diff-verb-skips-the-canonical-fold: `diffMetaItem` answers an EMPTY diff for a manifest-absent type addressed with a plural

[hotlong]

Measured while implementing #8819 (not fixed there — out of that card's declared region, which is rollbackMetaItem :15427–:15587).

What was measured

#8769 routed publishMetaItem through canonicalizeMetaRequestType (the seventh /meta entry point); #8819 routed rollbackMetaItem (the eighth). diffMetaItem is a ninth entry point on the same URL family and does not funnel through it either — after #8819 lands it is the last straggler I can find on this family.

Measured on the #8819 branch at merge with origin/main 20067c56b:

• packages/metadata-protocol/src/protocol.ts — async diffMetaItem(request: { type, name, fromVersion?, toVersion?, organizationId? }), no canonicalizeMetaRequestType call in its body.
• Its first statement is const singularType = PLURAL_TO_SINGULAR[request.type] ?? request.type; — the MANIFEST-COLLECTION map, i.e. the exact lookup meta-plural-url-bypass: PUT /meta/fields/<name> walks around the whole two-tier registry gate — 4 registry types have no entry in PLURAL_TO_SINGULAR #7894 replaced at the boundary.
• The history read runs under that key: engineAny.find('sys_metadata_history', { where: { organization_id: orgId, type: singularType, name: request.name } }).
• The response echoes the caller's spelling back: return { type: request.type, ... }.

Reachable from the wire: GET /api/v1/meta/:type/:name/diff is a registered route with a caller-supplied :type (packages/rest/src/rest-route-ledger.ts:184, handler at packages/rest/src/rest-server.ts:6587).

The consequence, stated at its real width

For the four manifest-absent types — field, seed, external_catalog, translation, legitimately absent from PLURAL_TO_SINGULAR because they are not stack collections — the plural spelling stays plural all the way into the history query, which then matches no row. The endpoint answers a well-formed empty diff (added: [], removed: [], changed: []) rather than the real diff or a refusal. That is a silent "nothing changed" for an item that does have history, on a routed live endpoint, and the echoed type names a spelling the read did not actually use.

For manifest-present types (view and friends) the manifest map folds and the diff resolves correctly, so this is narrower than #8819's window.

Two smaller limbs, same cause:

• the meta-plural-url-bypass: PUT /meta/fields/<name> walks around the whole two-tier registry gate — 4 registry types have no entry in PLURAL_TO_SINGULAR #7894 boundary refusal never runs here, so an unrecognised spelling of a declared type is forwarded rather than refused 400 INVALID_REQUEST;
• the surrounding try { … } catch { /* history table unavailable */ } swallows a genuine outage into the same empty-diff answer, so "no rows because the type key is wrong" and "no rows because the store is down" are indistinguishable to a caller. (The catch is deliberate and documented by [finding] diffMetaItem awaits a full historyMetaItem read and discards it — a dead round trip on every live diff request #8798 — noted only because it is what makes the wrong key silent rather than loud.)

Not the #8819 class

diffMetaItem is read-only: it takes no lock and performs no write, so there is no ADR-0010 gate to address around here and none of #8819's severity carries over. This is a wrong-answer defect, not a protection bypass. Filed separately rather than as a rider for that reason, and because the fix wants its own look at whether the echoed type should report the canonical spelling (which would change a response field consumers may read).

Backlink: #8819 · #8769 · the boundary fold's rationale is #7894.

---

Generated by Claude Code

[os-project-manager]

Triage: lands in packages/metadata-protocol/src/protocol.ts (diffMetaItem) ⇒ domain:metadata, pm:queue, type Bug — a routed live endpoint answers a well-formed empty diff for an item that has history, and the #7894 boundary refusal never runs on this ninth entry point.

Fix direction is inherited from the family rulings, not open: route through canonicalizeMetaRequestType the way #8769 (publishMetaItem) and #8819 (rollbackMetaItem) did — fold at the boundary, refuse unrecognised spellings 400 INVALID_REQUEST. One genuine sub-question the card names: whether the echoed type should report the canonical spelling (a response-field change consumers may read). Follow the precedent the #8769/#8819 implementations set for their echoes; if they disagree with each other, stop and escalate rather than minting a third answer.

⚠️ Serial constraint: protocol.ts is hot — #8819 is in flight in this file and #8858 is queued against it. Sequence behind #8819; do not dispatch concurrently with another protocol.ts card.

