fix(runtime): the @objectstack/hono catch-all's PUT /meta honours If-Match, If-None-Match and ?mode=draft

[objectstack-fleet]

Fixes #22141
Clause-②: yes

What this changes

Behind @objectstack/hono's ${prefix}/* catch-all, PUT /meta/:type/:name is answered by the runtime dispatcher's /meta domain (handleMetadataRequest). That branch handed saveMetaItem no parentVersion and no mode. So through the catch-all a stale If-Match wrote (200, not 409), If-None-Match: * over an existing row wrote, and a ?mode=draft save landed on the ACTIVE row. A draft went live without a publish, and the client read a 200.

• One mapping, two doors. RestServer's private precondition parser moves to @objectstack/rest as metaSaveRequestOptions (packages/rest/src/meta-save-request.ts). It now also reads ?mode=draft. RestServer's PUT door and the dispatcher's PUT branch both call it, and spread its request (parentVersion and mode, each present only when asked) into saveMetaItem. It reads a Fetch Headers (get) or a plain header record, so it takes the raw Request the catch-all hands dispatch() and the record the plugin-hono-server adapter hands RestServer.
• Dispatcher refusals. A pin that can never be honoured (both headers, or an If-None-Match other than *) is 400 VALIDATION_ERROR, after the capability gate and before anything is written, as on RestServer. The dispatcher alone has a fallback writer (metadata.saveItem(type, name, item), used when the protocol has no saveMetaItem). It cannot carry a pin or a lifecycle, so a save that asks for one is refused 501 NOT_IMPLEMENTED there instead of written unguarded or active.
• RestServer answers are unchanged. One ordering moved: its multiplicity guard (refuseRepeatedQueryParams for force / package / mode) now runs just before the shared read, because the guard unwraps a single-element ?mode array in place and the mapping must see the unwrapped string. A request that carries both a malformed pin and a repeated parameter now gets the repeated-parameter 400 first. Both are 400 VALIDATION_ERROR.
• Widened public surface (Clause-②: yes). @objectstack/rest's package entry now exports metaSaveRequestOptions and the types MetaSaveRequestHttp, MetaSaveRequestMembers and MetaSaveRequestOptions. That widens its public surface, so its changeset is minor with Clause-②: yes (widening), the shape the read-side twin of this parity declared when it published createMetaItemReadGate. @objectstack/runtime's public surface does not change: its changeset stays patch with Clause-②: no.
• @objectstack/hono itself is unchanged: the catch-all already hands dispatch() { request: c.req.raw }, so the headers were on context.request all along (H3). The fix ships in @objectstack/runtime (patch) and @objectstack/rest (minor).

Readings (on origin/main 6ed0c0f3, this branch's base)

• H1, reach. In this repository objectstack serve / os dev compose createRestApiPlugin and createDispatcherPlugin. The dispatcher plugin mounts no /meta route (its explicit mounts are /notifications*, /keys, /analytics/*, /i18n/*, /health, /ready, /discovery, plus AI routes), so /meta writes there are RestServer's. packages/adapters/ now holds only hono, and createHonoApp is called by no app, example or package outside tests. Whether the hosted runtime's PUT /meta reaches this catch-all, and on which cloud pin: NOT MEASURED from this session (objectstack-ai/cloud is not readable here). The grade is the seat's.

• H2, reproduced on main, through the real createHonoApp. A scratch probe (not committed) mounted createHonoApp({ kernel, prefix: '/api/v1', cors: false }) from this checkout's adapter source over a LiteKernel carrying a real ObjectStackProtocolImplementation on ObjectQL + better-sqlite3 :memory:, with identity stubbed to manage_metadata. Requests went through app.request. Same probe, main's meta.ts then this branch's:

  request through the catch-all	main	this branch
  PUT /api/v1/meta/view/case_grid (v1, then v2)	200, 200	200, 200
  PUT with If-Match = v1's token (stale)	200, active row now v3 stale	409 METADATA_CONFLICT, active row v2
  PUT with If-None-Match: * over an existing row	200, active row now second	409 METADATA_CONFLICT, active row first
  PUT ?mode=draft	200, receipt state: 'active', active row staged, no draft row	200, receipt state: 'draft', active row v2, draft row staged

