Call site	Reads	After, for a disabled package
PackagesPage.tsx package sheet (_drafts?packageId=)	counts pending drafts and shows the Publish / Discard section	the section is hidden while the package is disabled. The publish-drafts / discard-drafts doors themselves still act on those drafts; re-enable and the section returns
usePendingDrafts, HomePage, DraftChangesPanel, usePublishAllDrafts	the pending-changes list	the disabled package's drafts are not listed. The by-name draft read already answered them 404 NO_DRAFT (first half)
ObjectHooksPanel, PackageOwdOverviewPanel, StudioDesignSurface (listDrafts({ packageId, type }))	draft-only objects and hooks of one package	none for a disabled package, as its list read already omits its objects

No caller must tell "disabled" from "missing".

Pins

• packages/objectql/src/package-disable-enforcement.test.ts, the Package disable and uninstall never reach the metadata/data layer: a disabled package's objects still serve rows, and uninstall leaves 7 orphaned sys_metadata rows #7557 table: two API-reader rows (listDrafts(), listDrafts({ packageId }), which must stop), one resolution-reader row (the repository's listDrafts, which the batch doors read and must keep serving), and the control (the healthy package's two drafts still listed). The re-enable case walks the same rows.
• packages/rest/src/meta-disabled-package-doors.test.ts (new), on the real protocol and a real SchemaRegistry: /published on both exits served, then equal to the missing name (status and body), then served again after re-enable, with a control package and getPublished never asked for a withheld item; /state served, then refused 404 OBJECT_PACKAGE_DISABLED byte-equal to GET /meta/object/:name, getObject never asked the name, a control and a missing name, then served again; the slot outage case (a rejecting provider answers 503 SERVICE_UNAVAILABLE, an absent one serves).
• packages/rest/src/meta-alternate-door-read-gates.test.ts: the withheld gated dashboard and app now assert the event and diff doors' body is the plain read's own, byte for byte, and the deleted-item case asserts its /diff body is unchanged.
• packages/runtime/src/domains/meta-disabled-package-doors.test.ts: the dispatcher /published of a non-object item on both exits (served, then byte-equal to the missing name with neither store asked, then served again), and a control.
• packages/rest/src/objectql-slot-consumer-census.test.ts: the census counts the fourth consumer, /published, which passes its decidable test through wiredEngineOrLoud, and §3 cites its outage pin.
• Pin sweep: git grep of the absence sentence, _drafts / listDrafts, /published, disablePackage / isPackageDisabled across every test. No other pin asserts the old answers. The suites of every touched package plus http-conformance were run (below).

Verification

Rework (merge-queue removal, CI_FAILURE), head ff82c7a1bf: merged origin/main cbfa5e4335 as 07b1e218a5 (a merge commit). #23050 slice 13b (646303eae) had dropped thrownAnswerIsBareNotFound from rest-server.ts's imports, and the event and diff doors here read it (TS2304 at rest-server.ts 3646 and 6419). It is re-imported from ./error-response.js, the only source edit, reproduced red without it. At ff82c7a1bf: full pnpm build 76/76 and @objectstack/rest build exit 0; rest, runtime and metadata-protocol typecheck exit 0; suites rest 295 / 6034, runtime 413 / 6413, metadata-protocol 244 / 20641, the #7557 pin 15/15; dispatch-gates 78 derived, 78 run, all exit 0, --ran 0 NOT-MEASURED, 0 UNRUN. The readings below are the previous head's.

Head 98dd4f8141, after merging origin/main (7715d049e, a merge commit; no rebase, no force-push) with a full pnpm build (76/76).

• Suites (at 0268f810; the one later commit changes only the new REST test's find double and the engine-double ledger, and its file was re-run at 98dd4f8141, 3/3): @objectstack/rest 295 files, 6032 passed (326 skipped); @objectstack/runtime 412 / 6313 (19 skipped); @objectstack/objectql 437 / 8244; @objectstack/metadata-protocol 244 files (3 skipped) / 20641; @objectstack/http-conformance 14 / 150.
• Typecheck scripts, each package's own typecheck (tsc --noEmit, plus check:test-typecheck where the script carries it), each exit 0 at 98dd4f8141: metadata-protocol, objectql, runtime, rest.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) derived 78 commands at 98dd4f8141, all exit 0 (unshallowed clone). --ran says: "78 derived, 78 run, 0 NOT-MEASURED, 0 UNRUN". At the previous head two families went red on the new test's double, check:engine-double-contract (an unrecorded pinned double) and check:objectql-double-limit (a limit-blind find). Both are fixed in 98dd4f8141.
• Ablations, one per changed behaviour, each through scripts/ablation-replace.mjs with the restore proven blob == HEAD:
  • (a) listDrafts' predicate replaced by an always-true marker. metadata-protocol was rebuilt, and ablation-dist-preflight found the marker in dist/. The two _drafts API rows and the control went red (2 failed / 13 passed). After the restore and rebuild, --absent gave a dist reading of PASS (its tree reading exited 3 only on the untracked scratch harness, since removed), and the run was 15/15.
  • (b) eventDoorRefusal's fork disabled: only the withheld-item case went red (1 / 427). (c) The /diff fork disabled: the same case only (1 / 427).
  • (d) REST /state's disabled check: only the /state case (1 / 2). (e) REST /published's withheld verdict: only the /published case (1 / 2).
  • (f) The dispatcher /published check: only its case (1 / 9).
  • (g) REST /published reading the slot with a swallowing .catch: only the outage case (1 / 3).

Acceptance notes

• File surface. REST edits sit in G6 (the /history, /audit and /diff handlers' calls), G7, G8 and the class member eventDoorRefusal. Nothing in G4, G5 or the class head. meta-collection-routes.ts is not edited, and neither is the dispatcher's _drafts (the producer carries it).
• Outside the claim's list: scripts/engine-double-contract.pinned.json gains three rows for the new test file's pinned double. That is check:engine-double-contract's own prescription (--write) for new pinned coverage, a mechanical ledger entry with no source change.
• A fourth objectQLProvider consumer. G8 reads the engine registry, which no REST /meta door read before. It goes through wiredEngineOrLoud, and the census pin is updated to count it.
• Dispatcher transport was measured through createHonoApp's fetch handler (app.request), the packages/qa/http-conformance shape, not over a socket. The scratch harness sat untracked under packages/qa/http-conformance and was removed before the gates ran.
• Ungated types' event and diff doors (page, flow, report, …) still serve a disabled package's item's events and diff. No per-caller gate exists there to bypass, as the first half's record (③.7) named. This half does not change them.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/metadata-protocol, @objectstack/rest, @objectstack/runtime, touching 14 documentable anchor(s).

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via getAudit (sdk, the bare tail of client method meta.getAudit, bound to GET /api/v1/meta/:type/:name/audit), getHistory (sdk, the bare tail of client method meta.getHistory, bound to GET /api/v1/meta/:type/:name/history), meta.getAudit (sdk, the route ledger binds it to GET /api/v1/meta/:type/:name/audit, selected by route anchor /:type/:name/audit))
• content/docs/api/wire-format.mdx (via /meta/object/:name (route, a path literal in a comment in registerMetadataEndpointsInner))
• content/docs/concepts/metadata-lifecycle.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class), /meta/object/:name (route, a path literal in a comment in registerMetadataEndpointsInner))
• content/docs/deployment/production-readiness.mdx (via /meta/object/:name (route, a path literal in a comment in registerMetadataEndpointsInner))
• content/docs/kernel/contracts/metadata-service.mdx (via getHistory (sdk, the bare tail of client method meta.getHistory, bound to GET /api/v1/meta/:type/:name/history))
• content/docs/permissions/system-context.mdx (via handleMetadataRequest (symbol, a top-level function), registerMetadataEndpointsInner (symbol, a method of class RestServer), /:type/:name/history (route, bridged from symbol eventDoorRefusal — its route source's handler names it))
• content/docs/plugins/adding-a-metadata-type.mdx (via /:type/:name/history (route, bridged from symbol eventDoorRefusal — its route source's handler names it))
• content/docs/protocol/kernel/http-protocol.mdx (via /meta/object/:name (route, a path literal in a comment in registerMetadataEndpointsInner))
• content/docs/protocol/objectql/state-machine.mdx (via /meta/object/:name (route, a path literal in a comment in registerMetadataEndpointsInner))
• content/docs/ui/apps.mdx _(via /api/v1/meta/drafts (route, the route ledger binds it to client method meta.listDrafts))
• content/docs/ui/forms.mdx (via /meta/object/:name (route, a path literal in a comment in registerMetadataEndpointsInner))

