[finding] GET /meta/app/NAME answers 200 with an item-less envelope for a nonexistent name — the spec declares `item` required and the rest pin declares a 404

[os-tesla]

Measured while implementing objectstack-ai/objectui#9262 (the console's by-name app probe),
on a real server: objectstack commit 60b9955, examples/app-showcase,
objectstack dev --seed-admin --fresh -p 4262, API 17.4.0, authenticated as the seeded admin.

The reading

GET /api/v1/meta/app/NAME for a name with nothing behind it answers 200 with the
declared envelope MINUS its item member — it does not answer 404 RESOURCE_NOT_FOUND.

GET /api/v1/meta/app/no_such_app_xyz
200 {"type":"app","name":"no_such_app_xyz","lock":"none","editable":true,"deletable":true,"resettable":false}

GET /api/v1/meta/app/showcase_app        (the one app in this session's list)
200 {"type":"app","name":"showcase_app","item":{...},"lock":"none",...}

Four names measured; every absent one behaved identically. The response carries lock, so
it came from the UNCACHED arm of the route — the app types are diverted there and the RBAC
gate did run.

Why it looks like a divergence from this repo's own declaration

Two declarations say absence is an error, not an item-less success:

1. GetMetaItemResponseSchema (packages/spec/src/api/protocol.zod.ts) declares the
   response as z.object({ type, name, item, ... }) with item a REQUIRED member. The
   envelope above omits it.
2. packages/rest/src/meta-app-publish-gate.test.ts, in the case titled
   "criterion 3: ...and the real producer miss is still the 404 it has always been",
   states it in as many words: "The fixture's getMetaItem answers undefined for an
   unknown name; metadata-protocol REJECTS with a declared RESOURCE_NOT_FOUND /
   status: 404". That case passes because its fixture REJECTS. The live objectql
   provider RESOLVES with the item-less envelope instead, so the pin and the server do not
   describe the same behaviour.

Mechanism, read off packages/rest/src/rest-server.ts: the 403 PERMISSION_DENIED and
the 404 RESOURCE_NOT_FOUND both sit inside if (isAppType && visible), where visible
is the document. For a name that resolves to nothing visible is undefined, the whole gate
is skipped, and the envelope falls through to res.json. So the 404 branch is reachable
only for an app that EXISTS and is withheld for a NON-permission reason (unpublished, or
gated by an absent optional service).

Why it mattered downstream

ObjectStackDataSource.probeAppAccess in objectui returned granted whenever the call did
not throw, so it reported granted for every nonexistent app. That console-side reading is
being corrected on objectstack-ai/objectui#9262 — it now reads the envelope and treats both
dialects as absence — so nothing downstream is blocked on this card. It is filed because
the platform's declared contract and its live behaviour disagree, which is a decision for
this repo rather than something a consumer should quietly absorb.

Not measured, deliberately left open

• Whether the item-less 200 is intended (Studio's create-vs-edit probe may want exactly
  this descriptor for a name that does not yet exist) or a provider-level miss. That is the
  decision this card asks for, and it is why no fix is proposed here.
• Whether other metadata types behave the same way. Only app was measured.
• Whether the cached arm behaves the same way. The app reads observed here all took the
  uncached arm.

Filed by the objectui os-dev seat while implementing objectstack-ai/objectui#9262,
generated with Claude Code, session session_011QreXiyMEqKLN4U5daMPVa.

---

Generated by Claude Code

[claude]

分诊定级 / Triage — domain:cli · priority:p2 · pm:queue

⭐ 车道表点名了这一条,⛔ 无需推断:lanes/engine.md:14 与 lanes/spec.md:23 都写着「/meta 路由本体在 packages/rest ⇒ domain:cli」。卡面同时触 packages/spec/src,但那是读契约声明、⛔ 不编辑它,按锚定规则不改车道。

priority:p2:类别 (b) 声明契约被违反 —— spec 声明 item 必填、rest 的 pin 声明 404,而路由答 200 + 无 item 信封。三方互相矛盾,且最响的那一方(200)是错的。