• H3, where. Confirmed: handleMetadataRequest's PUT branch read neither headers nor mode. The catch-all's dispatcher.dispatch(method, subPath, body, queryParams, { request: c.req.raw }, prefix) already carries the Fetch Request, so context.request.headers.get(...) reaches them. No adapter change is needed.

• H4, one mapping. Dependency direction measured: @objectstack/runtime depends on @objectstack/rest (dependencies), and rest does not depend on runtime. So the shared parser lives in @objectstack/rest, beside the /meta read chain the runtime already imports from there. No packages/spec edit.

• H5, every /meta write verb. Measured on both doors (catch-all rows driven through dispatch() with the catch-all's arguments, every header and parameter sent):

  write verb	parameter	RestServer	catch-all before	catch-all after
  PUT /meta/:type/:name	If-Match	→ parentVersion; stale → 409 METADATA_CONFLICT	dropped: stale token writes, 200	as RestServer
  	If-None-Match: *	→ parentVersion: null; over a row → 409. Non-* or beside If-Match → 400 VALIDATION_ERROR	dropped: writes, 200	as RestServer
  	?mode=draft	→ mode: 'draft'	dropped: lands active	as RestServer
  DELETE /meta/:type/:name (reset)	If-Match → parentVersion; ?state=draft → state; If-None-Match not read	as listed	verb not served: 405 METHOD_NOT_ALLOWED (Allow: GET, HEAD, PUT), no protocol call	unchanged
  POST /meta/:type/:name/publish	none of the three is read	—	route not served: 404 ROUTE_NOT_FOUND, no protocol call	unchanged
  POST /meta/:type/:name/rollback	none of the three is read	—	404 ROUTE_NOT_FOUND, no protocol call	unchanged
  POST /meta/_migrate-stored	none of the three is read	—	served; reads none of the three	unchanged

  The three verbs the catch-all does not serve answer loudly and write nothing. The comment on the 405 branch records that mounting a real DELETE there "needs its own card". RestServer's rows where a parameter is not read stay as they are (not widened).

• H6, same answer. Partly holds. Same status, same code, same refusal sentence, and the draft receipt says state: 'draft' on both doors. Not byte-identical envelopes: each transport answers in its own dialect, and the spec declares MetadataConflictErrorSchema as "the REST door's flat ADR-0112 dialect". RestServer's 409 is { error: SENTENCE, code: 'METADATA_CONFLICT', currentVersion: TOKEN }. The catch-all's is { success: false, error: { code: 'METADATA_CONFLICT', message: SENTENCE, httpStatus: 409 } } (measured through the real createHonoApp). currentVersion is not carried as data on the catch-all. That is an open question for the seat (see the report), not decided here.

• H7, neighbour. rest-server.ts's ?package reads (the PUT door's packageRaw / packageId lines and the publish door's) are untouched. Edits there are the import, the removed private parser, and the PUT door's precondition / guard / spread lines.

Pins (packages/runtime/src/domains/meta-save-preconditions-parity.test.ts)

Each door over its own real store (better-sqlite3 :memory:, the real sys_metadata* objects, a real ObjectStackProtocolImplementation). The store is read after every write. The RestServer leg calls its registered PUT handler. The catch-all leg repeats the catch-all's four statements over a real Fetch Request (path below the prefix, JSON body, query flattened from the URL, the raw Request as context.request) into the real HttpDispatcher.dispatch(). It cannot import createHonoApp: this package cannot depend on @objectstack/hono (that package depends on it), and packages/adapters/hono's suite aliases @objectstack/runtime to a stub. The H2 probe above is the real-createHonoApp reading.

