meta door: GET /meta/_drafts?packageId[]= / ?type[]= reads as no filter and answers every package / every type (same class as #29199)

domain:server#2 · os-steve · session_01ADHkmQxwoGb5fSnrFkpxmt

立卡门: ① 产品缺陷，具名落点（finding class a · reach: 具名真实生产面 GET /api/v1/meta/_drafts，两个传输上都只在元数检查后读 packageId / type，读法见下；HTTP 未实测，派工第一步先测）。来源：PR #29298（#29199）合约复审记录 6576238292 should-fix 2 与开发报告 out_of_scope。
业务理由: 按 qs 风格序列化数组的客户端想看一个包或一种类型的草稿，却拿回全部草稿并当成过滤后的结果；#29046 与 #29298 已在 /meta/:type 列表上把括号键拒掉，_drafts 是同一类缺口的最后一处。不修，审草稿、批量发布前列清单的调用方会读到别的包的草稿。
动手的读者: domain:server 席，packages/rest/src/meta-collection-routes.ts（约 467 行，_drafts 门）与 packages/runtime/src/domains/meta.ts（约 2067 行，调度器孪生），把 #29298 的 metaBracketedPackageRefusal 推广到该门自己的键名。
查重: _drafts packageId bracketed 5 命中（含已关）；最近邻 #29199（PR #29298）、#28930（PR #29046）、#29180（_drafts 错拼类型答 200，另一类）。

Follow-up of: #29199 (PR #29298)

What happens (read in the tree, not yet measured at HTTP)

META_QUERY_ARITY_DOORS.drafts = ['packageId', 'type'] gives the drafts door an arity gate but no closed set. So ?packageId[]=X and ?type[]=Y pass the gate under another key name, and the door then reads packageId / type as absent. The answer would be every package's drafts, or every type's.

Acceptance

Measure first, on main, over both transports. If neither spelling reds, close this card with the reading.
If one reds, refuse it with fix(rest)!: GET /meta/app refuses a bracketed id key (?id[]=, ?id[0]=) instead of answering every app #29046 / fix(rest)!: /meta list refuses a bracketed object key on views and a bracketed package key on the list and book tree #29298's 400 frame (same status, code and sentence shape), with red-first HTTP pins and plain-spelling controls.
Narrowing: ! title, BREAKING banner, adr-0087: marker, dogfood. Clause-②: yes (narrowing) if the exported refusal union widens, as the fix(rest)!: /meta list refuses a bracketed object key on views and a bracketed package key on the list and book tree #29298 review spelled it.

Generated by Claude Code

domain:server#2 · os-steve · session_01ADHkmQxwoGb5fSnrFkpxmt

Path: none

Triage: p2 · `domain:server` · `area:api` · `pm:queue` · 2026-11-02T11:47Z

⛔ Not a claim.

Ruling-ref: the maintainer, 2026-11-01T12:11Z: 「定级你可以自己决定」 (server seats grade lane cards).

Read fresh. This is the last site of the bracketed-key class that fix(rest)!: GET /meta/app refuses a bracketed id key (?id[]=, ?id[0]=) instead of answering every app #29046 and fix(rest)!: /meta list refuses a bracketed object key on views and a bracketed package key on the list and book tree #29298 closed on the /meta list doors. GET /meta/_drafts gives packageId / type an arity gate but no closed set, so a bracketed spelling may read as no filter. The sibling cards Metadata API: GET /api/v1/meta/app?id[]=NAME (bracketed array spelling) ignores the filter and answers the caller's full app list #28930 and meta door: GET /meta/view?object[]=NAME answers every view instead of the views of that object #29199 were p2, so this is p2 by the same reading.
domain:server, pm:queue. It is serial behind PR fix(rest)!: /meta list refuses a bracketed object key on views and a bracketed package key on the list and book tree #29298, which edits meta-collection-routes.ts: measure first, and edit only after it lands. If neither spelling reds on main, close with the reading.
Triage may re-grade; this grade stands until it does.

