hono adapter: createHonoApp's catch-all flattens a repeated query name to its last value, so every dispatcher arity rule is unreachable on a @objectstack/hono host

Filing gate ①, class (b): a rule the platform declares, and keeps at one adapter, is unreachable at the other. It is measured at a public door's adapter.

reach: HTTP, measured once by #23072 slice 2's dev at 6fe8e74629 (os-dev-report 6142050405, out-of-scope finding 1). It used @objectstack/hono's createHonoApp with a recording dispatcher. A by-name /meta item read carrying the same query name twice, with two different values, reached dispatcher.dispatch() as a single string: the LAST value. The first value was dropped silently, and the answer was 200.

Filed by domain:cli seat 2 (#22648) · os-steve · session session_01VoSxBQujKLZKPwK2u5ehQ6. ⛔ Not a claim. Lane and grade are triage's.

Reader who acts: triage grades it. The landing is packages/adapters/hono/src/index.ts, which is domain:cli by the lane table (packages/adapters/*). This seat claims it next if triage queues it here.

What happens

createHonoApp's catch-all builds the dispatcher's query with url.searchParams.forEach((val, key) => { queryParams[key] = val; }) (packages/adapters/hono/src/index.ts, about :787-:789). A repeated name therefore arrives as its last value, never as the array the handler would need to see the ambiguity.

Every dispatcher domain that declares an arity rule is unreachable on such a host:

the /packages domain's repeatedQueryParamMessage refusals (packages/runtime/src/domains/packages-get-version-scope.test.ts pins them through another adapter);
the four by-name /meta doors' query decision, as of PR fix(runtime)!: the dispatcher's by-name /meta doors ask RestServer's query decision, so ?member= is honoured or refused, never dropped (#23072, dispatcher half) #23211 (metaItemQueryRefusal, rule 2).

On a createHonoApp host the request is answered with one of the two values the caller sent, where the same request through @objectstack/plugin-hono-server or the node adapter is refused 400 "supplied 2 times".

Governing text

两个 IHttpServer 适配器对「重复的查询参数」给出不同形状:Hono 折叠成第一个值,node:http 给数组 #6878, the cli-lane seat ruling 5236010909 (route 2, adopted): "the handler must be able to SEE the ambiguity in order to refuse it". @objectstack/plugin-hono-server's readQuery (packages/plugins/plugin-hono-server/src/adapter.ts, about :375) implements it with c.req.queries() and a length normalisation: a single value stays a string, and a repeated one becomes an array.
packages/qa/http-conformance/src/query-multiplicity.conformance.test.ts (PR test(http-conformance): 「重复查询参数」的跨适配器分歧落锁为已知事实 (#6878 路线 1) #6941) is the multiplicity conformance file. Measure whether it covers createHonoApp at all.

Seam: spec:IHttpServer query Record (string | string[]) → runtime: @objectstack/hono createHonoApp catch-all (consumer: every dispatcher domain with an arity rule).

Acceptance

createHonoApp's catch-all hands the dispatcher the same query shape readQuery hands its handlers: one value as a string, a repeated name as an array, built without dynamic property writes (the __proto__ reason readQuery's docblock gives).
The 两个 IHttpServer 适配器对「重复的查询参数」给出不同形状:Hono 折叠成第一个值,node:http 给数组 #6878 order lesson applies first. Before the flip, measure which dispatcher read points receive an array for the first time on a createHonoApp host and are unguarded. The same dispatcher already receives arrays through plugin-hono-server, so the population may be empty, but measure it. Any unguarded point is fixed in the same PR or before it.
One conformance case in the multiplicity file runs through createHonoApp: a repeated single-valued name is refused 400, as through the other adapters, and a single value is unchanged.

Dedupe

MCP search_issues on objectstack-ai/objectstack, closed included:

createHonoApp catch-all repeated query parameter last value wins searchParams forEach flattens multiplicity: 0 hits.
hono adapter dispatcher query repeated name supplied twice silently dropped first value: 5 hits.
- 两个 IHttpServer 适配器对「重复的查询参数」给出不同形状:Hono 折叠成第一个值,node:http 给数组 #6878 (closed) is the plugin-hono-server half of this family: its adapter flipped, and createHonoApp was not in its claimed surface.
- hono adapter: render an escaped throw that carries a declared ADR-0112 status + registered code as that envelope, not as bare 500 INTERNAL_ERROR "No response from handler" — #15999's shared half #16545, [objectui] four live adapter.find calls pass an unprefixed query option — and no-query-params-under-options gates only the sibling half of the class #10470, examples: the showcase CRM workbench react page passes limit: 200 to adapter.find — same dropped-option class as #10288, a second file that card's fix does not reach #10479 and adapters/hono's two bare { data } discovery bodies lose their ratchet owner when #9364 lands #9436 (all closed) are not this.

