fix(metadata-protocol)!: the by-name /meta read refuses an object of a disabled package (404 OBJECT_PACKAGE_DISABLED), as the list and the data plane do

[objectstack-fleet]

Fixes #24097

Clause-②: no (narrowing)

Implements the seat ruling on #24097 (review 6236971888: OQ1 → A, OQ2 → A, items 1–7) under the re-declared claim 6236980302.

What changed

A disabled package's object was refused by the /meta/objects list and by the data plane, but GET /meta/object/:name still served it. Every by-name door now gives the same answer, 404 OBJECT_PACKAGE_DISABLED. The authoring check that needs the object still sees it.

1. getMetaItem, the API face (packages/metadata-protocol/src/protocol.ts). The refusal is checked once, right after canonicalizeMetaRequestType and before any layer is read, so it covers the active read, state: 'draft' and previewDrafts, and the plural spelling folds into it. The refusal comes from objectPackageDisabledError, a constructor extracted from assertObjectRegistered, so the data plane and the by-name read throw byte-identical envelopes. The predicate is registry.isObjectPackageDisabled, optional-called through isObjectOfDisabledPackage, as the data plane already calls it.
2. One private shared body. The old getMetaItem body is now the private readMetaItem, and getMetaItem delegates to it after the refusal. saveMetaItem's destructive-change prior read uses readMetaItem. There is no new public method, spec key or error code.
3. getMetaItemLayered (?layers=true) reads its layers without going through getMetaItem, so it carries the same check itself (item 5).
4. packages/runtime/src/domains/meta.ts (cross-lane, declared to domain:cli). The object branch no longer falls back to registry.getObject when the protocol refuses OBJECT_PACKAGE_DISABLED. The unscoped kernel's registry-first read skips an object the registry reports as disabled, so the protocol answers it. The predicate is read through a local type, because EngineSchemaRegistryView (packages/spec, outside the fence) does not declare it.
5. packages/rest/src/meta-item-read-gate.ts (cross-lane, declared to domain:cli). loadObjectItem reads OBJECT_PACKAGE_DISABLED as "no object" and does not log the fail-open warning. Any other thrown read still fails open and warns.

Call sites of the by-name object read

"Today" is origin/main 7d6ec91d2; "after" is this branch's head. The case is type: 'object' for an object whose owning package is disabled.

Call site	What it does	Today	After
objectui apps/console/src/components/FormPage.tsx (/meta/object/NAME)	record form schema	served	404 OBJECT_PACKAGE_DISABLED. It uses the object, and the data plane already refuses its rows
objectui packages/app-shell/src/providers/MetadataProvider.tsx (getItem('object', name))	console metadata cache	served	refused, same as above
objectui packages/app-shell/src/console/ai/AiChatPage.tsx	AI-chat handoff schema	served	refused, same as above
objectui apps/console/src/pages/system/hiddenFields.ts, PagePreview.tsx, ObjectChart.tsx, getObjectSchema users	render-time schema	served	refused. All of them use the object
objectui designer (MetadataFieldsPage, PermissionMatrixEditor, StudioDesignSurface, PackageOwdOverviewPanel)	open an object to edit	served by name, but unreachable: every entry point lists first, and client.list('object', …) already omits the package's objects	refused. No entry point reaches it
objectui PackagesPage.tsx (show or re-enable a package)	/api/v1/packages only	not a reader	unchanged
protocol.ts saveMetaItem destructive-change check	diffs the prior schema	served, so 409 DESTRUCTIVE_CHANGE	reads readMetaItem, still 409 DESTRUCTIVE_CHANGE (pinned; measured over HTTP below)
protocol.ts getMetaItemCached	REST cached item door	served	refused (an API face)
protocol.ts applySeedBodies adapter, build probes	seed a published package; post-publish probe	served	refused. The seed would be refused by the data plane anyway; the probes are best-effort and swallow errors
packages/rest import template / export / import-prepare	uses the object	served	refused. The import template answers 404 OBJECT_PACKAGE_DISABLED; the others keep their best-effort catch
packages/rest reference-label lookup (rest-server.ts)	label of a lookup target	served	the target's name stands in (its existing catch)
packages/rest enforceApiAccess → loadObjectItem	API-exposure gate	judged the object's enable	no object; the data plane answers 404 OBJECT_PACKAGE_DISABLED, with no warning
packages/runtime dispatcher GET /meta/object/:name (object branch, draft read, layered read)	the door itself	served (registry first, or registry fallback)	404 OBJECT_PACKAGE_DISABLED
packages/core import runner (servesReferenceTarget)	is the reference target served	served	reference_not_found (fail-closed catch), which matches the data plane
packages/services/service-automation connector pull	uses the object	served	refused (uses it)
packages/cli ownership ceremony lock.verdict	lock verdict	never asked about an object (item 6, below)	unchanged; nothing in packages/cli is touched

