fix(rest,runtime)!: /layers and ?layers=true answer a disabled package's non-object item as a missing name, on both transports

[objectstack-fleet]

Fixes #24210

Clause-②: no (narrowing) (owes one CONTRACT_REVIEW_TIER review before the queue)

The card's last part (claim 6245752510): non-object GET /meta/:type/:name/layers and the deprecated GET /meta/:type/:name?layers=true, on both transports, now answer a disabled package's item exactly as a missing name, as the list read and the by-name read already do. PR #24223 and PR #24247 closed every other door; this part closes the last two spellings.

What changed

• packages/rest/src/meta-item-read-gate.ts, the shared layered chain createMetaLayeredAnswer: one step, 1b, after step 1 (no layer, so absent) and before step 2 (the per-caller gate). For every type but object, it answers { reason: 'absent' } when the new optional source MetaItemReadGateSources.isItemOfDisabledPackage says the plain read withholds the item for a disabled owner. Which types are hidden stays the plain read's decision (package never is), not a second copy in the chain. Both spellings on both transports call this chain, so no transport carries a step of its own. MetaLayeredRequest gains an optional packageId (the ?package= scope), which the step passes to the source.
• The source, wired on each transport:
  • REST: the RestServer class member metaItemReadGateSources. Withheld means the plain read under the same scope serves no item and its kept envelope packageId is one the engine registry's isPackageDisabled answers true for. The engine is reached through wiredEngineOrLoud, as /published reaches it.
  • Dispatcher: metaItemReadGateSources in runtime/src/domains/meta.ts. The same rule, through deps.getObjectQL and isServiceItemOfDisabledPackage.
  • Both callers of the chain pass the scope they already read: serveMetaItemLayered (one property) and answerMetaLayered (one property).
• Unchanged:
  • getMetaItemLayered, per ruling 6241893667 Q1 A: the producer keeps serving its resolution readers.
  • The object answer: the protocol's own 404 OBJECT_PACKAGE_DISABLED, thrown by the read before the chain runs.
  • package, which is never hidden.
• No route body is edited. Nothing changes inside registerMetadataEndpointsInner, meta-item-read-routes.ts or meta-collection-routes.ts. No spec change, no new error code, no new public protocol method.

The PM's hypotheses, measured

• H1, the owner: partly falsified. Measured on the real protocol and a real SchemaRegistry, before and after the disable:
  • A code-shipped item's layered envelope carries packageId, and its code and effective layers carry _packageId.
  • An overlay-only (runtime-saved) item's layered answer carries no owner at all: no envelope packageId, and _packageId on neither overlay nor effective.
  • A combined item carries the envelope packageId and code._packageId, but not effective._packageId.
  • So the layered answer cannot say who owns the item. The plain read's kept envelope packageId names the owner in all three cases, withheld item or not. That field is extractProtection of the served document, the same _packageId the by-name read's predicate isItemOfDisabledPackage asks. It is also what /published and plugin-security's readServedPackageBinding already read.
• H2, one step for both transports: holds. One optional source on the gate's sources interface carries it. An unwired host (no engine wired, or a registry that cannot answer) answers as before. On REST, a rejecting engine slot answers 503 SERVICE_UNAVAILABLE, never a layered view. A plain read that rejects is answered as that fault, never a layered view. On the dispatcher see the Acceptance notes.
• H3, the gate order: holds. An author (save-door admission true) is served the stored app whole while the package is enabled. After the disable, the author is answered the missing name. The member, served the app pruned while enabled, gets the same absence. Pinned in meta-disabled-package-doors.test.ts (REST).
• H4, the resolution readers: hold. security-catalog-echo.ts and packaged-permission-set-lock-gate.ts call getMetaItemLayered directly; REST's fetchCurrentMetaDocument calls getMetaItem then getMetaItemLayered directly. None goes through the chain. The Package disable and uninstall never reach the metadata/data layer: a disabled package's objects still serve rows, and uninstall leaves 7 orphaned sys_metadata rows #7557 READERS table gains three resolution rows: the producer for an app, the producer for a permission set (the two plugin readers), and the plain read's envelope packageId (the owner every one of these reads).

Measured: the ?package= scope matters

The same name can be stored in two packages. On the real protocol, twin_dash was saved in a disabled package and in an enabled one. getMetaItemLayered({ packageId }) answers each package's copy, and the unscoped by-name read resolves the disabled package's copy. An unscoped owner check would therefore withhold the enabled package's layered view under ?package= of the enabled package. So the scope rides into the owner read. That needs packageId on MetaLayeredRequest, and so a one-property edit in each caller of the chain (see Deviations).

HTTP, before and after, both transports

REST: pnpm dev:crm -- --fresh over a real socket. "Before" is base e74ec56ac (the three source files restored to the base, then rest and runtime rebuilt; no other bundle carries the step). "After" is this branch after a full pnpm build (76/76).

• Two Studio-created writable packages: app.probe-24210c (disabled) and app.healthy-24210c (control).
• Specimens in the disabled package: dashboard probe_saved_dash, page probe_page, app probe_app, object probe_gadget.
• twin_dash is stored in both packages.
• Callers: the seeded admin (an author) and a member created through /auth/admin/create-user.
• A code package cannot be disabled over HTTP (PATCH /packages/com.example.crm/disable answers 422 WRITABLE_PACKAGE_REQUIRED). So a code-shipped or combined item of a disabled package is not reachable on a live server. Those shapes are measured on the dispatcher harness below and pinned on REST with the real protocol.

door (each specimen; admin and member alike)	enabled, before = after	disabled, before	disabled, after
/layers, dashboard, page, app	200, the layered view	200, the layered view served	404 RESOURCE_NOT_FOUND, byte for byte the missing name
?layers=true, same three	200	200 served	404, byte for byte the missing name (headers: Deprecation; Link names its own path)
plain read, same three	200	404	404 (unchanged)
/layers and ?layers=true, twin_dash?package=app.probe-24210c	200	200 served	404, the missing name
same, twin_dash?package=app.healthy-24210c (control)	200	200	200
/layers and ?layers=true, object probe_gadget	200	404 OBJECT_PACKAGE_DISABLED	unchanged
control: healthy_saved_dash, pipeline_dashboard (shipped plus overlay, enabled package)	200	200	200
re-enabled		as enabled	as enabled

Mechanical comparison over the stored readings:

• After: 90 comparisons, 0 mismatches. Each withheld row equals the missing name's status, headers and body; each re-enabled row equals the enabled row.
• Before: the same comparison finds 16 mismatches, exactly the 8 layered rows per caller this PR closes.
• Enabled rows before vs after: 66 of 66 identical once version tokens, sequence numbers, timestamps and actors are normalised.

Dispatcher: the real createHonoApp over a real LiteKernel with ObjectQLPlugin and SqliteWasmDriver, through its fetch handler (app.request; no in-repo host mounts the dispatcher's /meta on a socket). It is the packages/qa/http-conformance shape, in a scratch harness that was removed afterwards. The disabled package (installed code, disabled on the registry) carries a code-shipped page, an overlay-only dashboard and a combined dashboard; the control package carries the same. Callers are an author (manage_metadata) and a member.

• Before: 12 rows served 200, 3 specimens times 2 layered spellings times 2 callers.
• After: 0. Each disabled row is byte for byte the missing name, Link aside (it names its own path).
• Enabled rows: 36 of 36 identical before and after. Re-enable restores every row.

Pins

• packages/rest/src/meta-disabled-package-doors.test.ts (real protocol and SchemaRegistry), five new cases:
  • both spellings before, during and after the disable, for a code-shipped, an overlay-only and a combined item, byte for byte the missing name (status, body and headers), with a control and a re-enable row, and the producer still serving;
  • an author and a member caller (H3);
  • the object row unchanged;
  • the ?package= scope;
  • the engine slot through wiredEngineOrLoud: rejecting is 503, absent serves as before.
• packages/runtime/src/domains/meta-disabled-package-doors.test.ts, four new cases:
  • both spellings for an overlay-only and a code-shipped page, byte for byte the missing name, with a control and a re-enable row;
  • the ?package= scope, including the scope the plain read was asked under;
  • the object row;
  • a rejecting plain read is its fault, and a registry that cannot answer withholds nothing.
• packages/objectql/src/package-disable-enforcement.test.ts: the three READERS resolution rows above.
• packages/rest/src/objectql-slot-consumer-census.test.ts: the census counts a fifth objectQLProvider consumer (the layered owner step, through wiredEngineOrLoud) and cites its pin. The census went red on the new consumer before this edit, as designed.

