fix(rest, runtime): the dispatcher's /meta reads answer what RestServer's answer (#20320)

[objectstack-fleet]

Fixes #20320
Clause-②: yes (widening)

The runtime dispatcher's /meta reads now give the same answers as RestServer's. A host that mounts only the ${prefix}/* catch-all (createHonoApp, or any adapter on the public HttpDispatcher API) serves /meta through the dispatcher. Triage's direction was to extend the shared seam (AGENTS.md 〈Route & surface ownership〉 rule 1: one implementation, two transports). ADR-0076 item 9 keeps the catch-all as the fallback.

What changed

Row A: one list chain. Everything RestServer's GET /meta/:type does to a list after the store read moved, unchanged, into createMetaListAnswer in packages/rest/src/meta-item-read-gate.ts, beside createMetaListReadGate. The steps, in RestServer's order:

1. the 声明式端点的两个机器可读面会说谎:runtime-authored api 行在 /meta/api 与 /openapi.json 里在场,匹配器却永远看不见(真实 boot 实测) #5224 api served-set face;
2. the per-caller list gate;
3. ?id= for apps;
4. ?object= for views;
5. the ADR-0046 doc locale collapse;
6. the doc content slim;
7. the transport's own ADR-0106 object mask (a port);
8. the translation.

RestServer's handler keeps its entry: the repeated-parameter refusal, the unknown-type refusal and the admitted previewDrafts declaration from #20338, still ONE declaration ahead of every read of it. It then calls the chain. Every exit of the dispatcher's list branch (protocol, MetadataService, ObjectQL registry) calls the same chain. The dispatcher's own slimDocList is gone. Its list answer now carries Vary: Accept-Language, as RestServer's does.

The chain needs the locale parse and the translation helpers, so those moved too. RestServer's private methods extractLocale, buildTranslationBundle, translateOptionsFor, packagedObjectBase, translateMetaItems and the module-level isTranslatableMetaType are now one-line delegates to them. Nothing in meta.ts is a copy.

Row B: one public-audience predicate. isPublicAudienceRead moved out of RestServer. It now takes a method, a route shape and the raw :type. RestServer's static maps its registered path onto a shape and delegates. The dispatcher's anonymous gate at handleMetadataRequest's entry asks the same predicate with its own shapes: list for one segment, item for two. The dispatcher has no /book/:name/tree route; that path falls to the located ROUTE_NOT_FOUND tail. So the dispatcher never names book-tree, and that path, like /published, keeps the deny. The legacy one-segment object-name exit answers the anonymous deny, so the exemption can never reach an object schema.

The ?state=draft row. The dispatcher's item read declares ?state=draft next to ?preview=draft, each with its mayReadPendingDrafts admission, above every branch. It parses the parameter as RestServer does. An admitted caller gets the protocol's draft read for any type, the object branch included:

• 404 NO_DRAFT answered as itself when nothing is pending;
• otherwise the draft through the per-caller gate under STORED_VERSION_DOOR_POLICY. The constant moved to the shared module; RestServer keeps its static name as an alias.
• mayWriteItem comes from the dispatcher's own save-door admission. That admission is now spelled once, as a local in handleMetadataRequest, and the PUT branch uses it too.

A caller the predicate does not admit gets the plain read, byte for byte.

Add-on. The cached arm's [#9741] Typed request comment now says the branch is unreachable for an ADMITTED switch. The query parameter itself still reaches it.

Gate ledger. scripts/check-route-envelope.mjs declares meta.ts handBuilt: 2 (was 1), with a note. The dispatcher's list answer must carry Vary: Accept-Language, and deps.success takes no headers.

What a dispatcher-only host answered before (measured on b1cbd9277)

The census drives dispatch() and RestServer over the same fixtures:

• 18 type cells × 10 parameter probes × 4 callers = 720 list cells;
• anonymous public book and doc reads, with controls;
• the ?state=draft cells.