Measurements (ruling items 5–7)

• Item 5, getMetaItemLayered: it does not route through getMetaItem. An ablation that removes only its own check turns its READERS row red ("getMetaItemLayered … → refuses": false): without the check it serves the object. Over HTTP below, ?layers=true answers 404 OBJECT_PACKAGE_DISABLED.
• Item 6, the CLI ceremony's lock.verdict: the ceremony enumerates candidates by raw SQL over sys_metadata (readMetadataKeyRows, organization-ownership-plan.ts), limited to PRESENTATIONAL_TYPES = view, dashboard, report, translation, email_template. The other caller, organization-ownership-apply.ts, asks only about 'position'. So lock.verdict is never asked about an object, and the refusal, which is type: 'object' only, cannot reach it. No needs_decision; packages/cli is untouched.
• Item 7, non-object types over HTTP (CRM boot, below): with package app.probe-24097 disabled, GET /api/v1/meta/app/probe_gadget_app answers 200 while GET /api/v1/meta/app omits the app (5 → 4 items). This is class (b) with that reach. It is reported to the seat to file the family card and is ⛔ not fixed here.

HTTP readings: pnpm dev:crm -- --fresh at this branch's head

These come from a full pnpm build (76/76) and a seeded admin, against a writable package app.probe-24097 holding object probe_gadget and app probe_gadget_app. Code-shipped com.example.crm refuses disable with 422 WRITABLE_PACKAGE_REQUIRED.

Request	enabled	disabled	re-enabled
GET /meta/object/probe_gadget	200	404 OBJECT_PACKAGE_DISABLED	200
GET /meta/object/probe_gadget?layers=true	200	404 OBJECT_PACKAGE_DISABLED	—
GET /meta/object/probe_gadget?state=draft	404 NO_DRAFT	404 OBJECT_PACKAGE_DISABLED	—
GET /data/probe_gadget	200	404 OBJECT_PACKAGE_DISABLED	200
GET /meta/objects contains it	yes (81)	no (80)	—
GET /meta/app/probe_gadget_app	200	200 (item 7)	200
GET /meta/app contains it	yes (5)	no (4)	—
PUT /meta/object/probe_gadget dropping field title	—	409 DESTRUCTIVE_CHANGE	—
control GET /meta/object/crm_account (another package)	200	200	—

The server log carried 0 failing open warnings.

Pins

• packages/objectql/src/package-disable-enforcement.test.ts, the Package disable and uninstall never reach the metadata/data layer: a disabled package's objects still serve rows, and uninstall leaves 7 orphaned sys_metadata rows #7557 pin. READERS gains five enforces: true rows: getMetaItem object, objects, state: 'draft', previewDrafts, and getMetaItemLayered. A row counts only OBJECT_PACKAGE_DISABLED as refusing and rethrows any other error, so NO_DRAFT cannot pass for enforcement. The seed adds a pending draft so the draft row serves before the disable. New cases:
  • the by-name and layered refusals assert code, status, object, and a message identical to the data plane's;
  • the control: another package's object is still served by name and layered;
  • a field drop on a disabled package's object still answers 409 DESTRUCTIVE_CHANGE, and the stored row keeps the field.
• packages/runtime/src/domains/meta-object-disabled-package.test.ts, through HttpDispatcher.dispatch, on unscoped (registry-first) and scoped (protocol-first) kernels: 404 OBJECT_PACKAGE_DISABLED, registry.getObject never asked for the disabled name, and the control served.
• packages/rest/src/meta-item-read-gate.object-package-disabled.test.ts: OBJECT_PACKAGE_DISABLED reads as no object and no warning, any other throw still warns once, and the control.
• Pin sweep, flipped: packages/rest/src/rest-exposure-gate-one-object-read.test.ts's rest: every /data request's API-exposure gate reads EVERY object's metadata (with a full schema diagnostic) to check ONE object's enable flags — 62-72% of a data request's time, measured #24031 row "a DENIED operation answers the exposure verdict (405)" now asserts 404 OBJECT_PACKAGE_DISABLED, with createData reached once. The ledger protocol.lookup-artifact-item-call-sites.test.ts re-keys its three by-name rows from getMetaItem to readMetaItem; the call sites, arguments and dispositions are unchanged.