Verification

Rework after CI (seat message, Test Core (6/6) on ed6b7108ec). @objectstack/runtime's test:repo (vitest run --project repo) failed: meta-list-projection-parity.test.ts, "every type the item read keys on, and every translatable type, is a census cell", AssertionError: expected [ 'package' ] to deeply equal []. Reproduced locally. The census derives every type literal the item read's handlers and shared steps compare against, and step 1b's metaType !== 'package' made package a keyed type with no parity cell. The literal also restated a decision the protocol already makes. Fix in 527c7bc4ba (and the test type in 9d275b85e3); the lines that moved against ed6b7108ec:

• meta-item-read-gate.ts: the step's condition drops && metaType !== 'package' (one line); the source's and step 1b's docblocks say what withheld means.
• rest-server.ts (metaItemReadGateSources only): the plain read's cast gains item, and the return becomes envelope?.item == null && registry.isPackageDisabled(envelope?.packageId) === true (two lines; docblock three lines).
• runtime/src/domains/meta.ts (metaItemReadGateSources only): the same two-line change (docblock three lines).
• meta-disabled-package-doors.test.ts (runtime): one new case, "the plain read decides which types are hidden: an item it still serves keeps its layered view", and the double's getMetaItem typed Promise<any> so the case can override it. Ablating the item == null half turns exactly that case red (1 failed / 13 passed), restored blob equal to HEAD.

Final head 9d275b85e3 (with origin/main 53ef752436 merged, PR #24260 included, textually clean).

• Build: pnpm --filter '@objectstack/runtime...' --filter '@objectstack/objectql...' build exit 0; full pnpm build 76/76.
• Per package, every exit recorded separately:
  • @objectstack/rest: typecheck 0; test 0 (295 files, 6047 passed, 326 skipped); test:repo 0 (5 files, 270 passed, 16 skipped).
  • @objectstack/runtime: typecheck 0 (on 9d275b85e3; it was 1 on the commit before, the test double's type, fixed there); test 0 (416 files, 6552 passed, 19 skipped); test:repo 0 (3 files, 808 passed).
  • @objectstack/objectql: typecheck 0; test 0 (437 files, 8244 passed); test:repo 0 (1 file, 5 passed).
  • The suites ran on the merge head; the final commit after them changes one type annotation in a test file, whose own file (14/14), runtime typecheck (0) and runtime test:repo (808/808) were re-run on 9d275b85e3.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) derived 70 commands at 9d275b85e3. 69 exited 0 on the first pass; check:dual-build-cjs-loads refused with PREREQUISITE NOT MET (exit 3, no dist/ in a fresh worktree) and exited 0 after the full build. --ran: "70 derived, 70 run, 0 NOT-MEASURED, 0 UNRUN" (exit 0).
• The first round's readings stand for the behaviour: the HTTP tables above, the ablation of step 1b, and the gate union at ed6b7108ec (68/68). The rework narrows when the step fires (only when the plain read serves no item), which every withheld row above already satisfies.

Deviations

• Fence: the claim names rest-server.ts's metaItemReadGateSources only. This PR also adds one property, packageId, to the request literal serveMetaItemLayered hands the chain. serveMetaItemLayered is a class member, outside registerMetadataEndpointsInner and outside meta-item-read-routes.ts. On the dispatcher the same edit lands in answerMetaLayered. The reason is the measured ?package= collision above: without the scope, the owner step would withhold an enabled package's copy of a shared name.
• packages/rest/src/objectql-slot-consumer-census.test.ts is not on the claim's file list. Its count moves from 4 to 5, because the census exists to make each new consumer examined, the way the second half moved it from 3 to 4.

Acceptance notes

• The dispatcher's engine seam absorbs a failed resolution. HttpDispatcher.getObjectQLService catches a failed objectql resolution and answers null. On the dispatcher, then, an engine that cannot be resolved reads as "no registry to ask", and the layered doors serve as before. That is what the dispatcher's /published owner check, landed in PR fix(rest,runtime,metadata-protocol)!: /published, REST /state, _drafts and the event-door absence body answer a disabled package's item as the by-name read does #24247, already does; REST is loud (503). This is read in code, an existing property of the dispatcher's seam, not new here. A loud answer there means changing that seam for every dispatcher consumer, which is outside this card. No class; no carrier.
• Live servers: a disabled package's item can only be runtime-saved there, because code packages refuse the disable. The code-shipped and combined cases are therefore reachable only on hosts that disable a code package on the registry (tests, embedders).

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/rest, @objectstack/runtime, touching 10 documentable anchor(s).

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/metadata-service.mdx (via packageId (symbol, a field of interface MetaLayeredRequest))
• content/docs/permissions/authorization.mdx (via packageId (symbol, a field of interface MetaLayeredRequest))
• content/docs/permissions/capabilities.mdx (via packageId (symbol, a field of interface MetaLayeredRequest))
• content/docs/permissions/permission-sets.mdx (via packageId (symbol, a field of interface MetaLayeredRequest))
• content/docs/protocol/kernel/plugin-spec.mdx (via packageId (symbol, a field of interface MetaLayeredRequest))
• content/docs/ui/doc-pages.mdx (via packageId (symbol, a field of interface MetaLayeredRequest))
• content/docs/ui/setup-app.mdx (via packageId (symbol, a field of interface MetaLayeredRequest))

⛔ 5 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via RestServer (symbol, a top-level class))
• content/docs/releases/v12.mdx (via RestServer (symbol, a top-level class))
• content/docs/releases/v16.mdx (via RestServer (symbol, a top-level class))
• content/docs/releases/v17/17-3.mdx (via RestServer (symbol, a top-level class))
• content/docs/releases/v17/17-5.mdx (via RestServer (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 cross-cutting symbol(s) contributed no route anchor: packageId (4 routes)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 35 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 53ef7524368075a1f64003b9dfb1609d3d206d69 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 69376fb00c7e874cbafe2df2d02302c76f6d9d03 — the merge of head 9d275b85e3c5f624998f6047adc7c5b196c63730 into base 53ef7524368075a1f64003b9dfb1609d3d206d69, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 69376fb00c7e874cbafe2df2d02302c76f6d9d03 && git checkout 69376fb00c7e874cbafe2df2d02302c76f6d9d03
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 53ef7524368075a1f64003b9dfb1609d3d206d69 9d275b85e3c5f624998f6047adc7c5b196c63730 && git checkout -B drift-repro 53ef7524368075a1f64003b9dfb1609d3d206d69 && git merge --no-ff 9d275b85e3c5f624998f6047adc7c5b196c63730

node scripts/docs-audit/affected-docs.mjs --json 53ef7524368075a1f64003b9dfb1609d3d206d69

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 53ef7524368075a1f64003b9dfb1609d3d206d69 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ed6b7108ec0aafd43138f1980d3865cf538e7fe6
Local-runs: none
Scope: packages/rest/src/meta-item-read-gate.ts, packages/rest/src/rest-server.ts, packages/runtime/src/domains/meta.ts, packages/objectql/src/package-disable-enforcement.test.ts, packages/rest/src/meta-disabled-package-doors.test.ts, packages/runtime/src/domains/meta-disabled-package-doors.test.ts, packages/rest/src/objectql-slot-consumer-census.test.ts + packages/rest/src/meta-item-read-routes.ts (the /layers route, the item read's ?layers= branch and its catch), packages/rest/src/index.ts (the exported MetaItemReadGateSources and MetaLayeredRequest), packages/rest/src/batch-routes.ts (the census population), packages/runtime/src/http-dispatcher.ts (domainDeps.getObjectQL, getObjectQLService, errorFromThrown), packages/metadata-protocol/src/protocol.ts (getMetaItem, readMetaItem, isItemOfDisabledPackage, canonicalizeMetaRequestType, servedLockState, getMetaItemLayered, findServedOverlayRow), packages/objectql/src/registry.ts (isPackageDisabled), packages/spec/src/kernel/metadata-protection.zod.ts (extractProtection), packages/plugins/plugin-security/src/security-catalog-echo.ts and packages/plugins/plugin-security/src/packaged-permission-set-lock-gate.ts (the direct getMetaItemLayered readers), packages/spec/src/api/plugin-rest-api.zod.ts (the declared /layers route), scripts/check-changeset-no-major.mjs and .github/workflows/pr-automation.yml (the Check Changeset job), content/docs/ui/apps.mdx and content/docs/permissions/system-context.mdx (the two hand-written pages naming /layers); the two changesets, .changeset/24210-rest-layered-doors-disabled-package.md and .changeset/24210-runtime-layered-doors-disabled-package.md, read as prose for ② only.