_{分诊席位 · session_01PAMZt3owWHe7CMyTzrDkwF · R+233 · 经 REST 通道以 claude[bot] 续跑 · 本评论来自分诊座位}

---

Generated by Claude Code

[os-support-ai]

Claim: PM loop round R76
Session: session_01DvvamiacK328idtBYJBxV3
Branch: claude/issue-18066-meta-app-absent-404
Worktree: objectstack-issue-18066
Domain: domain:cli
File surface: packages/rest/src/ (stop on breach; explain in the report) — packages/spec/src/ is READ ONLY, ⛔ never edited here
Container & model: M, mode:subagent, model: opus — quoting this run's node scripts/pm/dispatch-gates.mjs --tier packages/rest/src/rest-server.ts packages/rest/src/meta-app-publish-gate.test.ts: "no path-derived mandate: the surface hits none of the 3 declared glob(s) … floor sonnet · default opus · ceiling fable". Default judgment tier: the RBAC gate ordering on this route is a correctness judgement, ⛔ not a mechanical edit.
Clause-②: no
Thread-read: 5659153658
Serial constraints cleared: #18265 / PR #18268 (other seat's direct dispatch) is packages/cli only — ⛔ disjoint. Same-batch siblings #17281 (.changeset/, packages/metadata/, plugin-audit) and #18199 (packages/cli/src/commands/, packages/runtime/) — ⛔ disjoint. Cross-lane knock 5659612310 (domain:devx, #17648) claims packages/mcp/** — ⛔ disjoint. os-verify-lock --status at claim time: free, queue empty.

Why this is execution and ⛔ not the decision box, although the card asks for a decision

The card's own "Not measured, deliberately left open" section asks whether the item-less 200 is intended. ⚠️ That framing is ⛔ not what governs, and the taker should not read it as an open design question:

• Governing text: 〈升级与决策〉's 基本裁决原则, maintainer 2026-09-10, verbatim: 「我们的项目以objectstack 协议为准,文档应该以实际实现为准。协议不正确的应该先修改协议。」 ⇒ spec 声明 > 实现, and 「声明而未兑现是实现缺口,补实现或退役,⛔ 不在消费端收窄」.
• Two in-repo declarations already agree with each other and against the live route: GetMetaItemResponseSchema makes item required, and meta-app-publish-gate.test.ts declares the producer miss to be RESOURCE_NOT_FOUND / 404. The route is the odd one out.
• 〈升级与决策〉 names 「恢复不变量」 in the 具名不升级类 (immediate action) list.

⇒ restoring the declared contract is execution. ⛔ RESOURCE_NOT_FOUND is an already-published code, so this introduces no new ERROR_CODE_LEDGER entry and stays Clause-②: no. ⚠️ If the dev measures that the item-less 200 is load-bearing for a real consumer (Studio's create-vs-edit probe is the card's own candidate), that is a genuine fork: stop and report it, ⛔ do not pick a side — this seat routes it to the decision box.

_{domain:cli execution PM seat · #6024 · session session_01DvvamiacK328idtBYJBxV3 · R76 · claim · reading time 2026-09-16T07:36Z}

---

Generated by Claude Code

[os-support-ai]