Generated by Claude Code

wip(rest): one source for the /meta arity lists both transports read (#…

wip(runtime): the dispatcher's read points refuse a repeated single-v…

test: refusal and preservation pins for the dispatcher arity sweep an…

test: split the /data one-element filter unwrap into its own pin (#23214

chore(changeset): the dispatcher arity sweep's accept-set narrowing (#…

os-dev-report
{
"issue": 23214,
"round": "2 (slice 1, the dispatcher's arity sweep; claim 6144390225 under seat ruling 6144365165)",
"status": "done",
"branch": "claude/issue-23214-s1-dispatcher-arity-sweep",
"pr": "#23263",
"session": "session_01VoSxBQujKLZKPwK2u5ehQ6 (subagent of the domain:cli seat 2 PM; the parent's id)",
"premise_still_valid": true,
"summary": "Draft PR #23263 (Part of #23214; Clause-②: yes (narrowing); title carries the bang). Every read point round 1 measured, plus the four typeof-absent /meta list and book-tree names and /packages' status and type, now refuses a repeated single-valued name with its RestServer twin's 400 and sentence, before any protocol or service call it feeds. That is 10 dispatcher routes and 17 names, the /data filter slot counted once. The four /meta arity lists RestServer spelled inline (list, book tree, _drafts, state) moved to meta-item-read-gate.ts as META_QUERY_ARITY_DOORS with the decision metaQueryArityRefusal. RestServer was re-pointed in spelling only, proven byte-identical by a 50-case BASE/HEAD differential. The /data filter slot imports assertFilterParamSuppliedOnce from the @objectstack/rest entry. Refusal and preservation pins cover every route, and the six ablations went red where expected and nowhere else. The dispatcher's DELETE /data version drop IS measurable at a public door (createHonoApp); it is reported and unchanged.",
"points": [
"GET /meta/object/:name/state/:field ?from | twin: RestServer refuses ['from'] | before: 200, from 'done,todo', next [] | after: 400 VALIDATION_ERROR, repeatedQueryParamMessage('from', n)",
"GET /meta/_drafts ?packageId ?type | twin: RestServer refuses both | before: the array reached listDrafts | after: 400 VALIDATION_ERROR, asked where RestServer asks it (after the capability gate and the listDrafts probe)",
"GET /meta/:type ?package ?preview ?object ?include ?id | twin: RestServer refuses all five | before: object 200 []; package an unscoped list of every package; preview, id, include read as absent | after: 400 VALIDATION_ERROR, before any list read",
"GET /meta/book/:name/tree ?package | twin: RestServer refuses it | before: read as absent, a tree over every package | after: 400 VALIDATION_ERROR, after the protocol lookup as on REST",
"GET /ui/view/:object ?type (only when the path names no type) | twin: none reads ?type (REST mounts /ui/view/:object/:type) | before: the array reached getUiView | after: 400 VALIDATION_ERROR",
"GET /i18n/translations and GET /i18n/labels/:object ?locale (only when the path names no locale) | twin: none | before: TypeError in resolveLocale, so a 500 | after: 400 VALIDATION_ERROR before any i18n call",
"GET /security/suggested-bindings ?status ?packageId | twin: RestServer refuses both, in that order | before: packageId joined to 'a,b', 200 []; status a 400 with the unknown-status sentence | after: 400 VALIDATION_ERROR with the multiplicity sentence, before the service",
"GET /packages ?status ?type | twin: this domain's own enabled refusal (deps.error(repeatedQueryParamMessage(...), 400)) | before: === against an array, 200 with no packages | after: 400 VALIDATION_ERROR before the registry read",
"GET /data/:object, the filter slot (filter, where and their aliases, filters, $filter) | twin: RestServer's list asks assertFilterParamSuppliedOnce | before: the array reached findData | after: 400 INVALID_FILTER with RestServer's repeated-filter sentence; select and expand untouched (pinned as arrays)"
],
"one_source": "META_QUERY_ARITY_DOORS (list: package, preview, object, include, id; book-tree: package; drafts: packageId, type; state: from) and metaQueryArityRefusal(door, query) live in packages/rest/src/meta-item-read-gate.ts beside metaItemQueryRefusal. metaItemQueryRefusal's rule 2 and the new decision share one private implementation. rest-server.ts:5863, :6017, :6293 and :8232 now read refuseRepeatedQueryParams(req, res, metaReadGate.META_QUERY_ARITY_DOORS.DOOR), in spelling only. Byte-identity proof: a BASE/HEAD differential, because the unchanged REST pins cover only object and package on the list door. It ran 50 cases through RestServer's four handlers: every name x2 and x3, a one-element array, an empty array, one value, two repeated names, an undeclared repeat, no query. Each case recorded status, body, headers and protocol calls. BASE leg: the three rest files restored from 06dbc4e into the tree only, under an EXIT trap. HEAD leg: at 45db887, after a restore proven by an empty git diff HEAD and matching blob hashes. cmp silent; sha256 prefix c63cb9403588e830 on both; 18 refusals. meta-query-arity-doors.test.ts also pins that RestServer refuses exactly the shared list's names, door by door.",
"d1_import": "packages/rest/src/index.ts adds assertFilterParamSuppliedOnce to the entry (already exported from query-multiplicity.ts, which is untouched). FILTER_SLOT_QUERY_PARAMS is not exported: the dispatcher does not need the list itself. domains/data.ts asks it on the copy findData receives (it unwraps a one-element array in place) and answers its throw as deps.error(e.message, 400, { code: e.code }). The pin computes REST's expected code and message by calling the same imported rule.",
"census": "No in-repo caller sends a repeat to these routes. (1) @objectstack/client: every swept name is written with URLSearchParams.set or a single template (?from=, ?package=); ui.getView and the i18n reads put type and locale in the path. The only append calls are data.find's plain filter map, which writes each key of one object once. (2) objectui at .objectui-sha 1fb1ced, a read-only depth-1 fetch with nothing executed: direct requests to these paths are single-occurrence templates (/api/v1/meta/drafts?packageId=..., GET /meta/object?package=...&preview=draft). Its three non-example append sites build browser URL state (filter[...], uf). (3) dogfood, http-conformance and every string literal under packages/ and examples/ (8,595 files): the only literal repeats are REST's own multiplicity test, on REST routes this PR does not change. There are no append calls in packages/qa and no array-valued dispatch() queries on these routes. Mechanism assumption 1 holds: on a shipped host the narrowing is visible only at GET /packages through plugin-hono-server; everywhere else only a direct HttpDispatcher.dispatch() caller passing an array sees it, until slice 2. The changeset says so.",
"delete_reading": "Measurable at a public door: YES. Through the real createHonoApp over the real dispatcher (a scratch http-conformance probe, deleted), with a recording deleteData: DELETE /api/v1/data/task/r1?expectedVersion=7 answered 200, and so did the same request with If-Match "7". deleteData received { object: 'task', id: 'r1' } with no version, identical to a request sending none. RestServer forwards expectedVersion (query or If-Match) to deleteData behind its arity gate (rest-server.ts DELETE /data/:object/:id). Not changed, per the dispatch.",
"responsibility": "git blame at 06dbc4e (not shallow). Every swept read line post-dates the flattening's origin, 6ac9f8c (2026-02-13). Most come from the ADR-0076 D11 domain extractions of 2026-07-27, which moved older http-dispatcher.ts code: 8891f93 (/meta, /data), 21ca1d5 (/ui), 8f124a7 (/i18n, /security packageId), d729a31 (/packages). The rest: fd8521f (/data list, 2026-08-04); bca935b (/security status, 2026-07-30); 5c7aa46 and 95f729a (/meta list preview and the view switcher object, 2026-09-28); fbcbcf1 (?package= on the list and book tree, 2026-10-08). #6877's sweep commit f3f855a (2026-08-10) touched no runtime domain or dispatcher file. The later #6877-citing commits that edited domains/meta.ts (7986d97, d2b2381) added no arity rule (0 matching lines). The claim's reading is confirmed.",
"tests": "At HEAD 9107ffa (after merging origin/main): runtime vitest run --project local --maxWorkers=2: 'Test Files 368 passed (368)', 'Tests 5254 passed | 19 skipped (5273)', VERDICT command-exit 0. rest vitest run --project local --maxWorkers=2: 'Test Files 279 passed (279)', 'Tests 5831 passed | 326 skipped (6157)', VERDICT command-exit 0. runtime --project repo src/domains/meta-list-projection-parity.test.ts: 739 passed, VERDICT command-exit 0. Typecheck rest and runtime: exit 0; runtime test-layer debt unchanged at 27 files / 190 errors / 68 signatures; rest 0. Before the merge, at 11725bf: runtime 367 files / 5238 passed; rest 278 / 5825. New pins: dispatcher-query-arity.test.ts (33) and meta-query-arity-doors.test.ts (23 passed, VERDICT command-exit 0; 99 passed with its three neighbouring rest suites). Ablations, via scripts/ablation-replace.mjs WRAP inside os-verify-lock (VERDICT command-exit 0), each with an EXIT/INT/TERM trap and its restore proven by git diff HEAD = 0 plus a HEAD blob-hash match. Each anchor hit x1 and went to x0. No build or dist leg applies: the pins import runtime source relatively, and runtime's vitest aliases @objectstack/rest to source (vitest.config.ts:149). /meta (delete the state refusal): 1 failed, 32 passed. /ui (short-circuit the array branch): 1 failed, 32 passed. /i18n (threshold 99): 2 failed, 31 passed. /security (threshold 99): 2 failed, 31 passed. /packages (threshold 99): 2 failed, 31 passed. /data (delete the assertFilterParamSuppliedOnce call): 5 failed (the four spellings plus the one-element unwrap, the rule's own), 28 passed. No preservation pin failed in any leg.",
"gates": [
"HEAD 9107ffa. Derived list node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths): 65 commands, each run with its exit captured before any pipe; 64 exit 0.",
"NOT MEASURED: pnpm check:dual-build-cjs-loads, exit 3, 'PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/' (37 packages). A full build here is 31 turbo cache misses including @objectstack/console, on a shared box with about 4.4 GB free. CI owns it. Scoped supplement: require() of packages/rest/dist/index.cjs and packages/runtime/dist/index.cjs both exit 0, and rest's carries metaQueryArityRefusal, META_QUERY_ARITY_DOORS and assertFilterParamSuppliedOnce.",
"Reconciliation: dispatch-gates --repo objectstack-ai/objectstack --ran FILE (each line 'COMMAND :: exit CODE'): 'Run reconciliation — 65 derived, 64 run, 1 NOT-MEASURED, 0 UNRUN', exit 0.",
"pnpm check:adr-0087-registration: exit 0, '.changeset/23214-dispatcher-query-arity.md [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)'. Its first run, before the changeset was committed, read '0 non-breaking changeset(s) seen'; that run measured nothing and is not cited.",
"node scripts/check-changeset-no-major.mjs --base origin/main: exit 0, '✓ This diff introduces no major bump.'. --event on this PR's title and body: exit 0, '✓ LEVEL AXIS: this PR declares clause-② yes (narrowing)'.",
"pnpm check:route-envelope: exit 0. pnpm check:nul-bytes: exit 0, 'check-nul-bytes: OK (scanned 11240 text file(s) ...)'. pnpm check:test-source-alias: exit 0. pnpm check:cross-package-test-inputs: exit 0. pnpm check:dispatcher-error-vocabulary: exit 0. pnpm check:error-status-conformance: exit 0. pnpm check:published-files: exit 0. pnpm check:doc-authoring: exit 0.",
"Lint, as the proven narrowing over the 11 touched .ts files (from git diff --name-only $(git merge-base origin/main HEAD) HEAD). (1) Population: eslint.config.mjs's own block files ['**/.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'] (line 971); none of the 11 is ignored, since an ignored file reports a warning and there are 0. (2) Count from --format json: 11 files, 0 errors, 0 warnings, 0 fatal; eslint exit 0. (3) Invariance: eslint.config.mjs never enables type-aware linting (no parserOptions.project, no typed rules; it says so at line 327), so this diff cannot move any untouched file's verdict.",
"CI at report time: 12 check runs completed, none failed; 25 in_progress. Not waited on."
],
"line_budget": "12 files, 725 additions + 25 deletions = 750 changed lines (merge-base three-dot); under the 3,000-line class.",
"files_changed": [
".changeset/23214-dispatcher-query-arity.md",
"packages/rest/src/index.ts",
"packages/rest/src/meta-item-read-gate.ts",
"packages/rest/src/meta-query-arity-doors.test.ts",
"packages/rest/src/rest-server.ts",
"packages/runtime/src/domains/data.ts",
"packages/runtime/src/domains/dispatcher-query-arity.test.ts",
"packages/runtime/src/domains/i18n.ts",
"packages/runtime/src/domains/meta.ts",
"packages/runtime/src/domains/packages.ts",
"packages/runtime/src/domains/security.ts",
"packages/runtime/src/domains/ui.ts"
],
"changeset": "@objectstack/rest minor, @objectstack/runtime minor; summary fix(runtime)!:; Clause-②: yes (narrowing); one marker, adr-0087 not-required (no-migration-prescription), closing the other five categories on facts; the launch-window BREAKING line; a what-changes-for-you paragraph listing every route and name, the codes, and where a caller meets it today. No tracker numbers in its prose.",
"deviations": [
"Scope reading, stated not chosen silently: besides the two lists the dispatch names (:6013, :6288), the _drafts (:5861) and state (:8225) lists also moved to META_QUERY_ARITY_DOORS. Both are /meta doors whose twins spell an arity list, they are in neither of the dispatch's two groups, and the ruling's general rule ('where RestServer spells an arity list, that list moves') plus the claim's rest-server.ts surface ('the arity lists' spelling') cover them. Spelling-only, inside the byte-identical differential.",
"/security/suggested-bindings: REST's twin also spells ['status', 'packageId'] (rest-server.ts:11605). The dispatch groups S1/S2 as having no shared list, and meta-item-read-gate.ts is no home for it, so the dispatcher spells those two names at its read point beside repeatedQueryParamMessage. That second spelling of a two-name list is recorded in the PR's Acceptance notes.",
"Three new @objectstack/rest value exports, not one: META_QUERY_ARITY_DOORS and metaQueryArityRefusal (which the one-source move needs, so the dispatcher can import them) plus assertFilterParamSuppliedOnce. The door type is not exported, matching MetaItemQueryDoor.",
"Scratch files outside the claim surface, each run once, never committed, then deleted, with sources kept in the session scratchpad: packages/rest/src/zz-scratch-23214-rest-diff.test.ts (the BASE/HEAD differential) and packages/qa/http-conformance/src/zz-scratch-23214-delete-occ.test.ts (the DELETE reading). The objectui pin fetch lives under the scratchpad, never inside a worktree.",
"Ordering: the /data filter refusal answers before callData's exposure gate, where RestServer answers after its own. For a repeated filter on an object whose API is not exposed, this transport answers 400 before 403. It is in the PR's Acceptance notes.",
"origin/main was merged once (9107ffa; #23242 touched rest and runtime in disjoint files). Build state was refreshed, then both full suites, both typechecks and the gate battery re-ran at that head."
],
"mcp_calls": "0. No MCP GitHub tool was called.",
"api_writes": "2. (1) pr_create through scripts/pm/fleet-write/dispatch.mjs (relay run 38401985349): POST /repos/objectstack-ai/objectstack/pulls (draft forced) plus POST /repos//issues/23263/assignees (os-steve). Read-back 13757 bytes sent and stored identically. (2) This os-dev-report: POST /repos//issues/23214/comments through scripts/pm/post-stamped.mjs. git push of the branch (several pushes) is not a REST write. No label write, no other comment. Reads: GET of #23214's comments, pulls/23263, its check-runs, and the objectui pin fetch.",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: HTTP, measured once at @objectstack/hono createHonoApp over the real HttpDispatcher with a recording deleteData: DELETE /api/v1/data/task/r1?expectedVersion=7 and the same with If-Match "7" both answer 200, and deleteData receives { object, id } only, identical to a request with no version, while RestServer forwards expectedVersion to deleteData · evidence: packages/runtime/src/domains/data.ts (the DELETE branch passes { object, id }) against packages/rest/src/rest-server.ts DELETE /data/:object/:id; scratch probe source in the session scratchpad issue-23214-s1/delete-occ.test.ts.txt · dedupe: dispatcher delete expectedVersion If-Match dropped optimistic concurrency createHonoApp",
"carrier: slice 2 of #23214 (the adapter flip) · noted, not filed: after slice 2, a createHonoApp host reaches each refusal this PR adds. Slice 2's /meta and /packages pins can drive real createHonoApp requests against these exact sentences."
]
}

Generated by Claude Code

✅ ACCEPT: PR #23263 at `9107ffa4c9` (#23214 slice 1, the dispatcher's arity sweep; `Part of #23214`). It queues after one `CONTRACT_REVIEW_TIER` PASS on this head and a green head

domain:cli seat 2 (#22648) · os-steve · session session_01VoSxBQujKLZKPwK2u5ehQ6 · 2026-10-13T13:10Z · holder of claim 6144390225, under ruling 6144365165. Report: os-dev-report 6146257839. Thread-read: 6146257839.

Checklist, read against GitHub:

PR shape: draft, base main, line 1 Part of #23214, line 2 Clause-②: yes (narrowing), assignee os-steve, title fix(runtime)!:.
Scope: 12 files, +725 / −25, all inside the claim. check-governed-merges --pr 23263, run from current main's script: not governed. git merge-tree against today's origin/main (6d7f4df3c9) is clean.
The sweep, read in the diff: 10 dispatcher routes and 17 names now refuse a repeated single-valued name with their RestServer twin's 400 and sentence (repeatedQueryParamMessage), before any protocol or service call they feed. The routes:
- /meta's state, _drafts, list and book-tree doors;
- /ui/view (when the path names no type);
- both /i18n query-locale arms, which used to throw a TypeError and answer 500;
- /security/suggested-bindings;
- /packages' status and type;
- /data's filter slot.
select and expand are untouched, and pinned as arrays.
One source: the four /meta arity lists RestServer spelled inline move to meta-item-read-gate.ts as META_QUERY_ARITY_DOORS, with metaQueryArityRefusal, which shares one private implementation with metaItemQueryRefusal's rule 2. rest-server.ts changes four lines, each in spelling only. A 50-case BASE/HEAD differential through the four handlers is cmp-identical, and meta-query-arity-doors.test.ts pins that RestServer refuses exactly the shared names.
- The ruling named the list and book-tree doors. The _drafts and state lists moving too is inside its general rule ("where RestServer spells an arity list, that list moves"), and is accepted.
- /security's two-name list stays spelled at the dispatcher's read point beside the shared sentence. That is recorded in the PR's acceptance notes and accepted: meta-item-read-gate.ts is no home for it.
The /data filter slot imports assertFilterParamSuppliedOnce from the @objectstack/rest entry and answers REST's INVALID_FILTER and sentence. The dispatcher answers it before its exposure gate, where REST answers after, so a repeated filter on an unexposed object gets 400 before 403. Accepted as recorded.
Exports: three new @objectstack/rest values (META_QUERY_ARITY_DOORS, metaQueryArityRefusal, assertFilterParamSuppliedOnce), and no type export. The changeset is @objectstack/rest minor and @objectstack/runtime minor, fix(runtime)!:, Clause-②: yes (narrowing), with one ADR-0087 not-required (no-migration-prescription) marker and the launch-window BREAKING line.
The census held: the SDK, objectui at the console pin, dogfood and http-conformance send no repeat to these routes. On a shipped host the narrowing is visible only at GET /packages through plugin-hono-server, until slice 2 flips the Hono adapter.
Pins and ablations:
- dispatcher-query-arity.test.ts has 33 tests and meta-query-arity-doors.test.ts has 23;
- six ablations, one per domain, each red only its own refusal pins and never a preservation pin;
- every restore was proven against HEAD.
Tests and gates at 9107ffa4c9 (after merging main):
- runtime 368 files / 5254, rest 279 / 5831, the parity file 739;
- both typechecks exit 0, and the ledgers are held;
- 65 gates derived, 64 exit 0, and check:dual-build-cjs-loads NOT MEASURED (prerequisite), which CI owns;
- lint is narrowed with the three-part proof.
CI on 9107ffa4c9 at this stamp: 24 success, 6 skipped and 8 in progress, with no failure.
Contract review owed: three new exports, and narrowed accept sets. needs:contract-review goes on PR fix(runtime)!: the dispatcher's read points refuse a repeated single-valued query name, as their RestServer twins do #23263 in this act.
Filed from the report: the dispatcher's DELETE /data/:object/:id drops a caller's optimistic-concurrency version. It was measured at createHonoApp, so it goes to triage as its own card in this act.

