@@ -0,0 +1,15 @@
+---
+'@objectstack/rest': patch
+'@objectstack/spec': patch
+---
+
+fix(rest): the app metadata bundle serves its objects in the object list's order
+
+Clause-②: no
+Metadata-protocol: none
+
+`GET /meta/app/{appId}/bundle` listed its objects navigation-first, then the objects that reference them. An inbound object that is also a navigation object kept its navigation place, so a console that derives related lists from the bundle showed them in a different order than over the object list (contact before activities on an account record). The bundle now serves the same objects in the object list's order. Objects the list does not name keep their navigation order after the listed ones.
+
+The bundle's contract in `@objectstack/spec` (`AppMetadataBundleResponseSchema`: the docblock and the `objects` description, and the reference page generated from them) now states the object list's order. The schema's shape does not change.
+
+- **Unchanged.** Which objects, views, pages and dashboards the bundle holds, each member's envelope, the validator and the cache posture. A bundle whose navigation already follows the object list is served byte for byte as before.
@@ -29,10 +29,11 @@ Which items the bundle holds is derived on the server, from the app the
 caller is served (navigation already pruned to that caller):
 
 - `objects` — every object an `object` navigation entry names (top-level
-  `navigation`, each area's `navigation`, and `children` at any depth), in
-  navigation order; then every object with a `lookup` or `master_detail`
-  field whose `reference` is one of those, in registry order. One hop: an
-  object related only to a related object is not included.
+  `navigation`, each area's `navigation`, and `children` at any depth), and
+  every object with a `lookup` or `master_detail` field whose `reference` is
+  one of those, all in the object list's order; a name the object list does
+  not hold follows the listed ones, in navigation order. One hop: an object
+  related only to a related object is not included.
 - `views` — every view a navigation entry names by `viewName`, and every view
   bound to an object in `objects`.
 - `pages` — every page a `page` navigation entry names, and every page bound
@@ -73,7 +74,7 @@ const result = AppMetadataBundleResponseSchema.parse(data);
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **app** | `{ type: string; name: string; item: any; sortability?: object; … }` | ✅ | The app, as `GET /meta/app/{appId}` answers it to this caller (its navigation pruned to what the caller may open). |
-| **objects** | `{ type: string; name: string; item: any; sortability?: object; … }[]` | ✅ | The objects the app's navigation reaches, then the objects whose relationship fields reference them, each as `GET /meta/object/{name}` answers it. An object the caller may not read is absent. |
+| **objects** | `{ type: string; name: string; item: any; sortability?: object; … }[]` | ✅ | The objects the app's navigation reaches and the objects whose relationship fields reference them, in the object list's order, each as `GET /meta/object/{name}` answers it. An object the caller may not read is absent. |
 | **views** | `{ type: string; name: string; item: any; sortability?: object; … }[]` | ✅ | The views the navigation names and the views bound to the bundled objects, each as `GET /meta/view/{name}` answers it. A view the caller may not read is absent. |
 | **pages** | `{ type: string; name: string; item: any; sortability?: object; … }[]` | ✅ | The pages the navigation names and the pages bound to the bundled objects, each as `GET /meta/page/{name}` answers it. A page the caller may not read is absent. |
 | **dashboards** | `{ type: string; name: string; item: any; sortability?: object; … }[]` | ✅ | The dashboards the navigation names, each as `GET /meta/dashboard/{name}` answers it. A dashboard the caller may not read is absent. |
 
@@ -20,7 +20,7 @@ import { PerfTiming, runWithPerfTiming } from '@objectstack/observability';
 import { representationEtag } from '@objectstack/types';
 // Explicit `.js` extension: NodeNext resolution (see the sibling meta tests).
 import { RestServer } from './rest-server.js';
-import { appNavigationReach, inboundRelationObjects, META_APP_BUNDLE_PARAMS } from './meta-app-bundle-routes.js';
+import { appNavigationReach, inboundRelationObjects, inObjectListOrder, META_APP_BUNDLE_PARAMS } from './meta-app-bundle-routes.js';
 
