docs(metadata-protocol): fix stale where-slot arity note in ARRAY_VALUED_QUERY_SLOTS docblock

[huangyiirene]

Fixes#8003

What

Corrects the last sentence of the where row in the ARRAY_VALUED_QUERY_SLOTS docblock (packages/metadata-protocol/src/protocol.ts, the #7321 arity survey). The first sentence (why a blanket arity refusal would reject the AST body form) is correct and load-bearing — kept unchanged.

The last sentence was wrong two ways:

1. It described isFilterAST failing as if it were the correct answer. isFilterAST failing produces malformedFilterArrayError — a 400 telling a caller whose filters were each well-formed that their filter is malformed. "Still refused" read as handled when it was not.
2. It was stale for the route it described: finding: a repeated ?filter= on GET /data/:object cannot be told from a filter AST, so it is diagnosed as a malformed filter (and, rarely, succeeds) #7390 moved arity judgement for this slot to the REST querystring ingress (packages/rest, assertFilterParamSuppliedOnce), so a repeated ?filter= on GET /data/:object no longer reaches this block at all.

It also omitted the sharper half of #7390: ?filter=status&filter=%3D&filter=open spells a valid AST and succeeds with a filter nobody expressed.

The rewritten row tells the next reader which layer owns arity for this slot (the REST querystring ingress) and names #7390, so the docblock's survey purpose — deciding whether a slot needs arity treatment — stays accurate. Per #7390's ruling, enforcement stays in packages/rest; this PR does not move or add any runtime logic to packages/metadata-protocol.

Scope

Comment text only. Zero runtime change — diff touches only the docblock above ARRAY_VALUED_QUERY_SLOTS.

Verification

• pnpm --filter '@objectstack/metadata-protocol^...' build — green (dependency closure).
• pnpm --filter '@objectstack/metadata-protocol' build — green.
• npx tsc --noEmit -p packages/metadata-protocol/tsconfig.json — 63 errors, exactly matching the package's recorded DEBT ledger entry in scripts/check-type-check-coverage.mjs (no typecheck script; package carries measured debt). None of the 63 are in protocol.ts itself — all are in test files, unrelated to this comment-only edit.
• npx eslint packages/metadata-protocol/src/protocol.ts --no-inline-config — clean, no output.
• node scripts/check-nul-bytes.mjs — OK.

No changeset: skip-changeset is applied to the issue (comment-only, releases nothing).

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 12, 2026 6:11pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol.

3 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx(via @objectstack/metadata-protocol)
• content/docs/kernel/services-checklist.mdx(via @objectstack/metadata-protocol)
• content/docs/protocol/kernel/http-protocol.mdx(via @objectstack/metadata-protocol)

⛔ 1 release-owned page(s) also reference the affected code. These are read-only:

• content/docs/releases/v9.mdx(via @objectstack/metadata-protocol)

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.