Generated by Claude Code

Landed: PR #23263 → `d45d0e938a` (slice 1, `Part of #23214`, the dispatcher's arity sweep). The card goes back to `pm:queue` for slice 2, the Hono flip

domain:cli seat 2 (#22648) · os-steve · session session_01VoSxBQujKLZKPwK2u5ehQ6 · 2026-10-13T14:06Z · holder of claim 6144390225, released by this landing.

Landed: through the merge queue at 2026-10-13T14:05:37Z as d45d0e938a, a squash with one parent. On a direct dispatch() caller, 10 dispatcher routes and 17 names now refuse a repeated single-valued name with their RestServer twin's 400 and sentence. Before, they answered with one value, or with a 500 on the two /i18n query-locale arms. The routes:
- /meta's state, _drafts, list and book-tree doors;
- /ui/view when the path names no type;
- both /i18n query-locale arms;
- /security/suggested-bindings;
- /packages' status and type;
- /data's filter slot, through assertFilterParamSuppliedOnce imported from @objectstack/rest.
The four /meta arity lists RestServer spelled inline are now one source, META_QUERY_ARITY_DOORS in meta-item-read-gate.ts. RestServer was re-pointed in spelling only, and its answers are byte-identical.
Review chain:
- round 1's stop 6144314970 and the ruling 6144365165;
- ACCEPT 6146305565;
- the CONTRACT_REVIEW_TIER record PASS on 9107ffa4c9 (6146721946 on PR fix(runtime)!: the dispatcher's read points refuse a repeated single-valued query name, as their RestServer twins do #23263), with the served model checked against the reviewer's transcript;
- every check on the head was success or a roster skip.
The changeset is @objectstack/rest minor and @objectstack/runtime minor, fix(runtime)!:, Clause-②: yes (narrowing), with one ADR-0087 not-required (no-migration-prescription) marker and the launch-window BREAKING line.
Where a caller sees it: on a shipped host, only at GET /packages through plugin-hono-server. That holds until slice 2 lands, because createHonoApp's catch-all still flattens a repeated name to its last value before dispatch() reads it.
Next: slice 2, the flip. Slice 2 makes packages/adapters/hono pass a repeated query name through as an array, so this sweep becomes reachable on a @objectstack/hono host, and then closes the card. It is not dispatched, because this seat is going off shift; the next holder claims it fresh. The reachable population is now guarded, which was the ruling's precondition (两个 IHttpServer 适配器对「重复的查询参数」给出不同形状:Hono 折叠成第一个值,node:http 给数组 #6878's order lesson).
Filed from the report: runtime: the dispatcher's DELETE /data/:object/:id drops expectedVersion / If-Match, so a stale delete is applied where REST refuses it #23265 (finding, awaiting triage). The dispatcher's DELETE /data/:object/:id drops expectedVersion and If-Match, measured at createHonoApp.
Carried, not filed (the record's residuals, none of them a defect at this head):
- /security/suggested-bindings' two-name list is spelled on both transports, placed so by the ruling, because meta-item-read-gate.ts is no home for it.
- The MetaQueryArityDoor type is not on the entry, which matches MetaItemQueryDoor. It is added only if a consumer needs the name.
- A stale comment at packages/rest/src/index.ts:140 says "two doors", where META_QUERY_ARITY_DOORS declares four. It should be fixed by the next change to that block.
Serial queue on rest-server.ts: this hold is released, and [maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050's next slice may claim it.
Holds released:
- packages/runtime/src/domains/{meta,ui,i18n,security,data,packages}.ts;
- meta-item-read-gate.ts, packages/rest/src/index.ts, and rest-server.ts's four arity lines;
- the two test files and the changeset.

Generated by Claude Code

Release: domain:cli seat 2 · sunhaolin · session_01Q9PZ5Pzqcus4woVvTZwWNU · 2026-10-14T07:09Z · cause: the maintainer's scope change · destination: pm:queue, unassigned

Step ① of this seat's claim pair for slice 2 (assignee + pm:dispatched, 07:06Z) is rolled back. No Claim: was posted, no slice-2 branch was created and no dev was dispatched.

Whose instruction: the maintainer's. Verbatim: 「暂时只派 p1 卡片」. Where: this seat's session chat (session_01Q9PZ5Pzqcus4woVvTZwWNU), at about 07:06Z. This card is priority:p2.
Readings handed to the next claimant (origin/main 5656c5638a, 06:59Z):
- The premise holds. packages/adapters/hono/src/index.ts:789 still builds the catch-all's query with url.searchParams.forEach((val, key) => { queryParams[key] = val; }). readQuery (the model) is packages/plugins/plugin-hono-server/src/adapter.ts:375.
- Slice 1 landed as d45d0e938a. data.ts has moved since (f24574ae0a, fix(runtime)!: the /ui and /data dispatcher domains deny an anonymous caller as their first statement (ADR-0138 D2) #23364), so the 两个 IHttpServer 适配器对「重复的查询参数」给出不同形状:Hono 折叠成第一个值,node:http 给数组 #6878 order-lesson census is re-measured at claim on the then-current main, not taken from round 1's list.
- Open PRs touching packages/adapters/hono/: only the Version Packages PR chore: version packages (next) #23382 (its CHANGELOG.md and package.json, release-owned). No in-flight claim declares the adapter (read at 07:00Z).
- Neighbour: hono adapter: createHonoApp's catch-all renders an error thrown out of dispatch() from statusCode alone, so a declared status/code (a missing record's 404 RECORD_NOT_FOUND, an outage's 503) answers 500 INTERNAL_ERROR #23365 (pm:queue, p2) edits the two catch arms of the same catch-all (:744, :794). It is a different defect form, so it is not foldable under the five gates (gate ①: different defect form and fix). Serial: whichever is claimed first goes first, and the other merges main.

Generated by Claude Code

Regrade: p2 → p1 · `target:v18` · protocol-first rule, all lanes · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T08:17Z

Under the maintainer's grading rule, recorded on #6015 (6163099154, amended 6163539661) and extended today, 「立卡，规则扩到所有车道，REST 收窄也算」: every metadata-protocol change, and every narrowing of a REST or data door, is p1 + target:v18 in every lane. The skill text follows in #23431.

Why it is in the class: on a createHonoApp host, a repeated single-valued query name is refused 400 instead of answered with one of the values. That is a REST-door narrowing (Clause-②: no (narrowing), with an ADR-0087 marker).

Lane, scope and Clause ② are unchanged.

Claim: PM loop round 2 (#23214 slice 2, the flip: createHonoApp's catch-all keeps repeated query values as plugin-hono-server's readQuery does; seat ruling A 6144365165, item 3) · 2026-10-14T09:06Z
Session: session_01Q9PZ5Pzqcus4woVvTZwWNU
Account: sunhaolin (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-23214-s2-hono-flip
Worktree: objectstack-issue-23214-s2
Domain: domain:cli
Seat: domain:cli#2 (seat post #22648)
File surface (read on origin/main a7a135dc26; stop on a breach and explain it in the report):

packages/adapters/hono/src/index.ts, ONLY the catch-all's query construction (:789, url.searchParams.forEach((val, key) => { queryParams[key] = val; }), read in this act). It is built as readQuery builds it (packages/plugins/plugin-hono-server/src/adapter.ts:375, module-private): c.req.queries() with the length normalisation, via Object.fromEntries, never dynamic writes. ⛔ Not the two catch arms (:744, :794); hono adapter: createHonoApp's catch-all renders an error thrown out of dispatch() from statusCode alone, so a declared status/code (a missing record's 404 RECORD_NOT_FOUND, an outage's 503) answers 500 INTERNAL_ERROR #23365 holds them next.
One pin file under packages/adapters/hono/src/, per the ruling: a repeated name reaches the dispatcher as an array; a single value unchanged; the /meta and /packages arity refusals answer 400 "supplied 2 times" through createHonoApp; __proto__ kept as an own key. One ablation.
One .changeset/23214-*.md: @objectstack/hono minor, fix(hono)!:, Clause-②: no (narrowing), one ADR-0087 marker and the launch-window BREAKING line.
The 两个 IHttpServer 适配器对「重复的查询参数」给出不同形状:Hono 折叠成第一个值,node:http 给数组 #6878 order lesson is re-measured first, on current main. It covers which dispatcher read points receive an array for the first time on a createHonoApp host and are unguarded. Slice 1 (d45d0e938a) guarded the round-1 census, but data.ts moved since (f24574ae0a, fix(runtime)!: the /ui and /data dispatcher domains deny an anonymous caller as their first statement (ADR-0138 D2) #23364). Any newly unguarded point is reported before the PR leaves draft; ⛔ no dispatcher domain is edited here.
⛔ Not packages/plugins/plugin-hono-server (read-only model), not the multiplicity conformance file (ruling item 3), not packages/spec.

Container & model: S, judged (one construction site, four pins, one ablation, one changeset), mode:subagent, model: default tier (dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate"). Ceiling CONTRACT_REVIEW_TIER, reason: an accept-set narrowing on a released package (Clause-②: no (narrowing)), one review at that tier owed before the queue.
Clause-②: no (narrowing)
Responsibility: the hono adapter's catch-all in packages/adapters/hono (this lane) | plugin-hono-server's readQuery and the node adapter already keep repeats; none on createHonoApp | every createHonoApp host's caller who repeats a single-valued name; measured once at 6142050405
Thread-read: 6164025912
Serial constraints cleared:

Open PRs touching packages/adapters/hono/: only the Version Packages PR chore: version packages (next) #23382 (its CHANGELOG.md and package.json, release-owned). That is 19 open PRs read at 09:03Z. None of the 24 pm:dispatched claims names the adapter.
Fold-or-serial with hono adapter: createHonoApp's catch-all renders an error thrown out of dispatch() from statusCode alone, so a declared status/code (a missing record's 404 RECORD_NOT_FOUND, an outage's 503) answers 500 INTERNAL_ERROR #23365 (same catch-all, the catch arms) is answered serial: gate ① fails (different defect form). This claim goes first, and hono adapter: createHonoApp's catch-all renders an error thrown out of dispatch() from statusCode alone, so a declared status/code (a missing record's 404 RECORD_NOT_FOUND, an outage's 503) answers 500 INTERNAL_ERROR #23365 merges main.
runtime: the dispatcher's DELETE /data/:object/:id drops expectedVersion / If-Match, so a stale delete is applied where REST refuses it #23265 (this round, data.ts DELETE) is file-disjoint. It is coupled by semantics: this flip makes its new ?expectedVersion read point array-fed on a Hono host, and that card refuses a repeat.
This seat's in-flight organization-ownership column-drops never completes where no platform-global objects are declared: organization_id is still injected on the sys_metadata family and sys_flow_dispatch, so the drop is never proposed #23399 (packages/cli) is disjoint.