 // ── Fixtures ──────────────────────────────────────────────────────────────────
 
@@ -176,6 +176,12 @@ describe('[#27627] which items an app reaches', () => {
         expect(inboundRelationObjects(OBJECTS, [])).toEqual([]);
     });
 
+    it('[#29680] orders names as the object list does, names it does not list after, in their own order', () => {
+        expect(inObjectListOrder(OBJECTS, ['secret_deal', 'contact', 'account', 'note'])).toEqual(['account', 'contact', 'secret_deal', 'note']);
+        expect(inObjectListOrder(OBJECTS, ['ghost', 'contact', 'phantom', 'account'])).toEqual(['account', 'contact', 'ghost', 'phantom']);
+        expect(inObjectListOrder(OBJECTS, [])).toEqual([]);
+    });
+
     it('declares an EMPTY closed query set', () => {
         expect(META_APP_BUNDLE_PARAMS).toEqual([]);
     });
@@ -184,12 +190,12 @@ describe('[#27627] which items an app reaches', () => {
 // ── The bundle ────────────────────────────────────────────────────────────────
 
 describe('[#27627] one request answers the app, its reached objects, views, pages and dashboards', () => {
-    it('admin: every reached member, in derivation order, the body parsing against the declared shape', async () => {
+    it('admin: every reached member, objects in the object list\'s order (#29680), the body parsing against the declared shape', async () => {
         const { res } = await bundle('admin');
         expect(res.statusCode).toBe(200);
         expect(AppMetadataBundleResponseSchema.safeParse(res.body).success).toBe(true);
         expect(res.body.app.name).toBe('crm');
-        expect(namesOf(res.body.objects)).toEqual(['account', 'secret_deal', 'contact', 'note', 'task', 'deal_line']);
+        expect(namesOf(res.body.objects)).toEqual(['account', 'contact', 'secret_deal', 'note', 'task', 'deal_line']);
         expect(namesOf(res.body.views)).toEqual(['account.all', 'account.legal', 'contact.mine']);
         expect(namesOf(res.body.pages)).toEqual(['home_page', 'account_record']);
         expect(namesOf(res.body.dashboards)).toEqual(['pipeline', 'legal_board']);
@@ -240,6 +246,53 @@ describe('[#27627] one request answers the app, its reached objects, views, page
     });
 });
 
+// ── [#29680] The objects, in the object list's order ──────────────────────────
+
+describe('[#29680] the bundle serves its objects in the object list\'s order, not navigation-reach first', () => {
+    // `contact` references `account`; the navigation names `contact` first.
+    const REVERSED_APP = {
+        name: 'service',
+        label: 'Service',
+        navigation: [
+            { id: 'nav_contacts', type: 'object', objectName: 'contact' },
+            { id: 'nav_accounts', type: 'object', objectName: 'account' },
+        ],
+    };
+    // CONTROL: the navigation already follows the object list, so reach-first and list order agree.
+    const IN_ORDER_APP = {
+        name: 'accounts',
+        label: 'Accounts',
+        navigation: [{ id: 'nav_accounts', type: 'object', objectName: 'account' }],
+    };
+    const data = () => ({ ...store(), app: [...store().app, REVERSED_APP, IN_ORDER_APP] });
+    /** The order the bundle served before #29680: navigation reach, then inbound relations. */
+    const reachFirst = (app: unknown) => {
+        const reach = appNavigationReach(app).objects;
+        return [...reach, ...inboundRelationObjects(OBJECTS, reach)];
+    };
+
+    it('two navigation objects where one references the other come back in object-list order', async () => {
+        const { res } = await bundle('admin', 'service', { data: data() });
+        expect(res.statusCode).toBe(200);
+        expect(AppMetadataBundleResponseSchema.safeParse(res.body).success).toBe(true);
+        expect(reachFirst(REVERSED_APP)).toEqual(['contact', 'account', 'note', 'task']);
+        expect(namesOf(res.body.objects)).toEqual(['account', 'contact', 'note', 'task']);
+        // The same set, and only the order moved: views and pages derive from that set.
+        expect(namesOf(res.body.views)).toEqual(['account.all', 'account.legal', 'contact.mine']);
+        expect(namesOf(res.body.pages)).toEqual(['account_record']);
+    });
+
+    it('CONTROL: a bundle whose navigation already follows the list serves exactly the reach-first body', async () => {
+        const { res } = await bundle('admin', 'accounts', { data: data() });
+        expect(res.statusCode).toBe(200);
+        const expected = reachFirst(IN_ORDER_APP);
+        expect(expected).toEqual(['account', 'contact', 'note']);
+        expect(namesOf(res.body.objects)).toEqual(expected);
+        const singles = await Promise.all(expected.map(async (name) => (await item('admin', 'object', name)).body));
+        expect(JSON.stringify(res.body.objects)).toBe(JSON.stringify(singles));
+    });
+});
+
 // ── The validator ─────────────────────────────────────────────────────────────
 