Per door: control (an unguarded save writes the active row, last writer wins); a stale If-Match → 409 METADATA_CONFLICT, nothing written, and the current token still saves; If-None-Match: * writes the first row and over an existing row → 409, nothing written; ?mode=draft stages a draft and leaves the active row untouched; both unhonourable pins → 400 VALIDATION_ERROR, nothing written. Plus one side-by-side row (same status, code and token-masked sentence on both doors), and the dispatcher's fallback writer (three asks → 501 and saveItem never called; control: an unguarded save still reaches it).

Reverse verification and ablations (fix committed first; each leg restored from HEAD and proven by blob hash and an empty git diff HEAD; the subject resolves by relative source import and @objectstack/rest by the runtime vitest alias to source, so no dist/ leg applies):

leg	result	which rows went red
this branch	15 passed	—
main's meta.ts in the tree	8 failed, 7 passed	all on the catch-all side (4 case rows, the side-by-side row, 3 fallback rows). RestServer's 5 rows and both controls green.
ablation A: catch-all reads headers: undefined	6 failed, 9 passed	stale token, If-None-Match: *, the 400 row, the side-by-side row, 2 fallback header rows. RestServer green; the catch-all's draft row green.
ablation B: catch-all reads query: undefined	2 failed, 13 passed	the catch-all's draft row and the fallback draft row. RestServer green.

Ablations went through node scripts/ablation-replace.mjs (anchor hit x1 → x0, blob e90328952e70 → 18cb795a909f / 88f9509a61df, restored to e90328952e70 == HEAD, git diff HEAD empty).

Verification

All at this branch's head bba46774 (git rev-parse --short HEAD), base 6ed0c0f3. Heavy runs went through scripts/pm/os-verify-lock.sh.

• Build. pnpm --filter '@objectstack/runtime^...' build (dependency closure), then @objectstack/rest and @objectstack/runtime rebuilt at head: exit 0. dist/ checked to carry metaSaveRequestOptions.
• Typecheck. pnpm --filter @objectstack/rest typecheck: exit 0. pnpm --filter @objectstack/runtime typecheck: exit 0. The test layer printed check:test-typecheck: OK — 27 file(s) / 190 error(s) / 68 pinned signature(s) held, ledger unchanged. The new test file is in that program: it was refused once, for one error, before the fix in bba46774.
• Unit tiers. pnpm --filter @objectstack/rest exec vitest run --project local: 261 files passed, 4929 passed, 326 skipped. pnpm --filter @objectstack/runtime exec vitest run --project local: 335 files passed, 4736 passed, 19 skipped. The repo projects (test:repo) were not run locally; they are left to CI.
• Gates. The order's 64 commands plus the full pnpm lint, each exit recorded. node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands re-derived at head gives the same 64 (8 paths, 653 changed lines, under the 5000 threshold). --ran reconciliation: 64 derived famil(ies) accounted for — 63 run, 1 NOT-MEASURED, 0 unrun. 63 exit 0, and pnpm lint (eslint . --no-inline-config, whole repo) exit 0 with no findings.
  • NOT MEASURED: pnpm check:dual-build-cjs-loads, reason: exit 3 PREREQUISITE NOT MET. It reads every package's dist/, and 38 packages are unbuilt in this worktree. Declared narrowing in its place: the require entries of the two packages whose shipped code changed load at head. require('packages/rest/dist/index.cjs') gives 34 exports including metaSaveRequestOptions, and require('packages/runtime/dist/index.cjs') gives 312 exports. CI runs the full gate.
• Upstream. origin/main is 6 commits past the base (13aea189). None of them touches meta.ts, rest-server.ts, rest/src/index.ts, query-multiplicity.ts, http-dispatcher.ts or metadata-protocol/src/protocol.ts, so no merge of main was taken.
• Round 1 head 6d5f6a5f. Only .changeset/22141-rest-meta-save-request-options.md changed (patch → minor, Clause-②: no → Clause-②: yes (widening)), so the code verification above stands. dispatch-gates --commands for that path derives 20 gates, and all 20 exit 0 at 6d5f6a5f (--ran: 20 run, 0 NOT-MEASURED, 0 UNRUN). The branch union is unchanged (the same 64). Also exit 0: check:type-check-coverage, check:type-check-debt, and check-changeset-no-major.mjs --base origin/main --event over this body, whose level axis reads Clause-②: yes and finds @objectstack/rest: minor.