Generated by Claude Code

os-dev-report
{
"issue": 23214,
"round": "slice 2, the flip (claim 6164853215 under seat ruling 6144365165 item 3)",
"status": "needs_decision",
"branch": "claude/issue-23214-s2-hono-flip",
"pr": null,
"session": "session_01Q9PZ5Pzqcus4woVvTZwWNU (subagent of the domain:cli seat 2 PM; the parent's id)",
"premise_still_valid": true,
"summary": "The card's premise holds at 823da2f: through today's createHonoApp over the real HttpDispatcher, GET /api/v1/meta/app/x?package=a&package=b answers 200 with getMetaItem handed packageId 'b', and GET /api/v1/packages?status=installed&status=error answers 200 []. So slice 1's refusals are still unreachable there. The flip was NOT made, per the dispatch's stop rule: the order-lesson population is not empty. No dispatcher read point was added since slice 1 (5 domain commits since d45d0e9, 0 query-read lines changed). But the re-run found two /packages reads round 1's census never named. They exist at 197fbe2 too, and they are the same family as the status/type pair slice 1 swept. (1) DELETE /packages/:id ?keepData. Measured at the public door: a repeat makes the dispatcher drop the caller's tables silently with 200, where createHonoApp keeps them today. (2) POST /packages ?overwrite: a repeat flips 201 to a 409 'already exists'. Separately, pin 3 (the /meta and /packages refusals through createHonoApp) cannot live under packages/adapters/hono/src: that package's vitest.config.ts aliases @objectstack/runtime to a stub for its whole suite. The branch is pushed empty as the claim's landing marker. The decisions are in open_questions.",
"measurement": {
"tree": "objectstack-ai/objectstack at 823da2f (origin/main when the worktree was cut; the checkout IS shallow, --is-shallow-repository true; every ancestry reading below is an exit-0 leg, which proves itself in any checkout)",
"a_order_lesson": {
"method": [
"1. What moved since slice 1 (merge-base --is-ancestor d45d0e9 HEAD exit 0). 5 commits touched packages/runtime/src/domains: 28e294f (share-links refusal order), f24574a (the /ui and /data anonymous floor), 5d3018d (http-dispatcher 503 seam), 430e5f5 (wall: packages, meta, automation, activation-gate), 01d5034 (keys, notifications, share-links anonymous floor). A diff-grep of each over runtime/src and rest/src (tests excluded) finds 0 added or removed non-comment lines reading query. The dispatch() pipeline before the domain registry (scope, ADR-0069 gate, membership, scoped strip) reads no query.",
"2. REST twins: the refuseRepeatedQueryParams / assertFilterParamSuppliedOnce call sites in rest-server.ts are 19 at both 197fbe2 and HEAD. They differ only in slice 1's four re-spellings to META_QUERY_ARITY_DOORS (same names) and REST's meta DELETE gaining 'package' (543b33d). That door has no dispatcher twin: the dispatcher answers a meta item DELETE 405. data-action-routes.ts holds the other 2 sites, which are unchanged.",
"3. Static census of every non-comment query read in the 22 domain modules plus the @objectstack/rest helpers they call (metaItemQueryRefusal, metaQueryArityRefusal, metaItemPackageBinding, metaRequestLocale, metaMemberSelector, wantsMetaItemLayers, metaSaveRequestOptions, createMetaListAnswer, assertFilterParamSuppliedOnce) and runtime/src/query-param.ts.",
"4. Host map: on plugin-hono-server hosts, dispatcher-plugin.ts mounts /analytics (3), /mcp, /keys, /notifications (3), /packages (registerPackageRoutes, GET/POST/DELETE among them), /i18n/locales and the two path-locale arms, /automation/, /ai/, /actions/* and two /security POSTs. Each hands dispatch() req.query built by readQuery, so arrays. On a createHonoApp host every domain is reached through the catch-all, so EVERY read point there meets its first array with this flip.",
"5. Empirical: two scratch probes, each run once and deleted, never committed. (i) packages/runtime/src/domains: HttpDispatcher.dispatch() with today's last-value string against the post-flip array, beside slice 1's dispatcher-query-arity.test.ts as the control: 'Test Files 2 passed (2)', 'Tests 41 passed (41)', VERDICT command-exit 0. (ii) packages/qa/http-conformance/src: a real createHonoApp and a real HonoServerPlugin + createDispatcherPlugin over one LiteKernel, identity stubbed on HttpDispatcher.prototype as hono-meta-item-read-gate.conformance.test.ts does: 'Tests 3 passed (3)', VERDICT command-exit 0."
],
"guarded_at_HEAD": [
"Slice 1's 17 names on 10 routes: control pins green at 823da2f (33 tests). data.ts after f24574a still asks assertFilterParamSuppliedOnce before callData.",
"The four by-name /meta doors (item, layers, published, save): metaItemQueryRefusal rule 2.",
"/automation and /notifications: parseStringParam / parseIntegerParam / parseEnumParam / parseBooleanParam refuse an array with a located 400 (query-param.ts describeQueryValue). /packages ?enabled and ?version: readEnabledFilter / readRequestedVersion refuse a repeat."
],
"not_refusing_and_the_answer_changes_on_createHonoApp": [
"P1 DELETE /packages/:id ?keepData (domains/packages.ts:2230, query?.keepData === 'true' || === '1'). Destructive direction. Measured, request DELETE /api/v1/packages/com.acme.app?keepData=true&keepData=true: today on createHonoApp, 200 and deletePackage({ packageId, keepData: true }); on the plugin-hono-server mount today, 200 and deletePackage({ packageId }); the dispatcher fed the post-flip array, 200 and deletePackage({ packageId }) (likewise for ['1','true']). The metadata protocol drops object storage unless keepData === true (metadata-protocol/src/protocol.ts:25877, dropStorage = request.keepData !== true). Twin: no REST twin (packages is a dispatcher-only domain). In-domain twins: ?enabled and ?version refuse a repeat with repeatedQueryParamMessage. Producer: objectui at the pin b9814b3 sends ?keepData=true once (app-shell PackagesPage.tsx:542). The SDK and CLI send neither name.",
"P2 POST /packages ?overwrite (packages.ts:1291, query?.overwrite === 'true'). Safe direction. Measured with an installed package: today 201 (overwritten); the post-flip array gives 409 RESOURCE_CONFLICT 'Package ... already exists'. That refuses an ambiguous overwrite, but with a sentence that misnames the cause. Twin: as P1. The body arm (overwrite: true) is unaffected.",
"P3 GET /analytics/meta ?cube (analytics.ts:174, typeof). Static: a repeat reads as absent, so the list is unscoped. Already array-fed on the plugin-hono-server mount; no REST twin.",
"P4 /share-links ?object ?recordId ?includeRevoked (list) and ?email ?password (resolve) (share-links.ts:219-437, typeof / === 'true'). Static: a repeat reads as absent. The canonical twin, plugin-sharing share-link-routes.ts (presentedPassword, list, resolve), reads the same names the same way and is array-fed on plugin-hono-server hosts. The list is forced to the caller's own links.",
"Parity points (not defects): /data list names other than the filter slot pass through to findData as arrays (measured: findData received { limit: ['1','2'], top: ['3','3'] }). That is exactly what RestServer's list hands findData after the same filter-slot assertion. /data get-by-id select/expand are legitimately multi-valued and pass through as on REST. ?locale through metaRequestLocale reads a repeat as absent, deliberately on both transports."
],
"verdict": "Hypothesis (a) FALSIFIED in substance, not by a new read point. Interpretation stated, not chosen silently. Under round 1's host-map filter ('already array-fed elsewhere is not first-time'), the population is empty. Under the dispatch's literal criterion ('receive an array for the FIRST time on a createHonoApp host and do not guard against one'), and under slice 1's precedent (/packages status and type swept although array-fed, 'the same family'), it holds P1 and P2. P1 is destructive. So the literal reading was applied, nothing was flipped and no dispatcher domain was edited. P3 and P4 answer exactly as their canonical, already array-fed twins do: listed for completeness, recommended out (question 3)."
},
"b_concurrent_coupling": "#23265 is in flight in packages/runtime/src/domains/data.ts (branch claude/issue-23265-dispatcher-delete-version, a sibling worktree in this container at 823da2f). It adds a NEW read point, DELETE /data/:object/:id ?expectedVersion, which refuses a repeat. It is not on main, so this census does not count it; its dev pins its own refusal. Once both land, that read point is array-fed on a createHonoApp host.",
"c_queries_shape": "Verified on the installed hono 4.13.12 (the only copy in the store; the adapter's devDependency is ^4.13.9, the peer range ^4.12.8). c.req.queries() returns a null-prototype Record of string arrays with EVERY key an array: ?a=1&a=2&b=3 gives { a: ['1','2'], b: ['3'] }, and an empty value is ['']. The readQuery mirror (Object.fromEntries plus the length normalisation) keeps a proto name as an own data property: ?proto=x&proto=y gives own key proto = ['x','y'], ?proto=solo gives 'solo', the result's prototype is Object.prototype and Object.prototype is untouched. Today's searchParams.forEach construction DROPS the name silently (its own keys omit proto). Peer floor, read statically from the npm tarball (not executed): hono 4.12.8 builds results = {} in _getQueryParam, so on a host pinned there, hono itself never yields a proto key. The 'kept own' pin is therefore a reading of the installed version. No pollution occurs on either version."
},
"pin_location_finding": "packages/adapters/hono/vitest.config.ts aliases the specifier @objectstack/runtime (string find, prefix match) to src/mocks/runtime.ts for the whole suite, and createHonoApp imports HttpDispatcher from that specifier. So no file under packages/adapters/hono/src can compose createHonoApp with the real dispatcher. vi.importActual resolves through the alias too, and importing runtime by a computed path would route around check-test-source-alias's KNOWN_UNALIASED_TEST_IMPORTS ledger (hono's entry is ['@objectstack/types']). The repo already documents this and has a home for it: six packages/qa/http-conformance/src/hono-.conformance.test.ts files compose the real pair, each with a 'Why this lives HERE and not in packages/adapters/hono' paragraph. There, @objectstack/hono is aliased to the adapter SOURCE, and @objectstack/runtime is the ledgered dist pair. Pins 1, 2 and 4 (shape, control, proto) fit the claimed hono pin file over the recording stub. Pin 3 does not.",
"responsibility": "Unchanged from round 1's reading: the flattening is 6ac9f8c (2026-02-13), carried verbatim through the unified catch-all refactor. P1 and P2 are not new: both reads and both plugin-hono-server mounts exist at 197fbe2 (git show; ancestor exit 0). Round 1's census put /packages in 'already array-fed' and named only status/type there.",
"tests": "No implementation, so no pins and no ablation. Measurement runs, each through os-verify-lock with OS_VERIFY_LOCK_SLOT=issue-23214-s2: (1) closure build turbo run build --filter='@objectstack/hono^...' --concurrency=2: 'Tasks: 31 successful, 31 total', 'Cached: 30 cached', VERDICT command-exit 0. (2) Runtime probe plus slice 1's pins: 'Tests 41 passed (41)', VERDICT command-exit 0. Excerpts: 'P1 FLIPPED (array) status=200 deletePackage=[{"packageId":"com.acme.app"}]'; 'P2 FLIPPED (array) status=409 ... RESOURCE_CONFLICT'; 'P5 FLIPPED (array) status=200 findData=[{"limit":["1","2"],"top":["3","3"]}]'. (3) http-conformance probe: the first run was VERDICT command-exit 1 on the probe's own wiring ('Service protocol not found', a getService read after bootstrap; not a measurement and not cited). Rewired, it gave 'Tests 3 passed (3)', VERDICT command-exit 0. Excerpts: 'CREATEHONOAPP status=200 deletePackage=[{"packageId":"com.acme.app","keepData":true}]'; 'PLUGINHONOSERVER status=200 deletePackage=[{"packageId":"com.acme.app"}]'; 'BEFORE /meta/app/x?package=a&package=b status=200'; 'BEFORE getMetaItem=[{"type":"app","name":"x","packageId":"b","previewDrafts":false}]'. (4) A node probe of c.req.queries() on hono 4.13.12, exit 0.",
"gates": [
"HEAD 823da2f, no diff. NOT MEASURED: every gate family. Reason: the order lesson stopped the round before any edit, so a gate run on an unchanged tree measures nothing about this card.",
"Ran: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths): exit 2, 'this branch changes nothing against origin/main (merge base 823da2f) — nothing to derive'. No --ran reconciliation, because nothing was derived.",
"Lead for the next round: the same derivation over the option-B surface (hono index.ts, a hono pin file, the changeset, domains/packages.ts, a runtime pin file, a new http-conformance hono-.conformance file): exit 0, 63 commands at 823da2f.",
"Lint: NOT MEASURED (no diff)."
],
"line_budget": "0 lines changed; no commit beyond the base.",
"files_changed": [],
"deviations": [
"Two scratch probe files outside the claim surface: packages/runtime/src/domains/zz-scratch-23214-s2-census.test.ts and packages/qa/http-conformance/src/zz-scratch-23214-s2-keepdata.test.ts. Each was run, then deleted, and never staged or committed. git status --porcelain afterwards: 0 lines at 823da2f. Their shape is recorded in the session scratchpad (issue-23214/census-probe-notes.txt).",
"npm pack hono@4.12.8 downloaded the peer-floor tarball into the session scratchpad. Its dist/utils/url.js was read with grep and never executed.",
"Interpretation of the order-lesson criterion: the literal reading was applied over round 1's host-map filter. Both readings are measured above, so the seat can rule either way without a re-measure.",
"The worktree is removed at the end of this round (no PR to keep it for). The empty remote branch stays as the claim's landing marker."
],
"mcp_calls": "0. No MCP GitHub tool was called.",
"api_writes": "1: POST /repos//issues/23214/comments (this os-dev-report, through scripts/pm/post-stamped.mjs). git push -u origin claude/issue-23214-s2-hono-flip (an empty branch) is not a REST write. All other GitHub access was GET reads of #23214 and its comments.",
"open_questions": [
{
"question": "The order-lesson population is not empty under the literal criterion. P1 (?keepData, destructive: a repeat drops the caller's tables with 200 where createHonoApp keeps them today) and P2 (?overwrite: a repeat flips 201 to a misnamed 409) are unguarded /packages reads, the family slice 1 swept for status/type. How does #23214 proceed?",
"options": [
"A. Guard first in its own slice ('Part of #23214'). domains/packages.ts refuses a repeated keepData and overwrite as it refuses enabled and version: 400 VALIDATION_ERROR, repeatedQueryParamMessage, before the registry or protocol is touched. A refusal and a preservation pin per name. Then slice 2 is re-dispatched unchanged. Business need: keepData is a real wire flag (the console's package delete sends it), and the plugin-hono-server door already drops tables on a repeat today, so A fixes a live door too. Long-term: the ruling's recorded order, no window. AI-error prevention: a silent destructive default becomes a loud, located refusal, with no tolerance added. Startup scope: one more PR and contract review, and one more dispatch round; the code is about 15 lines plus 4 pins. Changeset: @objectstack/runtime minor, fix(runtime)!:, Clause-② no (narrowing).",
"B. Fold the two guards into slice 2. The seat amends the claim surface with packages/runtime/src/domains/packages.ts and a runtime pin file (plus the question-2 file). One PR flips the adapter and guards the two reads, and the changeset bumps @objectstack/hono and @objectstack/runtime minor under one Clause-② no (narrowing). Business need and AI-error prevention: as A. Long-term: the order is still met inside the PR, which the card's acceptance allows ('fixed in the same PR or before it'), and ruling 1 already places packages/runtime in this lane. Startup scope: the cheapest that is safe, with one landing and one contract review. The claim grows from S to S+.",
"C. Flip now and file P1 as its own card (it is live on plugin-hono-server hosts today). Business need: none served by the window. Long-term: a known-worse interim state on createHonoApp hosts, the shape the #6878 ruling refused. AI-error prevention: a silent data-loss default widened to a second door. Startup scope: the cheapest in cards. Not recommended."
],
"recommendation": "B. It closes the destructive window with no interim state (AI-error prevention, long-term). It is one landing and one contract review with no new export, gate or rider (startup scope). It also repairs the plugin-hono-server door, which is broken today (business need). A is the fallback if the seat wants dispatcher changes in their own PR, as slice 1 was."
},
{
"question": "Pin 3 (the /meta and /packages refusals answer 400 through createHonoApp) cannot live under packages/adapters/hono/src, because that package aliases @objectstack/runtime to a stub for its whole suite. Where does it land?",
"options": [
"A. Amend the surface with one NEW file, packages/qa/http-conformance/src/hono-query-multiplicity.conformance.test.ts, the seventh hono-*.conformance file. It holds a real createHonoApp over the real HttpDispatcher (identity stubbed on the prototype, as its six siblings do). It is not the multiplicity conformance file, so ruling 3 holds. Pins 1, 2 and 4 stay in the claimed hono pin file over the recording stub, the package's own pattern. The ablation (restore the forEach line in hono src/index.ts) reaches both files with no dist leg, because http-conformance aliases @objectstack/hono to the adapter source. Pin 3's before-leg is already measured above: 200 with packageId 'b', and 200 [].",
"B. Edit packages/adapters/hono/vitest.config.ts so one file gets the real runtime. That changes the config of a suite whose 6 files rely on the stub, and needs a KNOWN_UNALIASED_TEST_IMPORTS ledger change for the pair. Wider than the card.",
"C. Drop pin 3. Slice 1's dispatcher pins plus pin 1's shape would cover it by composition only, losing the end-to-end proof the ruling asked for."
],
"recommendation": "A. It follows the repo's documented home for exactly this composition, with no config or ledger change (startup scope, long-term). It keeps the end-to-end refusal the ruling asked for (AI-error prevention)."
},
{
"question": "Should the guard also cover P3 (/analytics/meta ?cube) and P4 (the share-link names), which read a repeat as absent?",
"options": [
"A. Exclude them. Each already answers a repeat exactly as its canonical, array-fed twin does (the dispatcher-plugin /analytics/meta mount; plugin-sharing's share-link routes). None is destructive, and no REST twin refuses them. Recorded in the PR's Acceptance notes.",
"B. Include them. That needs a twin decision on plugin-sharing too (one rule, two mounts), which widens the card into another package."
],
"recommendation": "A, because the flip opens no divergence there: the createHonoApp answer becomes the one the canonical mounts already give (long-term, startup scope)."
}
],
"out_of_scope_findings": [
"class: a · reach: HTTP, measured once at 823da2f on a plugin-hono-server host (HonoServerPlugin + createDispatcherPlugin over a LiteKernel). DELETE /api/v1/packages/com.acme.app?keepData=true&keepData=true answers 200, and deletePackage receives { packageId } with no keepData, so the metadata protocol drops object storage (protocol.ts:25877) for a caller who asked twice to keep it. · evidence: domains/packages.ts:2230 reads query?.keepData === 'true' against the array readQuery builds; dispatcher-plugin.ts mounts DELETE /packages/:id with req.query · carrier: #23214's next round (question 1, A or B), inside its acceptance ('Any unguarded point is fixed in the same PR or before it') · noted, not filed · dedupe: packages delete keepData repeated query drops tables",
"carrier: #23214's next round · noted, not filed: POST /packages ?overwrite repeated is refused 409 'already exists' instead of the multiplicity sentence (safe direction, misnamed cause).",
"carrier: the next census on this card · noted, not filed: round 1's host-map filter excluded the already array-fed domains from the census. That is how P1 and P2 stayed unnamed through slice 1."
]
}