Size/model suggestion: S–M, opus.

---

Generated by Claude Code

[hotlong]

Claim: PM loop — dispatched FOLDED with #8833 as one diffMetaItem PR
Session: session_01XeQRiAa7vYRVX5Fog7Zby8
Branch: claude/issue-8868-diff-verb-fold-and-503
Worktree: objectstack-issue-8868
Domain: domain:metadata
File surface: packages/metadata-protocol/src/protocol.ts — REGION diffMetaItem ONLY (:15911 → end of method, on origin/main @ 8664a2c99), plus its pin files (stop on breach; explain in the report)
Container & model: S–M, mode:subagent, model: opus
Serial constraints cleared: see below — the constraint both triage notes name is discharged, and two siblings run alongside under region declaration

The fold, and whose instruction it is

The maintainer's ruling on #8833 (5302933802, 15:34Z) names it directly:

the metadata seat may sensibly dispatch #8868 + this card as one diffMetaItem PR (fold + 503) with both cards on Part of/Fixes as appropriate — one dispatch, one review, same function.

Taking that option. Both cards land in the same method; two dispatches would have been two agents in one region, which is the collision the serial constraint exists to prevent. One PR closes both.

⚠️ Stale premise in both triage notes, corrected before dispatch rather than inherited

This card's triage note (15:11Z) and #8858's (15:11Z) both say "#8819 is in flight in this file — sequence behind #8819", and the maintainer's 15:34Z ruling repeats it.

Measured: #8819 closed completed 2026-08-15T12:53:19Z via merged PR #8870 — roughly two hours before the earliest of those notes was written. The serial constraint is already discharged; nothing is waiting on it. The notes were written against a state that had already changed, which is exactly the decay this repo keeps paying for, so I am recording the correction rather than sequencing behind a card that is closed.

Sibling dispatches in the same file — declared, not hidden

Under the maintainer's standing region-declaration exemption (the alternative discipline for protocol.ts, whose four clauses I am applying): two siblings are dispatched concurrently in this file, with regions named from the tree at dispatch time on origin/main @ 8664a2c99 (17,148 lines):

card	region	anchor
this + #8833	diffMetaItem	:15911 → end of method
#8855	getMetaDiagnostics	:4696 → :4819
#8858	publishPackageDrafts	:13570 → end of method

The regions are disjoint by thousands of lines. ⛔ Breach the declared region and stop and report rather than widening. Merge main before opening the PR, and again after a sibling lands; the merge queue arbitrates.

⚠️ Note #8855's region ends at :4819, where rethrowUnlessMetadataStoreUnprovisioned is declared. This card's fix does not touch that helper — if yours needs to modify it (rather than call it), that is a shared-producer edit outside every declared region: stop and report.

---

Generated by Claude Code

[hotlong]