List cells, by cause, before the fix:

cause	cells
the same answer	140
Vary header only	374
items differ	166
status differs (anonymous 401 vs 200)	40

• ?id=crm listed every visible app. ?object=lead listed every view.
• /meta/docs served bodies. Every doc list kept translations, with no locale collapse.
• Translatable lists were untranslated.
• /meta/api listed the unserved declaration.
• Anonymous public book and doc lists and items answered 401.
• Admitted ?state=draft answered the active item: 10 cells, builder and author.

Evidence

• Red first. The census file at the base: 198 failed | 13 passed (211). On the fix: 211 passed (211).
• REST unchanged. pnpm --filter @objectstack/rest test: 211 passed files, 3831 passed | 2 skipped tests, with every existing REST test unedited. test:repo: 8 passed.
• Runtime. pnpm --filter @objectstack/runtime test: 283 passed files, 4073 passed | 1 skipped tests. test:repo: 280 passed, the census included.
• Runtime pins that moved, and why:
  • the list parity's anonymous test and the item parity's anonymous test: book and doc reads now reach the §6.7 gate, as on REST, and every other type keeps the deny;
  • the draft-door ledger gains the ?state=draft site.
• Ablations. Each was committed first, mutated through scripts/ablation-replace.mjs, and restored with the restore proven: blob equal to HEAD, empty git diff HEAD, zero markers left. The subject resolves through the runtime vitest alias to packages/rest/src, so no dist was involved. The suites run: the census and meta-list-read-gate-parity.test.ts, 251 tests.
  • (A) The shared chain as a no-op: 19 failed. The direction was NOT the predicted one. The 720 parity cells stayed green, because both transports call the one chain and move together; that is what one implementation means. The reference pins went red: the reference-moves pin, 4 row-B list cells, and 14 [finding] the runtime dispatcher's /meta LIST reads apply no per-caller gate: through a catch-all host, GET /meta/doc?include=content lists a set-gated doc body, /meta/book lists a set-gated book, /meta/app lists gated apps and entries #20237 reference and gate cells. The first attempt was refused by the tool (its replacement contained its anchor) and ran nothing; the second attempt is the measurement.
  • (A2) The dispatcher bypassing the chain's query and translation: 27 failed. 20 census cells went red (?id= 4, ?object= 4, ?include=content 2, translation 10), plus 7 [finding] the runtime dispatcher's /meta LIST reads apply no per-caller gate: through a catch-all host, GET /meta/doc?include=content lists a set-gated doc body, /meta/book lists a set-gated book, /meta/app lists gated apps and entries #20237 cells. This is the ablation that shows the parity cells can fail.
  • (B) The dispatcher skipping isPublicAudienceRead: 49 failed. 40 anonymous book and doc census cells, 8 row-B cells and 1 [finding] the runtime dispatcher's /meta LIST reads apply no per-caller gate: through a catch-all host, GET /meta/doc?include=content lists a set-gated doc body, /meta/book lists a set-gated book, /meta/app lists gated apps and entries #20237 cell went red. The 401 controls stayed green.

Gates, all on head 64a05bb97 (after merging origin/main at 15bf186f5)

• pnpm --filter @objectstack/rest test: 213 files passed; 3886 passed | 26 skipped. test:repo: 1 file, 8 passed.
• pnpm --filter @objectstack/runtime test: 283 files passed; 4073 passed | 1 skipped. test:repo: 3 files, 280 passed.
• pnpm --filter @objectstack/rest typecheck and pnpm --filter @objectstack/runtime typecheck: exit 0, check:test-typecheck OK on both.
• pnpm lint: exit 0, the whole repo, 133s.
• node scripts/check-issue-citations.mjs --base origin/main: exit 0.
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands: 81 commands derived. 80 were run on this head, each exit recorded, and all exit 0 except:
  • pnpm check:dual-build-cjs-loads, exit 3: NOT MEASURED, PREREQUISITE NOT MET, because 36 packages have no dist/ in this worktree.
  • pnpm check:pm-dispatch-gates, exit 124: NOT MEASURED, because its self-test alone ran past a 580s foreground cap. The diff touches no scripts/pm/ file; the family comes from the scripts/ path of check-route-envelope.mjs.
  • pnpm check:dts-closure first answered 1 on tree state: client, organizations and verify had a dist/ without .d.ts, and this diff touches none of them. After rebuilding those three it answers 0; that is the recorded reading.
• Reconciliation: dispatch-gates --ran answers 81 derived famil(ies) accounted for — 79 run, 2 NOT-MEASURED (the two named above), exit 0.
• check-route-envelope.mjs edited: the script has no test file of its own, and no test executes it. Its --self-test passes inside pnpm check:route-envelope.