Generated by Claude Code

Seat ruling on slice 2's stop (`os-dev-report` `6165233131`): Q1 B, Q2 A, Q3 A. Slice 2 guards the two `/packages` reads and flips, in one PR · 2026-10-14T09:31Z

domain:cli seat 2 (#22648) · sunhaolin · session session_01Q9PZ5Pzqcus4woVvTZwWNU · under claim 6164853215. Thread-read: 6165233131.

What the stop found (tree 823da2f21c; this seat re-read the cited lines on origin/main 61b12584f0):

The card's premise holds. Through today's createHonoApp, ?package=a&package=b reaches getMetaItem as 'b' with 200.
No dispatcher read point was added since slice 1. But a literal re-run of 两个 IHttpServer 适配器对「重复的查询参数」给出不同形状:Hono 折叠成第一个值,node:http 给数组 #6878's order lesson found two /packages reads that round 1's census excluded as "already array-fed". Neither refuses an array:
- P1 DELETE /packages/:id ?keepData (domains/packages.ts:2230). It is destructive: a repeat makes the protocol drop the caller's object storage (protocol.ts:25877, dropStorage = request.keepData !== true). Measured with 200 on a plugin-hono-server host today. Today's createHonoApp keeps the tables, so the flip would carry the drop to a second door.
- P2 POST /packages ?overwrite (:1291). A repeat turns 201 into a misnamed 409.
The same domain already refuses a repeated enabled and version with repeatedQueryParamMessage (:1021).

The rulings. These are seat decisions, not escalated: Q1 is the order of technical tasks, Q2 is verification strategy, and Q3 changes no product semantics.

Q1 → B: fold the two guards into slice 2. domains/packages.ts refuses a repeated keepData and overwrite exactly as it refuses enabled and version: 400 VALIDATION_ERROR with repeatedQueryParamMessage, before the registry or protocol is touched. Each name gets a refusal pin and a preservation pin.
- Governing text: ruling 6144365165 item 1, "guard first, then flip", and the card's acceptance, "Any unguarded point is fixed in the same PR or before it". B meets the order inside one PR, so no interim state exists on either door.
- Why not A: a separate guard slice buys nothing but a second landing and a second contract review.
- Why not C: it is the known-worse window 两个 IHttpServer 适配器对「重复的查询参数」给出不同形状:Hono 折叠成第一个值,node:http 给数组 #6878 refused.
- Amends item 3 of 6144365165: slice 2 now also touches packages/runtime. The changeset bumps @objectstack/hono and @objectstack/runtime minor, under one Clause-②: no (narrowing) with one ADR-0087 marker and the launch-window BREAKING line.
- The out-of-scope finding (P1 live on plugin-hono-server hosts today) is fixed by this PR. No card.
Q2 → A: pin 3 lands in a new packages/qa/http-conformance/src/hono-query-multiplicity.conformance.test.ts. It is a real createHonoApp over the real HttpDispatcher, as its six hono-*.conformance.test.ts siblings compose it. packages/adapters/hono/vitest.config.ts aliases @objectstack/runtime to a stub for that whole suite, which this seat read at :43-:44.
- This is not the "new conformance rider" triage 6143014548 forbade, and not the multiplicity conformance file ruling item 3 keeps untouched. Nothing joins query-multiplicity.conformance.test.ts's describe.each. It is a standalone pin in the documented home for this composition.
- Pins 1, 2 and 4 stay in the hono package's own pin file over its recording stub. One ablation, restoring the forEach line, must reach both files.
Q3 → A: P3 and P4 are excluded, recorded in the PR's Acceptance notes.
- P3 is /analytics/meta ?cube. P4 is the share-link list and resolve names.
- Each already answers a repeat exactly as its canonical, already array-fed twin does: the dispatcher-plugin /analytics/meta mount, and plugin-sharing's share-link routes. The flip opens no divergence.

Next: the amended claim follows in its own comment. The same dev continues on claude/issue-23214-s2-hono-flip.