Verification (head 81e9289ba)

• Tests: @objectstack/objectql 437 files / 8239 passed. @objectstack/runtime 409 files / 6280 passed. @objectstack/rest 293 files / 6016 passed. @objectstack/metadata-protocol: the first full run had 1 failure, the lookupArtifactItem ledger, re-keyed above. The rerun at head: 243 files / 20628 passed, 3 files skipped. Runtime rerun at head: 409 / 6280 passed.
• Typecheck: metadata-protocol, objectql, rest and runtime are clean. The runtime typecheck was rerun after the predicate typing fix.
• Gates: node scripts/pm/dispatch-gates.mjs --commands (no paths) derived 68 commands at 81e9289b. All 68 exit 0. Two first refused on the shallow clone (check-engine-split-ratio --days 90, check-plugin-teardown-shape --self-test) and passed after the deepening each prescribed. --ran with exit codes: "68 derived, 68 run, 0 NOT-MEASURED (a DERIVED zero)". check-platform-checklist --changed-from origin/main: OK, 36 anchors judged, 0 lost. Control-byte scan of the changed files: clean.
• Ablations (one per changed, tested behaviour). Each went through scripts/ablation-replace.mjs, then pnpm --filter @objectstack/metadata-protocol build, with the test resolving dist/ through exports. The on-disk proof is the count of throw objectPackageDisabledError( in dist/index.js, because a comment or string marker is stripped by the bundler. A first attempt used such a marker; the preflight reported it absent from dist/, so it was discarded and redone.
  • (a) getMetaItem's check removed: dist 3 → 2. The four getMetaItem rows and the envelope case went red, while getMetaItemLayered stayed refusing. Restored: dist 3, 12/12.
  • (b) getMetaItemLayered's check removed: dist 3 → 2. Only the layered row went red. Restored: 12/12.
  • (c) the destructive-change read pointed back at getMetaItem: dist await this.readMetaItem( 1 → 0. The destructive pin went red with expected undefined to be 'DESTRUCTIVE_CHANGE'. Restored: 12/12.
  • Each restore was proven by blob == HEAD and an empty git status --porcelain.

Acceptance notes

• GET /meta/:type/:name/published (REST and the dispatcher) asks getMetaItemLayered inside a try and falls through to the published snapshot on any throw. For a disabled package's object it therefore serves the snapshot, not the refusal. It was not in the ruling's fence and was not measured over HTTP. Noted, not filed.
• The rest: every /data request's API-exposure gate reads EVERY object's metadata (with a full schema diagnostic) to check ONE object's enable flags — 62-72% of a data request's time, measured #24031 changeset (.changeset/pre/24031-exposure-gate-one-object-read.md, already consumed into a prerelease) says a denied operation on a disabled package's object answers the exposure verdict. This PR reverses that, and .changeset/24097-rest-exposure-gate-disabled-package.md states the FROM → TO. The consumed changeset is not edited.
• No changeset for @objectstack/objectql: its diff is a test file, which is not in its published files.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/metadata-protocol, @objectstack/rest, @objectstack/runtime, touching 22 documentable anchor(s).

26 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 70cfb12771bc8cc44bff830ea7528714f14d715e.