{
  "issue": 8868,
  "status": "done",
  "branch": "claude/issue-8868-diff-verb-fold-and-503",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8921",
  "premise_still_valid": true,
  "summary": "Both cards implemented as one PR in diffMetaItem, kept legible as two hunks. #8868: the method now routes through canonicalizeMetaRequestType instead of PLURAL_TO_SINGULAR, so a plural of a manifest-absent type (fields) folds before the sys_metadata_history read (it previously matched no row and answered a well-formed EMPTY diff for an item that has history), the #7894 boundary refusal now runs here (viewes -> 400 INVALID_REQUEST), and the echoed type reports the canonical spelling. #8833: the empty-bodied catch now calls rethrowUnlessMetadataStoreUnprovisioned (called, NOT modified) — a genuinely-absent table keeps its benign empty answer, every other read failure propagates 503 SERVICE_UNAVAILABLE per ADR-0110 D3. Option B (historyUnavailable key) declined and absent. BOTH PREMISES RE-VERIFIED ON TODAY'S main BEFORE BUILDING: the PLURAL_TO_SINGULAR lookup was still at :15926 and the catch still empty at :15973; PLURAL_TO_SINGULAR['fields'] is undefined while ['views'] is 'view' (the asymmetry the fix turns on); and post-#8841 no historyMetaItem round trip remains, so the outage was silent for EVERY type — this adds loudness uniformly rather than preserving an existing loud case. The echoed-type sub-question was NOT escalated because #8769 and #8819 AGREE: both reassign request at the top so every downstream request.type read reports canonical, and the two folded siblings that do echo a type in their body (saveMetaItem, deleteMetaItem) both return { type: request.type } after their fold — same mechanism inherited, no third answer minted. Scope: both hunks inside the declared region (diffMetaItem :15911-:16048 @ 8664a2c99); no sibling region touched. Sanitizer self-check: BOTH card bodies read in full and intact — no '<'+letter truncation in either (the &#39;/&#34; entities in the API response are JSON encoding, not damage).",
  "tests": "All results at HEAD f9811727d (branch merged with origin/main @ 85f5e7868), quoted from `git rev-parse --short HEAD` in the same runs. NEW PIN FILE packages/metadata-protocol/src/protocol.diff-canonical-type-and-history-outage.test.ts (9 tests) + 2 re-pointed pins in protocol.diff-dead-history-read.test.ts. SUITES: `pnpm --filter @objectstack/metadata-protocol test` -> 'Test Files 103 passed (103) / Tests 1496 passed (1496)'. CONSUMPTION RADIUS (re-run at the final head, not just the edited package): `pnpm --filter @objectstack/objectql --filter @objectstack/rest test` -> objectql 'Test Files 210 passed (210) / Tests 3675 passed (3675)', rest 'Test Files 118 passed (118) / Tests 1948 passed (1948)'. `typecheck` green for all three. ABLATIONS (fix committed FIRST, restored via `git checkout <branch> -- <path>`, byte-identity confirmed by an empty `git diff HEAD` and 0 ABLATION markers; NO dist rebuild step applies — these are vitest source-level ablations importing ./index.js from src, not a dogfood/dist ablation). FOLD ABLATED: 4 red — THE PIN failed on the body with exactly the defect's signature, 'expected { type: fields, ...(6) } to match object' with '- changed: [{from: A, path: label, to: B}] / + changed: []'; echo red 'expected fields to be field'; the 400 refusal went unrefused; the #8833 arms stayed GREEN (changes independent). 503 ABLATED: the 2 new outage pins + the 2 re-pointed #8798 pins red ('expected null to be an instance of Error'), while THE CONTROL (genuinely-absent table answers benignly) stayed GREEN — that pair is what proves the discrimination is selective, not blanket. DIRECTION THAT DID NOT MATCH PREDICTION, reported not smoothed: I expected the manifest-PRESENT control (views) to stay fully green under the fold ablation and it went RED — because my first version compared whole response objects and the ECHO moves for manifest-present types too (the echo never read the manifest map). The control is now split into body arms (unchanged by the fix — its real claim) and an echo arm; re-ablated after the split, body arms green and only the echo arm red at line 255. GATES re-derived from ACTUAL changed paths via `node scripts/pm/dispatch-gates.mjs` and all run: check:changeset-gate-self-tests, check:objectui-changeset, check:cross-package-test-inputs, check:durability-log-level (66 read seams, none invents), check:filter-alias-parity, check:query-options-erasure (no files added to baseline), check:type-check-coverage, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset — all PASS. RATCHET: `pnpm check:type-check-debt --re-measure` on a BUILT workspace (full turbo build first, since metadata-protocol hides **/*.test.ts from tsc and a green typecheck carries zero information) -> '33 ledger entries re-measured, 1926 raw tsc errors total, none above its recorded number'. ADDED BEYOND the script's derived list (it derives from paths and cannot see diff-content-keyed families): check:engine-double-contract (PASS — 266 pinned; my new double copies the PINNED shape with assertEngineDeleteDispatch/assertEngineUpdateDispatch so it entered the pinned set and NO ledger row was added), check:error-code-casing, check:nul-bytes. Changeset added (.changeset/diff-meta-item-canonical-type-and-history-outage.md) — the change is user-visible, so no skip-changeset label applies.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #8922 (finding, domain:devx, unassigned, no pm:queue): TEST_DEBT for @objectstack/lint records 20 where tsc now reports 19 — the open gap gives that package's test layer one error of free headroom, which the gate itself flags as the #6376 shape; remedy is the gate's own --lower affordance, deliberately not ridden on this PR"
  ]
}

Two notes the PM should read alongside the JSON.