Generated by Claude Code

Claim: PM loop round 2, patch round (#23214 slice 2: the two /packages guards and the Hono flip, in one PR; seat ruling 6165288468) · 2026-10-14T09:32Z
Session: session_01Q9PZ5Pzqcus4woVvTZwWNU
Account: sunhaolin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23214-s2-hono-flip (continued; pushed empty at 823da2f21c)
Worktree: objectstack-issue-23214-s2
Domain: domain:cli
Seat: domain:cli#2 (seat post #22648)
File surface (read on origin/main 61b12584f0; stop on a breach and explain it in the report). It supersedes the surface in 6164853215:

packages/runtime/src/domains/packages.ts, ONLY the two read points: DELETE /packages/:id ?keepData (:2230) and POST /packages ?overwrite (:1291). Each refuses a repeat with 400 VALIDATION_ERROR and repeatedQueryParamMessage, as enabled and version do (:1021), before any registry or protocol call. ⛔ No other read point, branch or answer in the domain.
A runtime pin file in packages/runtime/src/domains/, all through dispatch(): a refusal pin and a preservation pin per name. The keepData preservation pin also asserts what deletePackage received for a single true.
packages/adapters/hono/src/index.ts, ONLY the catch-all's query construction (:789), mirroring readQuery. ⛔ Not the catch arms (:744, :794; hono adapter: createHonoApp's catch-all renders an error thrown out of dispatch() from statusCode alone, so a declared status/code (a missing record's 404 RECORD_NOT_FOUND, an outage's 503) answers 500 INTERNAL_ERROR #23365 is next).
One pin file under packages/adapters/hono/src/, over the package's recording stub: the array shape, the single-value control, and __proto__ kept own.
One NEW packages/qa/http-conformance/src/hono-query-multiplicity.conformance.test.ts: a real createHonoApp over the real HttpDispatcher, as its six hono-* siblings compose it. It holds the /meta and /packages arity refusals answering 400 "supplied 2 times", and the ?keepData repeat refused. ⛔ Not query-multiplicity.conformance.test.ts (ruling item 3).
One .changeset/23214-*.md: @objectstack/hono minor and @objectstack/runtime minor, fix(hono,runtime)!:, Clause-②: no (narrowing), one ADR-0087 marker and the launch-window BREAKING line.
⛔ Not packages/plugins/plugin-hono-server or plugin-sharing, /analytics or /share-links (P3 and P4 are excluded by Q3 → A), not packages/spec, not packages/adapters/hono/vitest.config.ts.

Container & model: S, judged (two guarded reads, one construction site, three pin files, one ablation, one changeset), mode:subagent, model: default tier (dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate"). Ceiling CONTRACT_REVIEW_TIER, reason: accept-set narrowings on two released packages (Clause-②: no (narrowing)), one review at that tier owed before the queue.
Clause-②: no (narrowing)
Responsibility: the hono adapter's catch-all (this lane), and two /packages reads in packages/runtime (this lane) that do not refuse a repeat | plugin-hono-server's readQuery keeps repeats; the domain's enabled/version reads refuse them; none at keepData or overwrite | every createHonoApp host's caller who repeats a single-valued name, and every plugin-hono-server host's package delete sent with a repeated keepData; measured at 6142050405 and 6165233131
Thread-read: 6165288468
Serial constraints cleared:

No open PR touches packages/runtime/src/domains/packages.ts, packages/adapters/hono/src/ or packages/qa/http-conformance/src/hono-* (14 open PRs read at 09:30Z). None of the pm:dispatched claims names domains/packages.ts or http-conformance/src/hono-.
runtime: the dispatcher's DELETE /data/:object/:id drops expectedVersion / If-Match, so a stale delete is applied where REST refuses it #23265 (this round, data.ts DELETE) is file-disjoint. It is coupled by semantics: this flip makes its ?expectedVersion read point array-fed on a Hono host, and that card refuses a repeat.
organization-ownership column-drops never completes where no platform-global objects are declared: organization_id is still injected on the sys_metadata family and sys_flow_dispatch, so the drop is never proposed #23399 (packages/cli, PR fix(cli): the ceremony's column drops answer not-declared for a table the booted composition declares no object for #23446 in the merge queue) is disjoint.

Generated by Claude Code

os-dev-report
{
"issue": 23214,
"round": "slice 2 patch round (claim 6165302054 under seat ruling 6165288468: Q1 B, Q2 A, Q3 A)",
"status": "done",
"branch": "claude/issue-23214-s2-hono-flip",
"pr": "#23466",
"session": "session_01Q9PZ5Pzqcus4woVvTZwWNU (subagent of the domain:cli seat 2 PM; the parent's id)",
"premise_still_valid": true,
"summary": "Draft PR #23466 (line 1 'Fixes #23214', line 2 'Clause-②: no (narrowing)', title with the bang, assignee sunhaolin, head 99c7c05 after merging origin/main 7b3d558). Guard first: domains/packages.ts refuses a repeated ?keepData (DELETE /packages/:id) and ?overwrite (POST /packages) with 400 VALIDATION_ERROR and repeatedQueryParamMessage. The refusal comes after the capability and wall gates and before any registry or protocol call, through one module-private helper (refuseRepeatedWriteFlag) that unwraps a one-element array as the status/type rule does. Then the flip: createHonoApp's catch-all reads the query through readDispatchQuery, a module-private mirror of plugin-hono-server's readQuery whose docblock names the twin and #6878; the catch arms are untouched. Three pin files: runtime 11 tests through dispatch(), hono 15 over the recording stub, and http-conformance 7 through a real createHonoApp over the real HttpDispatcher. Both ablations went red only where expected, including after the final fixture change. One measured input moves in the admitting direction (an empty query name); it is stated in the changeset and raised in open_questions.",
"hypotheses": {
"a_new_read_point_since_823da2f21c": "HOLDS at 61b1258, the base this round was cut from. The 5 commits 823da2f..61b1258 touch none of packages/runtime, packages/rest, packages/adapters, packages/plugins/plugin-hono-server or packages/qa/http-conformance (git diff --stat over those paths: 0 lines), so the same diff-grep finds 0 query-read lines. The later merge of 7b3d558 brought 10 commits in spec, cli, lint, examples, docs and .claude; none touched those packages either.",
"b_concurrent_23265": "Respected. Nothing was merged or copied from claude/issue-23265-dispatcher-delete-version; domains/data.ts is not in this diff.",
"merge": "origin/main moved to 7b3d558 and was merged once (99c7c05, clean, no regen debt pending). Then: the closure rebuilt, spec check:generated run, the scoped re-runs done and the gate union re-run at that head."
},
"tests": "All runs through os-verify-lock, slot issue-23214-s2. At the final head 99c7c05 (post-merge): closure build turbo run build --filter='@objectstack/http-conformance^...' --concurrency=2 'Tasks: 36 successful, 36 total', VERDICT command-exit 0. Then, in one && chain under VERDICT command-exit 0: runtime packages-write-flag-arity.test.ts with dispatcher-query-arity.test.ts, 'Test Files 2 passed (2)', 'Tests 44 passed (44)'; @objectstack/hono test 'Test Files 7 passed (7)', 'Tests 154 passed (154)', and typecheck exit 0 (tsc --noEmit && tsc --noEmit -p tsconfig.test.json; the test files are under src/** and both configs include it); @objectstack/http-conformance test 'Test Files 12 passed (12)', 'Tests 124 passed (124)'. Separately: runtime typecheck exit 0 (test-layer ledger held at 27 files / 190 errors / 68 signatures); http-conformance typecheck exit 0 (ledger held at 3 / 27 / 10); pnpm --filter @objectstack/spec check:generated exit 0, 'All 14 generated artifacts are up to date'. Runtime full local suite at e5da6a0 (runtime source identical to the final head; the merge touched no runtime file): 'Test Files 374 passed (374)', 'Tests 5466 passed | 19 skipped (5485)', VERDICT command-exit 0. The new conformance file alone: 'Tests 7 passed (7)'. ABLATION 1 (the flip): scripts/ablation-replace.mjs in WRAP mode put the old forEach construction back in packages/adapters/hono/src/index.ts; anchor x1 to x0, blob 4089af0a973d to 6948cd6354ba. No build leg: the hono pins import ./index from source, and http-conformance aliases /^@objectstack\/hono$/ to adapters/hono/src/index.ts. Hono pin file: 6 failed / 9 passed (the 4 array-shape and 2 proto cases red, all 9 single-value controls green). Conformance file: 4 failed / 3 passed (every refusal red, every control green). Restore: blob == HEAD 4089af0a973d, git diff HEAD empty. Run twice with identical results: before and after the conformance fixture changed to the registry double. ABLATION 2 (the keepData guard): HOLD mode inside a script with an EXIT/INT/TERM trap. The guard call was disabled behind a marker property; anchor x1 to x0, blob 20fc9b7cd2c2 to ecba3c0a4be4. pnpm --filter @objectstack/runtime build, then ablation-dist-preflight: 'marker present in 2 built files'. Runtime pin file: 4 failed / 7 passed (three keepData refusals plus the one-element-array preservation, the unwrap being the guard's own; every overwrite case green). Conformance file (reads runtime dist): 1 failed / 6 passed (the keepData refusal). Restore leg: blob == HEAD 20fc9b7cd2c2, rebuild, preflight --absent: 'marker absent from all 6 built files', 'working tree clean against HEAD'. Also run twice with identical results. EMPTY-NAME measurement: a scratch probe through a real createHonoApp, deleted. With the old line, GET /api/v1/meta/app/crm?=x answered 400 VALIDATION_ERROR ('The "" query parameter is not supported by this endpoint...'); with the flip it answers 200.",
"gates": [
"Derivation: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) at 99c7c05: exit 0, 63 commands; 6 paths vs merge base 7b3d558, +516 / -3, under the 3000-line threshold.",
"Run: all 63 at 99c7c05, each exit captured before any pipe and recorded as 'COMMAND :: exit CODE'. 63 exit 0, including check:dual-build-cjs-loads (exit 0 once the post-merge closure build had produced its dists), check-adr-0087-registration --base origin/main ('.changeset/23214-hono-query-multiplicity.md [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)'), check-changeset-no-major --base origin/main, check:nul-bytes, check:test-source-alias, check:cross-package-test-inputs and check-registry-log-declared.",
"Reconciliation: dispatch-gates --repo objectstack-ai/objectstack --ran FILE: exit 0, 'Run reconciliation — 63 derived, 63 run, 0 NOT-MEASURED, 0 UNRUN.'",
"Earlier runs, superseded, not cited as the verdict: at 5c72800, 61 exit 0; check-registry-log-declared exit 1 (the conformance file constructed a SchemaRegistry in a suite whose vitest config declares no OS_REGISTRY_LOG; fixed by a registry double, see deviations); check:dual-build-cjs-loads exit 3 (PREREQUISITE NOT MET, some package had no dist/). A run at b9d049d was stopped at 33/63 when origin/main moved (kill of my own recorded PID 14574) and re-run in full at the final head.",
"PR event leg, offline: node scripts/check-changeset-no-major.mjs --base origin/main --event FILE over this PR's exact title and body: exit 0, 'LEVEL AXIS: this PR declares clause-② no (narrowing), and no package whose published source ... it moves is graded patch'.",
"Lint, as the proven narrowing over the 5 changed .ts files: (1) population: eslint.config.mjs:971's block files ['**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'] covers all 5, and none is ignored (0 warnings); (2) count: eslint --no-inline-config --format json gives 5 files, 0 errors, 0 warnings, 0 fatal, eslint exit 0; (3) invariance: no type-aware linting (eslint.config.mjs:328; parserOptions carry only ecmaVersion/sourceType), so no untouched file's verdict can move.",
"CI on PR #23466 head 99c7c05, read once at report time: 36 check runs, 2 success, 6 skipped, 20 in_progress, 8 queued, 0 failed. Of the required five, Build Core is queued and Governed Surface Queue Guard in_progress; Lint & Repo Gates, TypeScript Type Check and Test Core had not been created yet. Not waited on."
],
"files_changed": [
".changeset/23214-hono-query-multiplicity.md",
"packages/adapters/hono/src/index.ts",
"packages/adapters/hono/src/hono-query-multiplicity.test.ts",
"packages/qa/http-conformance/src/hono-query-multiplicity.conformance.test.ts",
"packages/runtime/src/domains/packages-write-flag-arity.test.ts",
"packages/runtime/src/domains/packages.ts"
],
"line_budget": "6 files, +516 / -3 against merge base 7b3d558 (dispatch-gates reading); under the 3000-line class.",
"deviations": [
"Conformance fixture: the first version built a real SchemaRegistry, which reddened check-registry-log-declared (S1: http-conformance's vitest.config.ts declares no OS_REGISTRY_LOG). The gate's own prescription edits that config, which is outside the claim surface. So the rows use a three-method Map-backed registry double (getAllPackages, getPackage, uninstallPackage: every call these branches make, isWritablePackage included). Its docblock says so and points at the runtime pins over a real SchemaRegistry. Both ablations were re-run on the final file with identical results.",
"A scratch probe file, packages/qa/http-conformance/src/zz-scratch-23214-s2-emptyname.test.ts, outside the claim surface: run at HEAD and inside ablation 1's mutated leg, deleted, never staged or committed.",
"One lock acquisition answered VERDICT queue-timeout (exit 99, never acquired). The holder was another dev's runtime suite (pid 22508, ALIVE per --status). It was re-taken with the same slot name and ran; the 99 is not cited as a measurement.",
"Attribution: commits end with the model-free trailer pair AGENTS.md prescribes (Claude-Session + 'Co-authored-by: Claude'), not the harness reminder's model-named trailer. The PR body ends with the session-URL footer form the role file prescribes, not the harness's alternative footer. The role file's priority clause decides both.",
"The role file itself changed on main during this round (carrier: now a card number or a person). This report follows the new text."
],
"mcp_calls": "0. No MCP GitHub tool was called.",
"api_writes": "2 relay actions. (1) pr_create through scripts/pm/fleet-write/dispatch.mjs (relay run 38553665569): POST /repos/objectstack-ai/objectstack/pulls (draft forced) plus POST /repos//issues/23466/assignees (sunhaolin). Read-back: 10754 bytes sent, 10754 stored, identical; assignees sunhaolin. (2) This os-dev-report: POST /repos//issues/23214/comments through scripts/pm/post-stamped.mjs. git push (several pushes of the branch) is not a REST write. No label write: the dispatch names none, and skip-changeset does not apply because a changeset ships. Reads: GET of #23214's comments, pulls/23466 and its check-runs.",
"open_questions": [
{
"question": "Measured: with the flip, a query pair with an EMPTY name (?=x) is dropped by hono's parser before dispatch(), as plugin-hono-server's readQuery already drops it. So on a createHonoApp host, a door with a closed parameter set now answers it 200 where the old line made it 400 (unknown parameter ""). Every other measured input narrows or stays the same. The changeset and the PR's Acceptance notes state it. Does this one admitting input change the ruled line 'Clause-②: no (narrowing)'?",
"options": [
"A. Keep 'no (narrowing)'. The input is malformed (a parameter with no name), no producer sends it, and the canonical plugin-hono-server door already admits it, so the change removes a parser accident rather than widening a declared accept set. Nothing to edit.",
"B. Change to 'yes (narrowing)', the literal answer to 「本卡放宽接受集或扩大公开面吗」 for one input class. The grade is unchanged (minor, BREAKING, the same ADR-0087 marker). Cost: the seat edits PR body line 2, and one push edits the changeset's Clause-② line; both gates accept either arm at minor."
],
"recommendation": "B, narrowly: a declaration that is literally true costs one line, and an AI reader of the CHANGELOG then meets no 'no' contradicted by the paragraph below it. A is defensible, since the input has no producer; the seat's call either way."
}
],
"out_of_scope_findings": [
"carrier: #23214 · noted, not filed: slice 1's unreleased changeset (.changeset/23214-dispatcher-query-arity.md) still says the dispatcher refusals are reachable only through dispatch() 'until that adapter keeps repeats'. This PR makes that sentence stale. It is outside this claim's surface; this PR's changeset states the new reach. The fix is a one-sentence edit to that file if the seat adds it to this PR's surface.",
"Acceptance notes only (polish, no carrier): the domain's inline status/type loop (slice 1) could adopt refuseRepeatedWriteFlag. Excluded P3 (/analytics/meta ?cube) and P4 (the share-link names), per ruling Q3 A, are named there with the ruling's reason."
]
}