⛔ 10 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 39 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 70cfb12771bc8cc44bff830ea7528714f14d715e → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d1a14284cab408295948b9af76648b16a75b8163 — the merge of head 81e9289baa3466f31285059cc907e133b4789953 into base 70cfb12771bc8cc44bff830ea7528714f14d715e, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d1a14284cab408295948b9af76648b16a75b8163 && git checkout d1a14284cab408295948b9af76648b16a75b8163
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 70cfb12771bc8cc44bff830ea7528714f14d715e 81e9289baa3466f31285059cc907e133b4789953 && git checkout -B drift-repro 70cfb12771bc8cc44bff830ea7528714f14d715e && git merge --no-ff 81e9289baa3466f31285059cc907e133b4789953

node scripts/docs-audit/affected-docs.mjs --json 70cfb12771bc8cc44bff830ea7528714f14d715e

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 70cfb12771bc8cc44bff830ea7528714f14d715e → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 81e9289baa3466f31285059cc907e133b4789953
Local-runs: none
Scope: packages/metadata-protocol/src/protocol.ts, packages/metadata-protocol/src/protocol.lookup-artifact-item-call-sites.test.ts, packages/objectql/src/package-disable-enforcement.test.ts, packages/rest/src/meta-item-read-gate.ts, packages/rest/src/meta-item-read-gate.object-package-disabled.test.ts, packages/rest/src/rest-exposure-gate-one-object-read.test.ts, packages/runtime/src/domains/meta.ts, packages/runtime/src/domains/meta-object-disabled-package.test.ts + packages/rest/src/rest-server.ts (the item read's cached, uncached and draft arms, serveMetaItemLayered, /published, fetchCurrentMetaDocument and gatesPerCaller, enforceApiAccess, the import-template and reference-label reads), packages/rest/src/error-response.ts, packages/types/src/thrown-http-error.ts, packages/types/src/data-error-classification.ts, packages/objectql/src/registry.ts (isPackageDisabled, isObjectPackageDisabled), packages/spec/src/api/error-code-ledger.zod.ts, packages/spec/src/contracts/objectql-engine.ts, packages/cli/src/commands/migrate/organization-ownership.ts, packages/cli/src/utils/organization-ownership-apply.ts, packages/cli/src/utils/organization-ownership-plan.ts, packages/rest/src/import-prepare.ts, packages/rest/src/data-action-routes.ts, packages/core/src/utils/import-runner.ts, packages/services/service-automation/src/connector-pull.ts, packages/plugins/plugin-auth/src/auth-plugin.ts, packages/plugins/plugin-auth/src/admin-import-users.ts, .changeset/24040-reseed-converted-body.md, .changeset/pre/24031-exposure-gate-one-object-read.md, scripts/check-changeset-no-major.mjs, scripts/check-adr-0087-registration.mjs; the three .changeset/24097-*.md read as prose; objectui at 2ec9e2a read-only (FormPage.tsx, MetadataProvider.tsx, AiChatPage.tsx, MetadataService.ts, PackagesPage.tsx)

① Derived judgments

Read at the head; the check-runs' conclusions are the gate verdicts (40 runs: 34 success, 6 skipped, none failed or in progress).

1. Every by-name object face refuses with the data plane's envelope — right. getMetaItem folds the type first (canonicalizeMetaRequestType, so the plural objects lands on the same check), asks isObjectOfDisabledPackage(this.engine?.registry, name) and throws objectPackageDisabledError(name) before readMetaItem runs, so the active read, state: 'draft' and previewDrafts are refused before any layer is read. getMetaItemLayered (?layers=true, /layers) carries the same check after its own canonicalisation and before the code layer. assertObjectRegistered now throws through the same constructor, so code, status, object and message have one source. RestServer: the cached arm (getMetaItemCached delegates to getMetaItem, its catch rethrows), the uncached arm and the draft arm all let the throw reach the route's catch, where thrownAnswerIsBareNotFound is false (the resolved code is OBJECT_PACKAGE_DISABLED, a ledger code, never RESOURCE_NOT_FOUND), so handleRouteError → resolveErrorResponse → pass-through renders status 404 with code: OBJECT_PACKAGE_DISABLED (resolveThrownHttpError keeps a ledger-registered code as code; demotedDeclaredCode demotes nothing); RestServer has no registry fallback on these routes. Runtime dispatcher: readFromProtocol rethrows that one code instead of falling through, the registry-first path is skipped when isObjectPackageDisabled(name) answers true, and the draft arm (readPendingDraft) and layered arm (answerMetaLayered) render through errorFromThrown; pinned on both kernels through HttpDispatcher.dispatch, with registry.getObject asserted never called for the disabled name.
   Still serving, named and not fixed, outside the ruling's fence: GET /meta/:type/:name/published on both transports (the layered read sits in a try whose catch falls through to the published snapshot — confirmed in code, as the PR's acceptance note says); and on the dispatcher only, the one-segment legacy spelling GET /meta/NAME (registry.getObject(typeOrName) after the list misses, meta.ts line 2165 at head) and the /meta/object/:name/state/:field FSM read (line 1026): registry reads on API doors, the class ruling item 3 closed for the object branch. Carried in ③.