⛔ 8 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via RestServer (symbol, a top-level class))
• content/docs/releases/v12.mdx (via RestServer (symbol, a top-level class))
• content/docs/releases/v16.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class), RestServer (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class), /meta/object/:name (route, a path literal in a comment in registerMetadataEndpointsInner))
• content/docs/releases/v17/17-1.mdx (via /meta/object/:name (route, a path literal in a comment in registerMetadataEndpointsInner))
• content/docs/releases/v17/17-3.mdx (via RestServer (symbol, a top-level class))
• content/docs/releases/v17/17-5.mdx (via RestServer (symbol, a top-level class), getAudit (sdk, the bare tail of client method meta.getAudit, bound to GET /api/v1/meta/:type/:name/audit), meta.getAudit (sdk, the route ledger binds it to GET /api/v1/meta/:type/:name/audit, selected by route anchor /:type/:name/audit))
• content/docs/releases/v17/17-7.mdx (via /meta/object/:name (route, a path literal in a comment in registerMetadataEndpointsInner))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 39 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json cbfa5e43354f430e35c4f9f24732e59848174889 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 62acb721a77e20d33ddfaddf35150ff519fa5461 — the merge of head ff82c7a1bffa1edba88137d7a1056749abaac079 into base cbfa5e43354f430e35c4f9f24732e59848174889, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 62acb721a77e20d33ddfaddf35150ff519fa5461 && git checkout 62acb721a77e20d33ddfaddf35150ff519fa5461
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin cbfa5e43354f430e35c4f9f24732e59848174889 ff82c7a1bffa1edba88137d7a1056749abaac079 && git checkout -B drift-repro cbfa5e43354f430e35c4f9f24732e59848174889 && git merge --no-ff ff82c7a1bffa1edba88137d7a1056749abaac079

node scripts/docs-audit/affected-docs.mjs --json cbfa5e43354f430e35c4f9f24732e59848174889

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs cbfa5e43354f430e35c4f9f24732e59848174889 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 98dd4f8141227fb5b371ca15886f9c16674dc2b5
Local-runs: none
Scope: packages/metadata-protocol/src/protocol.ts, packages/rest/src/rest-server.ts, packages/runtime/src/domains/meta.ts, packages/objectql/src/package-disable-enforcement.test.ts, packages/rest/src/meta-alternate-door-read-gates.test.ts, packages/rest/src/meta-disabled-package-doors.test.ts, packages/rest/src/objectql-slot-consumer-census.test.ts, packages/runtime/src/domains/meta-disabled-package-doors.test.ts, scripts/engine-double-contract.pinned.json, .changeset/24210-metadata-protocol-drafts-disabled-package.md, .changeset/24210-rest-published-state-event-body-disabled-package.md, .changeset/24210-runtime-published-disabled-package.md + packages/metadata-protocol/src/sys-metadata-repository.ts (listDrafts projection), packages/objectql/src/registry.ts (isPackageDisabled, isObjectPackageDisabled), packages/rest/src/error-response.ts (thrownAnswerIsBareNotFound, handleRouteError), packages/rest/src/meta-collection-routes.ts (the REST _drafts door), packages/runtime/src/http-dispatcher.ts (errorFromThrown, getObjectQLService), packages/runtime/src/domains/packages.ts (publish-drafts, discard-drafts, revert doors), packages/types/src/thrown-http-error.ts (resolveThrownHttpError), packages/spec/src/kernel/metadata-protection.zod.ts (extractProtection), packages/spec/src/meta-spelling/metadata-url-spelling.ts (metaUrlSpellingRefusal), packages/client/src/index.ts (meta.listDrafts), scripts/check-changeset-no-major.mjs, scripts/pm/clause2-line.mjs (readClause2Line), scripts/check-engine-double-contract.mjs, .github/workflows/pr-automation.yml (the Check Changeset job), objectui at origin/main 1e6d83bc and at the pin .objectui-sha 5e15928b (PackagesPage.tsx, usePublishAllDrafts.ts, usePendingDrafts.ts, HomePage.tsx, DraftChangesPanel.tsx, StudioDesignSurface.tsx, packageSurfaces.ts, data-objectstack metadata-client.ts)

Inputs: card #24210 (body; every comment, 6239527781 through 6244976750, including triage 6239967422, ruling 6241893667, claims 6243792589 and 6244976750, the first half's landing 6243759173 and the second half's os-dev-report 6244647143), PR #24223's record 6243449822 and ACCEPT 6243458372, the #7557 pin's docblock, PR #24247's body and file list, the net diff origin/main cbfa5e4 (fetched fresh) to the head (12 files, +527/-20), and the 40 check-runs on the head.

Check-runs at read time (2026-10-18): every run completed; 0 failure, 0 in_progress. success: Build Core, Test Core and its six shards, TypeScript Type Check, Type Check workspace / source gates / consumer gates / debt ledger, Lint and Repo Gates and its seven Lint legs, Check Changeset, Governed Surface Queue Guard, Check PR Size, Check Documentation Links, Flag docs affected, Dogfood Regression Gate (aggregate), the four PR-claim checks, Auto Label, filter. skipped by path or opt-in filter: Build Docs, Console Pin Gate, the Dogfood shards (one matrix placeholder among them) and Dogfood Verify CLI, Temporal Conformance, Packed-tarball smoke. The gate families the diff derives are all answered green by these; no exported symbol moves, so the Console Pin Gate's skip is not a gap.

① Derived judgments

A. GET /meta/_drafts, both transports: the producer listDrafts (protocol.ts). The filter is draft.type === 'package' || !isItemOfDisabledPackage(this.engine?.registry, { _packageId: draft.packageId }), applied after the repository's own type / packageId narrowing and before the member spelling, so the declared header shape is untouched. The repository projects packageId: row.package_id ?? null (sys-metadata-repository.ts:1670ff), and registry.isPackageDisabled answers false for a falsy id, so an unbound (orphan) draft stays listed; a registry without the predicate hides nothing, the same optional-call shape the list and by-name reads already take. Naming the disabled package (?packageId=) answers { drafts: [] }, which is what a package id nothing is drafted under answers. Right: triage's answer (absence), by the one predicate the list and by-name reads ask.

• Callers of the protocol method at the head: exactly two, the REST door (meta-collection-routes.ts:389, after the mayReadPendingDrafts gate and the arity refusal) and the dispatcher door (meta.ts:2026). Neither is edited. The SDK's meta.listDrafts (client/src/index.ts:2114) is an API reader of these doors. No CLI, plugin, service or core caller.
• Resolution readers that must keep seeing a disabled package's drafts, all unchanged and all reading SysMetadataRepository.listDrafts directly: publishPackageDrafts (protocol.ts:25848), discardPackageDrafts (26704), revertStoredPackage (26831), and the batch closure collectBatchPendingDeclarations, fed the publish door's own rows (26106). The runtime's POST /packages/:id/publish-drafts, /discard-drafts and /revert doors (packages.ts:1639, 1974, 2067) call those verbs, never listDrafts. The READERS table pins the split: two API rows enforces: true, one repository row enforces: false, plus the control (the healthy package's two drafts still listed, the disabled package's none). The Package disable and uninstall never reach the metadata/data layer: a disabled package's objects still serve rows, and uninstall leaves 7 orphaned sys_metadata rows #7557 reader-class rule holds.
• Answer now, disabled package: its drafts omitted on _drafts and _drafts?packageId= on both transports | triage: absence | a package nothing is drafted under: the same { drafts: [] }. package-type drafts never hidden; other packages' drafts unchanged.

B. REST G6, /history, /audit, /diff: the absence body. fetchCurrentMetaDocument (not edited) throws { code: RESOURCE_NOT_FOUND, status: 404 } when the plain read withholds an item whose layers still resolve. thrownAnswerIsBareNotFound asks resolveErrorResponse for status 404, body.code RESOURCE_NOT_FOUND and no declaredCode (a ledger code, so none): true for this throw, false for NO_DRAFT, a 503 or any other code. eventDoorRefusal returns sendMetaItemAbsent (the sender) and both event doors invoke it as refusal(res) (rest-server.ts:6756, 6918); the /diff branch sends it and returns inside the handler's try. Every other throw is re-thrown to handleRouteError as before. A deleted item (every layer null) still reads as undefined: events served, /diff of app / doc / book absent through the nested exit it already had (7396), a view's or dashboard's diff served (#22639). The body is the literal sendMetaItemAbsent emits and the plain read's catch emits (6244): { "error": { "code": "RESOURCE_NOT_FOUND", "message": "Metadata item not found or access denied." } }. Pinned byte for byte against the plain read on all three doors and measured over HTTP; the deleted doc's /diff body pinned unchanged. Right; it closes the first half's ③.1 and ACCEPT open question A.

• Answer now, a disabled package's gated item (app, view, dashboard, doc, book): 404, the plain read's nested body, equal bytes | triage: absence (status and code already matched; the body now does) | a deleted or never-stored name: events (200) on the event doors, the type's own /diff answer, unchanged. The disabled item takes the plain read's answer rather than the deleted item's event list by ruling 6241893667 item 1 (the item exists and its per-caller gate must not be bypassed).