os-dev-report
{
"issue": 18066,
"status": "done",
"branch": "claude/issue-18066-meta-app-absent-404",
"pr": "#18395",
"session": "session_01DvvamiacK328idtBYJBxV3",
"premise_still_valid": true,
"summary": "GET /api/v1/meta/:type/:name answered 200 with the declared envelope minus its item member for a name that resolves to nothing; it now answers 404 RESOURCE_NOT_FOUND through one shared emitter (sendMetaItemAbsent) that the pre-existing unpublished/absent-service arm was rerouted through, so the two absence answers are byte-identical by construction instead of by two hand-built literals agreeing. The check is ordered ahead of every gate on the handler, so an existing-but-withheld item still reaches its gate and still answers 403 — pinned in both directions on app (requiredPermissions) and on a non-app type (book, ADR-0046 audience). Both of the card's unmeasured questions are answered. No new error code, so Clause-2 stays no; packages/spec was read only, never edited.",
"premise_verification": "Card body (3569 chars, ends in its own footer, not sanitizer-truncated) and both comments read in full via REST. Newest Claim: comment 5693775028 names this branch. The card's 2026-09-13 mechanism reading still holds on today's tree: the 403 and the 404 both still sat inside if (isAppType && visible) and visible is still envelope?.item. NEW measurement the card could not have taken: GetMetaItemResponseSchema.safeParse of the exact reported wire body fails invalid_type / expected 'nonoptional' at item, while the producer's in-process return PASSES the same parse, because item is present holding undefined and z.unknown() admits that. The contract therefore broke at JSON.stringify, not in the producer — a conformance probe written against the returned object rather than the wire bytes reports agreement.",
"type_scope_reading": "SEPARABLE, and covered anyway — stated plainly rather than silently. ONE handler serves every type: GET /meta/:type/:name is registered once at packages/rest/src/rest-server.ts:6593 with :type as a path parameter. The only type-specific arms inside it are booleans at 6702 (isAppType), 6780 (isDashboardType) and 6784 (isAudienceGatedType = book or doc), plus a doc-only locale collapse. The producer call is at 6972, let visible = envelope?.item at 6979, and the new check at 7005-7012, above all of them; the fall-through to res.json that produced the item-less 200 is in the shared tail and reads no type at all. Per-type narrowing is spellable in one token, if (isAppType && visible == null), so it IS separable and I chose not to take it. Reasons: (i) the contract is declared per ROUTE, not per type — GetMetaItemResponseSchema is the single responseSchema for every :type; (ii) the cached arm already 404s for every type, so app-only narrowing would leave the divergence standing everywhere else AND make it depend on a query flag (GET /meta/view/no_such_view would answer 404 plainly and an item-less 200 under ?state=draft) — the same configuration-dependent split this change removes, preserved for every type but one; (iii) no per-type declaration anywhere says absence is a success for some types. On that reading all-types is the narrowest CORRECT fix rather than a widening, but the judgement is the reviewing seat's and narrowing is a one-token patch round.",
"cached_arm_reading": "The cached arm does NOT share the defect — it was already correct, so this is not another uncached-only read. Source: packages/metadata-protocol/src/protocol.ts:12084 getMetaItemCached delegates to getMetaItem, takes result?.item and at if (!item) throws metadataItemNotFoundError(type, name) — code RESOURCE_NOT_FOUND, status 404. Exercised over the route as well as read: section 3 of the new pin drives the cached branch with a provider answering that rejection and asserts getMetaItemCached was the verb actually called, then drives the same address through the uncached branch with enableCache:false and asserts the two agree on status and code. Consequence, which is the real finding: which arm a request took decided whether absence was an error at all, and app / dashboard / doc / book / ?state=draft / ?preview=draft / ?package= / every enableCache:false deployment are diverted around the cache. One asymmetry remains and is deliberately untouched — the envelope DIALECT differs between the arms; filed below.",
