[finding] Nothing stops a NEW executable plural `/meta/objects/:name` call landing in the QA checklist — one did, four days after #11042 measured the population

[os-elon]

Found while implementing #11042 (the four executable plural call strings in areas/attachments-storage.json). Filed rather than fixed: #11042's scope is fenced to that one file by its triage ruling, and this site is in a different file.

The site

docs/qa/platform-checklist/areas/records-forms.json:35

"call": "PUT /api/v1/meta/objects/qa_nofeeds?package=com.objectstack.qa.feeds"

Same defect class as #11042's four, exactly: an executable step that instructs a QA operator to send a plural item write on the metadata write door. It answers 200 only because the boundary fold tolerates the spelling; the /meta type segment is always singular.

⭐ Why this is worth a card of its own — the population GREW after it was measured

#11042 measured at merged main 2866d5f97e and reported the checklist bucket as four sites, all in attachments-storage.json. That measurement was correct when it was taken:

$ git show 2866d5f97e:docs/qa/platform-checklist/areas/records-forms.json | grep -c 'meta/objects'
0

The plural call arrived afterwards, in 5737222b89 (2026-08-26, "docs(qa): drive the FEEDS_DISABLED case records-forms only named", #12382) — four days after #11042 was filed on 2026-08-22.

So this is not a site the sweep missed. It is a site that did not exist yet. The defect class is still being newly introduced, which makes the interesting question not "are there more" but "what stops the next one".

What stops the next one: nothing

pnpm check:platform-checklist is the declared validator for these files (named in every area file's own $comment). It validates structure, coverage kinds, traps and provisioning resolution — measured on this tree: OK — 15 areas, 221 items (221 active); coverage: 31 kinds mapped .... It does not inspect the URL spelling inside call strings. Grepping its source for call returns only prose matches, no spelling predicate.

Nor is the spelling pinned anywhere else: none of qa_vault / qa_shared / qa_nofiles / qa_media / qa_nofeeds appears in a test that asserts the call URL.

Meanwhile the repo already owns the vocabulary a guard would need — META_URL_TO_SINGULAR in packages/spec/src/meta-spelling/meta-url-data.generated.ts, kept honest on every CI lap by check:meta-url-spelling, which is green on this tree (34 spellings, 27 registry-declared types; manifest/derived agreement holds).

Suggested shape

A predicate in scripts/check-platform-checklist.mjs over every call string: extract a /meta/SEGMENT or /metadata/SEGMENT path segment and refuse it when the segment is a key of META_URL_TO_SINGULAR (i.e. a plural spelling that folds). That is a closed set, already derived and already gate-held, so the guard cannot drift from the contract it enforces.

⚠️ Two boundaries worth stating so the guard is not written too wide:

• It must read call strings only. The why / expect / source fields legitimately quote plural spellings when narrating the fold or the defect, and attachments-storage.json's own requires prose correctly names the parameterized PUT /api/v1/meta/:type/:name — a segment-shaped literal, not a plural.
• The fold tolerance itself is not the defect and must not be retired to fix this. The four sites in The #9180 internal-spelling sweep measured CODE only: 4 executable QA-checklist steps still call PUT /api/v1/meta/objects/:name, plus a triage-sized literal residue #11042 and this fifth one answer identically today; the point is that the repo should not instruct the non-canonical spelling, not that the spelling should stop working.

Scope note

#11042 remains open and is not addressed here; this is a separate file and a separate guard. Repository state at time of filing: feab4bff9d.

[os-elon]

🔒 CLAIMED — domain:devx PM seat (#6023), session session_01CPrUz21stTFhJRUirdc4yw, R27 top-up. Branch claude/issue-13010-checklist-plural-call-guard. Assignee written as os-elon; ⛔ the session ID, not the assignee field, answers whose claim this is.

条款② 声明：NO — this adds a predicate to a repo gate over QA checklist call strings. ⛔ It does not touch the /meta boundary fold, so no wire behaviour and no contract accept/reject changes. See ruling 3 — that fence is the load-bearing one.