Acceptance notes

• Out of scope; the census found these and they are reported, not fixed. The same family: the dispatcher's /meta answering differently from RestServer. Each is measured through dispatch() on the fixtures above.
  1. GET /meta/totally_invented_type answers 200 [] where RestServer answers 400 INVALID_REQUEST (the GET /api/v1/meta/<unknown-type> answers 200 with an empty collection while the write door refuses the same type #9488 refusal is REST-only).
  2. ?preview=DRAFT from a builder: the dispatcher compares case-sensitively and lists the published world, where RestServer overlays the drafts.
  3. The item read does not translate: GET /meta/app/crm with Accept-Language: zh-CN answers CRM against 客户管理.
  4. The item read does not collapse a doc's locale: it keeps translations, where REST answers 入门.
  5. There is no /meta/book/:name/tree route: 404 ROUTE_NOT_FOUND to an authenticated caller, where RestServer serves the tree.
  6. The object branch ignores ?preview=draft: a builder reads Invoice, where REST answers Invoice (draft).
• Not measured; read at source only.
  • The dispatcher's list and item reads thread resolveActiveOrganizationId for every type. RestServer threads organizationIdForMetaRead over the folded type, and only for org-overridable types.
  • The dispatcher's object mask sets no Cache-Control: private, no-store on an undetermined posture. RestServer's list does.
• Repeated parameters. RestServer refuses a repeated ?id= with 400. The Hono catch-all flattens the query to last-wins before dispatch(), so the dispatcher never sees a repeat. That is the adapter's seam, not this domain's.
• Docs drift, not filed. content/docs/permissions/system-context.mdx row 49 lists /layers, ?layers=true and /diff as the doors where a caller the save verdict admits reads an app's full stored version. It does not list ?state=draft: not on REST since [finding] an app author's draft baseline is read through the pruned plain read (GET /meta/app/:name?state=draft), and the designers merge it over the whole stored app, so a draft save drops the navigation entries withheld from that author #20290, and not on the dispatcher after this PR.
• Public API. @objectstack/rest gains the exports createMetaListAnswer, translateMetaList, metaRequestLocale, isPublicAudienceRead, STORED_VERSION_DOOR_POLICY and their types. Nothing is removed. That is a widening of its published surface, so the changeset declares @objectstack/rest minor with Clause-②: yes (widening); @objectstack/runtime stays patch.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/rest, @objectstack/runtime, touching 80 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/rest/src/index.ts, packages/runtime/vitest.repo-tests.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

38 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json dcd3bceaa068fc3cfb589bd6e04cd0b89b660580.

⛔ 10 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/rest/src/index.ts, packages/runtime/vitest.repo-tests.json) — pages documenting those are invisible to this run
• 1 cross-cutting symbol(s) contributed no route anchor: resolveProtocol (26 routes)
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 33 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json dcd3bceaa068fc3cfb589bd6e04cd0b89b660580 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 49231f28901d87c914432118c2ff784a8f9e0f84 — the merge of head 07671d4d40e46a961327dc6d41b9ee7a01bea921 into base dcd3bceaa068fc3cfb589bd6e04cd0b89b660580, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 49231f28901d87c914432118c2ff784a8f9e0f84 && git checkout 49231f28901d87c914432118c2ff784a8f9e0f84
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin dcd3bceaa068fc3cfb589bd6e04cd0b89b660580 07671d4d40e46a961327dc6d41b9ee7a01bea921 && git checkout -B drift-repro dcd3bceaa068fc3cfb589bd6e04cd0b89b660580 && git merge --no-ff 07671d4d40e46a961327dc6d41b9ee7a01bea921

node scripts/docs-audit/affected-docs.mjs --json dcd3bceaa068fc3cfb589bd6e04cd0b89b660580