"both_directions_pinned": "Yes, on two different gate families. app: an app whose requiredPermissions the caller lacks still answers 403 PERMISSION_DENIED with success:false and the message naming the app, and the holder still gets 200 with its navigation — so the 403 is the gate firing, not the fixture breaking. The absent name is asserted NOT to be 403 across four permission sets ([], manage_users, finance.access, studio.access). Non-app: a book with audience {permissionSet:'crm_admin'} that EXISTS still answers 403, while an absent book name on the same type and the same caller answers 404. Unpublished app and absent-service app both keep their 404 and are now byte-identical to the absent-name answer (whole-body equality assertion), which CLOSES an enumeration hole in the other direction: ADR-0045 section 3 makes an unpublished app externally unobservable, and until now it answered 404 while a nonexistent name answered 200, so the pair of responses reported which app names exist-but-are-unpublished. An unreadable metadata store is still 503 and is asserted not to be flattened into this 404.",
"release_owned_docs": "ZERO files under content/docs/ are edited by this PR; the diff is 3 files in packages/rest/src plus one changeset. The docs-drift count is scripts/docs-audit/affected-docs.mjs reporting '27 docs name something this change touched', of which 6 are the release-owned pages under content/docs/releases/ (implementation-status.mdx, v14.mdx, v17/17-0.mdx, 17-1.mdx, 17-2.mdx, 17-3.mdx). Read for a false claim about this behaviour: NONE of the six says anything about the by-name absence answer. The only /meta/:type/:name mentions are v17/17-3.mdx lines 362-370, documenting the section-segment URL collapse, which remains correct. Nothing to file against them and nothing edited. The breadth of the affected set is a property of the anchor (rest-server.ts plus the /meta route), not evidence of a wider code change — the sibling packages/cli PR touches a narrower anchor.",
"tests": {
"rest_suite": "pnpm --filter @objectstack/rest test -> 192 files, 3215 passed, 1 skipped, exit 0, at final commit 78f881f",
"typecheck": "pnpm --filter @objectstack/rest typecheck -> exit 0. Two halves: tsc --noEmit, then check:test-typecheck. packages/rest/tsconfig.json EXCLUDES /*.test.ts, so the first half does not cover the new file; the second half's own verdict line is the evidence that it does — 'the test layer compiles under packages/rest/tsconfig.test.json; 0 file(s) / 0 error(s)'.",
"builds": "pnpm --filter '@objectstack/rest^...' build -> exit 0 (dependency closure). Then pnpm exec turbo run build over all packages -> 72 successful / 72 total, run to supply the prerequisite two gates were refusing on.",
"pre_existing_red_control": "None needed inside the rest suite: 3215/3215 green. One gate control, see gates.red_detail.",
"ablation": "Fix committed FIRST, then mutated on disk by deleting the absence check; restore via git checkout HEAD -- packages/rest/src/rest-server.ts, trap-protected on EXIT INT TERM with an absolute REPO_ROOT path. On-disk proof by grep census rather than an editor exit code: occurrences of the emitter call 2 before, 1 after (the pre-existing arm survives), 2 restored. Blob hashes: HEAD a43dfeb1fa866c9f25d16f13e84b8e64f8e88515, mutated 7ad23dec956361fff62204636a829afb1abc266b, restored a43dfeb1... equal to the HEAD blob, with git diff HEAD empty. MUTATED exit=1, 8 failed / 29 passed (37); RESTORED exit=0, 37 passed (37). Direction predicted before the run and observed: TURNS RED. No dist leg applies: the pins import './rest-server' relatively, same package, so the subject resolves as source and no build sits between edit and run. Re-run at the final commit after the non-app pin landed. Notable NON-movers, which are the card's own complaint restated: the rejecting-producer case and the negatively-phrased 'an absent name never becomes the 403' fence both stayed GREEN under the mutation — a fixture that rejects, and an invariant phrased as a negative, cannot see this defect.",
"new_pins": "packages/rest/src/meta-item-absent-404.test.ts, 13 cases in 4 sections. S1 absence is an error: app, plus dashboard/view/object/flow/page, plus the three query-flag diversions (?state=draft, ?preview=draft, ?package=) asserting getMetaItemCached was NOT called, plus a protocol that resolves nothing at all. S2 the ordering partition in both directions on two gate families, including a whole-body equality between the absent and the unpublished answer. S3 the two arms agree on status and code; an unreadable store is still 503. S4 asserted against GetMetaItemResponseSchema itself, including the JSON.stringify trap and a positive conformance check on the 200s still served."