1. Fixture triage on pre-existing pins. protocol.diff-dead-history-read.test.ts carried two #8798 pins that asserted the swallow this PR removes — they pinned exactly the limb being deleted. They were re-pointed, not deleted: their subject was never "an outage is empty" but "one outage, one answer, not decided by the type", which both arms still pin, now against the 503. Their stub throws a generic Error, which isMissingTableError does not classify as benign, so it is a genuine outage under the new rule.

2. check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 resolved itself under me, in the safe direction. The merge with main brought 7c85bbe04 docs(scripts): record the measured decision NOT to extend the read-seam rule to catch-fallthrough (#8845). So the gate blind spot named in Zone 2 item 3 was closed as a documented decision not to extend the rule — nothing was owed by this card either way, and this fix removes the seam regardless. check:durability-log-level was re-run after that merge and is green.

---

Generated by Claude Code

[hotlong]

Supersedes my earlier report comment (5303303923) — same run, updated for the PM-authorized docblock commit 3dae00805. This is the current one.

{
  "issue": 8868,
  "status": "done",
  "branch": "claude/issue-8868-diff-verb-fold-and-503",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8921",
  "premise_still_valid": true,
  "summary": "Both cards implemented as one PR in diffMetaItem, kept legible as two hunks. #8868: the method now routes through canonicalizeMetaRequestType instead of PLURAL_TO_SINGULAR, so a plural of a manifest-absent type (fields) folds before the sys_metadata_history read (it previously matched no row and answered a well-formed EMPTY diff for an item that has history), the #7894 boundary refusal now runs here (viewes -> 400 INVALID_REQUEST), and the echoed type reports the canonical spelling. #8833: the empty-bodied catch now calls rethrowUnlessMetadataStoreUnprovisioned (called, NOT modified) — a genuinely-absent table keeps its benign empty answer, every other read failure propagates 503 SERVICE_UNAVAILABLE per ADR-0110 D3. Option B (historyUnavailable key) declined and absent. BOTH PREMISES RE-VERIFIED ON TODAY'S main BEFORE BUILDING: the PLURAL_TO_SINGULAR lookup was still at :15926 and the catch still empty at :15973; PLURAL_TO_SINGULAR['fields'] is undefined while ['views'] is 'view' (the asymmetry the fix turns on); and post-#8841 no historyMetaItem round trip remains, so the outage was silent for EVERY type — this adds loudness uniformly rather than preserving an existing loud case. The echoed-type sub-question was NOT escalated because #8769 and #8819 AGREE: both reassign request at the top so every downstream request.type read reports canonical, and the two folded siblings that do echo a type in their body (saveMetaItem, deleteMetaItem) both return { type: request.type } after their fold — same mechanism inherited, no third answer minted. SCOPE: the fix hunks are inside the declared region (diffMetaItem :15911-:16048 @ 8664a2c99); I stopped short of the docblock (:15902-:15910) because it sits outside the declared line anchor, reported that, and the PM then authorized that one widening — commit 3dae00805 adds two @throws entries stating the DISCRIMINATION (an unprovisioned history table still answers benignly), one hunk, 18 insertions, 0 deletions, no behaviour change, no other method and no content/docs touched. No sibling region touched at any point. Sanitizer self-check: BOTH card bodies read in full and intact — no '<'+letter truncation in either (the &#39;/&#34; entities in the API response are JSON encoding, not damage).",
  "tests": "FULL UNION at HEAD f9811727d (branch merged with origin/main @ 85f5e7868), quoted from `git rev-parse --short HEAD` in those runs; the later docblock commit is covered separately below. NEW PIN FILE packages/metadata-protocol/src/protocol.diff-canonical-type-and-history-outage.test.ts (9 tests) + 2 re-pointed pins in protocol.diff-dead-history-read.test.ts. SUITES: metadata-protocol 'Test Files 103 passed (103) / Tests 1496 passed (1496)'. CONSUMPTION RADIUS re-run at that same head, not just the edited package: objectql 'Test Files 210 passed (210) / Tests 3675 passed (3675)', rest 'Test Files 118 passed (118) / Tests 1948 passed (1948)'. typecheck green for all three. ABLATIONS (fix committed FIRST, restored via `git checkout <branch> -- <path>`, byte-identity confirmed by an empty `git diff HEAD` and 0 ABLATION markers; NO dist rebuild step applies — these are vitest SOURCE-level ablations importing ./index.js out of src, not a dogfood/dist ablation, so there is no built artifact that could have gone stale). FOLD ABLATED: 4 red — THE PIN failed on the body with exactly the defect's signature, 'expected { type: fields, ...