@@ -0,0 +1,19 @@
+---
+'@objectstack/runtime': patch
+'@objectstack/rest': patch
+---
+
+fix(runtime)!: the runtime dispatcher's `GET /data/:object/:id` refuses a query parameter other than `select` / `expand` with `400 VALIDATION_ERROR`, as `RestServer` does, instead of dropping it and answering `200`
+
+Clause-②: yes (narrowing) — the dispatcher's by-id read refuses a query parameter it dropped before, and `@objectstack/rest` gains one export (`DATA_RECORD_READ_PARAMS`) so both hosts read one set.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling or stored shape is added, removed, renamed or re-shaped, and no exported declaration is removed or narrowed. `@objectstack/rest` gains one export, `DATA_RECORD_READ_PARAMS`, the closed set its own route already asked. What narrows is one runtime door's query accept set: a parameter the dispatcher's by-id read dropped now answers a located `400 VALIDATION_ERROR`, and the remedy is in the request a caller sends, never a rewrite of a package source or a stored row. The other categories are closed on facts: both packages publish (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
+
+**BREAKING** accept-set narrowing at one runtime dispatcher door, the by-id record read served by the `@objectstack/hono` catch-all and `dispatcher-plugin`.
+
+- **Before.** `GET /api/v1/data/:object/:id?selct=name` answered `200` with every column on the dispatcher: the branch kept `select` and `expand` and silently dropped every other name. `RestServer` refused the same request `400 VALIDATION_ERROR`, so a typo was ignored on one host and refused on the other.
+- **Now.** The dispatcher asks the route's closed set, `DATA_RECORD_READ_PARAMS`, imported from `@objectstack/rest`, the same set `RestServer` asks, and refuses any other name `400 VALIDATION_ERROR` with `RestServer`'s sentence: it names each refused parameter and lists `expand, select`. The refusal comes before the read, so it is the same answer for an existing record, a missing id and a row the caller may not read.
+- **Unchanged.** `select` and `expand` are read as before. An object the API does not expose is answered its exposure refusal first, before the query is judged: the dispatcher's `404 OBJECT_API_DISABLED` with or without the unknown name, and `RestServer` likewise asks its closed set only after `enforceApiAccess`. The other `/data` routes are not touched.
+
+**The remedy.** Send only `select` and `expand` to the by-id read. `fields` and `populate` are not synonyms on this route (#8039): spell them `select` and `expand`.
@@ -212,7 +212,7 @@ raw rows** with nothing to say the aggregation never happened.
 
 ### `GET /data/:object/:id`
 
-Get a single record by ID. Only `select` and `expand` query parameters are allowed; all other parameters are discarded.
+Get a single record by ID. Only `select` and `expand` query parameters are allowed; any other parameter is refused `400 VALIDATION_ERROR`, and the message names it and lists the two accepted ones.
 
 | Parameter | Location | Description |
 |:----------|:---------|:------------|
 
@@ -81,6 +81,11 @@ export { assertFilterParamSuppliedOnce, refuseRepeatedQueryParams, repeatedQuery
 // invitation preview) — the same reason `repeatedQueryParamMessage` travels.
 export { unknownQueryParamRefusalMessage } from './query-allowlist.js';
 
+// [#26898] The closed set of `GET /data/:object/:id` (#7606), published so the
+// runtime dispatcher's twin asks THIS set rather than a copy of it: both hosts
+// refuse a name outside it with the one sentence above.
+export { DATA_RECORD_READ_PARAMS } from './rest-server.js';
+
 // [#20193] THE per-caller read gate of one `/meta/:type/:name` document — the
 // ADR-0046 §6.7 docs audience, the app nav filter (`requiredPermissions`, the
 // ADR-0045 §3 publish gate, the docs-audience entry arm) and the ADR-0057 D10
 
@@ -20,6 +20,12 @@
  * their own readers (`declaredEnvelopeForThrow` for `@objectstack/hono`'s
  * catch-all, `resolveThrownHttpError` for `dispatcher-plugin`), ⛔ not
  * restated — the rig of `data-empty-projection-count.test.ts`.
+ *
+ * [#26898] …and an unknown query parameter is one answer too. Measured on the
+ * base (`57820085fa`): `RestServer` refused `?nope=1` `400 VALIDATION_ERROR`
+ * through the route's closed set (#7606, `DATA_RECORD_READ_PARAMS`), the
+ * dispatcher dropped it and answered `200` with the full record. Both now ask
+ * that one set and answer the same status, code and sentence.
  */
 
 import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
@@ -36,6 +42,9 @@ import { installDefaultOrganization } from '../default-organization.testkit.js';
 