Acceptance notes

• Reproduced, not fixed here (reported to the seat): PUT ?package=all through the catch-all binds the row to a package literally named all. The dispatcher reads query?.package || undefined, while RestServer treats all and empty as the env-local overlay. Measured on the real store at this branch's head: catch-all → row package_id: 'all'; RestServer → package_id: null. This is the same write-parity family, but the shared fix would edit RestServer's ?package read, the region finding(metadata-protocol): a second package-less draft save of a package-owned item is refused 409 METADATA_CONFLICT with no If-Match — the save door's head read and the repository's draft package inheritance read different rows #22128's claim may edit. finding(metadata-protocol): a second package-less draft save of a package-owned item is refused 409 METADATA_CONFLICT with no If-Match — the save door's head read and the repository's draft package inheritance read different rows #22128 is not addressed here.
• The catch-all's 409 does not carry currentVersion as data (H6). Open question in the report.
• RestServer's PUT treats any ?mode value other than draft as an active save (no closed value set). Unchanged here: a row where RestServer itself does not refuse stays as it is.
• The dispatcher's /meta domain does not judge query multiplicity. The catch-all flattens its query to one string per name, so a repeated ?mode there is read as its last value. meta-save-request.ts's header records that a door calls the mapping after its own multiplicity gate.
• meta-draft-read-door-census.test.ts loses its PUT ?mode=draft row: that write switch is no longer read in rest-server.ts. Its header now says where it went and which tests hold it.

Written by session session_01RWZbGvPFcRKvUqASZtunCU. Round 1 changed only the Clause-② declaration (the @objectstack/rest changeset regrade and this body), with no code change.

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/rest, @objectstack/runtime, touching 16 documentable anchor(s).

28 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 0e9371f0c6104922e19b9bdaabc993b4d3dbca61.

⛔ 9 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 34 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0e9371f0c6104922e19b9bdaabc993b4d3dbca61 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 94c193505b7fea7efa6791b7b65c9318cdbc4dc2 — the merge of head 88ac87541f94f9a5ac5ac83c35b88999460a5cbf into base 0e9371f0c6104922e19b9bdaabc993b4d3dbca61, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 94c193505b7fea7efa6791b7b65c9318cdbc4dc2 && git checkout 94c193505b7fea7efa6791b7b65c9318cdbc4dc2
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e9371f0c6104922e19b9bdaabc993b4d3dbca61 88ac87541f94f9a5ac5ac83c35b88999460a5cbf && git checkout -B drift-repro 0e9371f0c6104922e19b9bdaabc993b4d3dbca61 && git merge --no-ff 88ac87541f94f9a5ac5ac83c35b88999460a5cbf

node scripts/docs-audit/affected-docs.mjs --json 0e9371f0c6104922e19b9bdaabc993b4d3dbca61

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0e9371f0c6104922e19b9bdaabc993b4d3dbca61 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 6d5f6a5fea58c6bb948c46fc3c2b10000ec1cd7a
Local-runs: none

① Derived judgments

Inputs, read 2026-10-08T06:40Z to 06:50Z: card #22141 (body and all six comments: triage 6052589425, claim 6052823060 as amended, reports 6053751704 and 6054009746, REWORK 6053835755, ACCEPT 6054035642), PR #22206 (body, 8-file list, net diff origin/main...6d5f6a5f, +585/−68 = 653 lines), the check-runs on the head, and the precedent #20193 / PR #20236. The PR head is still 6d5f6a5f (draft, base main, mergeable). origin/main is 7d7943dd, seven commits past the base 6ed0c0f3; none touches a file this PR touches or its neighbours (query-multiplicity.ts, http-dispatcher.ts, metadata-protocol/src/protocol.ts, spec/src/api/protocol.zod.ts, the hono adapter).

