[objectstack-fleet]

Fixes #27632

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:validating-metadata.mdx 的 GET /api/v1/meta/diagnostics 一节补一句：该路由只认 type、severity、package 三个参数名，其他参数名(如 ?typ=view)回 400 INVALID_REQUEST,不再悄悄回全量扫描。
• 为什么改:fix(rest): GET /meta/diagnostics refuses an unknown query parameter name instead of answering the full sweep #27913 已让路由拒收未知参数名，文档还没写;读文档的 AI 和 CI 作者会以为拼错参数名只是被忽略。
• 风险与回滚：仅文档，一个文件、一段(+7 / -3);回滚即 revert 本 PR,不影响任何发布包。
• 先看:content/docs/deployment/validating-metadata.mdx diagnostics 一节表格下方第一段。
• 两分钟验证:git diff origin/main -- content/docs/deployment/validating-metadata.mdx,预期只见表格下方那一段改写，多出参数名拒收与先后顺序两句。
• 需要你做的：无，席位落地。

What changes

The paragraph below the GET /api/v1/meta/diagnostics query table in content/docs/deployment/validating-metadata.mdx now states the refusal PR #27913 added. Each clause is written from the code on origin/main (fece78120c, which contains #27913's merge 9cd54faae5):

• The route accepts exactly three parameter names: META_DIAGNOSTICS_PARAMS = ['type', 'severity', 'package'] in packages/rest/src/meta-collection-routes.ts. There is no wider declared set.
• Any other name (?typ=view, ?packageId=…) is refused with 400 INVALID_REQUEST, even when its value is empty. The handler asks unknownQueryParamRefusalMessage (packages/rest/src/query-allowlist.ts) and throws diagnosticsRefusal. isDiagnosticsRefusal writes it in the nested { error: { code, message } } envelope. The message names the unknown parameter and the supported set (Supported parameters: package, severity, type.). The route no longer answers the full sweep.
• The name check runs before refuseRepeatedQueryParams, so an unknown name beside a repeated known one answers INVALID_REQUEST. A repeated known parameter alone still answers VALIDATION_ERROR.

The page's existing sentence "Every refusal answers in the nested envelope" now covers the new refusal as well, because the new text sits before it.

Tests

Docs only, so there is no test to run. The route's own pins in packages/rest/src/rest-meta-diagnostics-unknown-params.test.ts (unchanged, in the [#27633] describe block) back each new clause: ?typ=view refused with the supported set in the message, ?packageId= refused, an unknown name with an empty value refused, an unknown name outranking a repeated one, and the three known names together answering 200.

Acceptance notes

• No finding filed.
• Card comment 6514340216 says the closed set is "type, severity, package, and the rest of the declared set". The code declares exactly those three, so the page names three.

Verification

Measured at head 5c6293d280 (objectstack-ai/objectstack).

Derived gate families: 43 derived, 43 run, all exit 0

• Derivation: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, exit 0, 43 commands, change set of 1 path (+7 / -3).
• Each command's exit code was written to disk before any pipe. First pass: 38 exit 0. Four gates refused with exit 3, PREREQUISITE NOT MET, because @objectstack/formula, @objectstack/lint, the spec declarations and the client SDK were not built: check:doc-formula-expressions, check:doc-security-posture, check:skill-examples and check:docs-transcript-drift. One more, check:docs, refused with exit 1 because packages/spec/json-schema was missing; that is a gitignored build artifact, not a finding.
• I built those closures under the verify lock: turbo run build for formula, lint and spec (VERDICT command-exit 0, 4/4 tasks), then the @objectstack/client-react closure (VERDICT command-exit 0, 38/38 tasks). All five gates then re-ran with exit 0.
• check:doc-authoring: exit 0 ("19837 customer-facing string(s) ... clean"). check:nul-bytes: exit 0.
• Reconciliation: dispatch-gates.mjs --repo objectstack-ai/objectstack --ran answered "43 derived famil(ies) accounted for — 43 run, 0 NOT-MEASURED (a DERIVED zero — all 43 recorded an exit code and none of them is 3)".

Not measured locally

• NOT MEASURED: CI's Build Docs and Plan Test Core shards jobs, and the type-check lanes. The derivation names no local invocation for them, so they are left to CI.

---

Generated by Claude Code

[objectstack-fleet]

domain:devx#2 · os-justin · session_01QSeKYmTYfaPbLQD4BJfomW

席位核对 — ACCEPT · domain:devx#2 · head 5c6293d280 · 2026-10-30T06:59Z

维护者速读

• 改了什么：/meta/diagnostics 查询参数表下面补了一段：这个接口只接受 type、severity、package 三个参数名，其他参数名一律回 400 INVALID_REQUEST，参数值为空也一样，报错消息会写出被拒的参数名和支持的参数集合；它会先检查参数名，再检查有没有重复传参。
• 为什么改：这是 fix(rest): GET /meta/diagnostics refuses an unknown query parameter name instead of answering the full sweep #27913（rest: GET /meta/diagnostics declares no closed query-parameter set, so a misspelled parameter name (?typ=view) answers a 200 full sweep #27633）上线后欠下的文档跟进。docs: the /meta/diagnostics query table does not say an unknown type, severity or package is refused, or that stats is keyed by the canonical type (#27514 follow-up) #27632 的另一半已经由 docs(deployment): name the /meta/diagnostics query refusals and the canonical stats key #27959 落地，这一句补完，卡片就关闭。
• 风险与回滚：只改一页文档（+7/−3），不动代码。回滚 = 还原本 PR。
• 先看：表下面那段新加的文字。
• 两分钟验证：对正在运行的服务端请求 GET /api/v1/meta/diagnostics?typ=view，应收到 400，报错消息里写着支持的是 package, severity, type。
• 需要你做的：无。席位落地。

席位意见：合入。这段话照着已合并的代码写，每句都有 #27633 的 pin 测试撑着。卡片原写「以及其余已声明的参数」，席位按代码改正：参数集合只有这三个。

Shape: draft → main, Fixes #27632. 1 file, +7/−3. Labels documentation, size/s, skip-changeset. Non-governed; the seat lands it. Report 6516693543, claim 6516244178.

Sentences checked against the code (content/docs is a prose face, checked here at ACCEPT, at origin/main containing #27913's merge 9cd54faae5):

• Closed set: META_DIAGNOSTICS_PARAMS = ['type', 'severity', 'package'] in packages/rest/src/meta-collection-routes.ts; no wider set exists.
• Refusal: unknownQueryParamRefusalMessage decides it. The route throws diagnosticsRefusal (INVALID_REQUEST, 400), and the nested { error: { code, message } } envelope comes from isDiagnosticsRefusal. The message names the parameter and the supported set.
• Empty value: an unknown name with an empty value is still refused (pinned).
• Order: the name check runs before refuseRepeatedQueryParams, so an unknown name next to a repeated known one answers INVALID_REQUEST (pinned: "an unknown name outranks a repeated known one").

Gates: on head 5c6293d280, 49 check-runs: 30 success, 19 skipped, 0 failure; mergeable_state: clean. check-expected-skips --pr 27993: OK, all 19 skips are in main's roster (exit 0). check-governed-merges --pr 27993: NOT governed, 10 changed lines. Dev's union: 43 derived, 43 run, all exit 0.

Out of scope: none. Skills-docs: n/a.

Landing: non-governed, 10 changed lines. In this act the seat readies the PR and arms auto-merge. On merge, Fixes #27632 closes the card, which is then complete: #27959 landed the #27620 half and this PR the #27913 half. The seat verifies the merged diff and posts the landing note.

---

Generated by Claude Code