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs dcd3bceaa068fc3cfb589bd6e04cd0b89b660580 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 64a05bb978e40330b569ebe894f2a38bbbec963f

① Derived judgments

• Moved chain unchanged for RestServer — correct. Compared the removed inline blocks (rest-server.ts on origin/main, the GET ${metaPath}/:type handler) with createMetaListAnswer (packages/rest/src/meta-item-read-gate.ts) step by step. Same order (api face → list gate → ?id= → ?object= → doc locale → doc slim → mask → translation), same conditions (metaType === 'api' && !previewDrafts; typeof appIdFilter === 'string' && appIdFilter !== ''; query?.object truthy; query?.include !== 'content'), same shape rule (listItemsOf/withItems ≡ the inline array-or-{items} unwrap; metaItemsArray unchanged). resolveEndpointMatchAuthority already returns EndpointMatchAuthority | undefined, so the chain's added isEndpointMatchAuthority re-check is idempotent. Doc locale step calls sources.requestLocale() with no i18n ≡ this.extractLocale(req). Mask port (RestServer.metaListAnswerSources.maskObjects): same resolveObjectMasker(…, 'object'), D6 ObjectSchemaMaskEvaluationError → {ok:false} → sendFieldVisibilityFault(res, object); applyObjectSchemaMask + emptied → the same fault, which is exactly what maskObjectDocument (head :4000) did; Cache-Control: private, no-store still set after the loop. Translation: translateList → translateMetaItems(req, req.params.type, …) → translateMetaList, identical sequence (translatable check → unwrap → i18n → bundle → locale → import → protocol only for object → map). Vary is set after the !answer.ok exit, as before. metaItemReadGateSources returns closures, so the spread into MetaListAnswerSources keeps this. isPublicAudienceRead: /\/:type(\/:name)?$/ ≡ item | list, book-tree tested first, pluralToSingular ≡ PLURAL_TO_SINGULAR[t] ?? t on every string that can equal book/doc. No divergence found; packages/rest/src/*.test.ts untouched in the diff.
• Dispatcher answers what RestServer answers — correct, within the gaps the PR body itself lists. packages/runtime/src/domains/meta.ts: all four list exits (protocol, MetadataService.list, registry objects, registry listItems) go through answerList → answerMetaList → createMetaListAnswer, with previewDrafts declared once at the branch entry with its admission. Vary: { ...deps.success(answer.data), headers: { Vary: 'Accept-Language' } }; createHonoApp (packages/adapters/hono/src/index.ts:427) and dispatcher-plugin.ts:419 write response.headers to the wire. Cache: the dispatcher list has no cache; the missing Cache-Control: private, no-store on an undetermined posture is a real residual and is declared in the PR body. Anonymous exemption is exactly book/doc × list/item: isPublicAudienceRead(method, metaReadRouteOf(parts), parts[0]), list for 1 segment, item for 2, undefined otherwise, GET only, folded type; types, _drafts, _migrate-stored, zero segments, /published, the FSM /state/:field and the unrouted tail all keep the deny; the legacy one-segment object-name exit has if (anonymous) return anonymousDeny() before registry.getObject (head :1521). ?state=draft (head :1120-1135): isDraftRead = typeof query?.state === 'string' && …toLowerCase() === 'draft' && mayReadPendingDrafts(ctx), the same parse as rest-server.ts:6450; a non-admitted caller falls into the plain read, which never reads state (pinned byte-for-byte on both transports with the protocol never asked for state: 'draft'). Admitted: readPendingDraft → getMetaItem({ state: 'draft', previewDrafts, packageId, organizationId }); a thrown NO_DRAFT goes through errorFromThrown(e, 404) and NO_DRAFT is in error-code-ledger.zod.ts:615, so code survives as itself; gate under the shared STORED_VERSION_DOOR_POLICY with mayWriteItem = saveVerdict(canonicalMetaUrlType(type), activeOrganizationId).allowed, the same saveVerdict the PUT branch calls (head :1178); object mask after. Residuals on this row: no item locale collapse/translation and the org-id source (resolveActiveOrganizationId vs ctx.tenantId), both listed in the PR body's acceptance notes.