Inputs: card #24210 (body; every comment, 6239527781 through 6246528708, including triage 6239967422, the seat ruling 6241893667, the claim 6245752510, the two landings 6243759173 and 6245732037, and this part's os-dev-report 6246528708), PR #24223's record 6243449822 and ACCEPT 6243458372, PR #24247's record 6245404399 and ACCEPT 6245503059, the #7557 pin's docblock, PR #24267's body, file list and its one comment (the Docs Drift Check 6246519425; no review comments and no reviews), the net diff origin/main a422f04 (fetched fresh; merge-base fb6fb24, the main this head merged) to the head (9 files, +449/-21), and the 39 check-runs on the head.

Check-runs at read time (2026-10-18T06:32:44Z): 39 runs; 27 success, 6 skipped, 6 in_progress, 0 failure. success: Build Core (06:25:47Z), TypeScript Type Check and Type Check workspace / source gates / consumer gates / debt ledger, Lint and Repo Gates and its seven Lint legs, Check Changeset (06:23:15Z), Governed Surface Queue Guard, Check PR Size, Check Documentation Links, Flag docs affected, Dogfood Regression Gate (aggregate), the four PR-claim checks ("The card this PR closes must claim this branch" and "Part-of PR must not also close its card" among them), Auto Label, filter. in_progress, recorded as seen and not waited for: Test Core (1/6) through (6/6). skipped by path or opt-in filter: Build Docs, Console Pin Gate, the Dogfood shards placeholder and Dogfood Verify CLI, Temporal Conformance, Packed-tarball smoke. The build, type-check, lint and changeset families are answered green; the test family is the seat's to read before the queue (③.11).

① Derived judgments

A. One step, one chain, four doors. createMetaLayeredAnswer has exactly two callers at this head, RestServer.serveMetaItemLayered (rest-server.ts 4190) and the dispatcher's answerMetaLayered (meta.ts 883), and those two serve all four doors: REST GET /meta/:type/:name/layers (meta-item-read-routes.ts 307, after refuseUnknownQueryParams, the masker and the getMetaItemLayered probe) and the item read's ?layers= branch (551, after wantsMetaItemLayers and the deprecation headers); the dispatcher's three-segment layers branch (meta.ts 1189) and its item read's wantsMetaItemLayers branch (1782). The declared route in plugin-rest-api.zod.ts (handler: 'getMetaItemLayered') is a description; nothing in rest, runtime or core dispatches a protocol method by that name, so no third owner serves the path. Step 1b sits after step 1 (present.length === 0 is absent) and before step 2 (createMetaItemReadGate), so an author whose mayWriteItem is true never reaches the gate for a withheld item: pinned on REST with the real metaSaveVerdict (the author served the nav whole and the member pruned while enabled, both answered the missing name after the disable, each restored to its own view after the re-enable). The guard metaType !== 'object' && metaType !== 'package' is evaluated before the source is called, so objects and packages pay no engine resolution and no plain read. Right.

B. The source is optional, and an absent source withholds nothing. The step reads await sources.isItemOfDisabledPackage?.(…) === true: an interface without the member answers undefined, which is not true, so a host that builds its own MetaItemReadGateSources (exported from @objectstack/rest, index.ts 175) answers as before, with no crash. Both in-repo implementers wire it: RestServer.metaItemReadGateSources (rest-server.ts 3521-3544) and the dispatcher's metaItemReadGateSources (meta.ts 513-537). MetaListAnswerSources and MetaItemAnswerSources extend the same interface and receive the member from the same builders, but the chain's step (meta-item-read-gate.ts 3810) is the only read site, so the list and item chains are unchanged. Right.

C. The owner read is the by-name read's own field and predicate. On REST: p.getMetaItem({ type, name, packageId?, environmentId? }), then registry.isPackageDisabled(envelope?.packageId) === true; on the dispatcher: protocol.getMetaItem({ type, name, packageId? }), then isServiceItemOfDisabledPackage(registry, { _packageId: owner }), which is registry.isPackageDisabled(owner) === true (meta.ts 254). Field identity at this head: getMetaItem (protocol.ts 11099-11110) asks isItemOfDisabledPackage(this.engine?.registry, answer.item), i.e. registry.isPackageDisabled(answer.item._packageId); the envelope's packageId is servedLockState(…, decorated, …).packageId (11619-11641), servedLockState (17946) reads extractProtection(document).packageId, which is document._packageId (metadata-protection.zod.ts 174), and document is decorated, the same answer.item. The withheld answer keeps that envelope and drops only item and registration (11109-11110). readMetaItem grafts the stored row's package_id onto the item when it carries none (11263 on the draft arm, 11324-11325 on the active arm), which is why a runtime-saved item, whose layered answer names no owner (H1), still names it on the plain read. registry.isPackageDisabled(undefined) is false (registry.ts 5394-5398), so an unowned item is served. The predicate is the one getMetaItems, getMetaItem and listDrafts ask (protocol.ts 10411, 11105, 25570). One field, one predicate, four doors: right, and option A of the report's first open question is the right one; B would leave the runtime-saved shape, the only shape a live server can disable, served.

D. The ?package= scope. MetaLayeredRequest.packageId is the scope each transport already parsed (metaItemPackageBinding(req.query?.package), all naming no package) and handed to getMetaItemLayered; the chain hands it to the source, which hands it to getMetaItem. Both protocol reads resolve the overlay row through one function, findServedOverlayRow (protocol.ts 11293 and 11307 in readMetaItem, 11870 in getMetaItemLayered), at the same address (request.packageId or packagelessReadAddress), so the owner asked about is the owner of the copy the layered read served, scoped or not. Pinned on REST with the real protocol (twin_dash stored in both packages: the healthy copy served under its own scope on both spellings, the disabled copy absent under its own) and on the dispatcher (the scope reaches getMetaItem, asserted with toHaveBeenCalledWith; the unscoped read resolves the disabled copy and is absent). Right; the one-property edits in serveMetaItemLayered and answerMetaLayered are what carries it (③.1).

E. What the extra read costs and can throw. It is paid only after step 1 (a missing name pays nothing), only for non-object, non-package types, and only once an engine with isPackageDisabled is in hand (an unwired host or a predicate-less registry returns false before the plain read). The read is getMetaItem whole: one store resolution plus the lock state, and for app keyed by a package id an extra list read. It can throw a store outage or a spelling refusal from canonicalizeMetaRequestType (400 INVALID_REQUEST); objectPackageDisabledError and noPendingDraftError are unreachable here (no object, no draft state), and a spelling the plain read refuses is one the layered read refused first with the same canonicaliser, so no new spelling fault reaches a caller. Every throw propagates: on REST serveMetaItemLayered catches nothing, so the /layers route's handleRouteError (meta-item-read-routes.ts 346) and the item read's catch (1061-1065: thrownAnswerIsBareNotFound, then handleRouteError) render it as itself; a rejecting engine slot is AuthzStoreUnavailableError from wiredEngineOrLoud (rest-server.ts 1560), 503 SERVICE_UNAVAILABLE, pinned on both spellings with the item's label absent from the body. On the dispatcher the chain runs inside answerMetaLayered's try, whose catch is the door's existing errorFromThrown(e, 500): a 503-shaped throw is 503 (pinned), a 400-shaped one 400, a shapeless one 500, exactly what a throw of the layered read already answered there. No throw is read as "not withheld", and none reaches the caller as a layered view. Right. One asymmetry named: the dispatcher's plain item read falls back to 404 for a shapeless throw (errorFromThrown(e, 404), meta.ts 1995) where its layered door falls back to 500; pre-existing on the layered door's catch, not new (③.8).

F. The resolution readers keep serving. getMetaItemLayered is not in the diff (protocol.ts is untouched). Its direct readers at this head: plugin-security's echoSecurityCatalogMutation (security-catalog-echo.ts 194) and echoStoredSecurityCatalogOverlays (287), registerPackagedPermissionSetLockGate (packaged-permission-set-lock-gate.ts 83), REST's fetchCurrentMetaDocument (rest-server.ts 3636), and both transports' /published (rest-server.ts 6495, meta.ts 1306). None goes through the chain. Pinned two ways: the READERS table gains three enforces: false rows (the producer for app, the producer for permission, the plain read's kept packageId), and the REST pin asserts protocol.getMetaItemLayered(...).effective still resolves for every withheld specimen on the real protocol and real SchemaRegistry. Right; ruling 6241893667 Q1 A holds.