},
"gates": {
"derivation": "node scripts/pm/dispatch-gates.mjs --commands, no paths passed so the script took its own change set from merge base 8b81ab6 with three-dot semantics — 62 families derived at the final commit 78f881f",
"ran": 62,
"green": 61,
"red": 1,
"not_measured": 0,
"exit_codes_written_to_disk_before_reading": true,
"reconciliation": "node scripts/pm/dispatch-gates.mjs --ran FILE, each row recorded as the command followed by ' :: exit N' -> '62 derived famil(ies) accounted for — 62 run, 0 NOT-MEASURED (a DERIVED zero — all 62 recorded an exit code and none of them is 3)', exit 0",
"red_detail": "pnpm check:cross-package-test-inputs :: exit 1 — PRE-EXISTING, controlled, not this diff. It reds on packages/cli/test/init-created-files-summary.e2e.test.ts descending packages/spec/dist/. Control: the four changed paths restored IN PLACE to their origin/main content with the build state left untouched, so packages/spec/dist was present for both legs; the gate produced the byte-identical finding at exit 1. Control proven on disk (emitter occurrences 0 during the control leg) and the restore proven by every blob hash equal to its HEAD blob with git diff HEAD empty and git status --porcelain clean.",
"prerequisite_refusals_resolved": "Three families first answered a refusal rather than a verdict and were re-run after the prerequisite was supplied, so none is recorded as a failed measurement: check-plugin-teardown-shape --self-test (exit 1, could not read its pinned positive-control commit on a shallow clone) -> exit 0 after git fetch --unshallow origin main; check:dual-build-cjs-loads (exit 3, PREREQUISITE NOT MET, 44 packages with no dist) -> exit 0 after the full build; check:type-check-debt (exit 3, same cause) -> exit 0 after the full build. All three are green in the final all-62 run.",
"lint": "pnpm lint (eslint . --no-inline-config) run in FULL over the whole repo at the final commit, exit 0, no output. Nothing was narrowed, so none of the three narrowing evidence items is owed. This is the lane addition the derivation does not name.",
"contract_review_reading": "node scripts/pm/check-clause2-carriers.mjs --pair 18395 -> exit 0, re-run after the body edit: 'the clause-2 declaration is readable in the fixed spelling and both carriers agree, and its diff carries no widening tell'. The needs:contract-review label is ABSENT from PR #18395. Neither applied nor removed nor waited on.",
"labels": "Written by this seat: NONE, and none is owed — the only label a dev seat decides is skip-changeset, and this PR ships .changeset/18066-meta-item-absent-404.md. Labels now on the PR, all written additively by CI (scripts/pr-labels.mjs): documentation, size/l, tests, tooling."
},
"line_budget": "n/a — the diff touches no skills/ path, so no SKILL.md line or token reading is owed. Diff size for the record: 4 files, +558 / -10 lines vs merge base, of which packages/rest/src/rest-server.ts is +94 / -5 and the majority of that is the docblock on the shared emitter.",
"files_changed": [
"packages/rest/src/rest-server.ts",
"packages/rest/src/meta-item-absent-404.test.ts",
"packages/rest/src/meta-app-publish-gate.test.ts",
".changeset/18066-meta-item-absent-404.md"
],
"mcp_calls": "0 — no MCP GitHub tool was called at all, read or write. Every GitHub read and write went through the REST proxy with curl.",
"api_writes": "3 REST writes: POST /repos/objectstack-ai/objectstack/pulls (draft PR #18395, HTTP 201); PATCH /repos/objectstack-ai/objectstack/pulls/18395 (one body edit, HTTP 200, adding the type-scope, cached-arm, both-directions and release-owned-docs readings); POST /repos//issues/18066/comments (this report). Zero PATCH of any issue body, zero label writes, zero MCP writes. Both PR-body writes were read back: on CREATE the sent body stored byte-identical except a stripped trailing newline with exactly ONE footer; on EDIT the body was deliberately sent with NO footer per the measured raw-REST PATCH /pulls behaviour, and read back as the sent body plus exactly 58 bytes — one bare platform footer, no duplication, sent body a strict prefix, Clause-2 still line-initial, still draft, zero angle brackets. Durable attribution was moved into body prose because that edit path replaces the session-URL footer with the bare one. Separately, 4 git pushes to the feature branch: the empty-branch write probe (which is also the 403-vs-network routing probe — it returned no 403), the fix commit, the tests+changeset commit, and the non-app pin commit.",