 describe('[#27627] a per-caller validator: ETag, private, no-cache, and 304', () => {
@@ -290,7 +343,7 @@ describe('[#27627] a per-caller validator: ETag, private, no-cache, and 304', ()
         expect(res.statusCode).toBe(200);
         expect(res.headers['Cache-Control']).toBe('private, no-store');
         expect(res.headers.ETag).toBeUndefined();
-        expect(namesOf(res.body.objects)).toEqual(['account', 'secret_deal', 'contact', 'note', 'task', 'deal_line']);
+        expect(namesOf(res.body.objects)).toEqual(['account', 'contact', 'secret_deal', 'note', 'task', 'deal_line']);
     });
 
     it('`metadata.enableCache: false` sends no validator and answers a matching If-None-Match in full, as the item reads do', async () => {
@@ -302,7 +355,7 @@ describe('[#27627] a per-caller validator: ETag, private, no-cache, and 304', ()
         expect(res.statusCode).toBe(200);
         expect(res.headers.ETag).toBeUndefined();
         expect(res.headers['Cache-Control']).toBeUndefined();
-        expect(namesOf(res.body.objects)).toEqual(['account', 'secret_deal', 'contact', 'note', 'task', 'deal_line']);
+        expect(namesOf(res.body.objects)).toEqual(['account', 'contact', 'secret_deal', 'note', 'task', 'deal_line']);
     });
 });
 
 
@@ -180,6 +180,22 @@ export function inboundRelationObjects(objects: readonly unknown[], targets: rea
     return found;
 }
 
+/**
+ * `names` in the object list's order: every name `objects` lists, at its first
+ * position there, then the names it does not list, in `names` order. The same
+ * set as `names`, each name once.
+ */
+export function inObjectListOrder(objects: readonly unknown[], names: readonly string[]): string[] {
+    const wanted = new Set(names);
+    const ordered: string[] = [];
+    for (const item of objects) {
+        const name = nameOf((item as { name?: unknown } | null)?.name);
+        if (name !== undefined && wanted.has(name)) addOnce(ordered, name);
+    }
+    for (const name of names) addOnce(ordered, name);
+    return ordered;
+}
+
 /** A member the chain could not judge: the whole request answers it. */
 class BundleMemberFault extends Error {
     constructor(readonly object: string) {
@@ -273,8 +289,12 @@ export function registerMetaAppBundleRoute(this: MetaAppBundleRouteHost, scope:
                     if (!app || app.kind !== 'serve') return { kind: 'refused', app: undefined };
 
                     const reach = appNavigationReach((app.envelope as { item?: unknown } | null)?.item);
-                    const inbound = inboundRelationObjects(await objectList(), reach.objects);
-                    const objects = await members('object', [...reach.objects, ...inbound]);
+                    // The navigation's objects and their inbound relations, served
+                    // in the object list's order: a navigation object that also
+                    // points at another keeps its place in that list (#29680).
+                    const listed = await objectList();
+                    const inbound = inboundRelationObjects(listed, reach.objects);
+                    const objects = await members('object', inObjectListOrder(listed, [...reach.objects, ...inbound]));
                     const served = new Set(objects.map((o) => String((o.envelope as { name?: unknown }).name)));
 
                     const viewNames = [...reach.views];
 