G. The object row and package. Unchanged: getMetaItemLayered throws objectPackageDisabledError before any layer (protocol.ts 11751-11753), rendered by the route catch as 404 OBJECT_PACKAGE_DISABLED on both transports, pinned equal to the plain read on REST and through expectObjectRefusal on the dispatcher; the step's type guard never asks the source for an object. package is excluded by the same guard. Right.

H. The census. objectQLProvider invocation sites at this head: rest-server.ts 3097 (computeExecCtx), 3530 (this step), 6249 (/state), 6483 (/published), batch-routes.ts 171: five, all through wiredEngineOrLoud. The census counts five and §3 cites the pin file for /published, /layers and ?layers=true. Right.

I. Accept-set and public-surface changes the diff implies, each judged. (1) REST /layers and ?layers=true for a disabled package's non-object, non-package item: the served set narrows to the missing name's answer, for every caller: right. (2) The dispatcher's two spellings, the same: right. (3) REST gains a 503 arm on those two doors when a wired engine slot rejects (the decidable test every slot consumer passes): right. (4) Both transports answer a plain-read fault on those doors as itself (E): right. (5) MetaItemReadGateSources.isItemOfDisabledPackage and MetaLayeredRequest.packageId, both optional, both exported from @objectstack/rest: additive to implementers and callers, named in the rest changeset: right. (6) No spec change, no error code, no new protocol method, no route body; getMetaItemLayered and fetchCurrentMetaDocument untouched: right. (7) The merge commit brings main's fb6fb24e2f (slice 13c and a runtime body-parsing change); main has since moved three commits, none touching packages/rest/src, packages/runtime/src, packages/metadata-protocol/src or packages/objectql/src, so no symbol this diff reads has moved under it.

What each door answers now (a disabled package's non-object item | triage's answer | a missing name), on this head, author and member alike:

• REST GET /meta/TYPE/NAME/layers: 404, sendMetaItemAbsent's nested RESOURCE_NOT_FOUND body; status, body and headers pinned toEqual the missing name's | absence | the same bytes.
• REST GET /meta/TYPE/NAME?layers=true: the same, with Deprecation: true and a Link naming the item's own path, the one difference from the missing name's answer, whose Link names its own path | absence | the same bytes.
• Dispatcher GET /meta/TYPE/NAME/layers: 404 RESOURCE_NOT_FOUND "Not found", the item read's own absence, pinned byte-equal (status, headers, body) to the missing name's | absence | the same bytes.
• Dispatcher GET /meta/TYPE/NAME?layers=true: the same, with Deprecation and Link | absence | the same bytes.
• Author against member: enabled, the author reads the stored app whole and the member pruned (ruling 5856774816, unchanged); disabled, both read the missing name's answer on both spellings; re-enabled, each reads what it read before (pinned on REST; the chain is one, so the dispatcher follows).
• Objects on both spellings, both transports: 404 OBJECT_PACKAGE_DISABLED, unchanged | the object answer | 404 RESOURCE_NOT_FOUND.
• ?package= naming an enabled package's copy of a shared name: served (200) on both spellings; naming the disabled package's copy: the missing name's answer.
• Unwired engine, or a registry without the predicate: served as before metadata-protocol: a by-name /meta read of a non-object item (app, view, page, …) serves a disabled package's item while the list omits it; #24097 closes the object half only #24210 (pinned on both transports). A wired engine that rejects: REST 503 SERVICE_UNAVAILABLE (pinned); the dispatcher served as before (③.4).
• The producer getMetaItemLayered, the echo and the lock gate: served (pinned).

② Semver level

• Two changesets, @objectstack/rest and @objectstack/runtime, each minor, each BREAKING with Clause-②: no (narrowing) and the adr-0087 marker not-required (no-migration-prescription). minor is the launch-window level check-changeset-no-major.mjs enforces for a breaking change ("During the launch window we ship breaking changes as minor", its header), and the marker's reasoning holds: no stored shape, key, export or code moves, and re-enabling restores the reads (pinned on both transports). Each body matches the diff: the rest changeset's "to every caller, an author who may write the item included" is ①.A; its owner sentence is ①.C and ①.D; its "Added, optional" names exactly the two optional members, and "a host that supplies neither answers as before" is ①.B; its "Unchanged" names the producer and its two plugin readers (①.F). The runtime changeset's "as RestServer asks it" is ①.C, and "Objects already answered 404 OBJECT_PACKAGE_DISABLED here" has been true since PR fix(metadata-protocol)!: the by-name /meta read refuses an object of a disabled package (404 OBJECT_PACKAGE_DISABLED), as the list and the data plane do #24208 and PR fix(metadata-protocol)!: the by-name /meta read answers a disabled package's non-object item as absent, as the list omits it #24223. The title carries !.
• No @objectstack/objectql changeset: its diff is a test file outside the published files. Right.
• The PR body's Clause-②: no (narrowing) (owes one ... review before the queue) is the claim's spelling verbatim at a line start, the spelling readClause2Line read as no and narrowing on PR fix(rest,runtime,metadata-protocol)!: /published, REST /state, _drafts and the event-door absence body answer a disabled package's item as the by-name read does #24247; no new key lands on any published payload (the two added members are TypeScript interface members of @objectstack/rest, not wire keys). The face is narrowing, hence this tier.
• CI's verdict: Check Changeset success on this head (06:23:15Z); that job runs check-adr-0087-registration.mjs --base MERGE_BASE and check-changeset-no-major.mjs --base MERGE_BASE (pr-automation.yml 977 and 1127).
• One prose gap, no level change: neither changeset spells that the two doors now also answer a plain-read fault as itself, or REST's 503 arm on a rejecting engine slot (①.E, ①.I 3-4); the PR body names both (H2 and the Acceptance notes). The same gap was accepted on PR fix(rest,runtime,metadata-protocol)!: /published, REST /state, _drafts and the event-door absence body answer a disabled package's item as the by-name read does #24247 without a changeset edit; a one-sentence addendum is the most that is owed (③.6).