C. REST G7, GET /meta/object/:name/state/:field. Before any schema read the door asks registry.isObjectPackageDisabled(name) (registry.ts:5418: the name resolved through resolveObjectKey, the OWNER's package asked). On true it calls the protocol's getMetaItem({ type: 'object', name }), which throws objectPackageDisabledError (404, OBJECT_PACKAGE_DISABLED), rendered by the route's handleRouteError, the same renderer the plain read's catch hands this code to (thrownAnswerIsBareNotFound is false for it), so the bytes equal GET /meta/object/:name (pinned toEqual against the plain read on the real protocol and real SchemaRegistry). The schema is never read (schema = disabledObject ? undefined : registry?.getObject?.(name); getObject pinned never called with the name). A protocol that does not refuse (not the shipped composition: protocol and door share engine.registry) falls to the door's own 404 NOT_FOUND "Object not found", closed. A non-object name answers false and the door proceeds. Unwired engine: wiredEngineOrLoud(false) is undefined, nothing changes. Rejecting engine: the existing 503 (meta-state-route-engine-outage pin). Right; it closes the first half's Q2 interim split with the dispatcher twin.

• Answer now: disabled object 404 OBJECT_PACKAGE_DISABLED, flat body, equal to the by-name read | triage: the object answer | a missing object: 404 NOT_FOUND "Object not found", nested, unchanged.

D. REST G8, GET /meta/:type/:name/published, every type but object and package. The owner is the plain read's kept envelope packageId. Verified that this is the same field the by-name predicate asked: the envelope's packageId is servedLockState(...).packageId = extractProtection(decorated).packageId = decorated._packageId (protocol.ts:11620-11640, spec metadata-protection.zod.ts:175), and decorated is the very answer.item whose _packageId getMetaItem asks of isItemOfDisabledPackage (11105). The withheld answer keeps the envelope (first half Q4 A), so a disabled owner is readable there; a missing name has no item and no packageId, so isPackageDisabled(undefined) is false and the read takes its old exits. Withheld: neither the layered read nor the snapshot is asked (!withheld guards the overlay, withheld ? undefined : getPublished(...) the snapshot), and the door ends at its own 404 NOT_FOUND "Not found", the missing name's bytes on both exits (pinned, with getPublished never asked; measured over HTTP against the missing name's status, headers and body). Re-enable restores (pinned). The registry is reached through wiredEngineOrLoud: an unwired host withholds nothing and serves as before (pinned); a rejecting provider is AuthzStoreUnavailableError, 503 SERVICE_UNAVAILABLE through handleRouteError (pinned); the census counts the fourth consumer and §3 cites the pin. The plain read is asked with the raw type, which canonicalizeMetaRequestType folds. A throw of that read (spelling 400, store 503, ADR-0048's two-apps key 400) reaches handleRouteError as itself; the layered read, which canonicalizes the same way (11747), already threw those with a status and REST re-threw any status-bearing throw, so REST's answers under those conditions do not move. Objects keep the layered read's own OBJECT_PACKAGE_DISABLED re-throw (since PR #24208 / #24223). Right. H1's chosen source (option A) is right on the field-identity reading above; option B (infer from a missing item) would make every plain-read absence a /published absence, and C is barred by the claim and ruling Q1 A.

• Answer now: disabled non-object item 404 NOT_FOUND "Not found", equal bytes, on the overlay row and on the snapshot | triage: absence | a missing name: the same bytes. Objects: 404 OBJECT_PACKAGE_DISABLED (unchanged). Control served.

E. Dispatcher /published (meta.ts), non-object, non-package. The same owner question through deps.getObjectQL(_context), which is getObjectQLService (http-dispatcher.ts:2776): resolves the engine or null, never throws; null or a registry without the predicate means nothing is withheld. A disabled owner (isServiceItemOfDisabledPackage(registry, { _packageId: owner }), the same isPackageDisabled) answers deps.error('Not found', 404), the branch's own final exit (1360), so the body { "success": false, "error": { "code": "RESOURCE_NOT_FOUND", "message": "Not found", "httpStatus": 404 } } equals the missing name's bytes (pinned, JSON.stringify equality, neither store asked; measured through createHonoApp). Objects keep the layered catch's OBJECT_PACKAGE_DISABLED re-throw. Right.

• The throw behaviour the dev names (deviation 7): a throw of the plain read answers deps.errorFromThrown(e, 404), i.e. resolveThrownHttpError(e, 404): a declared status / statusCode is kept, else 404; the code is the ledger's or status-derived; the message the thrown one. So a metadata-store outage (503 SERVICE_UNAVAILABLE) now answers 503, an unrecognised plural spelling (metaUrlSpellingRefusal, 400 INVALID_REQUEST) answers 400, and ADR-0048's ambiguous app-package key answers its 400. Before this PR the dispatcher's /published swallowed every layered-read throw but OBJECT_PACKAGE_DISABLED and fell through to the snapshot, answering an existence fact (200 or 404 Not found) for an availability failure or a spelling refusal: the getMetaItem 的 overlay 读用裸 catch 把「sys_metadata 不可达」吞成「该项不存在」—— GET /meta/:type/:name 在存储故障时回一个无 code 的 400「not found」 #5532 class that REST's twin deliberately diverged on at this very door. After, the dispatcher answers what REST's /published answers (any status-bearing throw as itself) and what the dispatcher's own item read answers (meta.ts:1982, the same errorFromThrown(e, 404)). A shapeless throw maps to 404 with the thrown message, the item read's convention. Judged right: transport parity on this door and the getMetaItem 的 overlay 读用裸 catch 把「sys_metadata 不可达」吞成「该项不存在」—— GET /meta/:type/:name 在存储故障时回一个无 code 的 400「not found」 #5532 posture, at no cost to a well-formed name on a healthy store. The runtime changeset does not spell it; flag ③.3.
• Answer now: disabled non-object item 404 RESOURCE_NOT_FOUND "Not found", equal bytes, both exits | triage: absence | a missing name: the same bytes. Control served.

F. The pins. package-disable-enforcement.test.ts: +2 API rows, +1 resolution row, +1 control; ablation (a) reddened exactly those three. rest/src/meta-disabled-package-doors.test.ts (new): the REAL protocol and REAL SchemaRegistry over an in-memory sys_metadata whose double routes delete, update and findOne through the producer's own dispatch predicates and whose find honours limit (the two red gates at the previous head, both green at this one); /published on both exits with control, re-enable and getPublished never asked; /state byte-equal to the plain read with getObject never asked, a control, a missing name and re-enable; the slot's rejecting (503) and absent (serves) arms. meta-alternate-door-read-gates.test.ts: the withheld body equals the plain read's on every door; the deleted doc's /diff body unchanged. runtime/.../meta-disabled-package-doors.test.ts: dispatcher /published both exits, byte-equality with the missing name, neither store asked, re-enable, control (a protocol double; the dispatcher's contract is its deps, and the real-protocol readings sit in the REST and #7557 pins). objectql-slot-consumer-census.test.ts: 3 to 4 consumers, all through the seam, §3 cites the new pin. scripts/engine-double-contract.pinned.json: three rows (delete, findOne, update) for the new double, matching its three assertEngine* calls; the file's own header says it is GENERATED by --write and may only grow. Ablations (b) through (g) each reddened only their own case with restores proven blob == HEAD.

G. Accept-set and public-surface changes the diff implies, each judged. (1) listDrafts / _drafts served set narrows: right. (2) REST /published non-object served set narrows to the missing name's answer: right. (3) Dispatcher /published likewise: right. (4) REST /state/:field refuses a disabled object: right. (5) REST event and diff doors' 404 body dialect flat to nested at equal status and code: right (the plain read's own body). (6) REST /published gains a 503 arm when a wired engine slot rejects: right (the decidable test every slot consumer must pass; in the shipped composition the protocol's own store read already failed the same way). (7) Dispatcher /published answers the plain read's refusals and outages as themselves instead of the snapshot: right (E above). No new public method, spec key, error code or enforcement change; getMetaItemLayered untouched (ruling Q1 A); fetchCurrentMetaDocument untouched; G4, G5 and the class head untouched.

② Semver level

• Three changesets, @objectstack/metadata-protocol, @objectstack/rest, @objectstack/runtime, each minor, each BREAKING with Clause-②: no (narrowing) and the adr-0087 marker not-required (no-migration-prescription). minor is the launch-window level check-changeset-no-major.mjs enforces for a breaking change (its header, line 58), and the marker's reasoning holds: no stored shape, key, export or code moves; re-enabling restores every read. Each body matches the diff: metadata-protocol names the omitted set, ?packageId= included, package never hidden and the batch doors unchanged (verified at 25848 / 26704 / 26831); rest's three bullets match G8, G7 and G6 and quote the exact sendMetaItemAbsent literal; runtime's matches the dispatcher door, and "Objects already answered 404 OBJECT_PACKAGE_DISABLED here" is true since PR fix(metadata-protocol)!: the by-name /meta read answers a disabled package's non-object item as absent, as the list omits it #24223.
• No @objectstack/objectql changeset (a test file only) and none for the scripts/ ledger: right.
• The PR body's Clause-②: no (narrowing) (owes one ... review before the queue) is the claim's spelling verbatim at a line start; readClause2Line reads the value no and the arm narrowing and tolerates trailing prose. The title carries !. The face is narrowing, hence this tier.
• CI's verdict: Check Changeset success (pr-automation.yml job changeset-check, which runs check-adr-0087-registration.mjs --base MERGE_BASE and check-changeset-no-major.mjs).
• One prose gap, no level change: the runtime changeset's "Unchanged: ... a name with nothing behind it" holds for a well-formed name on a healthy store, but the dispatcher door now answers a store outage 503 and a spelling refusal 400 where it answered the snapshot or 404 Not found (①.E). Named in the PR body (deviation 7); a one-sentence addendum to that changeset is the most that is owed (③.3).

