`GET /meta/:type/:name/published` 404s for a runtime-published item — the route is mounted but resolves from the code/registry snapshot, not the row `publish-drafts` wrote

[baozhoutao]

Found by a retest of platform-core.metadata-authoring-roundtrip (QA run #7514) against origin/main @ b602d536, rebuilt. The fix under retest — #7526 / PR #7584, which mounted this route — is verified: the route is live and serves package-shipped items. This card is about what sits behind the mount.

Symptom

An item authored and published at runtime is served by the ordinary read and enumerated by the type listing, but /published 404s for it.

Reproduction (3×)

1. POST /api/v1/packages {id:'os_qa_rt4_pkg', name:…, version:'1.0.0'} → 201.
2. PUT /api/v1/meta/view/showcase_task.qa_rt4?package=os_qa_rt4_pkg&mode=draft with a valid ListView body → 200 state:'draft'.
3. GET /api/v1/meta/_drafts → the draft is listed.
4. POST /api/v1/packages/os_qa_rt4_pkg/publish-drafts → 200 {success:true, publishedCount:1, published:[{type:'view', name:'showcase_task.qa_rt4', version:'sha256:c9f8e037…'}]}.
5. GET /api/v1/meta/view/showcase_task.qa_rt4/published → 404 NOT_FOUND — also with ?package=os_qa_rt4_pkg and ?package=all.

Meanwhile, on the very same name:

• GET /api/v1/meta/view/showcase_task.qa_rt4 → 200 with the authored body;
• the name appears in GET /api/v1/meta/view (41 items).

Control on the same route: GET /api/v1/meta/view/showcase_task/published (a package-shipped view) → 200.

Reproduced with two different view names, one of them compound-named and container-shaped, each published with publishedCount:1.

Suspected root cause

The route (packages/runtime/src/domains/meta.ts:232-251) delegates to metadataService.getPublished(type, name) and 404s on undefined. That resolver appears to answer from the code/registry published snapshot rather than the published sys_metadata row the publish-drafts commit wrote — so precisely the runtime-authored items this round-trip is about are the ones it cannot serve.

The mount is fixed; the resolution behind it is not.

Acceptance criteria

• /published serves the body just written by publish-drafts for a runtime-authored item, matching what GET /meta/:type/:name returns immediately after publish.
• The package-shipped path keeps working (showcase_task/published → 200).
• The bogus-name 404 behaviour introduced by fix(rest,runtime): mount six ledgered-but-dead routes and gate the class that hid them (#7526) #7584 is preserved (a nonexistent name must still 404, so the route can still tell "not published" from "does not exist").

What is verified working (scoping this card)

• Three ledgered /meta routes are never mounted and die in the /meta/:type catch-all — the route audit can't see this class because it treats the ledger as ground truth for what's mounted #7526/PR fix(rest,runtime): mount six ledgered-but-dead routes and gate the class that hid them (#7526) #7584 is confirmed live under this item's contract too: /meta/view/showcase_task/published → 200, and /meta/types → 200 with the Studio-facing type registry (34 types, a payload shape distinct from GET /meta).
• Mounting the routes did not shadow neighbours: on the same names, the active read still returns the authored body, /meta/view still enumerates (41), /meta/_drafts still lists pending drafts and stops after publish, and /meta/view/showcase_task/history still returns its event list.
• The rest of the round-trip passes: draft save, _drafts listing, publish-drafts promotion with a commit id, both deny gates (422 writable_package_required on a read-only package, 403 NOT_OVERRIDABLE for object), and schema-validated refusal (422 invalid_metadata) with nothing stored.

Two authoring facts worth recording (not defects, each cost a first attempt)

• ?mode=draft is required to create a draft — a plain PUT lands as state:'active' and _drafts stays empty.
• An unknown ?package= id is silently accepted and the row lands env-wide as state:'active' — adjacent to the fix(objectql): don't stamp runtime-authored metadata into a loaded code package #2252 orphan shape this item's deny clause guards, but with an unknown rather than a read-only package.

Source

Retest of platform-core.metadata-authoring-roundtrip clause 1 at b602d536.

[hotlong]

Triage: lands in the metadata service — getPublished() resolves from the code/registry snapshot instead of the published sys_metadata row publish-drafts wrote (the route mount at packages/runtime/src/domains/meta.ts:232-251 delegates correctly and is verified fixed under #7526/PR #7584). Stays domain:metadata; queued pm:queue.

Rationale: Bug — /published contradicts the ordinary read and the type listing for the same runtime-published name, 3× repro with a green control on the package-shipped path. Acceptance criteria on the card are complete, including preserving the bogus-name 404.

Serial note for the metadata seat: in-flight cards #7893 / #8006 / #8027 sit on the same service family — check claimed file surfaces before batching. The two authoring facts recorded at the bottom (?mode=draft required; unknown ?package= silently accepted env-wide) are finding material if not already covered — the second one is adjacent to the #2252 orphan shape and may deserve its own card after grading.

---

Generated by Claude Code