Generated by Claude Code

Seat ruling on slice 2's open question (`os-dev-report` `6166893549`): `Clause-②: yes (narrowing)` · 2026-10-14T11:06Z

domain:cli seat 2 (#22648) · sunhaolin · session session_01Q9PZ5Pzqcus4woVvTZwWNU · under claim 6165302054. Thread-read: 6166893549.

What was measured: with the flip, a query pair with an EMPTY name (?=x) is dropped by Hono's parser before dispatch(), as plugin-hono-server's readQuery already drops it. On a createHonoApp host, a door with a closed parameter set therefore answers it 200, where the old construction refused it 400 as an unknown parameter "". Every other measured input narrows or is unchanged. The changeset already states it.
The ruling: B, Clause-②: yes (narrowing). The declaration's test is whether the card widens a published accept set, and for one input class it does. A no that newly admits an input stands only with a citation of contract text that already denies the refusal ("缺引即读作缺申报"). This seat searched packages/rest/src/query-allowlist.ts (the closed-set rule's authority), plugin-hono-server's adapter.ts and the spec's HTTP-server contract for any statement about an empty name, and found none; the control refuseUnknownQueryParams hits 4 in query-allowlist.ts. So no cannot be cited, and the literal answer is yes.
What stays as it is:
- The grade: minor, BREAKING, fix(hono,runtime)!:, the same ADR-0087 marker.
- The lane, by its own precedent: slice 1, PR fix(runtime)!: the dispatcher's read points refuse a repeated single-valued query name, as their RestServer twins do #23263, was Clause-②: yes (narrowing) in this lane under ruling A, with a CONTRACT_REVIEW_TIER review of record.
- The admitted input is malformed, has no producer, and the change aligns this adapter with the canonical one. It widens no authorable surface.
The edits it costs: the changeset's Clause-② line (the dev's push); line 2 of the PR body (this seat, after that push, so both read the same on one run); and the claim's Clause-② line (the amended claim follows).
Not a correction owed: slice 1's unreleased changeset says its refusals are reachable only through dispatch() "until that adapter keeps repeats". That stays byte for byte, by the precedent ruling B on verify: classify hotcrm's "platform-semantics pins" — each becomes a derived proof family in @objectstack/verify or a platform regression test in dogfood, never an app test (epic hotcrm#1579, step 5c) #15953 (6133232470). This PR's own changeset states the new reach, which completes that "until".

Generated by Claude Code

Claim: PM loop round 2, Clause-② amendment (#23214 slice 2, PR #23466: the declaration becomes yes (narrowing) by seat ruling 6166938503; surface unchanged from 6165302054) · 2026-10-14T11:06Z
Session: session_01Q9PZ5Pzqcus4woVvTZwWNU
Account: sunhaolin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23214-s2-hono-flip (continued; PR #23466)
Worktree: objectstack-issue-23214-s2
Domain: domain:cli
Seat: domain:cli#2 (seat post #22648)
File surface (read on origin/main 61b12584f0; stop on a breach and explain it in the report). It supersedes the surface in 6164853215:

packages/runtime/src/domains/packages.ts, ONLY the two read points: DELETE /packages/:id ?keepData (:2230) and POST /packages ?overwrite (:1291). Each refuses a repeat with 400 VALIDATION_ERROR and repeatedQueryParamMessage, as enabled and version do (:1021), before any registry or protocol call. ⛔ No other read point, branch or answer in the domain.
A runtime pin file in packages/runtime/src/domains/, all through dispatch(): a refusal pin and a preservation pin per name. The keepData preservation pin also asserts what deletePackage received for a single true.
packages/adapters/hono/src/index.ts, ONLY the catch-all's query construction (:789), mirroring readQuery. ⛔ Not the catch arms (:744, :794; hono adapter: createHonoApp's catch-all renders an error thrown out of dispatch() from statusCode alone, so a declared status/code (a missing record's 404 RECORD_NOT_FOUND, an outage's 503) answers 500 INTERNAL_ERROR #23365 is next).
One pin file under packages/adapters/hono/src/, over the package's recording stub: the array shape, the single-value control, and __proto__ kept own.
One NEW packages/qa/http-conformance/src/hono-query-multiplicity.conformance.test.ts: a real createHonoApp over the real HttpDispatcher, as its six hono-* siblings compose it. It holds the /meta and /packages arity refusals answering 400 "supplied 2 times", and the ?keepData repeat refused. ⛔ Not query-multiplicity.conformance.test.ts (ruling item 3).
One .changeset/23214-*.md: @objectstack/hono minor and @objectstack/runtime minor, fix(hono,runtime)!:, Clause-②: no (narrowing), one ADR-0087 marker and the launch-window BREAKING line.
⛔ Not packages/plugins/plugin-hono-server or plugin-sharing, /analytics or /share-links (P3 and P4 are excluded by Q3 → A), not packages/spec, not packages/adapters/hono/vitest.config.ts.

Container & model: S, judged (two guarded reads, one construction site, three pin files, one ablation, one changeset), mode:subagent, model: default tier (dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate"). Ceiling CONTRACT_REVIEW_TIER, reason: accept-set narrowings on two released packages plus one admitted malformed input (Clause-②: yes (narrowing)), one review at that tier owed before the queue, as PR #23263.
Clause-②: yes (narrowing)
Responsibility: the hono adapter's catch-all (this lane), and two /packages reads in packages/runtime (this lane) that do not refuse a repeat | plugin-hono-server's readQuery keeps repeats; the domain's enabled/version reads refuse them; none at keepData or overwrite | every createHonoApp host's caller who repeats a single-valued name, and every plugin-hono-server host's package delete sent with a repeated keepData; measured at 6142050405 and 6165233131
Thread-read: 6166938503
Serial constraints cleared:

No open PR touches packages/runtime/src/domains/packages.ts, packages/adapters/hono/src/ or packages/qa/http-conformance/src/hono-* (14 open PRs read at 09:30Z). None of the pm:dispatched claims names domains/packages.ts or http-conformance/src/hono-.
runtime: the dispatcher's DELETE /data/:object/:id drops expectedVersion / If-Match, so a stale delete is applied where REST refuses it #23265 (this round, data.ts DELETE) is file-disjoint. It is coupled by semantics: this flip makes its ?expectedVersion read point array-fed on a Hono host, and that card refuses a repeat.
organization-ownership column-drops never completes where no platform-global objects are declared: organization_id is still injected on the sys_metadata family and sys_flow_dispatch, so the drop is never proposed #23399 (packages/cli, PR fix(cli): the ceremony's column drops answer not-declared for a table the booted composition declares no object for #23446 in the merge queue) is disjoint.

Generated by Claude Code

os-dev-report
{
"issue": 23214,
"round": "slice 2, Clause-② amendment (ruling 6166938503, claim 6166947838)",
"status": "done",
"branch": "claude/issue-23214-s2-hono-flip",
"pr": "#23466",
"head": "692e8b1dcd (was 99c7c05)",
"session": "session_01Q9PZ5Pzqcus4woVvTZwWNU (subagent of the domain:cli seat 2 PM; the parent's id)",
"premise_still_valid": true,
"summary": "The changeset alone changed, as ruled: its line now reads exactly 'Clause-②: yes (narrowing)'. The ADR-0087 marker's prose gains one sentence after 'What narrows is a query accept set: …', in the PR's own words: 'One malformed input widens: on a createHonoApp host, a query pair with an empty name is no longer refused, matching @objectstack/plugin-hono-server.' The diff is 1 file, +2 / -2. The marker category stays not-required (no-migration-prescription): check-adr-0087-registration accepts it under the yes arm and asks for no other. No code, test or PR-body edit. When read for the event leg, the live PR body's line 2 already said 'Clause-②: yes (narrowing)' (the seat's write). No merge: GitHub reported mergeable true.",
"tests": "No code or test changed, so no test run is owed (Definition of done: the changeset edit is outside every package's test surface).",
"gates": [
"Derivation over the changed path: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack .changeset/23214-hono-query-multiplicity.md at 692e8b1: exit 0, 20 commands. All 20 run in the foreground with each exit captured before any pipe: 20 exit 0.",
"check-adr-0087-registration --base origin/main: exit 0. '✓ check-adr-0087-registration: 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.' and '.changeset/23214-hono-query-multiplicity.md [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)'.",
"check-changeset-no-major --base origin/main: exit 0, '✓ This diff introduces no major bump.' Its level axis prints NOT APPLICABLE without a pull_request input, by construction.",
"check-changeset-no-major --base origin/main --event FILE (the PR's live title, and its body with line 2 'Clause-②: yes (narrowing)'): exit 0. '✓ LEVEL AXIS: this PR declares clause-② yes (narrowing), and no package whose published source (src/**, a packed bin target, or a repo file its build copies in) it moves is graded patch.' and '· declaration line: Clause-②: yes (narrowing)'.",
"pnpm check:nul-bytes: exit 0, 'check-nul-bytes: OK (scanned 11397 text file(s) -- 11397 tracked, 0 untracked-not-ignored; skipped 9 binary; no raw ASCII control bytes).'",
"The other 15 changeset-path families, all exit 0: both self-tests of the two gates above; check-closing-keyword-parity and its self-test; check-comment-mask-corpus; check-empty-changeset --base origin/main and its self-test; release-rehearsal-clone and release-pending-publish self-tests; check:changeset-gate-self-tests; check:driver-memory-census; check:gitlink-declared; check:objectui-changeset; check:pm-changeset-deadline-census; check:published-files; check:refd-timer-probe; check:watch-hint-literal.",
"CI on PR #23466, read once at 692e8b1: 45 check runs, 30 success, 8 skipped, 7 in_progress, 0 failed. Not waited on."
],
"files_changed": [".changeset/23214-hono-query-multiplicity.md"],
"deviations": [
"The amended claim 6166947838 still lists the changeset as 'Clause-②: no (narrowing)' in its file-surface bullet, while its own Clause-② line and ruling 6166938503 say yes. This round followed the ruling and the claim's Clause-② line; the bullet is stale text in the claim.",
"The worktree was recreated on the branch for this round and removed after the push (node_modules deleted, git worktree remove without --force, exit 0)."
],
"mcp_calls": "0. No MCP GitHub tool was called.",
"api_writes": "1: POST /repos//issues/23214/comments (this os-dev-report, through scripts/pm/post-stamped.mjs). git push (99c7c05..692e8b1) is not a REST write. No PR-body, label or other write. Reads: GET of #23214's comments, pulls/23466 and its check-runs.",
"open_questions": [],
"out_of_scope_findings": []
}

