[sweep] Three routes serve a shape their responseSchema never declares (#5882 #5950 #6442) #6487

Sweep card (maintainer-directed, 2026-08-07; third member added 2026-08-08 after its ruling). One claim, one PR, three Fixes.

Admission criterion

A route serves a response shape that its declared responseSchema does not describe — the contract under-declares, or mis-declares, what actually goes on the wire.

Members

#5882 and #5950 land on the same handler and would serialize under the same-file rule regardless, so bundling them costs nothing. #6442 is a different handler in a different package but hits the identical criterion and takes the identical shape of fix, so it reviews as one more checklist line.

Direction

#6442 is already decided: narrow AnalyticsMetadataResponseSchema.data to the CubeMeta[] projection — zero runtime change. The recorded return path if format is ever needed is to add the key to the CubeMeta projection (additive); ⛔ do not widen the endpoint to full cube definitions (that would push sql to clients — capability expansion without pull).

#5882 / #5950 are per-member calls: either declare what is served (extend the contract, discriminated where the shapes genuinely differ) or stop serving the undeclared part. #5950's carrier has a real consumer story (optimistic concurrency), so widening the declaration is the likely answer; #5882's third shape may instead deserve its own declared variant. ⛔ Do not silently pick the cheaper one — the PR states the choice and its reason per member.

Scope discipline

• Zero changes beyond the three members. git diff --stat corresponds line-for-line to the checklist — the line between a sweep and a rider.
• Refusal/validation assertions for genuinely invalid shapes stay verbatim; a widened contract may not shrink the guarded surface.
• New assertions must bear load: assert the substance (the OCC carrier is present and typed; the layered shape parses under its own variant; /analytics/meta's response parses against the narrowed schema), never "the old assertion is gone".
• Out-of-scope findings filed separately per PD chore: version packages #10.

Landing constraints

• Touches packages/spec generated baselines ⇒ os-regen four-step序 on every sync (git merge origin/main → git checkout origin/main -- <generated> → commit the merge first, then regenerate wholesale → assert sibling entries survive). ⛔ Never a text merge; never gen:schema while in MERGE state (os-regen 驱动指示的 gen:schema 在 merge 未 commit 时运行,会把 authorable-surface 锚点倒退回旧 merge-base —— 生成器写入、门全绿、静默撤销 main 的锚点推进 #5370).
• Anchor assertion is pnpm --filter @objectstack/spec check:authorable-surface green; baseRev may lag; ⛔ never hand-edit the anchor.
• GET /analytics/meta 的已声明响应契约与实际响应不是同一个形状（data: { cubes: CubeSchema[] } vs data: CubeMeta[]） #6442 regenerates content/docs/references/api/analytics.mdx (it currently publishes the wrong shape). The hand-written data-api.mdx:393-395 already describes the array form correctly — leave it alone.

Review shape

By checklist, not diff order: one line per member — route + trigger | declared shape | actual shape | direction taken and why.

Filed unassigned. Member issues keep pm:queue but are excluded from batch selection while this card is open; all three close together when the PR merges.