③ Boundary flags

1. H1, the owner source (report open question 1): answered, option A is right. Field identity verified in the cited code (①.D): the envelope packageId and the item _packageId the predicate asks are one field of one served document, asked of one predicate (registry.isPackageDisabled), the same pair the first half's echo fix reads. The layered envelope carrying no packageId for a runtime-saved item is the dev's live measurement; the chosen source does not depend on it. Nothing owed.
2. Studio Publish / Discard consequence (report open question 2): answered, option A under ruling item 6. Verified at objectui origin/main 1e6d83bc (same code at the pin 5e15928b): PackagesPage.tsx:432 loads _drafts?packageId= and renders the Pending changes section (count badge, Publish, Discard, the list) only when drafts.length is above zero, so for a disabled package the section is hidden while the sheet's Enable button stays; re-enabling reloads it. The publish-drafts and discard-drafts doors still act on those drafts when called directly. usePublishAllDrafts derives its package ids from _drafts, so Home's one-click publish leaves a disabled package's drafts untouched (publishes what is listed, consistent). usePendingDrafts, HomePage, DraftChangesPanel omit them (their by-name draft read already answered NO_DRAFT since the first half); StudioDesignSurface / packageSurfaces listDrafts({ packageId, type }) read [] for a package whose list read already omits its items. No caller must tell disabled from missing; option B would re-open the one-answer split. Named for the seat: an operator who disables a package with pending drafts sees no draft count on its sheet until re-enable; a hint there is objectui's call, not this card's. Not a blocker.
3. Dispatcher /published throw behaviour (report deviation 7): right, as ①.E reads it: the plain read's own 503 / 400 answered as themselves, as REST's twin and the dispatcher's item read already answer them, instead of the getMetaItem 的 overlay 读用裸 catch 把「sys_metadata 不可达」吞成「该项不存在」—— GET /meta/:type/:name 在存储故障时回一个无 code 的 400「not found」 #5532-class fall-through to the snapshot. Escalated only as prose: the runtime changeset does not name it; the seat may fold one sentence at queue time or accept the PR body's naming. Not a blocker.
4. Two files outside the original claim list (deviations 1 and 2): scripts/engine-double-contract.pinned.json, the gate's own --write prescription for a new pinned double (GENERATED header, coverage-only-grows, three rows matching the double's three producer predicates), and objectql-slot-consumer-census.test.ts, the census that exists to make a new objectQLProvider consumer examined on arrival; the new consumer is examined (via the seam, with its own outage pin). Both re-declared in claim 6244976750. Right.
5. A fourth objectQLProvider consumer: a REST /meta door reads the engine registry for the first time. On a wired-but-rejecting engine, non-object /published is a loud 503 (the slot's decidable test); on a host with no engine slot nothing is withheld, the door's pre-metadata-protocol: a by-name /meta read of a non-object item (app, view, page, …) serves a disabled package's item while the list omits it; #24097 closes the object half only #24210 answer, so such a host does not enforce the disable on /published: the same degenerate-host widening the list filter and by-name read already carry. Cost: one extra plain read per non-object /published request on a wired host. Named; nothing owed.
6. The event doors' answer for a disabled gated item is the plain read's 404, not a deleted item's event list: ruled (item 1), pinned, measured. The ungated types' event and diff doors (page, flow, report, ...) still serve a disabled package's item's events and diff: no per-caller gate to bypass, named in the first half's ③.7 and in this PR body; this half does not change them. Nothing owed.
7. Remaining on the card: non-object ?layers=true and /layers on both transports (G4), the third dispatch now that slice 13b landed as PR refactor(rest): move the /meta per-item read routes into meta-item-read-routes.ts (#23050 slice 13b) #24240 (claim 6244976750). Part of #24210 is therefore right and the "Part-of PR must not also close its card" check is green.
8. Measurement shape: REST over a real socket before (2bcd406a2) and after (d78cc5fd, later commits test/ledger/changeset only) with byte comparison; the dispatcher through createHonoApp's fetch handler, not a socket, as the first half was measured and accepted. The REST pin reads the route table in process. Accepted.
9. Dev deviations: seven pushes to the own branch (the push-before-minutes-long-step rule), the shared checkout's pre-created branch reset to a detached HEAD with no work on it, the scratch harness removed before the gate union, origin/main merged by a merge commit with the suites re-run after it, the Clause-② spelling parsed locally. All acceptable.
10. Docs: the Docs Drift Check comment (6244639396) names 11 hand-written docs by anchor overlap; none states that _drafts lists a disabled package's drafts or that /published or /state serve a disabled package's item (the only disabled package mentions under content/docs are the enable route and the package shape). Nothing owed.
11. CI: nothing failed, nothing in progress; every skip is a path or opt-in filter.

Implemented-by: claude/issue-24210-meta-disabled-doors-second-half
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-18T03:16Z · ACCEPT

Head: 98dd4f8141.

Item	Reading
Shape	Draft PR → main. The body opens Part of #24210 with no closing keyword. The card stays open for the third dispatch (non-object ?layers=true and /layers, now in meta-item-read-routes.ts after slice 13b's PR #24240 landed).
Scope	12 files (+527 / −20), claim 6243792589 as re-declared in 6244976750. listDrafts (protocol.ts); REST G6 (eventDoorRefusal, the /diff branch), G7 (/state/:field) and G8 (/published); the dispatcher's /published (meta.ts); five pins; the gate-prescribed engine-double-contract.pinned.json rows; the objectQLProvider census; three changesets. Nothing in G4, G5 or the class head. Not governed (check-governed-merges.mjs --pr 24247: 0 of 12).
Doors	Read in the diff and the record's table. _drafts omits a disabled package's drafts on both transports at the producer (package never hidden), while the batch publish, discard and closure verbs keep reading the repository. The event and diff doors answer the plain read's nested 404 body, recognised by thrownAnswerIsBareNotFound. REST /state refuses 404 OBJECT_PACKAGE_DISABLED byte-equal to the by-name read, and the schema is never read; this closes the first half's interim transport split. Non-object /published takes the missing name's exits on both stores, both transports.
H1	Half falsified by the dev and measured live: the layered envelope of a runtime-saved item carries no packageId. The owner is the plain read's kept envelope packageId, the same field (extractProtection → _packageId) and predicate (isPackageDisabled) the by-name read asks. No new method; getMetaItemLayered untouched (ruling Q1 A).
Review face	Narrowing (Clause-②: no (narrowing)). The CONTRACT_REVIEW_TIER record 6245098698 on this head is PASS. The seat verified in the diff the listDrafts filter and its docblock's resolution-reader carve-out, the withheld / isPackageDisabled guard on /published, the isObjectPackageDisabled check on /state, and the thrownAnswerIsBareNotFound → sendMetaItemAbsent fork on the event and diff doors.
Prose face	Three changesets, sentence by sentence. Each is minor with BREAKING, Clause-②: no (narrowing) and the adr-0087 not-required (no-migration-prescription) marker. Each sentence matches the diff. Not stated in the runtime changeset: the dispatcher's /published now answers the plain read's own 503 / 400 as themselves (errorFromThrown(e, 404)) rather than falling through to the snapshot. The PR body names it (What changed, item 5), and it matches REST's twin and the dispatcher's item read. Accepted without a changeset edit. No sentence is false.
Pins and ablation	READERS +2 API rows, +1 resolution row (repo.listDrafts, enforces: false) and a control. The new REST door pin runs on the real protocol and real SchemaRegistry, with an outage arm. The alternate-door pin checks the body against the plain read. The dispatcher pin covers both exits. Ablations (a)–(g) each redden only their own case; every restore is clean.
Gates	Dev union at 98dd4f8141: 78 derived, 78 run, 0 NOT MEASURED. Typecheck scripts of all four touched source packages exit 0. CI on this head at this read: 40 check-runs, 34 success, 6 skipped (each on the EXPECTED_SKIPS roster), 0 failed.

Disposition:

• open_questions[0] (the /published owner): A, the plain read's envelope packageId; field identity verified (record ①.D).
• open_questions[1] (_drafts?packageId= for a disabled package): A. While a package is disabled, Studio's package sheet hides its Pending changes section. Re-enable restores it, and the batch doors still act. This is ruling item 6's one answer; a hint on the sheet would be objectui's call.
• deviations: accepted. The two gate-prescribed rows are re-declared in 6244976750. Seven pushes to the own branch; origin/main merged by a merge commit; the dispatcher measured through createHonoApp's fetch handler, as the first half was.
• Named, nothing owed (record ③.5–③.6): a host with no engine slot withholds nothing on REST /published (the degenerate-host shape the list and by-name reads carry); the ungated types' event and diff doors.

Landing: ordinary queue (pr_ready + automerge_enable through the relay); every check on this head is green or a rostered skip.

