platform-checklist: items whose clauses pin shapes the product has since ruled away — found by the browser pass at objectui 1fb1ced36243; re-point or re-word each (family card)

Filing-gate category ③ — the maintainer's order in the dispatching session, verbatim: 「测试遇到的问题，可以提交issue」. This is the family card for checklist-accuracy fails from that browser pass (#23104 Half 2): each row below is a fail whose disposition is stale spec (the product follows a later ruling the clause predates) or assertion defect (the clause is wrong about intended behaviour). The product side of each is correct, so no product card is owed for these rows. Later rows from the same pass are appended as comments here, never as single-point cards.

Reader who acts: whichever seat owns docs/qa/platform-checklist/areas/*.json edits (revise the item, bump revision, append history, keep node scripts/check-platform-checklist.mjs green). Dedupe: semantic issue search on this repo, closed included, "platform checklist items stale clause re-point assertion defect checklist item revision after ruling" — no open card collects these.

Subject of the pass: objectstack 36b2889c + .objectui-sha set locally to 1fb1ced36243 (equivalent to PR #23110's head), stock examples/app-showcase. Each row was reproduced on two fresh loads by its runner.

QA-source	disposition	what the clause pins	what the product does, and why that is right
`#23104 · platform-core.home-admin-cluster-links · A2` (rev 2)	stale spec	legacy `system/roles`, `system/positions`, `system/permissions` URLs land on the `sys_position` / `sys_permission_set` object routes	they land on the Setup metadata catalog (`/apps/setup/metadata/position?scope=environment`, `…/metadata/permission?scope=environment`); objectui `apps/console/src/AppContent.tsx` routes them to `SystemCatalogRedirect` since objectui#7611 (positions and permission sets are registry items, ADR-0131 D3). `users` and `organizations` still match. Re-point the three.
`#23104 · identity-auth.auth-method-matrix · A9` (rev 6)	assertion defect	`delete-user` answers 404 "to every caller, authed or not"	anonymous `POST /api/v1/auth/delete-user` → 401 `UNAUTHORIZED`, authed → 404; `packages/plugins/plugin-auth/src/change-email-delete-user-wiring.test.ts` pins exactly that (anonymous 401: mounted and session-guarded). No caller gets 2xx. Re-word: authed 404 (capability switch), anonymous 401 (session guard), never 2xx.
`#23104 · identity-auth.self-signup-gate · N5` (rev 2)	stale spec	under stock `invite_only` the login page offers the register link and `/register` renders the form	no register link; `/register` renders the by-invitation notice with no form, and the form appears for an `/accept-invitation/ID` redirect (verified) or a zero-owner deployment — objectui `RegisterPage.tsx` / `signUpOffer.ts` since objectui#11691 / objectui#11705. Re-point step 0 and the negative to that rule.
`#23104 · access-security.owd-save-gate · A3` (rev 3)	stale spec	widening a packaged object's OWD answers `403 PERMISSION_DENIED` with `declaredCode: owd_widening_forbidden` from the plugin-security R1 gate	`403 NOT_OVERRIDABLE` from the ADR-0131 D6 managed-content seal (`e02833c24`, #22401), which now answers before the R1 gate, so `owd_widening_forbidden` is unreachable on stock; the protection holds. Re-point to the seal, or to a writable-package widening probe if R1 still needs a live oracle.

Generated by Claude Code

Triage: first grade, `tooling` · `priority:p3` · `domain:skills` · `area:devpath`, into `pm:queue`. Maintainer-directed (③), so the queue rule's exemption applies

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-13T01:57Z. ⛔ Not a claim, ⛔ not a dispatch.

Queue rule: a tooling card needs Unblocks: or a published surface, unless the maintainer directed it. This one carries the maintainer's 「测试遇到的问题，可以提交issue」 verbatim, so it is exempt.
Why p3: each row is a false fail against a product that is right. That is noise in the QA run record, not a product defect. Release QA reads these items, so the rows are worth fixing before the next pass.
Direction: each row as its table says. Revise the item, bump revision, append history, and keep node scripts/check-platform-checklist.mjs green.
- A2: re-point the three legacy URLs to the Setup metadata catalog. users and organizations stay.
- A9: authed 404, anonymous 401, never 2xx. The existing wiring test is the oracle.
- N5: re-point to the by-invitation rule (the notice with no form; the form only on an accept-invitation redirect or a zero-owner deployment).
- A3: re-point to the managed-content seal (403 NOT_OVERRIDABLE). ⛔ No new fixture package built only to reach the R1 gate (new gates default no). If R1 keeps an oracle, it is its unit pins, named in the item.
Later rows from the same pass are appended here, per the card.
Triage: lands in docs/qa/platform-checklist/areas/*.json (domain:skills, the checklist family, as tooling(qa): check-platform-checklist has no legal shape for a planned item retired before it was implemented — statusFieldProblems judges retired by the active rule (since must be a release, steps non-empty) #22987); rationale: test truth.

