fix(rest): read the PUT door's mode after its multiplicity guard; re-ledger the moved draft switch

refuseRepeatedQueryParams unwraps one ?mode occurrence encoded as an array,
so the shared mapping must read the query after it, as the inline read did.
The census of rest-server.ts draft switches loses its PUT row because that
switch is now read in meta-save-request.ts. The parity test's unhonourable
header list is typed so tsc accepts it.

Claude-Session: https://claude.ai/code/session_01RWZbGvPFcRKvUqASZtunCU
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/rest/src/meta-draft-read-door-census.test.ts

@@ -35,6 +35,13 @@
  * Spellings it cannot see — a switch read under another name, a draft asked
  * for by a spread of the raw query — are review questions, not rows; the
  * behaviour pins are what hold the doors it names.
+ *
+ * [#22141] `PUT /meta/:type/:name?mode=draft` — a `write` switch — is no row
+ * here because it is no longer read in this file: the door asks
+ * `metaSaveRequestOptions` (`meta-save-request.ts`), the one mapping the
+ * runtime dispatcher's `/meta` door asks too, after its write-capability gate.
+ * Its behaviour is held by `meta-compound-save-mode-parity.test.ts` and by both
+ * doors' rows in `packages/runtime/src/domains/meta-save-preconditions-parity.test.ts`.
  */
 
 import { describe, it, expect } from 'vitest';
@@ -160,11 +167,6 @@ const LEDGER: readonly LedgerRow[] = [
         disposition: 'read',
         door: 'GET /meta/:type/:name?preview=draft — the draft overlaid on the active item',
     },
-    {
-        site: "PUT ${metaPath}/:type/:name » req.query.mode.toLowerCase() === 'draft'",
-        disposition: 'write',
-        door: 'PUT /meta/:type/:name?mode=draft — SAVES a draft; admitted by the write-capability gate first',
-    },
     {
         site: "DELETE ${metaPath}/:type/:name » req.query.state.toLowerCase() === 'draft'",
         disposition: 'write',

packages/rest/src/meta-save-request.ts

@@ -49,6 +49,13 @@
  * `?mode=draft` (any case) is `mode: 'draft'`: the save stages a draft row and
  * leaves the active row alone. Any other value is an active save, as it has
  * always been on `RestServer`.
+ *
+ * `query.mode` is read as the string a door has already judged for
+ * multiplicity. `RestServer` calls this AFTER `refuseRepeatedQueryParams`,
+ * which refuses a repeated `mode` and unwraps one occurrence encoded as an
+ * array; the `@objectstack/hono` catch-all flattens its query from the URL, one
+ * string per name. ⛔ So call it after your own multiplicity gate, never
+ * before: an array reaching here is not read as a draft.
  */
 
 import type { SaveMetaItemRequest } from '@objectstack/spec/api';

packages/rest/src/rest-server.ts

@@ -7094,6 +7094,13 @@ export class RestServer {
                     // `@objectstack/hono` catch-all cannot answer this request
                     // differently. Its `request` members are spread into the
                     // save below, each present only when the caller asked.
+                    //
+                    // The multiplicity guard runs FIRST: it refuses a repeated
+                    // `force`, `package` or `mode` (see the `force` read below
+                    // for why that one is sharp) and UNWRAPS one occurrence
+                    // encoded as an array, so `?mode=` reaches the mapping as
+                    // the string it reads.
+                    if (refuseRepeatedQueryParams(req, res, ['force', 'package', 'mode'])) return;
                     const saveOptions = metaSaveRequestOptions({ headers: req.headers, query: req.query });
                     if (!saveOptions.ok) {
                         res.status(400).json({ error: { code: 'VALIDATION_ERROR', message: saveOptions.message } });
@@ -7112,8 +7119,8 @@ export class RestServer {
                     // string, and a non-empty array is truthy — so
                     // `?force=false&force=false`, a caller repeating an explicit
                     // OPT-OUT, turned the destructive-change guard ON. An
-                    // inversion, on a destructive verb, reported as 200.
-                    if (refuseRepeatedQueryParams(req, res, ['force', 'package', 'mode'])) return;
+                    // inversion, on a destructive verb, reported as 200. The
+                    // multiplicity guard above refuses it before this read.
                     const forceRaw = req.query?.force;
                     const force = typeof forceRaw === 'string'
                         ? ['true', '1', 'yes', 'on'].includes(forceRaw.toLowerCase())

packages/runtime/src/domains/meta-save-preconditions-parity.test.ts

@@ -273,10 +273,11 @@ for (const [doorName, boot] of DOORS) {
 
         it('a pin that can never be honoured is refused 400 VALIDATION_ERROR and writes nothing', async () => {
             const door = await boot();
-            for (const headers of [
+            const unhonourable: Array<Record<string, string>> = [
                 { 'If-Match': 'any-token', 'If-None-Match': '*' },
                 { 'If-None-Match': 'W/"an-entity-tag"' },
-            ]) {
+            ];
+            for (const headers of unhonourable) {
                 const refused = await door.save('case_grid', 'never', { headers });
                 expect({ status: refused.status, code: refused.code }, JSON.stringify(headers)).toEqual({ status: 400, code: 'VALIDATION_ERROR' });
             }