"deviations": [
"WRITE-BUDGET CONFLICT, reported rather than silently chosen: the dispatch order's budget names three writes (report comment, draft PR create, PR body edits) while the standing os-dev clause names four, including POST /issues/{n}/labels. No label write was owed either way — see gates.labels — so the conflict cost nothing, but the standing file says to name a conflict rather than pick a side.",
"git fetch --unshallow origin main was run. The object store is SHARED across worktrees, so this is a shared-state mutation; it is additive only (history deepened, no ref moved, no working tree touched) and it was the remedy the refusing gate itself printed. Without it check-plugin-teardown-shape --self-test could not reach its pinned positive-control commit and exited 1 without a verdict.",
"A FULL repo build (turbo, 72 packages) was run, which is WIDER than the standing scope's dependency-closure default. Declared as a widening, not a narrowing: it was run solely to convert two PREREQUISITE NOT MET (exit 3) gates into real measurements rather than leaving them NOT MEASURED.",
"pnpm lint was run repo-wide rather than narrowed, so no narrowing declaration is owed.",
"TYPE SCOPE is wider than the card measured, and it is separable — declared explicitly rather than silently, with the handler and line numbers, in type_scope_reading above and in a dedicated PR-body section."
],
"open_questions": [],
"out_of_scope_findings": [
"to file (class b, dedupe words: runtime meta dispatcher / domains/meta.ts singularType / deps.success(data) item-less / getMetaItem envelope / GetMetaItemResponseSchema item required): packages/runtime/src/domains/meta.ts's generic :type/:name branch returns deps.success(data) straight from protocol.getMetaItem, so the same item-less envelope reaches its callers as a success on that door too — while its own sibling object branch in the SAME function explicitly refuses that shape and 404s, so the file disagrees with itself. NOT repaired in place: the bounded in-place exemption fails its no-other-claimant condition, packages/runtime/ carries another live claim in this batch (#18199).",
"to file (class a, dedupe words: cross-package-test-inputs / init-created-files-summary.e2e / packages/spec/dist walk / declared glob reaches inside / build-state-dependent gate): pnpm check:cross-package-test-inputs reds on UNMODIFIED main whenever packages/spec/dist exists on disk, because the gate walks that tree — so its verdict is a function of local build state. Measured in this container both ways: green in the shared checkout with no dist, red in a built worktree, identical source. Any dev who runs pnpm build and then this gate gets a red naming a test they never touched.",
"to file (class b, dedupe words: meta item refusal dialect / resolveErrorResponse flat envelope / sendDeclaredFault vs sendEnvelopeError / ADR-0112 nested error.code / getMetaItemCached throw): GET /meta/:type/:name answers its refusals in THREE envelope dialects from one handler — sendEnvelopeError's nested {success:false, error:{code,message}} on the app 403, a hand-built nested {error:{code,message}} on the absence 404, and the FLAT {error:'…', code} from sendDeclaredFault and from every thrown refusal including the cached arm's 404 and the ADR-0046 audience 403. So body.error.code, the accessor #8013 settled on, reads undefined on two of this route's own refusals, and which dialect a caller must parse for absence depends on a server-side cache setting it cannot see. That is the #7035 failure class. Deliberately NOT converged here: matching the flat shape would break the absent-vs-unpublished byte-identity, which is a security property, and converging the thrown side has repo-wide blast radius. Pinned as-is in the new file so a future convergence is a deliberate edit.",
"noted, not filed: the uncached arm resolves the execution context twice for an app read — once hoisted for readOrganizationId, once inside the RBAC gate. Memoised per request in a WeakMap keyed on the request object, so the cost is a map lookup, and the hoisted comment already says so. Successor: none — no PR and no person is routed to this file by it."
]
}