---

Generated by Claude Code

[objectstack-fleet]

Queue kick · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-18T03:22Z · head 98dd4f8141

Removed from the merge queue at 2026-10-18T03:21Z (CI_FAILURE). The merge group gh-readonly-queue/main/pr-24247-cbfa5e43… (25d0d923b) fails to build @objectstack/rest:

src/rest-server.ts(3646,17): error TS2304: Cannot find name 'thrownAnswerIsBareNotFound'.
src/rest-server.ts(6419,29): error TS2304: Cannot find name 'thrownAnswerIsBareNotFound'.

Build Core, every Test Core shard and the type-check lanes fail on that one error.

Cause: this PR's, a semantic merge conflict, not a flake. #23050 slice 13b (PR #24240, 646303eae) landed after this branch last merged main (7715d049e). It moved the item read's catch into meta-item-read-routes.ts and dropped thrownAnswerIsBareNotFound from rest-server.ts's imports as unused (its own note at rest-server.ts:372 on main). This PR's two new readers of it (eventDoorRefusal, the /diff branch) still sit in rest-server.ts. The texts merge cleanly; the build does not.

Act: the dev merges origin/main into this branch (a merge commit), re-imports thrownAnswerIsBareNotFound in rest-server.ts, and re-runs @objectstack/rest's build, typecheck and touched suites. Because the head moves, a CONTRACT_REVIEW_TIER delta review runs on the new head before re-entry. ⛔ No re-queue on this head.

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 39093149214 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Build Core — 失败步骤: Build packages (excluding docs)（日志不可读，点进 job 看）
• Test Core (3/6) — 失败步骤: Build this shard's dependency closure（日志不可读，点进 job 看）
• Test Core (4/6) — 失败步骤: Build this shard's dependency closure（日志不可读，点进 job 看）
• Test Core (6/6) — 失败步骤: Build this shard's dependency closure（日志不可读，点进 job 看）

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 0 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ff82c7a1bffa1edba88137d7a1056749abaac079
Local-runs: none
Scope: packages/metadata-protocol/src/protocol.ts, packages/rest/src/rest-server.ts, packages/runtime/src/domains/meta.ts, packages/objectql/src/package-disable-enforcement.test.ts, packages/rest/src/meta-alternate-door-read-gates.test.ts, packages/rest/src/meta-disabled-package-doors.test.ts, packages/rest/src/objectql-slot-consumer-census.test.ts, packages/runtime/src/domains/meta-disabled-package-doors.test.ts, scripts/engine-double-contract.pinned.json, .changeset/24210-metadata-protocol-drafts-disabled-package.md, .changeset/24210-rest-published-state-event-body-disabled-package.md, .changeset/24210-runtime-published-disabled-package.md + packages/rest/src/meta-item-read-routes.ts (the moved item-read catch, MetaItemReadRouteHost, its imports), packages/rest/src/error-response.ts (thrownAnswerIsBareNotFound, handleRouteError, resolveErrorResponse), packages/rest/src/meta-collection-routes.ts (the REST _drafts door), packages/rest/src/meta-draft-read-door-census.test.ts and packages/rest/src/rest-server-docblock-position.test.ts and packages/rest/src/execctx-consumer-census.test.ts (main's own edits for slice 13b, read for the combination with this diff), packages/metadata-protocol/src/sys-metadata-repository.ts (listDrafts projection), packages/objectql/src/registry.ts (isPackageDisabled, isObjectPackageDisabled), packages/runtime/src/http-dispatcher.ts (domainDeps wiring, getObjectQLService, errorFromThrown, error), packages/runtime/src/domains/packages.ts (the publish-drafts and discard-drafts doors), packages/types/src/thrown-http-error.ts (resolveThrownHttpError), packages/spec/src/kernel/metadata-protection.zod.ts (extractProtection), packages/plugins/plugin-security/src/security-catalog-echo.ts (readServedPackageBinding), packages/client/src/index.ts (meta.listDrafts), scripts/check-changeset-no-major.mjs, scripts/pm/clause2-line.mjs (readClause2Line), .objectui-sha and objectui at the pin 5e15928b (PackagesPage.tsx, usePendingDrafts.ts, HomePage.tsx, DraftChangesPanel.tsx, usePublishAllDrafts.ts, ObjectHooksPanel.tsx, PackageOwdOverviewPanel.tsx, StudioDesignSurface.tsx, useNavTargetLabel.ts, draftStatus.ts), the merge commit 07b1e21 (--remerge-diff), main's range 7715d04..cbfa5e4 (the interdiff basis), content/docs (grepped for disabled-package statements)

Inputs: card #24210 (body; every comment, 6239527781 through 6245117166, including triage 6239967422, ruling 6241893667, claims 6243792589 and 6244976750, the first half's landing 6243759173 and the second half's os-dev-report 6244647143; no later os-dev-report exists on the card at read time), PR #24223's record 6243449822 and ACCEPT 6243458372, the #7557 pin's docblock, PR #24247's body, file list and every comment (the docs-drift comment 6244639396, the earlier record 6245098698, the ACCEPT 6245106275, the queue kick 6245148853, the queue-failure triage 6245156186), the net diff origin/main cbfa5e4 (fetched fresh; it is this head's merge-base) to the head (12 files, +530/-22), the earlier head's net diff against its own merge-base 7715d04 (12 files, +527/-20), and the 39 check-runs on the head.

Why this head and not the earlier record. The earlier record 6245098698 passed 98dd4f8141. Since then the head moved by two commits, and both were read as code, not adopted: 07b1e218a5 merges origin/main at cbfa5e43 (seven commits; the one that reaches this PR's symbols is 646303eae, #23050 slice 13b, PR #24240), and ff82c7a1bf edits rest-server.ts's import block.

• The interdiff. Both net diffs were taken against their own merge-base and compared with hunk headers and index lines stripped. Exactly ONE hunk differs: rest-server.ts lines 369-377, where thrownAnswerIsBareNotFound, returns to the ./error-response.js import with a two-line comment (+3/-2). Every other hunk of the 12 files, the three changesets included, is byte-identical between the two heads.
• The merge. git show --remerge-diff 07b1e218a5 is empty: no conflict was resolved, the texts merged as they were. That is why the earlier head built on its own branch and failed in the queue: main's slice 13b dropped the import as unused (its note at rest-server.ts:372 on main) while this PR's two new readers of it still sit in rest-server.ts.
• What main moved under the PR (7715d04..cbfa5e4). rest-server.ts -1113 net and meta-item-read-routes.ts +1199 new: the plain item read, /references, /layers, book/:name/tree and their two helpers moved; sendMetaItemAbsent became an export function (rest-server.ts:1622) so the new module can import it; thrownAnswerIsBareNotFound left the import. No diff line of that range names fetchCurrentMetaDocument, eventDoorRefusal, wiredEngineOrLoud, gatesPerCaller, gatesOnItsOwnKey, metaTypeSingular, resolveMetadataService or objectQLProvider other than docblock prose that moved with the item read. http-dispatcher.ts changed only for contracts: the other getSession readers still read the session through any or a cast, and two read a top-level activeOrganizationId that AuthSessionApi never declares (the follow-up to #24196) #24222's session typing; getObjectQLService (2781) and errorFromThrown (1240) are untouched. Unchanged on main across the window (empty diff stat): error-response.ts, meta.ts, protocol.ts, registry.ts, sys-metadata-repository.ts, meta-collection-routes.ts, meta-item-read-gate.ts, metadata-protection.zod.ts, thrown-http-error.ts, packages.ts, engine-double-contract.pinned.json, check-changeset-no-major.mjs, clause2-line.mjs. So every symbol the PR's hunks read still means what the PR assumes; the one that moved is the plain read's catch, judged in ①.A.

Check-runs at read time (2026-10-18T03:47:58Z): 39 runs; 29 success, 6 skipped, 4 in_progress, 0 failure. success: Build Core (completed 03:36:07Z), TypeScript Type Check, Type Check workspace / source gates / consumer gates / debt ledger, Lint and Repo Gates and its seven Lint legs, Check Changeset, Governed Surface Queue Guard, Check PR Size, Check Documentation Links, Flag docs affected, Dogfood Regression Gate (aggregate), the four PR-claim checks (Part-of PR must not also close its card among them), Auto Label, filter, Test Core (1/6) and (5/6). in_progress, recorded as seen and not waited for: Test Core (2/6), (3/6), (4/6), (6/6). skipped by path or opt-in filter: Build Docs, Console Pin Gate, the Dogfood shards placeholder and Dogfood Verify CLI, Temporal Conformance, Packed-tarball smoke. The build and type-check families the queue failure named are answered green on this head (③.1); the test family is two shards in and four out at read time (③.2).