• Public surface, @objectstack/rest: a widening, named right. packages/rest/src/index.ts adds one value export (metaSaveRequestOptions) and three type exports (MetaSaveRequestHttp, MetaSaveRequestMembers, MetaSaveRequestOptions) to the package's only subpath (exports: ".", not private). The body is RestServer's former private metaSavePreconditionPin moved verbatim (the three refusal sentences are byte-identical) plus the ?mode=draft predicate that was inline at the PUT door (the same typeof === 'string' && toLowerCase() === 'draft'), with one new reach: a Headers-like get branch beside the record lookup h[lower] ?? h[canonical], which is what lets the catch-all's Fetch Request be read. MetaSaveRequestMembers picks parentVersion and mode off SaveMetaItemRequest; both are declared members of SaveMetaItemRequestSchema (parentVersion string nullable optional, mode enum draft|publish). No packages/spec edit. Dependency direction runtime depends on rest confirmed in both package.json files. Right.
• Public surface, @objectstack/runtime: none. No export changes, handleMetadataRequest keeps its signature, and the import block already drew from @objectstack/rest. Right.
• The dispatcher's PUT /meta/:type/:name refusals are a correction, not a narrowing. The declared contract (ADR-0008 §2.5: writes declare the head they expect and the server arbitrates; ADR-0033 §2: a draft write never lands live) and RestServer's own door already answered this route with 409 for a stale If-Match or * over a row, 400 for an unhonourable pin, and a draft row for ?mode=draft. main's meta.ts read none of it (zero occurrences of parentVersion or if-match; draft read only on the draft READ doors). The accept set the diff shrinks is one the contract never granted: a 200 that wrote through a declared refusal is the class-(a) wrong answer the card measured. Codes derive right: deps.error(msg, 400) resolves to standardErrorCodeForHttpStatus(400) = VALIDATION_ERROR; the 409 is the protocol's conflict builder (code = METADATA_CONFLICT, status = 409, a ledger member, kept by resolveThrownHttpError). mode: 'draft' reaches saveMetaItem as it does from RestServer. Clause-②: no on runtime is right, the same shape as the [finding] the runtime dispatcher's /meta item reads apply NO per-caller read gate: through a catch-all host, GET /meta/doc/:name serves a permission-set-gated doc body to a non-holder, and /meta/app/:name serves requiredPermissions-gated entries #20193 ruling that a pull-back to the declared contract is not clause ②.
• The fallback writer's 501: a bounded in-place refusal, named right. Reached only when protocol.saveMetaItem is absent and a metadata service with saveItem(type, name, item) exists; that writer can carry neither parentVersion nor mode, so the alternatives were the unguarded or active write this card closes, or a refusal. 501 is the code RestServer already answers for a save its protocol cannot take, derived as NOT_IMPLEMENTED; the sentence matches none of looksLikeInternalErrorLeak's limbs, so it reaches the wire. No non-test saveItem implementer exists under packages/*/src. Declared in the runtime changeset. Right. One unpinned precedence edge, nothing to fix: on a no-saveMetaItem host RestServer answers 501 before judging the pin while the dispatcher answers a malformed pin 400 first; both refuse, neither writes.