③ Boundary flags

1. Fence deviation, the one-property packageId edits in serveMetaItemLayered and answerMetaLayered (report deviation 1): accepted as right. serveMetaItemLayered is a RestServer class member (rest-server.ts 4152), outside registerMetadataEndpointsInner; no route body is edited, and neither meta-item-read-routes.ts nor meta-collection-routes.ts is in the file list. answerMetaLayered is in the file the claim names. The edit is what the measured two-package collision requires (①.D): option B (an unscoped owner read, as /published reads) withholds an enabled package's copy under its own ?package=; option C re-parses, in two transports, a query the caller already parsed. Open PR refactor(rest): move the /meta per-item write routes into meta-item-write-routes.ts (#23050 slice 13c) #24257 (slice 13c) edits registerMetadataEndpointsInner's write routes, disjoint from this member; the merge at this head is textually clean and main has not touched these files since.
2. Fence deviation, objectql-slot-consumer-census.test.ts (report deviation 2): accepted as right. The census exists to make each new objectQLProvider consumer examined on arrival; it went red at 4 before the edit and counts five with §3 naming the pin (①.H). The same move was accepted on the second half (record 6245404399 ③.6).
3. H1 falsified for a runtime-saved item, the owner source (open question 1): answered, A is right (①.C). The layered envelope's packageId and the layers' _packageId come from the code layer's artifact, so an overlay-only item names no owner there, while the plain read grafts the stored row's package_id (readMetaItem 11324-11325) and keeps the envelope when it withholds. Reading the owner off the layered answer (B) would serve exactly the shape a live server can disable (a code package refuses the disable over HTTP: 422 WRITABLE_PACKAGE_REQUIRED, measured). Nothing owed.
4. The dispatcher's getObjectQLService fail-open on an unresolvable engine (open question 3 and the report's out-of-scope finding): answered for this card, escalated as a seat question. Read at this head: domainDeps.getObjectQL (http-dispatcher.ts 550) is getObjectQLService (2781), whose catch answers null for a failed resolveService('objectql'), and the source reads null as "no registry to ask" and withholds nothing. REST's wiredEngineOrLoud answers the same condition 503, and its own docblock records the KERNEL branch of that seam as RESIDUE: kernel.getServiceAsync('objectql') rejects with a bare Error both when the service was never registered and when it was registered and failed to construct, which is why REST does not make that branch loud either. So on the dispatcher a failed engine resolution serves a disabled package's layered view as before metadata-protocol: a by-name /meta read of a non-object item (app, view, page, …) serves a disabled package's item while the list omits it; #24097 closes the object half only #24210, as its /published owner check (PR fix(rest,runtime,metadata-protocol)!: /published, REST /state, _drafts and the event-door absence body answer a disabled package's item as the by-name read does #24247, meta.ts 1287) already does. It is an existing property of a seam every dispatcher domain reads through, not a wrong answer this diff introduces, and the composition it affects (a kernel whose objectql service is registered and fails to construct) is an outage with wider symptoms than this door. Not a blocker. For the seat: option B, a card to make the dispatcher's engine seam tell "not wired" from "failed", is the @objectstack/core registry change REST's residue note already names; the report's dedupe words are the right ones.
5. The ?package= scope (open question 2): answered, A is right (①.D). The scope rides into the owner read as a fact of the chain's request, so the two transports cannot drift; pinned on both.
6. Changeset prose (②): the plain-read fault and REST's 503 arm are named in the PR body and not in the changesets; the seat may fold one sentence into each at queue time or accept the body's naming, as on PR fix(rest,runtime,metadata-protocol)!: /published, REST /state, _drafts and the event-door absence body answer a disabled package's item as the by-name read does #24247. Not a blocker.
7. H3 on the dispatcher has no author pin (report deviation 8): the step sits in the shared chain both transports call, the REST pin drives a real metaSaveVerdict author, and the dispatcher's live measurement covered an author and a member. Accepted; a dispatcher author pin would pin the chain a second time.
8. A throw-shape asymmetry on the dispatcher (①.E): a shapeless plain-read throw is 500 at the layered doors and 404 at the plain item read; pre-existing on the layered door's catch, not changed here, and not reachable by a well-formed name on a healthy store. Named; nothing owed.
9. Readers of the layered doors outside this repo. objectui's client.layered reads GET /meta/permission/:name/layers in PermissionMatrixEditPage (liveness permission.json); for a disabled package's set it now reads the absence the by-name read has answered since PR fix(metadata-protocol)!: the by-name /meta read answers a disabled package's non-object item as absent, as the list omits it #24223 and the list has omitted since Package disable and uninstall never reach the metadata/data layer: a disabled package's objects still serve rows, and uninstall leaves 7 orphaned sys_metadata rows #7557, and no caller the first half measured must tell disabled from missing. Named; nothing owed.
10. Dev deviations (report deviations 3-7): the platform's PR-subscription posture declined per os-dev.md; the model-free commit trailer pair kept (REPORTING); the shared checkout's pre-created branch reset to a detached HEAD with no work on it; the dispatcher measured through createHonoApp's fetch handler (no in-repo host mounts it over a socket); live REST specimens runtime-saved because a code package refuses the disable over HTTP, with the code-shipped and combined shapes pinned on the real protocol. All acceptable.
11. CI: nothing failed; the six Test Core shards are in_progress at read time and are the seat's to read as success before arming the queue (in_progress is not a pass). The dev's suites at this head (rest 6041, runtime 6549, the Package disable and uninstall never reach the metadata/data layer: a disabled package's objects still serve rows, and uninstall leaves 7 orphaned sys_metadata rows #7557 pin 15/15) and the single ablation of step 1b (REST 4 red, runtime 3 red, as predicted; restored blob == HEAD) are the report's readings, not this record's. Every skip is a path or opt-in filter; no exported symbol moves, so the Console Pin Gate's skip is not a gap.
12. Docs: the Docs Drift Check (6246519425) lists seven hand-written pages by the cross-cutting symbol name packageId. Grepped at this head, the two pages that name /layers (content/docs/ui/apps.mdx 364, content/docs/permissions/system-context.mdx 184) describe the stored-version authoring read and the manage_metadata bypass item, and no hand-written page states that a disabled package's item is served by the layered view. Nothing owed.
13. Fixes #24210: with these four doors the card's remaining list (landing 6245732037) is empty: the by-name read and the dispatcher object doors (PR fix(metadata-protocol)!: the by-name /meta read answers a disabled package's non-object item as absent, as the list omits it #24223), the echo binding (PR fix(metadata-protocol)!: the by-name /meta read answers a disabled package's non-object item as absent, as the list omits it #24223), /published, REST /state, _drafts and the event and diff body (PR fix(rest,runtime,metadata-protocol)!: /published, REST /state, _drafts and the event-door absence body answer a disabled package's item as the by-name read does #24247), and now the layered doors. The ungated types' event and diff doors were ruled nothing owed on the first half (record 6243449822 ③.7). The "Part-of PR must not also close its card" and "The card this PR closes must claim this branch" checks are success. Right.

Implemented-by: claude/issue-24210-meta-disabled-layered-doors
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

CI red · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-18T06:41Z · head ed6b7108ec

• Failing check: Test Core (6/6) (job 117605266183), step "Run this shard's tests". The failure is @objectstack/runtime#test:repo exited 1, which is vitest run --project repo in packages/runtime. The local project of the same package passed (416 files / 6549 tests). The annotation sits at log line 36726. The raw log is not readable from the seat's container, so the failing test is named by the dev's reproduction, not here.
• This PR's, not a flake: main is green on that shard at a422f04fe and 0d34066ef. The runtime repo project is three files, one of which, src/domains/meta-list-projection-parity.test.ts, drives both layered spellings through both transports over a protocol double. The dev's report counted only the local project for runtime.
• Routed: the dev session is reproducing the failure with test:repo, root-causing it, merging main (which now carries PR refactor(rest): computeExecCtx calls the one request-to-ExecutionContext composition, resolveRequestExecutionContext #24260), re-running test and test:repo for rest, runtime and objectql plus the gate union, and pushing. The contract record 6246648398 binds ed6b7108ec; a code change on the new head is re-reviewed before the queue.

---

Generated by Claude Code

[objectstack-fleet]

CI red (addendum) · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-18T07:02Z · head 5d2ec3188

• Failing check: Type Check · workspace (job 117610392400): @objectstack/runtime#typecheck. tsc --noEmit passes; check:test-typecheck --project tsconfig.test.json then reports one type error in src/domains/meta-disabled-package-doors.test.ts, a file the ledger does not cover. This PR's: the file is this PR's new pin.
• Routed: to the dev's rework in progress (the test:repo fix from the note above). The fix goes in the same push, and the full typecheck script of rest, runtime and objectql runs before it. A ledger entry is not the fix.
• Lint & Repo Gates and TypeScript Type Check on 527c7bc4b are aggregate reds over runs cancelled by the push 27 seconds later, not failures of their own.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9d275b85e3c5f624998f6047adc7c5b196c63730
Local-runs: none
Scope: packages/rest/src/meta-item-read-gate.ts, packages/rest/src/rest-server.ts, packages/runtime/src/domains/meta.ts, packages/objectql/src/package-disable-enforcement.test.ts, packages/rest/src/meta-disabled-package-doors.test.ts, packages/runtime/src/domains/meta-disabled-package-doors.test.ts, packages/rest/src/objectql-slot-consumer-census.test.ts + packages/metadata-protocol/src/protocol.ts (isItemOfDisabledPackage 547, getMetaItem 11093-11110, readMetaItem 11187 and 11323-11325 and 11619-11632, getMetaItemLayered 11704-11752 and 11866-11875, servedLockState 17946-17954), packages/spec/src/kernel/metadata-protection.zod.ts (extractProtection 175), packages/objectql/src/registry.ts (isPackageDisabled 5394-5398), packages/rest/src/meta-item-read-routes.ts (the /layers route 308-346 and the item read's ?layers= branch 538-559 with its catch 1061-1065), packages/rest/src/index.ts (175, 180: the two exported members), packages/rest/src/batch-routes.ts (171: the census population), packages/runtime/src/domains/meta-list-projection-parity.test.ts (the census that failed on the earlier head: 519-551, 822, 873-879, 934-937) and packages/runtime/vitest.repo-tests.json (the repo project that runs it), main's 0d34066 (PR #24260) read as the merge's other parent, objectui packages/data-objectstack/src/metadata-client.ts 1586-1600 and its seven client.layered call sites (readers of these doors outside this repo, at objectui 2ec9e2a); the two changesets, .changeset/24210-rest-layered-doors-disabled-package.md and .changeset/24210-runtime-layered-doors-disabled-package.md, read as prose for ② only.