• Security — correct, no new reach found. After the deny is skipped, a doc/book item can only exit through serveItem → gateMetaItemDocument (protocol and MetadataService.getItem exits) or a 404; a list only through the chain's createMetaListReadGate. In the shared gate, allReadable = caller.authenticated && !gated (meta-item-read-gate.ts:528), so an anonymous caller never takes the every-doc fast path; the doc arm filters by docAudienceAllows and the book arm by admitsBook, which admit 'public' only; the item gate answers anonymous refusals 401 UNAUTHENTICATED. Object schemas, apps, views, writes, HEAD/undefined method: denied at entry. Pinned: DOC_SECRET never on the wire, /meta/doc/crm_admin_runbook anonymous → 401.
• Census is derived — correct, with one limit. deriveListReads() parses rest-server.ts for the GET ${metaPath}/:type handler literal and the chain's createMetaListAnswer/metaRequestLocale/translateMetaList, collecting query.X reads, refuseRepeatedQueryParams literals (['package','preview','object','include','id']), extractLocale calls and metaType === '…' literals, and asserts each is a probe/type cell (plus TRANSLATABLE_METADATA_TYPES). A projection reading a new parameter or keying on a new type literal reddens it. Limit: a step reading no new parameter and spelled without a metaType === literal is not derived; then only the 720 equality cells catch it, and only if it lands on one transport.
• Ablations hold by reading. A: both transports call the chain, so equality stays green; the reds are the reference-moves pin (asserts ?id=, ?object=, slim, locale, translation, api face on RestServer), the 4 row-B list cells (need the gate inside the chain) and [finding] the runtime dispatcher's /meta LIST reads apply no per-caller gate: through a catch-all host, GET /meta/doc?include=content lists a set-gated doc body, /meta/book lists a set-gated book, /meta/app lists gated apps and entries #20237's fixed-expectation cells; the row-B item cells and the ?state=draft cells do not use the chain, consistent with staying green. So yes, the census cannot catch a chain defect that hits both transports by equality; the reference pin covers steps 1, 3, 4, 5, 6, 8, [finding] the runtime dispatcher's /meta LIST reads apply no per-caller gate: through a catch-all host, GET /meta/doc?include=content lists a set-gated doc body, /meta/book lists a set-gated book, /meta/app lists gated apps and entries #20237 covers 2 and 7, and RestServer's own unedited suite covers each. A2 (4 + 4 + 2 + 10 = 20) and B (4 types × 10 probes = 40 row-A anonymous cells; 4 list + 4 item row-B cells; 401 controls untouched) match the cell arithmetic.
• Gate edit — correct. check-route-envelope.mjs counts response: object literals; the failure text (:2028-2031) prescribes exactly "raise the count and say which in note" for "a status or header the helper cannot express", and kind 1 in its docblock already names the header case (Allow:). deps.success(data, meta) (http-dispatcher.ts:1009) takes no headers. Not a weakening. vitest.repo-tests.json is required: the SPLIT rule (check-cross-package-test-inputs.mjs:2570-2595) holds the list equal to the escaping-test scan in both directions; the census readFileSyncs packages/rest/src/rest-server.ts and meta-item-read-gate.ts, and runtime's local project excludes REPO_TESTS (vitest.config.ts:219).
• Comments and changeset prose — true, except the declaration. [#9741] comment: the cache condition !isDraftRead && !previewDrafts (head :6552) does admit a non-admitted caller's ?state=draft. metaReadRouteOf docblock, the notifyMissingEndpointMatcher twin (RestServer logError), the 5856866273 citation (carried from main's docblock) all check. Every "before" row in the changeset matches base meta.ts (slimDocList comparing type !== 'doc', only package/preview read, unconditional shouldDenyAnonymous, state never read). Wrong: the changeset says "New exports from @objectstack/rest…" and still declares Clause-②: no / patch — see ②.