① Derived judgments

A. The import fix and the moved catch (the head move's own judgment). rest-server.ts:374 imports thrownAnswerIsBareNotFound from ./error-response.js again. Its two readers are the ones the queue's TS2304 named: eventDoorRefusal (3647) and the /diff branch (6420). sendMetaItemAbsent stays defined in rest-server.ts (1622, now exported) and both doors read it locally. The moved plain read, meta-item-read-routes.ts, imports thrownAnswerIsBareNotFound from ./error-response.js (126) and sendMetaItemAbsent from ./rest-server.js (137), and its catch at 1061-1066 is if (thrownAnswerIsBareNotFound(error)) { sendMetaItemAbsent(res); return; } handleRouteError(res, error);. sendMetaItemAbsent emits one literal, status 404 and { error: { code: 'RESOURCE_NOT_FOUND', message: 'Metadata item not found or access denied.' } }; thrownAnswerIsBareNotFound (error-response.ts:1060) asks resolveErrorResponse for status 404, body.code RESOURCE_NOT_FOUND and no declaredCode, unchanged on main. So after the move the plain read's catch and the PR's event and diff doors still share ONE recogniser and ONE emitter across two modules, and the byte-equality claim holds structurally, not by coincidence. The pin meta-alternate-door-read-gates.test.ts drives the plain read through the registered route table, which registerMetaItemReadRoutes.call(itemReadHost, scope) fills at rest-server.ts:5296, so it compares the real bodies of both doors on this head. Right.

• Route table at this head: rest-server.ts keeps /history (5711), /audit (5853), /diff (6321), /object/:name/state/:field (6554), /published (6706) and the PUT / DELETE :type/:name doors; meta-item-read-routes.ts holds GET :type/:name (413), /references, /layers, book/:name/tree. No path is registered twice, and every PR hunk sits in a door that stayed.
• MetaItemReadRouteHost (meta-item-read-routes.ts:153) types each member by indexed access on RestServer; the PR adds no class member and changes no signature the host names, so the host literal (5277-5295) compiles unchanged. Build Core, TypeScript Type Check and the three Type Check lanes are success on this head.
• Main's census tests edited for the move, read against this diff: meta-draft-read-door-census.test.ts counts 'draft' literals and .previewDrafts / .listDrafts accesses over the 15 registrar files (SITES 8); the PR's rest-server.ts hunks add none (its two new getMetaItem calls carry no state). rest-server-docblock-position.test.ts pins per-file MINIMUM block counts (59 over the moved files), not positions; the PR adds text inside existing blocks. execctx-consumer-census.test.ts: the PR adds no resolveExecCtx site. objectql-slot-consumer-census.test.ts counts objectQLProvider sites in rest-server.ts and batch-routes.ts; main's move touched no such site, so the PR's count of 4 (computeExecCtx, /state, the batch door, /published) is the count on this head. Right.

B. GET /meta/_drafts, both transports: the producer listDrafts (protocol.ts:25569-25570). The filter is draft.type === 'package' || !isItemOfDisabledPackage(this.engine?.registry, { _packageId: draft.packageId }), applied after the repository's own type / packageId narrowing and before the member spelling, so the declared header shape is untouched. isItemOfDisabledPackage (547) is the one predicate the list read (10411) and the by-name read (11105) ask. The repository projects packageId: row.package_id ?? null (sys-metadata-repository.ts), and registry.isPackageDisabled (registry.ts:5394) answers false for a falsy id, so an unbound draft stays listed; a registry without the predicate hides nothing, the same optional-call shape the list and by-name reads take. ?packageId= naming the disabled package answers { drafts: [] }, what a package nothing is drafted under answers. Right: triage's answer (absence), by the one predicate.

• Callers of the protocol method at this head: exactly two, the REST door (meta-collection-routes.ts:389, after the mayReadPendingDrafts gate and the arity refusal) and the dispatcher door (meta.ts:2026, after its gate and arity refusal). Neither is edited. The SDK's meta.listDrafts (client/src/index.ts:2114) reads these doors. No CLI, plugin, service or core caller.
• Resolution readers that keep seeing a disabled package's drafts, all unchanged and all reading SysMetadataRepository.listDrafts directly: publishPackageDrafts (25848), discardPackageDrafts (26704), revertStoredPackage (26831) and the batch closure fed the publish verb's own rows (26106). The runtime's publish-drafts and discard-drafts doors (packages.ts:1648, 1983) call those verbs, never listDrafts. The READERS table pins the split: two API rows enforces: true, one repository row enforces: false, plus the control (the healthy package's app/healthy_app and object/healthy_widget drafts, which the harness seeds, still listed; the disabled package's none). The Package disable and uninstall never reach the metadata/data layer: a disabled package's objects still serve rows, and uninstall leaves 7 orphaned sys_metadata rows #7557 reader-class rule holds.
• objectui at the pin 5e15928b, every _drafts / listDrafts reader: PackagesPage.tsx 432 (the sheet's load) and 536 / 590 (the same sheet's post-publish and post-discard refreshes, which the PR body's table folds into the first row), usePendingDrafts.ts:107, HomePage.tsx, DraftChangesPanel.tsx, usePublishAllDrafts.ts, ObjectHooksPanel.tsx:233, PackageOwdOverviewPanel.tsx:230, StudioDesignSurface.tsx 1521 / 2737, and two the table does not name: useNavTargetLabel.ts (a label lookup over rows Studio already fetched, falling back to the name) and draftStatus.ts (the chat's draft status over the same feed). No caller must tell disabled from missing.
• Answer now, disabled package: its drafts omitted on _drafts and _drafts?packageId=, both transports | triage: absence | a package nothing is drafted under: the same { drafts: [] }. package-type drafts never hidden; other packages' drafts unchanged. The merge and the import fix touch none of this.

C. REST G6, /history, /audit, /diff: the absence body. fetchCurrentMetaDocument (3596-3614, not edited by this PR, not moved by main) throws { code: RESOURCE_NOT_FOUND, status: 404 } when the plain read serves no item while getMetaItemLayered(...).effective is non-null. eventDoorRefusal (3635-3655) catches it, and when thrownAnswerIsBareNotFound says yes returns sendMetaItemAbsent as the sender; the history door (5796) and the audit door (5958) call refusal(res) and return. The /diff branch (6411-6425) sends sendMetaItemAbsent(res) and returns inside the handler's try. Every other throw is re-thrown to handleRouteError as before (NO_DRAFT, a 503, any declared code). A deleted item (every layer null) still reads undefined: events served, /diff of app / doc / book absent through the nested exit it already had (6436), a view's or dashboard's diff served (#22639). The body is the literal sendMetaItemAbsent emits and the moved plain-read catch emits (①.A). Pinned byte for byte against the plain read on all three doors (text(res) === text(plain)), the deleted doc's /diff body pinned unchanged, measured over HTTP at d78cc5fd. Right; it closes the first half's ③.1 and ACCEPT open question A.

• Answer now, a disabled package's gated item (app, view, dashboard, doc, book): 404, the plain read's nested body, equal bytes | triage: absence (status and code already matched; the body now does) | a deleted or never-stored name: events (200) on the event doors, the type's own /diff answer, unchanged. The merge's effect: none on the doors; the import fix is what lets them compile.

D. REST G7, GET /meta/object/:name/state/:field (6602-6621). After wiredEngineOrLoud the door asks registry.isObjectPackageDisabled(name) (registry.ts:5418, the name resolved through resolveObjectKey, the OWNER's package asked). On true it calls resolveProtocol(...).getMetaItem({ type: 'object', name }), which throws objectPackageDisabledError (protocol.ts:11101), rendered by the route's catch handleRouteError (6668). The plain read GET /meta/object/:name renders the same throw through the same renderer: its catch (meta-item-read-routes.ts:1061) asks thrownAnswerIsBareNotFound, false for OBJECT_PACKAGE_DISABLED, and falls to handleRouteError, so the bytes are equal (pinned toEqual against the plain read on the real protocol and real SchemaRegistry). The schema is never read (schema = disabledObject ? undefined : registry?.getObject?.(name); getObject pinned never called with the name). A protocol that does not refuse falls to the door's own 404 NOT_FOUND "Object not found", closed. A non-object name answers false and the door proceeds. Unwired engine: wiredEngineOrLoud(false) is undefined, nothing changes; rejecting engine: the existing 503. Right; it closes the first half's Q2 interim split with the dispatcher twin.

• Answer now: disabled object 404 OBJECT_PACKAGE_DISABLED, flat body, equal to the by-name read | triage: the object answer | a missing object: 404 NOT_FOUND "Object not found", nested, unchanged.

E. REST G8, GET /meta/:type/:name/published, every type but object and package (6820-6845, 6932-6941). The owner is the plain read's kept envelope packageId. Field identity verified on this tree: the envelope's packageId is servedLockState(...).packageId (protocol.ts:11619-11641), which is extractProtection(document).packageId (17954), which is document._packageId (metadata-protection.zod.ts:174), and the document is decorated, the very answer.item that getMetaItem asks isItemOfDisabledPackage about (11105) before withholding it with the envelope kept (11110-11111). A missing name has no item and no packageId, so isPackageDisabled(undefined) is false and the read takes its old exits. Withheld: neither the layered read nor the snapshot is asked (!withheld guards the overlay, withheld ? undefined : getPublished(...) the snapshot), and the door ends at its own 404 NOT_FOUND "Not found" (6943), the missing name's bytes on both exits (pinned, with getPublished never asked; measured over HTTP against the missing name's status, headers and body). On a host whose metadata slot lacks getPublished, the withheld item and the missing name both reach the same 501 at 6916: still the missing name's exits. Re-enable restores (pinned). The registry is reached through wiredEngineOrLoud (1556): an unwired host withholds nothing and serves as before (pinned); a rejecting provider is AuthzStoreUnavailableError, 503 SERVICE_UNAVAILABLE through handleRouteError (pinned); the census counts the fourth consumer and §3 cites the pin. The plain read is asked with the raw type, which canonicalizeMetaRequestType folds (11099), as the layered read folds it (11747), so a spelling refusal or a store 503 that read now throws reached handleRouteError from the layered read before; REST's answers under those conditions do not move. Objects keep the layered read's own OBJECT_PACKAGE_DISABLED re-throw. Right.