Inputs: card #24210 (body and every comment, 6239527781 through 6247240647: triage 6239967422, the seat ruling 6241893667, the claims 6245752510 and 6246547899, the two os-dev-reports 6246528708 and 6247240647, and the two landings 6243759173 and 6245732037); PR #24267 (body as patched on this head, file list of 9, every comment: the Docs Drift Check 6246519425 recomputed on the merge of this head, the earlier record 6246648398 on ed6b7108ec, the CI notes 6246674049 and 6246896684; no review comments, no reviews); the net diff origin/main...9d275b85e3 (merge-base 53ef752436, 9 files, +464/-21) and the net diff of the earlier head (fb6fb24e2f...ed6b7108ec, 9 files, +449/-21), compared; git show --remerge-diff 5d2ec31885; the check-runs on this head. origin/main fetched fresh (93b4acb57e; one scripts-only commit past the merge-base, touching nothing this diff reads).

Check-runs on this head: at the first read Test Core (3/6) was in_progress; at 2026-10-18T07:50:15Z every run had concluded: 47 runs, 39 success, 8 skipped, 0 failure. success: Build Core (07:19:56Z), Test Core (1/6) through (6/6) and the Test Core aggregate (07:45:05Z), TypeScript Type Check and Type Check workspace (07:26:21Z) / source gates / consumer gates / debt ledger, Lint and Repo Gates (07:19:12Z) and its seven Lint legs, Check Changeset (07:16:01Z, and again 07:41:21Z on the body edit), Governed Surface Queue Guard, Check PR Size, Check Documentation Links, Flag docs affected, Dogfood Regression Gate (aggregate), the four PR-claim checks (each twice: the second workflow run at 07:39Z is the PR body edit), Auto Label, filter. skipped by path or opt-in filter: Build Docs, Console Pin Gate, the Dogfood shards placeholder and Dogfood Verify CLI, Temporal Conformance, Packed-tarball smoke, and the body-edit run's Auto Label and Check PR Size. Every gate family the earlier record left to the seat is answered green on this head. The PR is draft, mergeable_state: clean.

① Derived judgments

A. The interdiff (the earlier head's net diff against this head's), every difference named. Four files move; the two changesets, the #7557 pin, the REST pin and the census test are byte-identical between the two net diffs. (1) meta-item-read-gate.ts: the step's guard drops && metaType !== 'package' (3812, one code line); the source's docblock (168-183) and step 1b's docblock (3764-3775) now say withheld means the plain read serves no item while its kept envelope names a disabled owner, and that which types are hidden is the plain read's decision, never restated in the chain. (2) rest-server.ts metaItemReadGateSources only: the plain read's cast gains item (3439) and the return becomes envelope?.item == null && registry.isPackageDisabled(envelope?.packageId) === true (3440); docblock 3407-3413. (3) meta.ts metaItemReadGateSources only: the same two-line change (534-535); docblock 502-507. (4) The runtime pin: the double's getMetaItem typed as returning a Promise of any (82), getMetaItem exposed on the boot result (137), and one new case, "the plain read decides which types are hidden: an item it still serves keeps its layered view" (672-680). Nothing else differs: no pin deleted or weakened, no route body, no producer, no census edited. The merge 5d2ec31885 (parents 527c7bc and main's 53ef752) has an empty remerge-diff: no conflict was resolved by hand. Main's five commits in it (#24262, #24260, #24263, #24261, #24255) touch none of the nine files; #24260's rest-server.ts diff (+91/-193) edits computeExecCtx and the import block and adds or removes no line naming wiredEngineOrLoud, metaItemReadGateSources, serveMetaItemLayered, TransportScopedMetaRequest, GetMetaItemRequest, objectQLProvider or metaReadGate; computeExecCtx's one objectQLProvider site survives it (3096-3097 on main and on this head). No symbol this diff reads moved. Right.

B. The new condition is the protocol's own by-name decision, exactly. On this tree getMetaItem (protocol.ts 11093-11110) canonicalises, refuses a disabled package's object (objectPackageDisabledError, 11100-11102), reads readMetaItem, and then: if (type === 'object' || type === 'package' || !isItemOfDisabledPackage(registry, answer?.item)) return answer; else, for state: 'draft', throws NO_DRAFT, else strips item and registration and returns the envelope with item: undefined (11107-11110). isItemOfDisabledPackage is registry.isPackageDisabled(item._packageId) === true (547-550). The envelope's packageId is servedLockState(type, name, decorated, …).packageId (11619-11621, 11632), which is extractProtection(document).packageId (17954), which is document._packageId (metadata-protection.zod.ts 175), and document is decorated, the very answer.item the predicate reads. So, for every non-object type: the plain read withheld the item for a disabled owner if and only if item == null && isPackageDisabled(envelope.packageId), because (i) the only path that returns an envelope without an item while the envelope names an owner is the disable branch (a name with nothing behind it has decorated undefined, and extractProtection(undefined) names no owner, so isPackageDisabled(undefined) is false at registry.ts 5395), and (ii) the disable branch keeps exactly that envelope. The layered doors therefore hide precisely what the plain read hides, per type and per scope, with no type list in the chain. Right. The cases the brief asks about, each: an item the plain read hides for another reason (a missing name, a declined stored row with no code definition behind it, a ?package= scope that resolves no row) has no document, so its envelope names no owner and the step does not fire: the doors serve what they served before #24210 (step 1 answers the missing name first; the parity census's ?package=elsewhere cell at 1066-1074 is this shape). A package-type item is served by getMetaItem whatever its owner (the type === 'package' arm), so item is non-null and the step does not fire: the package's layered view stays served, which is what the plain read and the list read do (the registry's own list filter at registry.ts 5383-5385 and the protocol's at 10411 both except package). An object: the chain's guard metaType !== 'object' (3812) never calls the source, and getMetaItemLayered has already refused a disabled package's object itself (11750-11752) before the chain runs; an enabled object pays nothing. No type or case is found where the two now differ.

C. What the logic change moved relative to the earlier record (6246648398). On the real protocol the served set at the four doors is unchanged for every type but package, and for package it is unchanged too: the earlier guard excluded package by name; now the plain read's type === 'package' arm excludes it by serving the item. What moved: (1) the chain no longer restates which types the protocol hides, so a type the protocol starts or stops hiding is followed with no chain edit; (2) a disagreement between the protocol's registry and the transport's engine registry can no longer withhold an item the plain read serves (item != null decides first), where the earlier head withheld on the owner alone; (3) the package type's two layered spellings now reach the source: on REST one wiredEngineOrLoud resolution and one plain read per request (3428-3439), so a wired engine slot that REJECTS now answers 503 SERVICE_UNAVAILABLE on GET /meta/package/NAME/layers and ?layers=true where the earlier head served the view, and a plain-read fault propagates on both transports; an absent engine, or a registry without the predicate, returns false before the plain read and serves as before. That is the same decidable-test posture the earlier record judged right for every other non-object type (its ①.I 3-4), now uniform; the plain read of a package is the read GET /meta/package/NAME already serves. Named, not a blocker (③.12). The earlier record's ①.A-I otherwise hold on this tree as re-verified: createMetaLayeredAnswer has exactly two callers (rest-server.ts 4089, meta.ts 884) serving all four doors (meta-item-read-routes.ts 344 and 559; meta.ts 1190 and 1783); the source is optional and read at one site (3813); step 1b sits after step 1 (3810) and before the per-caller gate; the ?package= scope rides on MetaLayeredRequest.packageId (3693) from serveMetaItemLayered (4092-4095) and answerMetaLayered (885); both protocol reads resolve a name naming no package at one address (request.packageId || packagelessReadAddress, findServedOverlayRow: 11866-11875 for the layered read, #23291's contentPackageId for the plain read), so the owner asked about is the copy the layered read served; getMetaItemLayered is untouched (ruling 6241893667 Q1 A); five objectQLProvider sites (rest-server.ts 3096, 3429, 6148, 6382; batch-routes.ts 171), all through wiredEngineOrLoud, and the census counts five.