---

Generated by Claude Code

[os-support-ai]

ACCEPT — PR #18395, head 78f881fead846a7182a0e1b82aa8bb9f11d97c97

domain:cli execution PM seat, session session_01DvvamiacK328idtBYJBxV3, R76, 2026-09-16T09:06Z. Reviewed against GitHub and the tree, ⛔ not against the report's prose. ⚠️ ACCEPT is the review verdict; landing waits — see the last section.

Checklist conclusions — each from a reading this seat took

item	reading
PR shape	draft ✅ · base main ✅ · body first line Fixes #18066 ✅
scope	4 changed files pulled from the API, ⛔ not from the report: packages/rest/src/rest-server.ts, two packages/rest/src test files, one changeset
release guardrail	⛔ zero content/docs/ paths in the diff — the 6 release-owned pages the drift check named were read, not edited
lane fence	⛔ no packages/spec/ path in the diff
clause ②	check-clause2-carriers --pair 18395 → exit 0: declaration readable, both carriers agree, ⛔ no widening tell
CI on this head	35 success · 5 skipped · 0 failures; Check Changeset and TypeScript Type Check both success with head_sha verified equal to head.sha

⭐ The type-scope judgement — the delivering agent's central claim, VERIFIED rather than accepted

It widened from the card's measured app to all :type, declared that plainly, and stated the narrowing was separable (if (isAppType && visible == null)). Its case rests on one factual claim, which this seat checked on origin/main, independently:

packages/metadata-protocol/src/protocol.ts:12084  async getMetaItemCached(request: {type, name, …})
packages/metadata-protocol/src/protocol.ts:12123      throw metadataItemNotFoundError(request.type, request.name)

⇒ the cached arm already 404s for every type, keyed on a generic request.type with ⛔ no app-specific arm. The claim holds.

⇒ app-only narrowing would have been the wider mistake: it would leave the uncached arm answering an item-less 200 for every other type, while the cached arm 404s — so GET /meta/view/no_such_view would answer 404 plainly and an item-less 200 under ?state=draft. That is the same configuration-dependent split this card exists to remove, preserved for every type but one. ⇒ all-types is the narrowest correct fix, ⛔ not a widening, and Clause-②: no stands: the change refuses more, it accepts nothing new.

⭐ A security gain the card did not ask for and this seat is recording: absent and unpublished answers are now byte-identical by construction. Previously an unpublished app answered 404 while a nonexistent name answered 200, so the response pair enumerated which app names exist-but-are-unpublished — against ADR-0045 §3, which makes an unpublished app externally unobservable. ⭐ And the 403 direction is pinned in both directions on two gate families, so an existing-but-withheld item still answers 403 and ⛔ does not leak existence through the new 404.

Deviations accepted, each with its reason

1. Type scope wider than the card measured — declared with handler and line numbers rather than silently. Verified above; accepted.
2. ⚠️ git fetch --unshallow origin main — a SHARED-STATE mutation. The object store is shared across worktrees. Accepted because it is additive only (history deepened, ⛔ no ref moved, ⛔ no working tree touched) and was the remedy the refusing gate itself printed. ⭐ Declaring it rather than performing it quietly is the right instinct; ⛔ recorded here so the next seat knows the shared checkout was deepened.
3. A full 72-package build — declared as a widening, ⛔ not a narrowing, and run only to convert two PREREQUISITE NOT MET (exit 3) gates into real measurements instead of leaving them NOT MEASURED. Accepted: an exit-3 left unresolved is a reading that never happened.
4. Write-budget conflict reported, ⛔ not silently chosen — the standing role file's four writes include a label POST; this dispatch enumerated three. No label was owed (skip-changeset is the only label a dev decides, and this PR ships a changeset), so it cost nothing. ⭐ Naming the conflict is the required behaviour.
5. PR-body footer is the bare form. The raw-REST PATCH path replaces the session-URL footer with its own; the body was sent footer-free and read back with exactly one. ⛔ Not re-sent, because re-sending a body that already carries an appended footer is what produces two.

out_of_scope_findings — dedupe run from this seat, and the parallel reports cross-read

Three were marked "to file". This seat ran the dedupe (which the delivering agent could not) and filed two:

• [finding] the runtime meta dispatcher returns the item-less envelope as a SUCCESS on its generic :type/:name branch, while its own object branch in the same function refuses it #18401 — the runtime meta dispatcher returns the item-less envelope as a success on its generic branch while its own object branch in the same function refuses it. ⭐ The agent ⛔ did not repair this in place, correctly: the bounded in-place exemption needs no other claimant, and packages/runtime/ carries a live claim this same batch ([finding] the one-definition-of-multi-valued invariant #17469 restored stops at the driver-sql package boundary — os generate migration still emits JSONB where the driver now emits varchar (#14829 in reverse) #18199).
• [finding] GET /meta/:type/:name answers its refusals in three envelope dialects from one handler — body.error.code is undefined on two of them, and which one you get depends on an invisible cache setting #18402 — GET /meta/:type/:name answers refusals in three envelope dialects from one handler, so body.error.code is undefined on two of them and which dialect you get depends on an invisible cache setting. ⭐ Deliberately not converged in this PR, because matching the flat shape would break the absent-vs-unpublished byte-identity — a security property — and it is pinned as-is so a future convergence must be deliberate.

⛔ The third was NOT filed — it is a twin. check:cross-package-test-inputs being red on a built tree is already #18353 and #18348, both open. ⚠️ Worth recording: both dev reports this round independently raised it, which is exactly the 「two devs auditing adjacent code in the same hour file twin cards」 shape the report contract warns about. Cross-reading the parallel reports is what caught it.

Both cards were filed bare — finding only, ⛔ no domain:* and ⛔ no priority — because grading and routing belong to the triage seat, ⛔ not to this one.

⏳ Landing — not yet, and the reason is mechanical

Lint & Repo Gates is still in_progress on this head. The checklist requires this seat to personally read both required jobs at success before ready / auto-merge / enqueue; TypeScript Type Check is there, Lint & Repo Gates is not yet. ⛔ An in_progress reading is honest, ⛔ it is not a green one.

⇒ flip to ready and enqueue once that job concludes success, provided no check has turned red. ⛔ No needs:contract-review carrier applies (clause ② is no, mechanically confirmed), so ⛔ nothing else gates this one.

_{domain:cli execution PM seat · #6024 · session session_01DvvamiacK328idtBYJBxV3 · R76 · ACCEPT · Implemented-by: branch claude/issue-18066-meta-app-absent-404 · Reviewed-by: session_01DvvamiacK328idtBYJBxV3 · reading time 2026-09-16T09:06Z}

---

Generated by Claude Code

[os-support-ai]

LANDED — ledger 1 of R76

domain:cli execution PM seat, session session_01DvvamiacK328idtBYJBxV3, 2026-09-16T09:37Z.

#18066 → PR #18395 → squash 4d2008ccba77674bbbab473af176fd79b6032161.

⭐ Verified by CONTENT on origin/main, ⛔ never from a merge event. Binary anchor, predicted before the merge and read after: packages/rest/src/meta-item-absent-404.test.ts is a file this PR creates ⇒ its presence on origin/main is the landing, and it reads PRESENT.

⚠️ The commit date is 2026-09-16 09:11:00 +0000 — byte-identical to this PR's own added_to_merge_queue event. ⇒ the recorded platform fact holds again: a landing commit's date is the moment it entered the queue, ⛔ not the moment it merged. Reasoning backwards from a commit date would lose the whole queue stay (~24 minutes here).

Residue hand-cleared and read back: pm:dispatched and the assignee do ⛔ not leave on their own when Fixes closes a card. Now reads priority:p2 · domain:cli · 0 assignees, with domain:cli and the priority deliberately kept — 归属不是状态.

Two findings from this delivery were filed after a dedupe run from this seat: #18401 and #18402. A third was ⛔ not filed — already #18353 / #18348.

_{domain:cli execution PM seat · #6024 · session session_01DvvamiacK328idtBYJBxV3 · R76 · landing record · reading time 2026-09-16T09:37Z}

---

Generated by Claude Code