2. Resolution readers and the authoring caller — right. registry.getObject and registry.listItems('object') are untouched and stay pinned enforces: false. saveMetaItem's destructive-change prior read now calls this.readMetaItem inside the try whose catch rethrows only DESTRUCTIVE_CHANGE, so a field drop on a disabled package's object still answers 409 DESTRUCTIVE_CHANGE: pinned on code, status and the stored row keeping the field, and ablation (c) turns that pin red when the read points back at the API face. readMetaItem makes no call back into getMetaItem. The seed adapter and build probes keep reading the API face on purpose (best-effort, swallowed).

3. Checked before any layer, healthy package unaffected — right. In both getMetaItem and getMetaItemLayered the order is canonicalise → refuse → read. Controls are pinned (healthy_widget served by name and layered; the runtime pin's control served on both kernels) and measured over HTTP (crm_account 200 with the probe package disabled). The runtime's registry-first skip uses the same predicate, so a healthy object answers from the registry as before.

4. No widening — right. readMetaItem is private; objectPackageDisabledError and isObjectOfDisabledPackage are module-local, not exported; OBJECT_PACKAGE_DISABLED already sits in the error-code ledger; no spec key and no packages/spec edit (the runtime reads the predicate through a local optional type because EngineSchemaRegistryView declares getPackage and disablePackage but not isObjectPackageDisabled); loadObjectItem's signature is unchanged and its new arm returns undefined for one code. Accept sets only narrow: the exposure gate passing a disabled package's object on cannot admit a request, because every data verb funnels through assertObjectRegistered, the same predicate on the same registry.

5. The flipped rest-exposure-gate-one-object-read row — right and consistent. The card said the gate "inherits that with no REST change"; ruling item 4 orders the refusal read as no object without the fail-open warn; the rest: every /data request's API-exposure gate reads EVERY object's metadata (with a full schema diagnostic) to check ONE object's enable flags — 62-72% of a data request's time, measured #24031 changeset's move is reversed and the new rest changeset states the FROM → TO. The pin runs a real ObjectStackProtocolImplementation on a real SchemaRegistry, so the row exercises the new refusal rather than a mock; it asserts 404 + OBJECT_PACKAGE_DISABLED with createData reached once, and the ALLOWED row is unchanged. loadObjectItem has one consumer (enforceApiAccess), so the "no object" reading reaches nothing else.

6. Refusal pins assert code + status — right. The envelope case asserts code, status, object and message identity with assertObjectRegistered's throw; servesByName counts only OBJECT_PACKAGE_DISABLED as refusing and rethrows anything else, so NO_DRAFT cannot pass for enforcement (the seed adds a pending draft so the draft row serves before the disable); the REST and runtime pins assert code + status; the warn-suppression pin keeps the "any other throw still warns once" half.

Residue, not a defect: the by-name predicate is the data plane's (registry.isObjectPackageDisabled, owner-based through resolveObjectKey) while the list filters by each served item's _packageId; they agree for a registered object, which is the one predicate the ruling ordered.