• RestServer's answers: unchanged in status, code, wording and body on every request, with the one declared exception. Verified against main: pin read, then resolveMetaWriteActor, then refuseRepeatedQueryParams(force, package, mode) became guard, then metaSaveRequestOptions, then actor. The guard unwraps a one-element ?mode array in place (query[name] = read.value), so the mapping must follow it: the move is forced, not cosmetic. resolveMetaWriteActor has no answer of its own. The spread ...saveOptions.request reproduces the old parentVersion spread and the trailing mode: 'draft' spread exactly (key order in the literal is not observable). req.headers arrives as c.req.header(), a plain lowercased record (plugin-hono-server/src/adapter.ts:1313), so the record branch runs and the header read is byte-identical. The one observable change: a request carrying BOTH a malformed pin and a repeated force, package or mode now gets the repeated-parameter 400 sentence instead of the pin's. Both are 400 VALIDATION_ERROR and the PR body declares it. The rest changeset's "Unchanged: RestServer's answers" is true of status, code and each sentence's wording and silent on that precedence; acceptable. Right.
• @objectstack/hono: unchanged, correctly. packages/adapters/hono/src/index.ts:739 already hands dispatch() { request: c.req.raw }; the test's catchAll repeats its four statements (sub-path substring, JSON body with catch to {}, searchParams flatten, the raw Request) statement for statement. Nothing publishes from hono, so no changeset is owed there despite triage's line; the deviation is right.
• No anchor breaks of the fix(runtime,rest): the dispatcher /meta item reads ask the per-caller read gate RestServer asks (#20193) #20236 kind. Every liveness evidence citation into rest-server.ts is a #symbol anchor (registerMetadataEndpointsInner, findPublicFormView, resolveFormBySlug, and so on), none of them the moved function; the rest-server.ts:1716 in view.json is prose in a note, which the gate does not read. scripts/adr-anchors/packages__rest__src__rest-server.ts.json anchors ADR-0045 filterAppForUser, untouched. meta-draft-read-door-census.test.ts drops its PUT ?mode=draft row because that literal left the file, and its header names the holders.
• PR-body readings checked against the tree, all true: packages/adapters/ holds only hono; no createHonoApp( caller outside tests (one docblock mention in runtime/src/domains/auth.ts); the dispatcher's /meta item door answers DELETE 405 with Allow: GET, HEAD, PUT (METADATA_ITEM_METHODS, meta.ts:229 and :1541–:1564, comment "needs its own card") and unrouted tails 404; RestServer's DELETE /meta door reads If-Match on its own (:7335) plus ?state=, as the H5 table says; the other two if-match reads (:9148, :9230) are the /data update and delete doors, not /meta. Round-1 delta bba46774..6d5f6a5f is one file, +2/−2.
• Residuals, named not failed: the dispatcher judges no query multiplicity, so a repeated ?mode through the catch-all reads as its last value where RestServer refuses 400 (pre-existing for every dispatcher query key, declared in Acceptance notes); the ?package=all binding is finding(rest): ?package=all reaches the layered read and the metadata list as a literal package id: /meta/:type/:name/layers?package=all answers 404 and GET /meta/:type?package=all answers [] for an item stored in a package #22188 (open, finding); H1 cloud reach is NOT MEASURED, so the p1 grade stays triage's.