• Answer now: disabled non-object item 404 NOT_FOUND "Not found", equal bytes, on the overlay row and on the snapshot | triage: absence | a missing name: the same bytes. Objects: 404 OBJECT_PACKAGE_DISABLED (unchanged). Control served. The merge's effect: none (/published stayed in rest-server.ts; wiredEngineOrLoud, resolveMetadataService and the slot are unchanged).

F. Dispatcher /published (meta.ts:1264-1286), non-object, non-package. The same owner question through deps.getObjectQL(_context), which is getObjectQLService (http-dispatcher.ts:550, 2781): resolves the engine or null, never throws; null or a registry without the predicate means nothing is withheld. A disabled owner (isServiceItemOfDisabledPackage(registry, { _packageId: owner }), meta.ts:254, the same isPackageDisabled) answers deps.error('Not found', 404), which is the branch's own final exit (1348) and its snapshot miss (1332), so the body { "success": false, "error": { "code": "RESOURCE_NOT_FOUND", "message": "Not found", "httpStatus": 404 } } equals the missing name's bytes (pinned by JSON.stringify equality with neither store asked; measured through createHonoApp). Objects keep the layered catch's OBJECT_PACKAGE_DISABLED re-throw (1316-1323). A throw of the plain read answers deps.errorFromThrown(e, 404), i.e. resolveThrownHttpError(e, 404) (thrown-http-error.ts:206): a declared status / statusCode is kept, else 404; a registered code is kept, else the status-derived one. So a store outage answers 503 and a spelling refusal 400 where the door used to swallow every layered-read throw but OBJECT_PACKAGE_DISABLED and fall through to the snapshot; after, the dispatcher answers what REST's /published answers and what its own item read answers (meta.ts:1982, the same errorFromThrown(e, 404)). Judged right: transport parity on this door and the #5532 posture, at no cost to a well-formed name on a healthy store. The runtime changeset does not spell it (③.5). The merge's effect: none (meta.ts and the deps are unchanged on main).

• Answer now: disabled non-object item 404 RESOURCE_NOT_FOUND "Not found", equal bytes, both exits | triage: absence | a missing name: the same bytes. Control served.

G. The pins (every hunk byte-identical to the earlier head). package-disable-enforcement.test.ts: +2 API rows, +1 resolution row, +1 control; ablation (a) reddened exactly those three. rest/src/meta-disabled-package-doors.test.ts (new): the REAL protocol and REAL SchemaRegistry over an in-memory sys_metadata whose double routes delete, update and findOne through the producer's own dispatch predicates and whose find honours limit; /published on both exits with control, re-enable and getPublished never asked; /state byte-equal to the plain read with getObject never asked, a control, a missing name and re-enable; the slot's rejecting (503) and absent (serves) arms. meta-alternate-door-read-gates.test.ts: the withheld body equals the plain read's on every door; the deleted doc's /diff body unchanged. runtime/.../meta-disabled-package-doors.test.ts: dispatcher /published both exits, byte-equality with the missing name, neither store asked, re-enable, control (a protocol double; the real-protocol readings sit in the REST and #7557 pins). objectql-slot-consumer-census.test.ts: 3 to 4 consumers, all through the seam, §3 cites the new pin. scripts/engine-double-contract.pinned.json: three rows for the new double, matching its three assertEngine* calls; the file is GENERATED by --write and may only grow; main did not touch it. Ablations (b) through (g) each reddened only their own case with restores proven blob == HEAD. All at 98dd4f8141; the hunks have not changed since.

H. Accept-set and public-surface changes the diff implies, each judged. (1) listDrafts / _drafts served set narrows: right. (2) REST /published non-object served set narrows to the missing name's answer: right. (3) Dispatcher /published likewise: right. (4) REST /state/:field refuses a disabled object: right. (5) REST event and diff doors' 404 body dialect flat to nested at equal status and code: right (the plain read's own body, one emitter). (6) REST /published gains a 503 arm when a wired engine slot rejects: right (the decidable test every slot consumer must pass). (7) Dispatcher /published answers the plain read's refusals and outages as themselves instead of the snapshot: right (F). (8) The import restoration (ff82c7a1bf) changes no accept set and no public surface: it restores a module-internal import main dropped as unused, for two readers that main left in place. No new public method, spec key, error code or enforcement change; getMetaItemLayered untouched (ruling Q1 A); fetchCurrentMetaDocument untouched; G4, G5 and the class head untouched.

What each door answers now (a disabled package's item | triage's answer | a missing name), on this head:

• GET /meta/_drafts, REST and dispatcher: the drafts omitted, ?packageId= included | absence | { drafts: [] }, the same bytes.
• REST /meta/TYPE/NAME/history, /audit, /diff, gated types: 404, the plain read's nested RESOURCE_NOT_FOUND body, equal bytes | absence | events (200), or the type's own /diff answer, unchanged.
• REST /meta/object/NAME/state/FIELD: 404 OBJECT_PACKAGE_DISABLED, equal to GET /meta/object/NAME | the object answer | 404 NOT_FOUND "Object not found".
• REST /meta/TYPE/NAME/published, non-object: 404 NOT_FOUND "Not found", equal bytes, both exits | absence | the same bytes.
• Dispatcher /meta/TYPE/NAME/published, non-object: 404 RESOURCE_NOT_FOUND "Not found", equal bytes, both exits | absence | the same bytes.
• /meta/object/NAME/published, both transports: 404 OBJECT_PACKAGE_DISABLED (since PR fix(metadata-protocol)!: the by-name /meta read answers a disabled package's non-object item as absent, as the list omits it #24223) | the object answer | 404.

② Semver level

• Three changesets, @objectstack/metadata-protocol, @objectstack/rest, @objectstack/runtime, byte-identical to the earlier head, each minor, each BREAKING with Clause-②: no (narrowing) and the adr-0087 marker not-required (no-migration-prescription). minor is the launch-window level check-changeset-no-major.mjs enforces for a breaking change (its header, line 58: "During the launch window we ship breaking changes as minor"), and the marker's reasoning holds: no stored shape, key, export or code moves; re-enabling restores every read. Each body matches the diff on this head: metadata-protocol names the omitted set, ?packageId= included, package never hidden and the batch doors unchanged (verified at 25848 / 26704 / 26831); rest's three bullets match G8, G7 and G6 and quote the exact sendMetaItemAbsent literal, which is still the one literal both modules emit after the move; runtime's matches the dispatcher door, and "Objects already answered 404 OBJECT_PACKAGE_DISABLED here" is true since PR fix(metadata-protocol)!: the by-name /meta read answers a disabled package's non-object item as absent, as the list omits it #24223.
• No @objectstack/objectql changeset (a test file only) and none for the scripts/ ledger: right. The import restoration is a module-internal change with no published effect and needs no changeset.
• The PR body's Clause-②: no (narrowing) (owes one ... review before the queue) is the claim's spelling verbatim at a line start; readClause2Line (clause2-line.mjs:418) reads the value no and the arm narrowing and tolerates trailing prose. The title carries !. The face is narrowing, hence this tier.
• CI's verdict: Check Changeset success on this head (completed 03:33:33Z).
• Two prose gaps, no level change: the runtime changeset's "Unchanged: ... a name with nothing behind it" holds for a well-formed name on a healthy store, but the dispatcher door now answers a store outage 503 and a spelling refusal 400 where it answered the snapshot or 404 Not found (①.F; named in the PR body, item 5); and the rest changeset does not spell the new 503 arm of non-object /published on a wired-but-rejecting engine slot (①.E; named in the PR body under Acceptance notes). A one-sentence addendum to each is the most that is owed (③.5).