Generated by Claude Code

domain:server#2 · os-steve · session_01ADHkmQxwoGb5fSnrFkpxmt

Claim: PM loop round 1 · card thread · 2026-11-02T11:50Z
Session: session_01ADHkmQxwoGb5fSnrFkpxmt (the seat); the card thread is session_01ADHkmSq83zsshBxiLpFJdE
Account: os-steve (the seat's linked user; the card's assignee)
Branch: claude/project-thread-ta4g7t (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: the card thread's own container checkout
Domain: domain:server
Seat: domain:server#2
Ruling-ref: the maintainer, verbatim: 「开 server 2、3、5 号席位, 前任已经下班，接手所有开发，包括跟进之前未完成的开发落地。」 Card: none from the maintainer on this card; graded p2 on the card (6576358498).
File surface: packages/rest/src/meta-collection-routes.ts (the _drafts door), packages/rest/src/meta-item-read-gate.ts (helper, only if it must generalise), packages/runtime/src/domains/meta.ts (dispatcher twin); tests; dogfood; changeset. ⛔ No ui/**, no packages/spec/**.
Container & model: M, mode:thread, model: opus (TIER_DEFAULT; --tier names no path mandate: PM's call), effort: medium
Clause-②: yes (narrowing) (expected only if a spelling reds and the published refusal union widens; the dev measures first and declares)
Metadata-protocol: none (expected)
Responsibility: the code is the GET /meta/_drafts door in @objectstack/rest and its dispatcher twin · the platform path is a qs-style client asking for one package's or one type's drafts · reached by any SDK, script or integration that serialises arrays with brackets
Thread-read: 6576358498
Premise: unmeasured (read in the tree by the PR #29298 contract review; the card thread measures it first and the card closes with the reading if nothing reds)
Serial constraints cleared: none — PR #29298 edits meta-collection-routes.ts and is queued to merge; the card thread measures only and makes no source edit until it has merged
Resume-from: none — fresh from origin/main

State: pm:queue → pm:dispatched, assigned to os-steve, recorded by this claim.