D. The census on the earlier head, and why it is green here for the dev's reason. meta-list-projection-parity.test.ts (in packages/runtime/vitest.repo-tests.json, the repo project test:repo runs) derives, for the item read, every string literal compared === or !== against an expression whose text matches metaType or MetaType (readsUnder, 546-550) inside the handler, serveMetaItemLayered, and SHARED_ITEM_FUNCTIONS (873-877), which include createMetaLayeredAnswer; it requires each such type to be a cell of ITEM_TYPE_AXIS (822, derived from ITEM_CELLS: app, view, doc, book, object, dashboard, page, action, dataset, picklist, flow, api). The earlier head's metaType !== 'package' put package in that set with no cell: expected ['package'] to deeply equal [] (934-937). On this head the chain's only type literal is 'object' (3812), which is a cell. The census test file and vitest.repo-tests.json are not in the diff and are byte-identical to main; no cell was added and no assertion loosened. Green for the reason the dev names. CI's verdict on this head: Test Core (6/6), the shard that failed on ed6b7108ec, success (07:27:16Z), and the Test Core aggregate success. Right.

E. Accept-set and public-surface changes the diff implies, each judged. (1) REST /layers and ?layers=true for a disabled package's item of every type the plain read withholds: the served set narrows to the missing name's answer, every caller: right. (2) The dispatcher's two spellings, the same: right. (3) REST's 503 arm on those doors when a wired engine slot rejects, now for every non-object type including package: right (C.3). (4) Both transports answer a plain-read fault on those doors as itself (REST: handleRouteError at meta-item-read-routes.ts 346 and the item read's catch 1061-1065; dispatcher: errorFromThrown(e, 500) at meta.ts 888, a 503-shaped throw pinned 503): right. (5) MetaItemReadGateSources.isItemOfDisabledPackage and MetaLayeredRequest.packageId, both optional, both exported from @objectstack/rest (index.ts 175, 180): additive to implementers and callers; a host that supplies neither answers as before (undefined === true is false): right. (6) No spec change, no error code, no new protocol method, no route body; getMetaItemLayered, fetchCurrentMetaDocument, meta-item-read-routes.ts and meta-collection-routes.ts untouched: right. (7) Readers outside this repo: objectui's MetadataClient.layered (metadata-client.ts 1586-1600) turns a 404 into every layer null, and its seven call sites (StudioDesignSurface app/dashboard/flow/object, ObjectListViewInspector view, PackageOwdOverviewPanel object, EmbeddedItemEditor parent) read that as "nothing published" and refuse to write a stub over it; most are guarded by a list row (saved ?), and the list omits a disabled package's items. No caller must tell disabled from missing (the first half's measurement, unchanged). Right.

What each door answers now (a disabled package's non-object item | an object | a package item | a missing name), on this head, author and member alike unless said:

• REST GET /meta/TYPE/NAME/layers: 404, sendMetaItemAbsent's nested RESOURCE_NOT_FOUND body, status, body and headers pinned equal to the missing name's | 404 OBJECT_PACKAGE_DISABLED while disabled (thrown by the producer before the chain), the layered view while enabled | 200, the layered view (the plain read serves it) | 404, the same body, no owner read paid (step 1).
• REST GET /meta/TYPE/NAME?layers=true: the same, with Deprecation: true and a Link naming the item's own /layers path, the one difference from the missing name's answer, whose Link names its own | the same object answer | served | the same absence.
• Dispatcher GET /meta/TYPE/NAME/layers: deps.error('Not found', 404), the item read's own absence, pinned byte-equal (status, headers, body) to the missing name's | 404 OBJECT_PACKAGE_DISABLED through errorFromThrown (pinned expectObjectRefusal) | served | 404 Not found.
• Dispatcher GET /meta/TYPE/NAME?layers=true: the same, with Deprecation and Link | the same | served | the same.
• Author against member: enabled, the author (save-door admission true) reads the stored app whole and the member pruned (ruling 5856774816, unchanged); disabled, both read the missing name's answer on both spellings, because step 1b precedes the per-caller gate (pinned on REST with the real metaSaveVerdict); re-enabled, each reads what it read before.
• ?package= naming an enabled package's copy of a shared name: served on both spellings; naming the disabled package's copy, or unscoped where the unscoped read resolves that copy: the missing name's answer (pinned on both transports).
• Unwired engine, or a registry without the predicate: served as before metadata-protocol: a by-name /meta read of a non-object item (app, view, page, …) serves a disabled package's item while the list omits it; #24097 closes the object half only #24210. A wired engine that rejects: REST 503 SERVICE_UNAVAILABLE; the dispatcher served as before when getObjectQLService absorbs the failure into null (③.4). A plain read that rejects: that fault, never a layered view (pinned on both transports).
• The producer getMetaItemLayered, the security catalog echo and the packaged-permission-set lock gate: served (pinned in the Package disable and uninstall never reach the metadata/data layer: a disabled package's objects still serve rows, and uninstall leaves 7 orphaned sys_metadata rows #7557 READERS table, three enforces: false rows, and on the real protocol in the REST pin).

② Semver level

• Two changesets, @objectstack/rest and @objectstack/runtime, each minor, each BREAKING with Clause-②: no (narrowing) at a line start and the adr-0087 marker not-required (no-migration-prescription). minor is the launch-window level check-changeset-no-major.mjs enforces for a breaking change, and the marker's reasoning holds on this tree: no stored shape, key, export or error code moves, and re-enabling restores the reads (pinned on both transports). The changesets are unchanged from the earlier head. Their served-set sentence, "an item of every type but object and package whose owning package is disabled", still describes exactly what the doors withhold on this head (①.B: the plain read hides every type but those two), and the rest changeset's "Added, optional" names exactly the two members; "a host that supplies neither answers as before" is ①.E 5; "Unchanged" names the producer and its two plugin readers. The runtime changeset's "as RestServer asks it" is the same two-line source on both transports. The title carries !.
• No @objectstack/objectql changeset: its diff is a test file outside the published files. Right.
• The PR body's Clause-②: no (narrowing) (owes one ... review before the queue) is the claim's spelling at a line start; record-recognisers.mjs --paths on the nine files refuses with "the paths decide no face" and sends the reader to the changeset's Clause-②: line, which carries the (narrowing) arm: the face is narrowing, hence this tier. No new wire key lands on any published payload.
• CI's verdict: Check Changeset success on this head, twice (07:16:01Z and 07:41:21Z).
• One prose gap, no level change, carried from the earlier record and now one type wider: neither changeset spells that the two doors answer a plain-read fault as itself, or REST's 503 arm on a rejecting engine slot, which on this head also covers the package type's layered spellings (①.C 3). The PR body names the fault arms (H2 and the Acceptance notes). A one-sentence addendum is the most that is owed (③.6).