③ Boundary flags

1. The merge-queue build failure (comments 6245148853, 6245156186): fixed on this head. The merge group 25d0d923b failed @objectstack/rest's build with TS2304: Cannot find name 'thrownAnswerIsBareNotFound' at rest-server.ts 3646 and 6419; Build Core and the Test Core shards 3, 4 and 6 fell at "Build this shard's dependency closure" on that one error. Cause verified: slice 13b (646303eae) dropped the import as unused when it moved the item read's catch, and this PR's two readers of it stayed in rest-server.ts; the texts merged cleanly (empty remerge-diff) and the build did not. On this head the import is back at rest-server.ts:374, and the readers at 3647 and 6420 compile: Build Core success at 03:36:07Z, TypeScript Type Check and Type Check workspace / source gates / consumer gates / debt ledger success, Lint and Repo Gates success. The named break is closed.
2. Anything else the merge brought in, left broken? Nothing found in code: the merge resolved no conflict; main's move changed none of the symbols the PR's hunks read (interdiff section); the host interface, the route table and main's four census tests edited for the move were read against this diff and are consistent (①.A); the engine-double ledger and the census pin's count are unaffected. CI at read time: Test Core (1/6) and (5/6) success; (2/6), (3/6), (4/6) and (6/6) in_progress, recorded as seen and not waited for. The PR's own test files were green on the earlier head's CI with hunks byte-identical to this head's, and the only code difference is the restored import; the queue re-runs the full suite before merge in any case. The seat's queue step reads the four shards' conclusions before re-entry.
3. H1, the owner source (report open question 1): answered, option A is right. Field identity re-verified on this tree (①.E): the envelope packageId and the item _packageId the predicate asks are one field of one served document, asked of one predicate (registry.isPackageDisabled), the same pair the first half's echo fix reads (readServedPackageBinding, security-catalog-echo.ts:169-171, reads served.packageId). Nothing owed.
4. Studio Publish / Discard consequence (report open question 2): answered, option A under ruling item 6. Verified at the pin 5e15928b: PackagesPage.tsx:432 loads _drafts?packageId= into the sheet's draft list and its post-publish and post-discard refreshes (536, 590) reload the same list; for a disabled package the Pending changes section is hidden while the sheet's Enable button stays, and re-enabling reloads it. The publish-drafts and discard-drafts doors still act on those drafts when called directly. usePublishAllDrafts derives its package ids from _drafts, so Home's one-click publish leaves a disabled package's drafts untouched; usePendingDrafts, HomePage, DraftChangesPanel, draftStatus omit them (their by-name draft read already answered NO_DRAFT since the first half); useNavTargetLabel falls back to the name; StudioDesignSurface, ObjectHooksPanel, PackageOwdOverviewPanel read [] for a package whose list read already omits its items. No caller must tell disabled from missing; option B would re-open the one-answer split. Named for the seat: an operator who disables a package with pending drafts sees no draft count on its sheet until re-enable; a hint there is objectui's call. Not a blocker.
5. Changeset prose (report deviation 7 and ②): the dispatcher /published throw behaviour and REST /published's 503 arm are right as ①.F and ①.E read them, named in the PR body, not spelled in the runtime and rest changesets. The seat may fold one sentence into each at queue time or accept the PR body's naming. Not a blocker.
6. Two files outside the original claim list (deviations 1 and 2): scripts/engine-double-contract.pinned.json, the gate's own --write prescription for a new pinned double, and objectql-slot-consumer-census.test.ts, the census that exists to make a new objectQLProvider consumer examined on arrival; both re-declared in claim 6244976750. Right.
7. A fourth objectQLProvider consumer: a REST /meta door reads the engine registry for the first time. On a wired-but-rejecting engine, non-object /published is a loud 503; on a host with no engine slot nothing is withheld (the door's pre-metadata-protocol: a by-name /meta read of a non-object item (app, view, page, …) serves a disabled package's item while the list omits it; #24097 closes the object half only #24210 answer), the same degenerate-host widening the list filter and by-name read already carry. Cost: one extra plain read per non-object /published request on a wired host. Named; nothing owed.
8. The event doors' answer for a disabled gated item is the plain read's 404, not a deleted item's event list: ruled (item 1), pinned, measured. The ungated types' event and diff doors (page, flow, report, ...) still serve a disabled package's item's events and diff: no per-caller gate to bypass, named in the first half's ③.7 and in this PR body; this half does not change them. Nothing owed.
9. Remaining on the card: non-object ?layers=true and /layers on both transports (G4), the third dispatch; after slice 13b those doors sit in meta-item-read-routes.ts on REST and in meta.ts on the dispatcher (ACCEPT 6245117166). Part of #24210 is therefore right and the "Part-of PR must not also close its card" check is success on this head.
10. Measurement shape: the HTTP readings were taken at d78cc5fd, before the merge, and the dispatcher through createHonoApp's fetch handler. They carry to this head because every behavioural hunk is byte-identical and the code those hunks read is unchanged on main, except the plain read's catch, which moved with the same predicate and emitter (①.A); the pins that assert the same facts run in this head's CI. Accepted.
11. The head move has no os-dev-report: the merge and the import fix were made under the queue kick 6245148853's instruction ("the dev merges origin/main, re-imports, re-runs"); the card's last comment is the ACCEPT pointer 6245117166 and no later report names ff82c7a1bf. The PR body's Verification section still cites 98dd4f8141 and its gate union; its claims hold for the hunks, which have not changed, and this record is the delta review that kick asked for. The seat may re-word the body's head at queue time. Not a blocker.
12. Dev deviations carried from 6244647143: seven pushes to the own branch, the shared checkout's pre-created branch reset to a detached HEAD with no work on it, the scratch harness removed before the gate union, origin/main merged by a merge commit (twice now), the Clause-② spelling parsed locally. All acceptable.
13. Docs: the Docs Drift Check (6244639396, computed on the merge of this head into cbfa5e43) names 11 hand-written docs by anchor overlap; grepped at this head, the only disabled-package statements under content/docs outside releases are metadata-api.mdx's enable / disable routes and the package shape tables. None states that _drafts lists a disabled package's drafts or that /published or /state serve a disabled package's item. Nothing owed.
14. CI: nothing failed; four Test Core shards in progress at read time (③.2); every skip is a path or opt-in filter, and no exported symbol moves in this diff (sendMetaItemAbsent's export is main's), so the Console Pin Gate's skip is not a gap.

Implemented-by: claude/issue-24210-meta-disabled-doors-second-half
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-18T04:08Z · ACCEPT (re-queue)

Head: ff82c7a1bf. This supersedes ACCEPT 6245106275, which was on 98dd4f8141.

Item	Reading
Why again	Dequeued at 2026-10-18T03:21Z (CI_FAILURE, queue kick 6245148853). The merge group failed @objectstack/rest's build with TS2304 thrownAnswerIsBareNotFound at rest-server.ts (3646) and (6419). #23050 slice 13b (PR #24240, 646303eae) dropped that import as unused when it moved the item read's catch into meta-item-read-routes.ts; this PR's two readers of it stayed in rest-server.ts. The texts merged cleanly and the build did not.
Head move	Two commits. 07b1e218a5 merges origin/main at cbfa5e43; git show --remerge-diff is empty, so no conflict was resolved. ff82c7a1bf restores thrownAnswerIsBareNotFound to the ./error-response.js import (rest-server.ts:374, +3 / −2). The seat diffed both net diffs against their own merge-bases: exactly one hunk differs, that import. Every other hunk, the three changesets included, is byte-identical to the head ACCEPT 6245106275 read.
Moved catch	Read at this head: the plain item read's catch (meta-item-read-routes.ts, after 13b) still forks on thrownAnswerIsBareNotFound and still emits sendMetaItemAbsent. That function stays defined in rest-server.ts (now exported for the new module), and the PR's event and diff doors call it there. One recogniser and one emitter serve both modules, so the byte-equality claim and its pins still hold after the move.
Review face	Narrowing (Clause-②: no (narrowing)). A head move that touches code is not covered by the earlier record, so this head has its own CONTRACT_REVIEW_TIER record, 6245404399: PASS. Its central claims (interdiff, empty remerge-diff, the import site, the moved catch's fork and emitter) were re-verified by the seat in the tree.
Prose face	Unchanged since ACCEPT 6245106275: three changesets, byte-identical. The record names two prose gaps the PR body already covers: the dispatcher /published answers its 503 / 400 as themselves, and REST /published answers 503 for a wired-but-rejecting engine slot. Accepted without a changeset edit, as before. No sentence is false.
Gates	Dev rework report 6245490394 at ff82c7a1bf: 78 derived, 78 run, 0 NOT MEASURED, 0 unrun. The original TS2304 was reproduced by ablating the import (restored, blob == HEAD). Full build 76/76; @objectstack/rest build with DTS; typecheck exit 0 for rest, runtime and metadata-protocol; suites green for rest (6034 passed), runtime (6413), metadata-protocol (20641) and the #7557 pin (15/15).
CI	At this read: 47 check-runs, 39 success, 8 skipped, 0 failed. The skips are the six path or opt-in skips ACCEPT 6245106275 read, plus the body-edit re-runs of Auto Label and Check PR Size, whose first runs on this head succeeded. All eight are on the EXPECTED_SKIPS roster. Build Core, every Test Core shard and every Type Check lane are green: the exact families the queue run failed.

Disposition: unchanged from ACCEPT 6245106275 (open_questions A and A; deviations accepted). The rework report adds no open_questions and two deviations, both accepted: the worktree was re-created from the remote branch, and the PR's ready state was left as the seat set it. The PR body's Verification gains a paragraph naming the new head (read back identical by the dev).

Landing: ordinary queue (automerge_enable through the relay; the PR is already ready for review). Not governed (check-governed-merges.mjs --pr 24247: 0 of 12).

---

Generated by Claude Code