② Semver level

Wrong: @objectstack/rest must be minor with Clause-②: yes (widening); @objectstack/runtime patch is right. packages/rest/src/index.ts adds 5 value exports and 6 type exports to the root . subpath, which the package's exports map makes addressable — the published surface as contract-review.md:9 defines it. The Clause-② criterion (execution-duties.md:66) is "widen the accept set OR enlarge the public surface"; the family precedents PR #20236 (createMetaItemReadGate + 5 types) and PR #20319 (createMetaListReadGate) each declared @objectstack/rest: minor + Clause-②: yes for exactly this class and said so in the changeset. AGENTS.md (:1074-1075) and the 2026-09-04 ruling: yes takes at least minor. Check Changeset is green only because check-changeset-no-major.mjs enforces yes ⇒ ≥ minor, not a wrong no; landing-operations.md:11 calls a wrong no an auditable false declaration and the enqueue gate reads the claim comment's line. Runtime: a fix, packages/runtime/src/index.ts untouched.

③ Boundary flags

• Files outside claim 5863714418: packages/rest/src/index.ts (root export surface; not on the claim's list and not declared as a deviation in the os-dev report), packages/runtime/vitest.repo-tests.json (declared), scripts/check-route-envelope.mjs (declared). The read-only fence (core, metadata-core, metadata-protocol, spec) is untouched.
• PR body vs diff: +1693/−527 across 11 files, the delegates, slimDocList removed, handBuilt: 2, the export list and "nothing removed" all match; "every existing REST test passes unedited" holds (no packages/rest/src/*.test.ts in the diff); Clause-②: no does not hold (②).
• CI on the head: 30 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)), 1 in progress: Lint & Repo Gates. No red. Check Changeset green.

Implemented-by: claude/issue-20320-dispatcher-meta-list-parity
Reviewed-by: session_01UYBdGBzWSrAMzpW8ah3GbP

Independence: INDEPENDENT AGENT (fed the card, the triage direction and the PR only; not the dispatch order or the seat's conclusions)

VERDICT: FAIL

• Change .changeset/20320-dispatcher-meta-read-parity.md to '@objectstack/rest': minor and Clause-②: yes (widening) (keep '@objectstack/runtime': patch), and correct the Clause-② line in the PR body and in the claim comment to match, as PR fix(runtime,rest): the dispatcher /meta item reads ask the per-caller read gate RestServer asks (#20193) #20236 and PR fix(runtime,rest): the dispatcher /meta list prunes what RestServer's list prunes, through one list gate (#20237) #20319 did for new @objectstack/rest root exports; the seat should also record packages/rest/src/index.ts on the claim's file surface.

---

Generated by Claude Code

[objectstack-fleet]

Contract review (delta, patch round 1)

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 07671d4d40e46a961327dc6d41b9ee7a01bea921