 const PREFIX = '/api/v1';
 const OBJECT = 'by_id_parity_26816';
+// [#26898] An object the API does not expose, for the closed set's place in
+// the gate order: after the exposure gate, on both hosts.
+const UNEXPOSED = 'by_id_parity_26898_unexposed';
 const ME = 'usr_26816_member';
 const OTHER = 'usr_26816_other';
 const SYS_CTX = { isSystem: true, userId: 'usr_system' };
@@ -72,7 +81,16 @@ const CASES: ReadonlyArray<readonly [string, string, Record<string, string>, Omi
     ['CONTROL hidden row', HIDDEN, {}, { status: 404, code: 'RECORD_NOT_FOUND' }],
     ['CONTROL hidden row ?select=title', HIDDEN, { select: 'title' }, { status: 404, code: 'RECORD_NOT_FOUND' }],
     ['CONTROL own record ?select=title', MINE, { select: 'title' }, { status: 200 }],
+    ['CONTROL own record ?expand=parent', MINE, { expand: 'parent' }, { status: 200 }],
     ['CONTROL own record', MINE, {}, { status: 200 }],
+    // [#26898] The route's closed parameter set (#7606), asked by both hosts:
+    // a name outside it is refused before the read, whichever id it names.
+    ['own record ?nope=1 (the card)', MINE, { nope: '1' }, { status: 400, code: 'VALIDATION_ERROR' }],
+    ['own record ?select=title&nope=1', MINE, { select: 'title', nope: '1' }, { status: 400, code: 'VALIDATION_ERROR' }],
+    ['own record ?fields=title (the #8039 alias)', MINE, { fields: 'title' }, { status: 400, code: 'VALIDATION_ERROR' }],
+    ['own record ?nope=1&selct=title', MINE, { nope: '1', selct: 'title' }, { status: 400, code: 'VALIDATION_ERROR' }],
+    ['hidden row ?nope=1', HIDDEN, { nope: '1' }, { status: 400, code: 'VALIDATION_ERROR' }],
+    ['missing id ?nope=1', NOWHERE, { nope: '1' }, { status: 400, code: 'VALIDATION_ERROR' }],
 ];
 
 function createMockServer() {
@@ -92,8 +110,8 @@ function makeRes() {
 
 describe('[#26816] GET /data/:object/:id — RestServer and the dispatcher give one answer', () => {
     let engine: ObjectQL;
-    let rest: (id: string, query: Record<string, string>) => Promise<Answer>;
-    let dispatched: (id: string, query: Record<string, string>) => Promise<Answer>;
+    let rest: (id: string, query: Record<string, string>, object?: string) => Promise<Answer>;
+    let dispatched: (id: string, query: Record<string, string>, object?: string) => Promise<Answer>;
 
     beforeAll(async () => {
         engine = new ObjectQL();
@@ -116,8 +134,17 @@ describe('[#26816] GET /data/:object/:id — RestServer and the dispatcher give
                     fields: {
                         title: { name: 'title', type: 'text' },
                         owner: { name: 'owner', type: 'text' },
+                        // A lookup, so `?expand=` has a relation to accept.
+                        parent: { name: 'parent', type: 'lookup', reference: OBJECT },
                     },
                 },
+                {
+                    name: UNEXPOSED,
+                    label: 'Hidden ledger',
+                    sharingModel: 'public_read_write',
+                    enable: { apiEnabled: false },
+                    fields: { title: { name: 'title', type: 'text' } },
+                },
             ],
         } as never);
         await engine.syncSchemas();
@@ -156,10 +183,16 @@ describe('[#26816] GET /data/:object/:id — RestServer and the dispatcher give
         server.registerRoutes();
         const route = server.getRoutes().find((r: any) => r.method === 'GET' && r.path === '/api/v1/data/:object/:id');
         expect(route).toBeDefined();
-        rest = async (id, query) => {
+        rest = async (id, query, object = OBJECT) => {
             const res = makeRes();
-            await route!.handler({ params: { object: OBJECT, id }, query, headers: {} } as any, res);
+            await route!.handler({ params: { object, id }, query, headers: {} } as any, res);
             const body = res._json;
+            // [#26898] The closed-set gate writes the nested `{ error: { code,
+            // message } }` body (`refuseUnknownQueryParams`); every other
+            // refusal here is `mapDataError`'s flat one.
+            if (body?.error && typeof body.error === 'object') {
+                return { status: res._status ?? 200, code: body.error.code, message: body.error.message };
+            }
             return { status: res._status ?? 200, code: body?.code, field: body?.field, message: body?.error };
         };
 
