Measured while implementing #10077 (step ② of the #9180 ruling, PR #10177). Filed unassigned and unqueued — this is an observation for triage, ⛔ not a claim that it should be changed.
What was measured
packages/runtime/src/domains/meta.ts:236:
if(parts.length===4&&(parts[0]==='objects'||parts[0]==='object')&&parts[2]==='state'&&(!method||method==='GET')){The legacy dispatcher's /meta if-chain accepts both spellings of the FSM state read through a hard-coded literal pair — the same shape the REST server carried until #10077 deleted its plural registration. So after that PR:
- a REST-fronted deployment refuses
/meta/objects/:name/state/:field (transport 404); - a deployment where
dispatch() fronts the request still answers it.
Why this is a finding and not a bug fixed in that PR
PR #10177 leaves the branch alone and records the asymmetry in the dispatcher ledger row's note, so the ledger is not claiming something the branch does not do.
What a triage decision would look like
Either (a) the plural arm goes, on the same reasoning that retired the REST registration — one rule, no exception — which is a new refusal on the dispatcher surface and therefore needs the maintainer, or (b) it stays as the deferred external tolerance, in which case the direction "singular is the only canonical spelling" holds internally while this surface stays deliberately wider, and that is worth being written down somewhere other than a code comment.
Part of #9180.
Measured while implementing #10077 (step ② of the #9180 ruling, PR #10177). Filed unassigned and unqueued — this is an observation for triage, ⛔ not a claim that it should be changed.
What was measured
packages/runtime/src/domains/meta.ts:236:The legacy dispatcher's
/metaif-chain accepts both spellings of the FSM state read through a hard-coded literal pair — the same shape the REST server carried until #10077 deleted its plural registration. So after that PR:/meta/objects/:name/state/:field(transport 404);dispatch()fronts the request still answers it.Why this is a finding and not a bug fixed in that PR
/meta/objects/:name/state/:fieldregistration: SDK moves to the singular twin, the collision's registration-order pin is deleted (step ② of the #9180 ruling) #10077's file surface names the REST mount plus the two ledgers. Deleting this arm too would be a second surface's new refusal, which the 2026-08-17 re-weigh (item 3) forecloses for anything beyond what step ① shipped. ⇒ Out of that card's scope by construction.META_URL_TO_SINGULARfold whose retirement the maintainer deferred. This is a literal||in an if-chain, which is what makes it a separate decision rather than a slice of the deferred one.PR #10177 leaves the branch alone and records the asymmetry in the dispatcher ledger row's
note, so the ledger is not claiming something the branch does not do.What a triage decision would look like
Either (a) the plural arm goes, on the same reasoning that retired the REST registration — one rule, no exception — which is a new refusal on the dispatcher surface and therefore needs the maintainer, or (b) it stays as the deferred external tolerance, in which case the direction "singular is the only canonical spelling" holds internally while this surface stays deliberately wider, and that is worth being written down somewhere other than a code comment.
Part of #9180.