① Derived judgments

• Changeset declaration — correct. .changeset/20320-dispatcher-meta-read-parity.md at the head: front matter '@objectstack/rest': minor, '@objectstack/runtime': patch; line-initial Clause-②: yes (widening) — …. The shared reader (scripts/pm/clause2-line.mjs, matchValueToken then readArmToken: ^\([ \t]*(widening|narrowing) anchored only at the start of the remainder) reads value yes, arm widening, and tolerates the trailing prose; the key is not in a backtick span, so clause2LineDescribes is false. check-changeset-no-major.mjs:393 and check-adr-0087-registration.mjs:374 both import that reader. Check Changeset is green on the head (both runs).
• Export sentence matches packages/rest/src/index.ts exactly — correct. Diff vs origin/main adds five values (createMetaListAnswer, isPublicAudienceRead, metaRequestLocale, STORED_VERSION_DOOR_POLICY, translateMetaList) and six types (MetaListAnswer, MetaListAnswerSources, MetaListRequest, MetaListTranslationSources, MetaPublicReadRoute, MetaRequestHttp), all re-exported from ./meta-item-read-gate.js, all declared there at the head (:230, :1536, :1559, :1574, :1591, :1701, :1728, :1759, :1798, :1816, :1877) and none present in that module or in index.ts at origin/main. The changeset names the same eleven, nothing extra. "Nothing it exported before is removed, renamed or narrowed" holds: the index.ts hunk is add-only (createMetaItemReadGate, createMetaListReadGate and the five prior types retained), no export *, rest-server.ts's root-level export declaration set is identical at main and head, and RestServer's static set differs only by the dropped private static metaItemsArray (TS-private, not published surface).
• Rest of the changeset prose — still true. The OLD→NEW delta on the file is exactly the two lines (front-matter level, Clause-② line); origin/main moved 15bf186→dcd3bceaa without touching any of the 11 files, so the "before" rows keep their base. No packages/rest/src/*.test.ts in the file list, so "every existing REST test passes unedited" stands. The closing "New exports … and their types" paragraph now duplicates the Clause-② sentence: redundant, not wrong.
• PR body — correct. Line 2 is bare, line-initial Clause-②: yes (widening) (first declared read wins; the Acceptance-notes mention is inline and never reached). The added sentence ("That is a widening … minor with Clause-②: yes (widening); @objectstack/runtime stays patch") is true against the changeset and index.ts. No body statement contradicts the changeset. One staleness, not a falsehood: the ## Gates heading still dates every reading to 64a05bb97; the round's gate readings on 07671d4d4 exist only in report 5865936722.
• Merge of origin/main — clean, no conflict resolution in the PR's files. d5e1b1bfb has parents 64a05bb97 and dcd3bceaa; its tree 1c172a3df equals a driver-free git merge-tree --write-tree 64a05bb97 dcd3bceaa from a bare probe clone, so it carries nothing beyond the two sides. Blob ids of all 11 files are identical at 64a05bb97, d5e1b1bfb and 07671d4d4 except the changeset (c1f14a11a→d4203b09f, in 07671d4d4 only). git diff origin/main...07671d4d4 --stat and …64a05bb97 --stat both list the same 11 files, +1693/−527; the files API agrees.
• Claim 5863714418 — covers all 11 files; line matches. Surface: rest-server.ts, meta-item-read-gate.ts, index.ts, runtime meta.ts, "tests in packages/runtime/src/domains/" (the four test files), one .changeset/20320-*.md, vitest.repo-tests.json, scripts/check-route-envelope.mjs. Line-initial Clause-②: yes; the claim template admits exactly yes | no (execution-duties.md:66), so the arm rides on the changeset and body, and the value agrees. Amended in place at 07:58:20Z, before the REWORK; newest claim still names this branch.

② Semver level

Right. @objectstack/rest has one export subpath, . (packages/rest/package.json at the head), and that entry gains 5 values + 6 types: a widening of the published surface, so minor with Clause-②: yes (widening), exactly as the family precedents .changeset/20193-dispatcher-meta-read-gate.md (PR #20236) and .changeset/20237-dispatcher-meta-list-gate.md (PR #20319) declared ('@objectstack/rest': minor + Clause-②: yes). Nothing removed or narrowed, so not (narrowing) and not major. @objectstack/runtime: packages/runtime/src/index.ts is not in the diff, no new surface, behaviour fix only, so patch.

③ Boundary flags

• Files outside the amended claim: none. Read-only fence (core, metadata-core, metadata-protocol, spec) untouched.
• PR file list between heads: unchanged (11 files, same stat).
• Body gate ledger: dated to the previous head 64a05bb97; nothing false, but the current head's gate readings are in the report comment, not the body. CI on the head is the check of record.
• CI on 07671d4d4 (read last): 27 success, 5 skipped (Auto Label, Build Docs, Check PR Size, Console Pin Gate, Packed-tarball smoke (opt-in)), 0 red, 7 in progress: Lint & Repo Gates, Test Core (1/6), Test Core (2/6), Test Core (4/6), Test Core (5/6), Test Core (6/6), Type Check · workspace. Green so far among the required set: Build Core, Dogfood Regression Gate, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard; Check Changeset green. The PR is still draft.

Implemented-by: claude/issue-20320-dispatcher-meta-list-parity
Reviewed-by: session_01UYBdGBzWSrAMzpW8ah3GbP

Independence: INDEPENDENT AGENT (fed the card, the triage direction and the PR only; not the dispatch order or the seat's conclusions)

VERDICT: PASS

---

Generated by Claude Code