@@ -170,8 +203,8 @@ describe('[#26816] GET /data/:object/:id — RestServer and the dispatcher give
         const kernel: any = { context: { getService: get }, getService: get, getServiceAsync: async (n: string) => get(n) };
         const dispatcher = new HttpDispatcher(kernel);
         (dispatcher as any).timedResolveExecutionContext = async () => ({ ...MEMBER_CTX });
-        dispatched = async (id, query) => {
-            const path = `/data/${OBJECT}/${id}`;
+        dispatched = async (id, query, object = OBJECT) => {
+            const path = `/data/${object}/${id}`;
             const raw = new Request(`http://localhost${PREFIX}${path}`, { method: 'GET' });
             let returned: any;
             try {
@@ -212,4 +245,19 @@ describe('[#26816] GET /data/:object/:id — RestServer and the dispatcher give
         // One refusal, one sentence: the same text whichever host carried it.
         expect(restMessage, 'the refusal sentence').toBe(dispatcherMessage);
     });
+
+    // [#26898] Which parameters a route understands is information: a caller
+    // the object refuses is answered that refusal, never a verdict on its
+    // query. `RestServer` asks the closed set after `enforceApiAccess`
+    // (`crud-routes.ts`); the dispatcher now asks it after the same exposure
+    // gate. Pinned on the dispatcher alone: this rig's `RestServer` has no
+    // metadata store to read the declaration from, so its exposure gate falls
+    // open here (`loadObjectItem` answers nothing) and it would not be
+    // measuring the gate order at all.
+    it('the dispatcher: an unexposed object ?nope=1 answers the exposure refusal, not the closed set', async () => {
+        const withUnknown = await dispatched(MINE, { nope: '1' }, UNEXPOSED);
+        const without = await dispatched(MINE, {}, UNEXPOSED);
+        expect(withUnknown).toEqual({ status: 404, code: 'OBJECT_API_DISABLED', field: undefined, message: without.message });
+        expect(without.code).toBe('OBJECT_API_DISABLED');
+    });
 });
@@ -33,7 +33,12 @@ import type { DomainHandlerDeps, DomainRoute } from '../domain-handler-registry.
 // `RestServer`'s list asks, imported rather than restated.
 // [#23265] …and the repo's one sentence for a repeated single-valued
 // parameter, which the delete's `?expectedVersion` answers.
-import { assertFilterParamSuppliedOnce, repeatedQueryParamMessage } from '@objectstack/rest';
+// [#26898] …and the by-id read's closed parameter set (#7606), with the one
+// sentence that refuses a name outside it.
+import {
+    assertFilterParamSuppliedOnce, repeatedQueryParamMessage,
+    DATA_RECORD_READ_PARAMS, unknownQueryParamRefusalMessage,
+} from '@objectstack/rest';
 // [#23492] The dispatcher's one constructor for a `400 VALIDATION_FAILED`
 // answer, which a refused version token returns in this transport's envelope.
 // [#23491] …and the one Zod-issue → `fields[]` mapping, which a write whose
@@ -263,8 +268,20 @@ export async function handleDataRequest(deps: DomainHandlerDeps, path: string, m
         // GET /data/:object/:id
         if (parts.length === 2 && m === 'GET') {
             const id = parts[1];
-            // Spec: Only select/expand are allowlisted query params for GET by ID.
-            // All other query parameters are discarded to prevent parameter pollution.
+            // [#26898] The route's closed parameter set (#7606), the one
+            // `RestServer`'s twin asks, and at the same place in the gate
+            // order: after the object's API exposure (the twin's
+            // `enforceApiAccess`), since which parameters a route understands
+            // is information a caller the object refuses should not learn.
+            // Every name outside `select` / `expand` used to be dropped here,
+            // so `?selct=name` answered `200` with every column where the twin
+            // answered `400`; both now refuse it, before the read, whatever id
+            // the path names.
+            await actionExec.refuseUnexposedDataAction(deps, _context, 'get', objectName, _context.environmentId, _context.executionContext);
+            const unknownParams = unknownQueryParamRefusalMessage(query, DATA_RECORD_READ_PARAMS);
+            if (unknownParams !== undefined) {
+                return { handled: true, response: deps.error(unknownParams, 400, { code: 'VALIDATION_ERROR' }) };
+            }
             const { select, expand } = query || {};
             const allowedParams: Record<string, unknown> = {};
             if (select != null) allowedParams.select = select;
 
@@ -1584,19 +1584,23 @@ describe('HttpDispatcher', () => {
             );
         });
 
-        it('should NOT pass non-allowlisted params for GET /data/:object/:id', async () => {
+        it('refuses a non-allowlisted param for GET /data/:object/:id, never dropping it (#26898)', async () => {
             mockProtocol.getData.mockResolvedValue({ object: 'task', id: 't1', record: {} });
 
-            await dispatcher.handleData(
+            const result = await dispatcher.handleData(
                 '/task/t1', 'GET', {},
                 { expand: 'assignee', malicious: 'drop_table', filter: 'hack' },
                 AUTHED_CALLER()
             );
 
-            // Only expand is passed; malicious and filter are dropped
-            expect(mockProtocol.getData).toHaveBeenCalledWith(
-                { object: 'task', id: 't1', expand: 'assignee', context: AUTHED_CALLER().executionContext }
-            );
+            // The route's closed set (#7606), `RestServer`'s: the names outside
+            // it are refused before the read, and the sentence names them.
+            // They used to be dropped and the read served (`200`).
+            expect(result.handled).toBe(true);
+            expect(result.response?.status).toBe(400);
+            expect(result.response?.body?.error?.code).toBe('VALIDATION_ERROR');
+            expect(result.response?.body?.error?.message).toMatch(/^The query parameters "filter", "malicious" are not supported by this endpoint\./);
+            expect(mockProtocol.getData).not.toHaveBeenCalled();
         });
 
         it('should pass full query (with expand/populate) for GET /data/:object list', async () => {