② Semver level

• @objectstack/metadata-protocol: minor, BREAKING banner, Clause-②: no (narrowing), adr-0087 marker not-required (no-migration-prescription) — matches the diff: a served-set narrowing of a public read door; no stored shape, key, export or code added or removed. check-changeset-no-major reads a declared narrowing as BREAKING shipped minor in the launch window (the cloud-connection: the marketplace reseed door hands applySideEffects the raw ledger entry, so it reloads translations a conversion strips (a pre-17.4 per-app settings group) that install and rehydrate load converted #24040 convention cited). Right.
• @objectstack/runtime: the same triple — matches: the dispatcher's object door narrows, nothing else published changes. Right.
• @objectstack/rest: the same triple — right, conservatively labelled. The diff publishes a refusal-code move (405 / 404 OBJECT_API_* back to 404 OBJECT_PACKAGE_DISABLED for an already-refused request) and a warn log that stops; the accept set is unchanged, and rest: every /data request's API-exposure gate reads EVERY object's metadata (with a full schema diagnostic) to check ONE object's enable flags — 62-72% of a data request's time, measured #24031 shipped the inverse move as patch with Clause-②: no. Declaring a consumer-visible code change BREAKING is at least as strict as owed, the body says "a refusal moves" honestly, and the gate accepted it.
• @objectstack/objectql: no changeset; its diff is one test file outside the published files. Right.
• The three dispositions were re-verified by Check Changeset (success). Each body's "What changes for you" names a remedy (re-enable the package), not a rewrite prescription.

③ Boundary flags

Report 6238493670, every entry:

• deviation 1 (pin sweep: the rest: every /data request's API-exposure gate reads EVERY object's metadata (with a full schema diagnostic) to check ONE object's enable flags — 62-72% of a data request's time, measured #24031 row flipped; the lookupArtifactItem ledger re-keyed getMetaItem → readMetaItem with the same sites, arguments and dispositions) — answered in ① 5 and read in the diff. Right.
• deviation 2 (runtime local type for the predicate; packages/spec out of fence) — answered: the view type lacks the member; the optional call mirrors the protocol's own posture; no widening.
• deviation 3 (commit ae7c051 titled narrower than its content, history not rewritten) — cosmetic; one landing.
• deviation 4 (shared clone deepened so two derived gates could run) — process, additive; not a contract matter.
• deviation 5 (attribution per AGENTS.md over the harness reminder) — process; noted.
• deviation 6 (no objectql changeset) — answered in ②.
• open question 1 (bump level) — answered in ②. open question 2 (predicate typing) — answered above.
• out-of-scope 1 (GET /meta/app/NAME of a disabled package answers 200 while the list omits it, measured over HTTP) — escalated to the seat: ruling item 7 has the seat file the family card for the non-object types; ⛔ not this PR's.
• out-of-scope 2 (/published serves the snapshot of a disabled package's object; carrier none) — confirmed in code on both transports; escalated: an API door still serving, outside the ruling's fence, needs a carrier — the same family card (one answer per door), not a rider here. The two dispatcher registry reads named in ① 1 (one-segment legacy spelling; /state/:field) go on that card too. /history, /audit and /diff are unaffected for objects: gatesPerCaller('object') is false, so fetchCurrentMetaDocument never reads an object.
• out-of-scope 3 (the consumed rest: every /data request's API-exposure gate reads EVERY object's metadata (with a full schema diagnostic) to check ONE object's enable flags — 62-72% of a data request's time, measured #24031 changeset states the opposite) — answered: consumed changesets are release-owned; the new rest changeset carries the FROM → TO.
• Ruling item 6, measured not edited — confirmed in code: lock.verdict is asked only for rows readMetadataKeyRows selects (type IN PRESENTATIONAL_TYPES: view, dashboard, report, translation, email_template) and for 'position'; the refusal is type === 'object' only, so packages/cli is rightly untouched.
• Report 6236347492's carried findings (the runtime registry fallback; the fail-open warn) are closed by ruling items 3 and 4 as implemented here.
• For the ledger's owner, not this PR (packages/spec is fenced): the OBJECT_PACKAGE_DISABLED row's comment still reads "data plane refuses"; the by-name /meta reads now raise it too.
• main has moved in protocol.ts since the merge base 7d6ec91 (+74/−25, other cards); the claim already says whichever lands later merges main.

Implemented-by: claude/issue-24097-meta-by-name-disabled-package
Reviewed-by: session_01JtSQQ3EWsbNPzyYMug1tXy

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-17T19:24Z · ACCEPT

Head: 81e9289baa3466f31285059cc907e133b4789953.