Generated by Claude Code

✅ ACCEPT: PR #23466 at `692e8b1dcd` (#23214 slice 2: the two `/packages` guards and the Hono flip). It lands on an all-green head; its review of record is PASS · 2026-10-14T11:16Z

domain:cli seat 2 (#22648) · sunhaolin · session session_01Q9PZ5Pzqcus4woVvTZwWNU · holder of claim 6166947838. Rulings 6165288468 (Q1 B, Q2 A, Q3 A) and 6166938503 (Clause-②: yes (narrowing)). Reports 6166893549 and 6167079032. Thread-read: 6167079032.

Checklist, read against GitHub and origin/main, not against the reports:

PR shape: draft, base main, line 1 Fixes #23214 (the body's only closing keyword), line 2 Clause-②: yes (narrowing) (written by this seat, read back), assignee sunhaolin, title fix(hono,runtime)!:.
Scope: 6 files, +516 / −3, inside the claim: packages.ts's two read points, the catch-all's query construction, three pin files, and the changeset. check-governed-merges --pr 23466: NOT governed, 519 changed lines. The catch arms (:744, :794) are untouched.
The fix, read in the diff:
- refuseRepeatedWriteFlag refuses a repeated keepData / overwrite with 400 and repeatedQueryParamMessage, after the capability and wall gates and before any registry or protocol call. It unwraps a one-element array.
- readDispatchQuery mirrors readQuery, built with Object.fromEntries.
Pins and reverse verification:
- Runtime: 11 cases through dispatch().
- Hono: 15 cases over the package's recording stub (array shape, single-value control, __proto__).
- http-conformance: 7 cases, a real createHonoApp over the real HttpDispatcher. Each refusal asserts status, code, the sentence and that the service was never called, beside a preservation control.
- Two ablations (the flip; the keepData guard, with a dist leg and a preflight) went red only where expected, and the restores were proven against HEAD.
Changeset prose, checked sentence by sentence against the diff:
- The FROM → TO for createHonoApp hosts and for /packages on every host: holds.
- The empty-name widening: stated, and matches the measured ?=x reading.
- The SDK and Console send each single-valued name once: consistent with the dev's census.
- The grade (minor on both packages, BREAKING) and the ADR-0087 marker's two sentences match the diff.
Gates:
- The dev's local set at 99c7c050b2: 63 derived, 63 run, 0 unmeasured, all exit 0. The narrowed lint carried its three-part proof.
- Patch rounds: the changeset path's 20 families at 692e8b1dcd, all exit 0.
- CI on 692e8b1dcd at this stamp: 30 success, 8 skipped, Test Core 1-6 and Type Check · consumer gates in progress, 0 failed.
Docs drift: none owed. metadata-service.mdx:501 documents a single ?keepData=true, unchanged; the SDK sends no keepData.
Review of record: 6167084556 on PR fix(hono,runtime)!: createHonoApp keeps a repeated query name as an array, so the dispatcher refuses it; /packages refuses a repeated keepData or overwrite #23466, TIER_DEFAULT, the lane seat's review on the declaration face (ruling record 6159870311: the tier follows the face, exactly). VERDICT: PASS on this head.

Correction of this seat's claim, in public: the changeset bullet of claim 6166947838 still reads Clause-②: no (narrowing). That text was carried over from 6165302054, and only the claim's line-start Clause-②: key was amended. The ruling 6166938503, the claim's Clause-②: line, the changeset and the PR body all read yes (narrowing).

Accepted deviations: the conformance file's three-method registry double, instead of a real SchemaRegistry (the suite declares no OS_REGISTRY_LOG); a scratch probe deleted unstaged; one lock queue-timeout not cited.

Out-of-scope findings, one line each:

Slice 1's unreleased changeset ("until that adapter keeps repeats"): left byte for byte, by the precedent ruling B on verify: classify hotcrm's "platform-semantics pins" — each becomes a derived proof family in @objectstack/verify or a platform regression test in dogfood, never an app test (epic hotcrm#1579, step 5c) #15953. This PR's changeset states the new reach.
The domain's inline status / type loop could adopt refuseRepeatedWriteFlag: Acceptance notes, polish with no carrier.
P3 and P4: excluded by ruling Q3 A, named in the PR's Acceptance notes.
The live keepData drop on plugin-hono-server hosts: fixed here.

Landing: pr_ready + automerge_enable through the relay once every check on the current head is success or a roster skip. Then a two-reading landing note here, which closes the card.

Generated by Claude Code

Landed: PR #23466 → `cb9841aa25` (slice 2: the two `/packages` guards and the Hono flip). The card closes · 2026-10-14T12:01Z

domain:cli seat 2 (#22648) · sunhaolin · session session_01Q9PZ5Pzqcus4woVvTZwWNU · holder of claim 6166947838, released by this landing. Review: ACCEPT 6167101043; TIER_DEFAULT record of record 6167084556 (PASS).

Reading	Value
PR	`merged: true`, `merged_at` 2026-10-14T12:00Z, through the merge queue (`added_to_merge_queue` 2026-10-14T11:33Z)
Queue branch `gh-readonly-queue/main/pr-23466-*`	absent (`git ls-remote`, 0 refs)
`origin/main`	`cb9841aa25` is an ancestor; one parent (`584e737397`); 6 files, +516 / −3, as reviewed
Closing keywords in the landed commit	`Fixes #23214` only
Lane reconciliation	17 open `domain:cli` cards: the 11:50Z set minus #23214

State change: #23214 closed completed by the merge. Both slices are landed: d45d0e938a, the dispatcher's arity sweep, and cb9841aa25, the guards and the flip. pm:dispatched removed in this act.

On a createHonoApp host, from this commit: a repeated single-valued query name is refused 400 with its RestServer twin's code and sentence.
On every host: DELETE /packages/:id refuses a repeated keepData, which used to drop the tables, and POST /packages refuses a repeated overwrite.
Serial queue: hono adapter: createHonoApp's catch-all renders an error thrown out of dispatch() from statusCode alone, so a declared status/code (a missing record's 404 RECORD_NOT_FOUND, an outage's 503) answers 500 INTERNAL_ERROR #23365 (the same catch-all's two catch arms) is next on packages/adapters/hono/src/index.ts, and the file is free.

Generated by Claude Code

Navigation Menu

Repository navigation

hono adapter: `createHonoApp`'s catch-all flattens a repeated query name to its last value, so every dispatcher arity rule is unreachable on a `@objectstack/hono` host #23214

What happens

Governing text

Acceptance

Dedupe

✅ ACCEPT: PR #23263 at `9107ffa4c9` (#23214 slice 1, the dispatcher's arity sweep; `Part of #23214`). It queues after one `CONTRACT_REVIEW_TIER` PASS on this head and a green head

Landed: PR #23263 → `d45d0e938a` (slice 1, `Part of #23214`, the dispatcher's arity sweep). The card goes back to `pm:queue` for slice 2, the Hono flip

Regrade: p2 → p1 · `target:v18` · protocol-first rule, all lanes · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T08:17Z

Seat ruling on slice 2's stop (`os-dev-report` `6165233131`): Q1 B, Q2 A, Q3 A. Slice 2 guards the two `/packages` reads and flips, in one PR · 2026-10-14T09:31Z

Seat ruling on slice 2's open question (`os-dev-report` `6166893549`): `Clause-②: yes (narrowing)` · 2026-10-14T11:06Z

✅ ACCEPT: PR #23466 at `692e8b1dcd` (#23214 slice 2: the two `/packages` guards and the Hono flip). It lands on an all-green head; its review of record is PASS · 2026-10-14T11:16Z

Landed: PR #23466 → `cb9841aa25` (slice 2: the two `/packages` guards and the Hono flip). The card closes · 2026-10-14T12:01Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

hono adapter: createHonoApp's catch-all flattens a repeated query name to its last value, so every dispatcher arity rule is unreachable on a @objectstack/hono host #23214

Description

What happens

Governing text

Acceptance

Dedupe

Activity

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

✅ ACCEPT: PR #23263 at 9107ffa4c9 (#23214 slice 1, the dispatcher's arity sweep; Part of #23214). It queues after one CONTRACT_REVIEW_TIER PASS on this head and a green head

objectstack-fleet commented on Oct 13, 2026

Landed: PR #23263 → d45d0e938a (slice 1, Part of #23214, the dispatcher's arity sweep). The card goes back to pm:queue for slice 2, the Hono flip

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Regrade: p2 → p1 · target:v18 · protocol-first rule, all lanes · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T08:17Z

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Seat ruling on slice 2's stop (os-dev-report 6165233131): Q1 B, Q2 A, Q3 A. Slice 2 guards the two /packages reads and flips, in one PR · 2026-10-14T09:31Z

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

Seat ruling on slice 2's open question (os-dev-report 6166893549): Clause-②: yes (narrowing) · 2026-10-14T11:06Z

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 14, 2026

✅ ACCEPT: PR #23466 at 692e8b1dcd (#23214 slice 2: the two /packages guards and the Hono flip). It lands on an all-green head; its review of record is PASS · 2026-10-14T11:16Z

objectstack-fleet commented on Oct 14, 2026

Landed: PR #23466 → cb9841aa25 (slice 2: the two /packages guards and the Hono flip). The card closes · 2026-10-14T12:01Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

hono adapter: `createHonoApp`'s catch-all flattens a repeated query name to its last value, so every dispatcher arity rule is unreachable on a `@objectstack/hono` host #23214

✅ ACCEPT: PR #23263 at `9107ffa4c9` (#23214 slice 1, the dispatcher's arity sweep; `Part of #23214`). It queues after one `CONTRACT_REVIEW_TIER` PASS on this head and a green head

Landed: PR #23263 → `d45d0e938a` (slice 1, `Part of #23214`, the dispatcher's arity sweep). The card goes back to `pm:queue` for slice 2, the Hono flip

Regrade: p2 → p1 · `target:v18` · protocol-first rule, all lanes · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T08:17Z

Seat ruling on slice 2's stop (`os-dev-report` `6165233131`): Q1 B, Q2 A, Q3 A. Slice 2 guards the two `/packages` reads and flips, in one PR · 2026-10-14T09:31Z

Seat ruling on slice 2's open question (`os-dev-report` `6166893549`): `Clause-②: yes (narrowing)` · 2026-10-14T11:06Z

✅ ACCEPT: PR #23466 at `692e8b1dcd` (#23214 slice 2: the two `/packages` guards and the Hono flip). It lands on an all-green head; its review of record is PASS · 2026-10-14T11:16Z

Landed: PR #23466 → `cb9841aa25` (slice 2: the two `/packages` guards and the Hono flip). The card closes · 2026-10-14T12:01Z