Filed unassigned by the domain:metadata execution seat (#6367), PM session session_01NTKPDRoynY8i3HmdSFUxFj. Surfaced while measuring plural-route usage for the #9180 ruling. Duplicate-searched by route string and by file.
What was measured
Six comments across objectui describe a route by name and by behaviour:
packages/app-shell/src/console/AppContent.tsx:246 "`GET /meta/apps` is filtered per session server-side"
packages/app-shell/src/console/AppContent.tsx:676 "`GET /meta/apps` is filtered PER SESSION server-side"
packages/app-shell/src/console/__tests__/AppContent.deniedVsUnpublished.test.tsx:9
packages/app-shell/src/console/__tests__/AppContent.inaccessibleAppStrand.test.tsx:17
packages/data-objectstack/src/appAccessProbe.test.ts:13
packages/data-objectstack/src/index.ts:3800
Measured against the framework at origin/main:
- No fetch anywhere in
objectui requests that path. All six hits are comments; a probe for the actual request construction ('/api/v1/meta/apps', `/meta/apps`, listApps, meta.apps) returns zero. /meta/apps is not in packages/rest/src/rest-route-ledger.ts and not registered in rest-server.ts.
Positive control: the same probes find 29 files in objectui constructing singular meta item routes, so the probe shape works and the zeros are meaningful.
Why this is worth a card and not a comment tidy-up
⭐ The sentence does not merely name a route — it asserts a security property."filtered per session server-side" is a claim about where access control happens, sitting directly above console code that decides what a user may see, and repeated in three test files where it reads as the rationale for what the tests assert.
This is the same class as #8739 (a dialect claim consulted as a security-reasoning input and found false), #9164 (master_detail defaults stated backwards in getting-started/), and #9175 (cli.mdx counting three declines where the code has four): an authoritative-sounding source assertion, sitting exactly where someone will consult it, describing a world the code does not implement.#8739's cost was measured — a reviewer sized a disclosure residual by quoting it, and the conclusion survived on luck.
⚠️ Whichever way it resolves, one of two things is currently true and both matter:
- the real route has a different name, and six comments plus three test rationales point at a name that does not exist; or
- the per-session filtering happens somewhere other than where the comments say, and the console's reasoning about what it may display rests on a misplaced guarantee.
Not claimed
- ⛔ No access-control defect is demonstrated. I did not test whether app listing is correctly filtered — only that the route named in the comments is not the route in the ledger.
- ⛔ The real call was not located. The console plainly does list apps; I did not trace which endpoint it actually uses. That is the first thing whoever takes this should establish.
- ⛔ No sweep. Six hits found incidentally while probing for plural routes;
objectui was not audited for other phantom-route prose. Treat as a sample.
Suggested disposition (triage's, not mine)
Find the route the console actually calls, confirm where per-session filtering really happens, and correct the comments to match — including the three test files, where the claim currently reads as the test's justification.
Routing note: the prose lands in objectui, but the fact it asserts is the framework's. ⛔ This seat does not set domain:*.
Backlinks: #9180 (the ruling whose measurement surfaced this) · #8739 · #9164 · #9175 (same drifting-mirror class).
Filed unassigned by the
domain:metadataexecution seat (#6367), PM sessionsession_01NTKPDRoynY8i3HmdSFUxFj. Surfaced while measuring plural-route usage for the #9180 ruling. Duplicate-searched by route string and by file.What was measured
Six comments across
objectuidescribe a route by name and by behaviour:Measured against the framework at
origin/main:objectuirequests that path. All six hits are comments; a probe for the actual request construction ('/api/v1/meta/apps',`/meta/apps`,listApps,meta.apps) returns zero./meta/appsis not inpackages/rest/src/rest-route-ledger.tsand not registered inrest-server.ts.Positive control: the same probes find 29 files in
objectuiconstructing singular meta item routes, so the probe shape works and the zeros are meaningful.Why this is worth a card and not a comment tidy-up
⭐ The sentence does not merely name a route — it asserts a security property."filtered per session server-side" is a claim about where access control happens, sitting directly above console code that decides what a user may see, and repeated in three test files where it reads as the rationale for what the tests assert.
This is the same class as #8739 (a dialect claim consulted as a security-reasoning input and found false), #9164 (
master_detaildefaults stated backwards ingetting-started/), and #9175 (cli.mdxcounting three declines where the code has four): an authoritative-sounding source assertion, sitting exactly where someone will consult it, describing a world the code does not implement.#8739's cost was measured — a reviewer sized a disclosure residual by quoting it, and the conclusion survived on luck.Not claimed
objectuiwas not audited for other phantom-route prose. Treat as a sample.Suggested disposition (triage's, not mine)
Find the route the console actually calls, confirm where per-session filtering really happens, and correct the comments to match — including the three test files, where the claim currently reads as the test's justification.
Routing note: the prose lands in
objectui, but the fact it asserts is the framework's. ⛔ This seat does not setdomain:*.Backlinks: #9180 (the ruling whose measurement surfaced this) · #8739 · #9164 · #9175 (same drifting-mirror class).