Item	Reading
Shape	Draft PR → main. The body opens Fixes #24097, its only closing keyword (full-body scan). mergeable_state: clean against today's main, which has since taken PRs #24202 and #24203 in protocol.ts.
Scope	11 files (+484 / −34), inside the re-declared claim 6236980302. protocol.ts: the getMetaItem refusal, the private readMetaItem body, the destructive-change prior read, and getMetaItemLayered's check. The runtime dispatcher's object branch and the REST read gate are declared to domain:cli on #6024 and #22648. Plus the #7557 pin rows, the flipped and re-keyed pins, and three changesets. Not governed (check-governed-merges.mjs --pr 24208: 0 of 11).
Ruling	The seat's ruling 6236971888 (OQ1 → A, OQ2 → A, items 1–7), implemented as written. The seat checked the record's central claims on this head before adopting it. getMetaItem canonicalises, then refuses type: 'object' of a disabled package, then calls readMetaItem. saveMetaItem's destructive-change read calls this.readMetaItem (:22950). The runtime's protocol read rethrows OBJECT_PACKAGE_DISABLED instead of falling through (meta.ts:1773).
Contract review	CONTRACT_REVIEW_TIER, an isolated reviewer: record 6239481977, PASS on this head (narrowing face, every non-prose path).
Measured	Item 6: lock.verdict is asked only for presentational types and 'position', never object, so packages/cli is untouched. Item 7: GET /meta/app/NAME of a disabled package answers 200 while the list omits it. That is measured over HTTP and filed by the seat as #24210 (the non-object family), ⛔ not fixed here. Live boot at this head: every by-name object face answers 404 OBJECT_PACKAGE_DISABLED; a destructive PUT answers 409; another package's object answers 200; re-enable restores 200; 0 fail-open warnings.
Prose faces	The three changesets, sentence by sentence. Each FROM / TO matches the pins. The rest changeset states the reversal of the #24031 move (a denied operation on a disabled package's object now answers 404 OBJECT_PACKAGE_DISABLED). Each "What changes for you" names the remedy (re-enable the package).
Clause-②	no (narrowing), at a line start in the PR body and all three changesets. minor + BREAKING under the launch-window convention, each with not-required (no-migration-prescription). No objectql changeset, since its diff is one test file outside its published files.
Gates	Dev union: 68 derived, 68 run, all exit 0. CI on this head: 40 check-runs, 34 success, 6 skipped, 0 failed. Every skip is rostered in EXPECTED_SKIPS: Console Pin Gate, Build Docs, Temporal Conformance, the Dogfood matrix template, Dogfood Verify CLI, Packed-tarball smoke.

Disposition:

• open_questions: [0] A: minor + BREAKING, the repo's narrowing convention. [1] A: a local optional type for the predicate in packages/runtime, so packages/spec is not widened for one consumer.
• out_of_scope_findings[0] (non-object by-name reads): filed metadata-protocol: a by-name /meta read of a non-object item (app, view, page, …) serves a disabled package's item while the list omits it; #24097 closes the object half only #24210.
• out_of_scope_findings[1] (/published serves a disabled package's object snapshot): carried on metadata-protocol: a by-name /meta read of a non-object item (app, view, page, …) serves a disabled package's item while the list omits it; #24097 closes the object half only #24210, the one-answer-per-door family. The reviewer adds two dispatcher-only registry reads on object API doors, the legacy one-segment GET /meta/NAME and /meta/object/NAME/state/FIELD. Both are carried there too.
• out_of_scope_findings[2] (the consumed rest: every /data request's API-exposure gate reads EVERY object's metadata (with a full schema diagnostic) to check ONE object's enable flags — 62-72% of a data request's time, measured #24031 changeset states the opposite): Acceptance notes. A consumed changeset is release-owned, and this PR's rest changeset carries the FROM / TO.
• Reviewer note: the OBJECT_PACKAGE_DISABLED ledger row's comment still says "data plane refuses", while the by-name /meta reads now raise it too. That is spec auxiliary text, noted, not filed; it is for the spec lane's next touch of the ledger row.
• deviations: accepted (the two pins outside the literal surface that this narrowing flips or re-keys; the local type; the commit title; the dev's own clone deepened; attribution per AGENTS.md; no objectql changeset).

Landing: ordinary queue (pr_ready + automerge_enable through the relay), in this stroke.

---

Generated by Claude Code