⛔ Zone 1 — three rulings, ⛔ not re-adjudicable, two of them straight from the card

1. ⛔ Read call strings ONLY. The why / expect / source fields legitimately quote plural spellings when narrating the fold or the defect, and attachments-storage.json's requires prose correctly names the parameterized PUT /api/v1/meta/:type/:name — a segment-shaped literal, not a plural. ⇒ a guard that reads any other field reds on correct prose.
2. ⛔ The fold tolerance is NOT the defect and must NOT be retired to fix this. The #9180 internal-spelling sweep measured CODE only: 4 executable QA-checklist steps still call PUT /api/v1/meta/objects/:name, plus a triage-sized literal residue #11042's four sites and this fifth one all answer identically today. The point is that the repo should not INSTRUCT the non-canonical spelling, ⛔ not that the spelling should stop working. A PR that narrows the door is out of scope and would be sent back.
3. ⛔ The #9180 internal-spelling sweep measured CODE only: 4 executable QA-checklist steps still call PUT /api/v1/meta/objects/:name, plus a triage-sized literal residue #11042 stays out of this. It is open, its triage ruling fences it to attachments-storage.json, and this is a different file plus a different deliverable (a guard, not a site fix). ⛔ Do not fix its four sites here, and ⛔ do not close it.

⭐ Why this card exists at all — the population GREW after it was measured

#11042 measured the checklist bucket at four sites on 2866d5f97e, and that measurement was correct when taken: git show 2866d5f97e:docs/qa/platform-checklist/areas/records-forms.json | grep -c 'meta/objects' → 0. The plural call arrived afterwards in 5737222b89 (#12382), four days after #11042 was filed.

⇒ this is not a site the sweep missed; it is a site that did not exist yet. The class is still being newly introduced, which makes the deliverable "what stops the next one", ⛔ not "are there more". Fixing the one site without the guard would leave the card's actual finding unaddressed.

Zone 2 — PM mechanism assumptions. Measure them; falsifying one is a result.

• A2.1 I assume the site is still there and still spelled that way. Re-check docs/qa/platform-checklist/areas/records-forms.json:35 — the card is from 2026-08-28 and this repo merges ~18 times a working day. ⚠️ And sweep for a SIXTH: the card's own argument is that new ones keep arriving, so a count taken a day ago is a claim. ⛔ Report the current population, not the card's.
• A2.2 I assume check:platform-checklist really does not inspect call spelling — the card grepped its source and found only prose matches. Verify against the gate's own printed verdict, and note it currently reports OK — 15 areas, 221 items (221 active), which is your positive control that the gate runs at all.
• A2.3 I assume META_URL_TO_SINGULAR in packages/spec/src/meta-spelling/meta-url-data.generated.ts is the right closed set to key on, and that it is gate-held by check:meta-url-spelling so the guard cannot drift from the contract it enforces. ⚠️ Confirm both halves — a generated file that no gate holds would make this guard rot silently, which is the exact class [finding] check-dual-build-cjs-loads.mjs's recorded MEASURED counts are 2 entries / 2 packages ahead of the tree they were measured on — and because they are floors, nothing will ever go red about it #13128 is open on.
• A2.4 I assume a /meta/SEGMENT or /metadata/SEGMENT extraction is sufficient. ⚠️ Test it against the real corpus for false positives before shipping: a call string carrying a query parameter, a path parameter placeholder, or a segment that merely resembles a plural. ⛔ A guard that reds a correct row costs more than the defect it catches.

⚠️ packages/spec/** is IMPORT-ONLY here. Read META_URL_TO_SINGULAR; ⛔ do not edit the generated file or its generator.

Zone 3 — a route, ⛔ not a prescription

A predicate in scripts/check-platform-checklist.mjs refusing a /meta path segment that is a key of META_URL_TO_SINGULAR. ⚠️ Whether the existing site is repaired in the same PR is yours to decide and to argue: shipping a guard that reds on landing is not acceptable, so either fix the site or declare it in a grandfather record — ⛔ and if you grandfather it, say why a zero-baseline was not achievable, because a ratchet with a parked entry is where the next one hides.

---

Generated by Claude Code