(6) } to match object' with '- changed: [{from: A, path: label, to: B}] / + changed: []'; echo red 'expected fields to be field'; the 400 refusal went unrefused; the #8833 arms stayed GREEN (changes independent). 503 ABLATED: the 2 new outage pins + the 2 re-pointed #8798 pins red ('expected null to be an instance of Error'), while THE CONTROL (genuinely-absent table answers benignly) stayed GREEN — that pair is what proves the discrimination is selective, not blanket. DIRECTION THAT DID NOT MATCH PREDICTION, reported not smoothed: I expected the manifest-PRESENT control (views) to stay fully green under the fold ablation and it went RED — because my first version compared whole response objects and the ECHO moves for manifest-present types too (the echo never read the manifest map). The control is now split into body arms (unchanged by the fix — its real claim) and an echo arm; re-ablated after the split, body arms green and only the echo arm red at line 255. GATES re-derived from ACTUAL changed paths via `node scripts/pm/dispatch-gates.mjs` and all run: check:changeset-gate-self-tests, check:objectui-changeset, check:cross-package-test-inputs, check:durability-log-level (66 read seams, none invents), check:filter-alias-parity, check:query-options-erasure (no files added to baseline), check:type-check-coverage, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset — all PASS. RATCHET: `pnpm check:type-check-debt --re-measure` on a BUILT workspace (full turbo build first, since metadata-protocol hides **/*.test.ts from tsc and a green typecheck carries zero information) -> '33 ledger entries re-measured, 1926 raw tsc errors total, none above its recorded number'. ADDED BEYOND the script's derived list (it derives from paths and cannot see diff-content-keyed families): check:engine-double-contract (PASS — 266 pinned; my new double copies the PINNED shape with assertEngineDeleteDispatch/assertEngineUpdateDispatch so it entered the pinned set and NO ledger row was added), check:error-code-casing, check:nul-bytes. SECOND COMMIT 3dae00805 (docblock only): gates re-derived for that single path and re-run at the new head — check:cross-package-test-inputs, check:durability-log-level, check:filter-alias-parity, check:nul-bytes, all PASS. ⚠️ CONFLICT SURFACED RATHER THAN SILENTLY RESOLVED: my role definition says re-run the union, or at minimum the ratchet family, at the new head after any post-review push; the PM's instruction for this commit was explicitly not to re-run the full union for a comment-only change. I followed the PM and am flagging it, because the reasoning happens to hold independently — the ratchets' inputs are tsc error counts, sites in test files, and engine doubles, none of which a 18-line comment-only diff can move. Changeset added (.changeset/diff-meta-item-canonical-type-and-history-outage.md); the change is user-visible so no skip-changeset label applies.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #8922 (finding, domain:devx, unassigned, no pm:queue): TEST_DEBT for @objectstack/lint records 20 where tsc now reports 19 — the open gap gives that package's test layer one error of free headroom, which the gate itself flags as the #6376 shape; remedy is the gate's own --lower affordance, deliberately not ridden on this PR"
  ]
}

Two notes the PM should read alongside the JSON.

1. Fixture triage on pre-existing pins. protocol.diff-dead-history-read.test.ts carried two #8798 pins that asserted the swallow this PR removes — they pinned exactly the limb being deleted. They were re-pointed, not deleted: their subject was never "an outage is empty" but "one outage, one answer, not decided by the type", which both arms still pin, now against the 503. Their stub throws a generic Error, which isMissingTableError does not classify as benign, so it is a genuine outage under the new rule.

2. check-durability-degradation-log-level: the read-seam invention rule keys on return, so a catch that degrades by FALLING THROUGH into an empty accumulator is structurally invisible #8845 resolved itself under me, in the safe direction. The merge with main brought 7c85bbe04 docs(scripts): record the measured decision NOT to extend the read-seam rule to catch-fallthrough (#8845). So the gate blind spot named in Zone 2 item 3 was closed as a documented decision not to extend the rule — nothing was owed by this card either way, and this fix removes the seam regardless. check:durability-log-level was re-run after that merge and is green.

Worktree objectstack-issue-8868 removed unforced after the push; no background process left running.

---

Generated by Claude Code