@@ -235,7 +235,7 @@ export const REST_ROUTE_LEDGER: readonly RestRouteLedgerEntry[] = [
   // [#27627] The app metadata bundle — see meta-app-bundle-routes.ts.
   { route: 'GET /api/v1/meta/app/:appId/bundle', family: 'metadata', source: 'route-manager', disposition: 'sdk', client: 'meta.getAppBundle',
     responseSchema: 'AppMetadataBundleResponseSchema',
-    note: 'The app metadata bundle: the app and the objects, views, pages and dashboards its navigation reaches (objects: navigation, then one hop of inbound relationships), each member the item chain\'s answer of its own GET /meta/:type/:name as the same caller (createMetaItemAnswer, the uncached arm\'s fetch), a refused member absent, a refused app the whole answer. Answers BARE, so the named schema is the whole body; per-caller weak ETag over the served body (the /meta reads\' shared validator), private, no-cache, 304 on If-None-Match. meta-app-bundle-routes.test.ts parses the body against the named schema on the mount' },
+    note: 'The app metadata bundle: the app and the objects, views, pages and dashboards its navigation reaches (objects: navigation plus one hop of inbound relationships, in object-list order), each member the item chain\'s answer of its own GET /meta/:type/:name as the same caller (createMetaItemAnswer, the uncached arm\'s fetch), a refused member absent, a refused app the whole answer. Answers BARE, so the named schema is the whole body; per-caller weak ETag over the served body (the /meta reads\' shared validator), private, no-cache, 304 on If-None-Match. meta-app-bundle-routes.test.ts parses the body against the named schema on the mount' },
   // [#5882] The three-layer diagnostic projection, promoted from the
   // `?layers=true` flag on the row below to a path of its own so that one path
   // answers one response shape. `responseSchema` is filled because this mount
 
@@ -28,10 +28,11 @@ import { GetMetaItemResponseSchema } from './protocol.zod';
  * caller is served (navigation already pruned to that caller):
  *
  * - `objects` — every object an `object` navigation entry names (top-level
- *   `navigation`, each area's `navigation`, and `children` at any depth), in
- *   navigation order; then every object with a `lookup` or `master_detail`
- *   field whose `reference` is one of those, in registry order. One hop: an
- *   object related only to a related object is not included.
+ *   `navigation`, each area's `navigation`, and `children` at any depth), and
+ *   every object with a `lookup` or `master_detail` field whose `reference` is
+ *   one of those, all in the object list's order; a name the object list does
+ *   not hold follows the listed ones, in navigation order. One hop: an object
+ *   related only to a related object is not included.
  * - `views` — every view a navigation entry names by `viewName`, and every view
  *   bound to an object in `objects`.
  * - `pages` — every page a `page` navigation entry names, and every page bound
@@ -56,8 +57,8 @@ export const AppMetadataBundleResponseSchema = lazySchema(() => z.object({
     'The app, as `GET /meta/app/{appId}` answers it to this caller (its navigation pruned to what the caller may open).',
   ),
   objects: z.array(GetMetaItemResponseSchema).describe(
-    'The objects the app\'s navigation reaches, then the objects whose relationship fields reference them, each as '
-    + '`GET /meta/object/{name}` answers it. An object the caller may not read is absent.',
+    'The objects the app\'s navigation reaches and the objects whose relationship fields reference them, in the '
+    + 'object list\'s order, each as `GET /meta/object/{name}` answers it. An object the caller may not read is absent.',
   ),
   views: z.array(GetMetaItemResponseSchema).describe(
     'The views the navigation names and the views bound to the bundled objects, each as `GET /meta/view/{name}` '