Generated by Claude Code

domain:server#2 · os-steve · session_01ADHkmSq83zsshBxiLpFJdE
os-dev-report

{
  "issue": 29319,
  "status": "done",
  "branch": "claude/project-thread-ta4g7t",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/29440",
  "session": "session_01ADHkmSq83zsshBxiLpFJdE",
  "premise_still_valid": true,
  "summary": "Measured first on main 27c1c555 (no edit): every bracketed packageId/type spelling on GET /meta/_drafts answered 200 with every draft on both transports, raw and percent-encoded; beside a plain packageId the bracketed key was silently dropped. After #29298 merged, its metaBracketedPackageRefusal was generalised and renamed to metaBracketedFilterRefusal over one per-door table (list and book-tree judge package, _drafts judges packageId then type); metaQueryArityRefusal already asks it, so the dispatcher needed no source change, and RestServer's _drafts door asks it after its multiplicity gate. rule stays bracketed-parameter, so no published union widens: Clause-②: no (narrowing).",
  "tests": "Red first (pins b748eaaf on main a2fcede8): rest Tests 10 failed | 39 passed (49); runtime Tests 5 failed | 38 passed (43). Green at ee0e30c9: rest suite Test Files 370 passed (370), Tests 7043 passed | 332 skipped; runtime dispatcher-query-arity + meta-list-projection-parity Tests 1185 passed (1185); rest/runtime/dogfood typecheck VERDICT 0. Ablations (ablation-replace wrap mode, rest rebuilt, dist-preflight marker present in 2 built files): packageId row -> rest 5 failed, runtime 3 failed, dogfood file 2 failed; type row -> rest 5, runtime 2, dogfood 2; RestServer hand-off -> rest 4, runtime 0 (dispatcher path untouched), dogfood 4. Each restore: blob == HEAD, git diff HEAD empty, rebuild, all three markers absent from 6 built files, tree clean.",
  "gates": "Local, at ee0e30c9: dispatch-gates --commands derived 64, all exit 0 first pass; --ran with exit codes: 64 accounted, 64 run, 0 NOT-MEASURED (a DERIVED zero). eslint --no-inline-config over packages/rest, packages/runtime, packages/qa/dogfood exit 0. check-platform-checklist --changed-from origin/main OK (12 anchors, 0 lost). CI check-runs on PR #29440 at report time: all in_progress or queued (Check Changeset, Lint · repo & tooling gates, Type Check · workspace, Governed Surface Queue Guard, PR-body guards …); not waited on.",
  "dogfood_battery": "ee0e30c9 · VERDICT command-exit 1 · Test Files 2 failed | 391 passed | 3 skipped (396) · Tests 4 failed | 3244 passed | 28 skipped (3276) · failures: flow-runas.dogfood.test.ts x3 (member flow trigger 404 RECORD_NOT_FOUND), declarative-endpoint-anonymous-guest.dogfood.test.ts x1 — reproduced identically (Tests 4 failed | 8 passed (12)) with this PR's 3 rest src files set back to origin/main's and rest rebuilt, so main-caused, not this change. Previous head 88dc5779 (same diff, older main): VERDICT 0 · Test Files 393 passed | 3 skipped (396) · Tests 3248 passed | 28 skipped (3276).",
  "files_changed": [
    "packages/rest/src/meta-item-read-gate.ts",
    "packages/rest/src/meta-collection-routes.ts",
    "packages/rest/src/meta-item-read-routes.ts",
    "packages/rest/src/meta-query-arity-doors.test.ts",
    "packages/runtime/src/domains/dispatcher-query-arity.test.ts",
    "packages/qa/dogfood/test/meta-read-doors-live.dogfood.test.ts",
    ".changeset/29319-bracketed-drafts-filter-refused.md"
  ],
  "line_budget": "+232 / -32 over 7 files (git diff --stat origin/main...HEAD at ee0e30c9); under the 3000 human-merge threshold",
  "deviations": [
    "File surface: one extra line outside the claim, meta-item-read-routes.ts, the book tree's call following the rename of the generalised helper. packages/runtime/src/domains/meta.ts was not edited (not needed).",
    "The final-head dogfood battery is red 4 (main-caused, evidence above); the green battery is on 88dc5779.",
    "The restore-leg rest rebuilds after the ablations and after the main-red check ran outside the verify lock (about 15 s each).",
    "The step-1 measurement used a scratch vitest file in packages/runtime/src/domains, deleted before any commit; readings at /mnt/project-files/server-seat2/29319-readings.md.",
    "The session context asked to set os-steve as PR assignee and reviewer through MCP; skipped, os-dev and the standing order forbid PR assignees and MCP writes."
  ],
  "mcp_calls": "5 — all reads: issue_read get (#29319), issue_read get_comments (#29319), pull_request_read get (#29298) x2, pull_request_read get_check_runs (#29440). No write tool.",
  "api_writes": "2 — relay pr_create (POST /repos/objectstack-ai/objectstack/pulls, draft, no labels, no assignees) and this os-dev-report comment (POST /repos/objectstack-ai/objectstack/issues/29319/comments via post-stamped).",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: a · reach: main-red, the booted showcase over HTTP — flow-runas.dogfood.test.ts (member-triggered runAs flows answer 404 RECORD_NOT_FOUND) and declarative-endpoint-anonymous-guest.dogfood.test.ts red on origin/main as merged at ee0e30c9, reproduced without this PR's source; dfbe34d8 (flow start doors) landed between the green and red heads, not bisected · dedupe words: flow-runas dogfood RECORD_NOT_FOUND, runAs member trigger 404, flow start door main-red",
    "carrier: none · noted, not filed: ?preview[]= and ?include[]= on the /meta list still read as absent (#29298's note), not measured here"
  ]
}

Stamped 2026-11-02T15:00Z.

Generated by Claude Code

Navigation Menu

Repository navigation

meta door: `GET /meta/_drafts?packageId[]=` / `?type[]=` reads as no filter and answers every package / every type (same class as #29199) #29319

What happens (read in the tree, not yet measured at HTTP)

Acceptance

Triage: p2 · `domain:server` · `area:api` · `pm:queue` · 2026-11-02T11:47Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

meta door: GET /meta/_drafts?packageId[]= / ?type[]= reads as no filter and answers every package / every type (same class as #29199) #29319

Description

What happens (read in the tree, not yet measured at HTTP)

Acceptance

Activity

objectstack-fleet commented on Nov 2, 2026

Triage: p2 · domain:server · area:api · pm:queue · 2026-11-02T11:47Z

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

meta door: `GET /meta/_drafts?packageId[]=` / `?type[]=` reads as no filter and answers every package / every type (same class as #29199) #29319

Triage: p2 · `domain:server` · `area:api` · `pm:queue` · 2026-11-02T11:47Z