② Semver level

• .changeset/22141-rest-meta-save-request-options.md: "@objectstack/rest": minor, Clause-②: yes (widening). Matches the diff: a new entry export widens the published surface, and AGENTS.md Post-Task step 3 makes yes at least minor. Precedent [finding] the runtime dispatcher's /meta item reads apply NO per-caller read gate: through a catch-all host, GET /meta/doc/:name serves a permission-set-gated doc body to a non-holder, and /meta/app/:name serves requiredPermissions-gated entries #20193 / PR fix(runtime,rest): the dispatcher /meta item reads ask the per-caller read gate RestServer asks (#20193) #20236 published createMetaItemReadGate plus five types as rest: minor, Clause-②: yes, after its round-0 contract review FAILed for lacking exactly that declaration. Every sentence of the changeset body is true of meta-save-request.ts (Headers-like or record input; { ok, request } or { ok: false, message }; quotes stripped; * pins no row; wording kept; case-insensitive draft; any other mode value an active save).
• .changeset/22141-runtime-meta-save-preconditions.md: "@objectstack/runtime": patch, Clause-②: no. A fix in a released package with no surface change, and refusals that are the declared contract's. Every sentence is true of meta.ts (the three fixed drops, the 400 pair, the 501 fallback, the unguarded save unchanged, and the transport's own { success: false, error: { code, message, httpStatus } } envelope via apiErrorResponse).
• PR body line 2 Clause-②: yes; the level axis (check-changeset-no-major, [finding] No gate answers whether a changeset's LEVEL fits the surface — Check Changeset is green on patch and on minor for the same diff #16055) asks for at least one moved package graded minor or above, which rest is. Check Changeset succeeded on the head in all three runs. Nothing breaking, so no ADR-0087 marker is owed. skip-changeset does not apply. No @objectstack/hono changeset, which is right: its shipped code is unchanged.

③ Boundary flags

The dev's flags (report 6053751704 deviations, report 6054009746 deviations) and the one open_questions entry:

1. No hono changeset: answered, correct (①).
2. The committed pin drives HttpDispatcher.dispatch() with the catch-all's arguments, not createHonoApp, and the real host is an uncommitted probe: answered with a correction, escalated to the seat. The two facts named are true (runtime cannot depend on hono; adapters/hono's vitest aliases @objectstack/runtime to src/__mocks__/runtime.ts), but the repo already holds the home built for this: packages/qa/http-conformance/src/hono-meta-item-read-gate.conformance.test.ts composes the real createHonoApp over a LiteKernel for the read-side twin. Triage's direction here ("one conformance test runs both doors over the same three cases") is met on the real dispatcher, the only thing the catch-all calls, so this does not fail the record. The seat decides whether a composed-host row of the write pins is added in packages/qa/http-conformance (this PR or a follow-up card) so the adapter's one-line hand-off is held by a test rather than a quoted probe.
3. File surface beyond the claim's three files: answered, forced by the move; the claim was amended in place (6052823060) to name them.
4. Bounded in-place 501 on the fallback: answered, right (①).
5. RestServer refusal order: answered, forced and declared (①).
6. H6 partly falsified, and open_questions[0] (currentVersion on the catch-all's 409): answered, C holds. MetadataConflictErrorSchema's docblock scopes itself to "the REST door's flat ADR-0112 dialect" and to the four RestServer /meta item doors, so no declared contract binds the dispatcher's envelope; B (an undeclared error.details member) would mint a dialect ADR-0112 forbids; A is a packages/spec change for domain:spec. The conflict builder already sets currentVersion on the thrown error, so A is cheap when reach is shown. The reopen condition needs a carrier: the seat should give it a card rather than an Acceptance note alone.
7. The pnpm lint order-versus-os-dev.md tension, the model-free commit trailers, the round-1 single PR-body PATCH with no footer appended, and the 44 branch-union gates carried from bba46774: answered, process with no contract effect; CI re-ran every gate on the head.
8. out_of_scope_findings[0], ?package=all: routed to finding(rest): ?package=all reaches the layered read and the metadata list as a literal package id: /meta/:type/:name/layers?package=all answers 404 and GET /meta/:type?package=all answers [] for an item stored in a package #22188, open.

Check-runs on 6d5f6a5f, read 2026-10-08T06:50Z: 35 success, 8 skipped, 1 in progress (Test Core (1/6), started 06:29:57Z), 0 failure. Lint & Repo Gates, Check Changeset (three runs), all four Type Check jobs, Build Core and Test Core 2 through 6 are green. Not fully green at this reading; the landing waits on that shard, which this record does not pre-empt.

Implemented-by: claude/issue-22141-hono-meta-write-preconditions
Reviewed-by: session_01RWZbGvPFcRKvUqASZtunCU

VERDICT: PASS