③ Boundary flags

1. Fence deviation, the one-property packageId edits in serveMetaItemLayered and answerMetaLayered (report 6246528708 deviation 1; claim 6246547899 widened the surface to them): accepted as right, re-verified on this tree. serveMetaItemLayered is a RestServer class member (rest-server.ts 4051), outside registerMetadataEndpointsInner; meta-item-read-routes.ts and meta-collection-routes.ts are not in the file list; answerMetaLayered is in the file the claim names. The edit carries the scope the measured two-package collision requires (①.C); the alternatives re-read a parsed query in two transports or withhold an enabled package's copy under its own ?package=.
2. Fence deviation, objectql-slot-consumer-census.test.ts (report deviation 2): accepted as right. The census counts five with §3 naming the pin; the five sites are at ①.C, and refactor(rest): computeExecCtx calls the one request-to-ExecutionContext composition, resolveRequestExecutionContext #24260 left computeExecCtx's one site in place.
3. H1 falsified for a runtime-saved item, the owner source (open question 1, A shipped): answered, right (①.B). The plain read grafts the stored row's package_id onto the item (readMetaItem 11323-11325) and keeps the envelope when it withholds; reading the owner off the layered answer would leave exactly the shape a live server can disable served.
4. The dispatcher's getObjectQLService fail-open on an unresolvable engine (open question 3 and the report's out-of-scope finding): unchanged at this head (meta.ts 532: (await deps.getObjectQL(context))?.registry, null read as no registry to ask). Answered for this card as the earlier record did: an existing property of a seam every dispatcher domain reads through, shared with the dispatcher's /published owner check (meta.ts 1288), not a wrong answer this diff introduces, and the composition it affects is an outage with wider symptoms. Escalated to the seat as before: option B, a card to make the dispatcher's engine seam tell "not wired" from "failed", with the report's dedupe words. Not a blocker.
5. The ?package= scope (open question 2, A shipped): answered, right (①.C). Pinned on both transports; the dispatcher pin asserts the scope reaches getMetaItem with toHaveBeenCalledWith.
6. Changeset prose (②): the fault arms, now including the package type's, are named in the PR body and not in the changesets. The seat may fold one sentence into each at queue time or accept the body's naming, as on PR fix(rest,runtime,metadata-protocol)!: /published, REST /state, _drafts and the event-door absence body answer a disabled package's item as the by-name read does #24247. Not a blocker.
7. H3 on the dispatcher has no author pin (report deviation 8): accepted; the step is in the one chain both transports call, the REST pin drives a real metaSaveVerdict author, and the dispatcher's live measurement covered both callers.
8. A throw-shape asymmetry on the dispatcher (earlier record ①.E): a shapeless plain-read throw is 500 at the layered doors (meta.ts 888) and 404 at the plain item read; pre-existing on the layered door's catch, not changed here. Named; nothing owed.
9. Readers of the layered doors outside this repo (①.E 7): objectui's client resolves the new absence as every layer null, the reading its call sites already give a never-published item; no caller must tell disabled from missing. Named; nothing owed.
10. Dev deviations, round 1 (report 6246528708 deviations 3-7): the PR-subscription posture declined per os-dev.md; the model-free trailer pair kept (verified on 527c7bc4ba and 9d275b85e3: Claude-Session and Co-authored-by: Claude); the shared checkout's pre-created branch reset to a detached HEAD with no work on it; the dispatcher measured through createHonoApp's fetch handler; live REST specimens runtime-saved because a code package refuses the disable over HTTP, with the code-shipped and combined shapes pinned on the real protocol. All acceptable. Round 2 (report 6247240647 deviations 1-2): round 1 ran only runtime's local project, which is how the repo-project census failure reached CI; this round ran test and test:repo for rest, runtime and objectql and recorded each exit, and CI's six shards confirm it; the worktree was re-created for the round. Acceptable; the gap is closed. Round 2 lists no open question and no out-of-scope finding.
11. The two CI failures on the earlier heads, both fixed on this head, nothing else left broken. (i) Test Core (6/6) on ed6b7108ec, @objectstack/runtime#test:repo, the parity census expected ['package'] to deeply equal []: root cause and fix verified in code (①.D), census untouched; on this head Test Core (6/6) success 07:27:16Z and the aggregate success. (ii) Type Check workspace on 5d2ec31885, @objectstack/runtime#typecheck's check:test-typecheck on the new runtime pin: fixed in 9d275b85e3 (the double's getMetaItem typed as returning a Promise of any, so the new case may override it); on this head Type Check workspace success 07:26:21Z and TypeScript Type Check success 07:26:28Z. The addendum's aggregate reds on 527c7bc4ba were cancelled runs superseded by the push 27 seconds later; on this head Lint and Repo Gates success 07:19:12Z. 47 check-runs, 39 success, 8 skipped (every skip a path or opt-in filter; no exported symbol moves, so the Console Pin Gate's skip is not a gap), 0 failure, 0 in_progress at 07:50:15Z. The dev's readings on this head (rest 6047 and 270, runtime 6552 and 808, objectql 8244 and 5, the pin file 14/14, the item == null ablation 1 red / 13 passed with the restored blob equal to HEAD, gate union 70/70) are the report's, not this record's.
12. The package type now pays the owner read (①.C 3, new on this head and named by neither report): one engine resolution and one plain read per /meta/package/NAME/layers or ?layers=true request, REST's 503 arm on a rejecting engine slot, and fault propagation on both transports; the served set for package is unchanged, because the plain read serves it. Consistent with the decidable-test posture every slot consumer carries, and the plain read of a package is the read GET /meta/package/NAME already serves. Named; not a blocker; the one sentence in ③.6 covers it.
13. Docs: the Docs Drift Check (6246519425, recomputed on the merge of this head, 69376fb) lists seven hand-written pages by the cross-cutting symbol packageId. On this tree the hand-written pages naming /layers (content/docs/ui/apps.mdx 364, content/docs/permissions/system-context.mdx 184, content/docs/references/api/rest-server.mdx 227) describe the stored-version authoring read, the manage_metadata bypass item and the route mount; none states that a disabled package's item is served by the layered view. Main has not changed content/docs since the merge-base. Nothing owed.
14. Fixes #24210: with these four doors the card's remaining list (landing 6245732037: non-object /layers and ?layers=true, both transports) is empty; the by-name read and the dispatcher object doors, the echo binding, /published, REST /state, _drafts and the event and diff body landed in PR fix(metadata-protocol)!: the by-name /meta read answers a disabled package's non-object item as absent, as the list omits it #24223 and PR fix(rest,runtime,metadata-protocol)!: /published, REST /state, _drafts and the event-door absence body answer a disabled package's item as the by-name read does #24247. "The card this PR closes must claim this branch" and "Part-of PR must not also close its card" are success (twice). Right.

Implemented-by: claude/issue-24210-meta-disabled-layered-doors
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-18T07:58Z · ACCEPT

Head: 9d275b85e.

Item	Reading
Shape	Draft PR → main. The body opens Fixes #24210; this is the card's last part (the remaining list in landing 6245732037 was exactly these four doors). Both card/branch claim checks are green.
Scope	9 files (+464 / −21), claim 6245752510 as re-declared in 6246547899. One step in the shared chain createMetaLayeredAnswer, with one optional source wired on both transports and one optional request member (the ?package= scope). Three pin files, the census, two changesets. No route body; getMetaItemLayered untouched. Not governed (check-governed-merges.mjs --pr 24267: 0 of 9).
Rework	Head ed6b7108ec had record 6246648398 (PASS) and then went red twice (notes 6246674049 and 6246896684). First, the runtime repo parity census: metaType !== 'package' had made package a keyed type with no cell. Then a test-typecheck error in the new pin. The fix (report 6247240647) drops that guard, and each transport's source now withholds only when the plain read serves no item AND its envelope names a disabled owner. So the chain never restates which types the protocol hides. The seat diffed both net diffs against their own merge-bases: exactly those lines, plus one new pin and a test-double type, differ. The merge 5d2ec3188 has an empty remerge-diff.
Doors	Non-object /layers and ?layers=true, on both transports, answer a disabled package's item with the missing name's bytes, for an author and a member alike; re-enable restores each caller's view. Objects keep 404 OBJECT_PACKAGE_DISABLED. package items are served, as the plain read serves them. A shared name under ?package= of an enabled package is served.
Review face	Narrowing (Clause-②: no (narrowing)). This head has its own CONTRACT_REVIEW_TIER record, 6247381651: PASS. It shows the new condition is extensionally the protocol's own getMetaItem decision, and that the census is green with neither the census file nor vitest.repo-tests.json touched. The seat re-verified the interdiff in the tree.
Prose face	Two changesets, unchanged since ed6b7108ec: minor, BREAKING, Clause-②: no (narrowing), and the adr-0087 not-required (no-migration-prescription) marker. Their served-set sentence ("every type but object and package") still holds exactly. Not spelled in them: these doors answer a plain-read fault as itself, and REST answers 503 on a rejecting engine slot, now including package's layered reads. The PR body names both, as on PR #24247; accepted without a changeset edit. No sentence is false.
Gates	Rework report at 9d275b85e: 70 derived, 70 run, 0 NOT MEASURED. For rest, runtime and objectql: typecheck, test and test:repo all exit 0 (runtime test:repo 808/808). The item == null ablation reddens exactly the new pin; the restore is clean.
CI	At this read: 47 check-runs, 39 success, 8 skipped, 0 failed. Test Core (6/6) and both Type Check lanes, red on the earlier heads, are green. The skips are the six path or opt-in skips plus the body-edit re-runs of Auto Label and Check PR Size, all on the EXPECTED_SKIPS roster.

Disposition:

• open_questions of report 6246528708: A, A and A, as the record answers them: the owner is the plain read's envelope; the scope is one optional request member; the dispatcher's getObjectQLService fail-open is an existing seam property, below the filing gate, and recorded on the seat post.
• Report 6247240647 adds no open_questions. Its deviations are accepted: round 1 ran only runtime's local project, and this round ran test and test:repo for all three packages.
• Named, nothing owed (record ③.12): package's layered reads now pay the owner read; the served set is unchanged.

Landing: ordinary queue (pr_ready + automerge_enable through the relay). On merge, #24210 closes.

---

Generated by Claude Code