Rows added from the same browser pass · PM seat domain:devx#2, session_016JB93R2KcQP4GgKaUnseVF · 2026-10-13T02:15Z

QA-source	disposition	what the clause pins	what the product does, and why that is right
`#23104 · api-backend.formula-stdlib-matrix · C1` (rev 1)	stale spec	27 advertised stdlib functions; step 1 says to re-count the registration chain and mark the matrix stale if the count moved	`registerStdLib` now registers 29 — the 27 plus `isoDate` and `isoDatetime` (`345d3f3d8`, #22347); `content/docs/data-modeling/formulas.mdx` lists the same 29, and all 29 pass their known answers against the built `packages/formula/dist` (73/73 rows). Re-count to 29 and add the two rows. Also an assertion defect inside the item: its literal row `joinNonEmpty(['a', null, ' ', 'b'], '-')` cannot evaluate (cel-js refuses a heterogeneous list literal); the same semantics through record fields gives `'a-b'` — rewrite the row that way.
`#23104 · api-backend.formula-stdlib-matrix · C6` (rev 1)	stale spec	EXPECTED-FAIL: an unregistered function is a silent null at head	the metadata authoring door now refuses it first: `PUT /api/v1/meta/object/…` adding a field `bad_f = sqrt(4)` → `422 INVALID_METADATA` "… `sqrt` is not a callable name here — a NAME fault …", and nothing is stored (reproduced twice). Flip the clause to the positive authoring-time refusal its own text anticipates.

Generated by Claude Code

Claim: PM loop round 4 (#23121 — six platform-checklist items whose clauses pin shapes the product has since ruled away; re-point or re-word each) · 2026-10-13T02:29Z
Session: session_012dGTuJen61ECNHXYXKChoC
Account: os-justin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23121-checklist-stale-clauses
Worktree: objectstack-issue-23121
Domain: domain:skills
Seat: domain:skills#2
File surface: docs/qa/platform-checklist/areas/platform-core.json (platform-core.home-admin-cluster-links A2), docs/qa/platform-checklist/areas/identity-auth.json (identity-auth.auth-method-matrix A9, identity-auth.self-signup-gate N5), docs/qa/platform-checklist/areas/access-security.json (access-security.owd-save-gate A3), docs/qa/platform-checklist/areas/api-backend.json (api-backend.formula-stdlib-matrix C1, C6): each item revised, revision bumped, history appended; ⛔ no product code, ⛔ no new fixture package (triage: new gates default no) (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: default tier (dispatch-gates --tier --repo objectstack-ai/objectstack on the four paths at e9e10fdab: "no path-derived mandate")
Clause-②: no
Responsibility: n/a — not a defect card (the product is right on every row; the items' clauses are stale or wrong)
Thread-read: 6136741771
Ruling-ref: none on this card. Maintainer-directed filing (③, 「测试遇到的问题，可以提交issue」); triage 6136407776 gives the per-row direction (A2 re-point the three legacy URLs; A9 authed 404, anonymous 401, never 2xx; N5 the by-invitation rule; A3 the managed-content seal 403 NOT_OVERRIDABLE, ⛔ no fixture package built only to reach R1); rows C1 and C6 appended in 6136741771 follow the card's own direction.
Resume-from: none
Serial constraints cleared: no open PR changes the four files (8 open PRs' file lists read at e9e10fdab); no in-flight claim names them (22 open pm:dispatched claims read). Disjoint from this seat's in-flight #23048.
Delivery shape: Fixes #23121; not governed; skip-changeset (docs/qa/** publishes no package).

Generated by Claude Code

Rows added from the same browser pass · PM seat domain:devx#2, session_016JB93R2KcQP4GgKaUnseVF · 2026-10-13T02:33Z

QA-source	disposition	what the clause pins	what the product does, and why that is right
`#23104 · platform-core.keyboard-shortcut-surface · C2` (rev 2)	stale spec	EXPECTED-FAIL K1a: the shortcuts dialog advertises bare `B` while the handler needs ⌘/Ctrl	the dialog advertises `⌘ B` and nothing bare: General — Close dialog/panel `Esc`, Open command palette `⌘ K`, Show keyboard shortcuts `?`; Navigation — Toggle sidebar `⌘ B`. Bare `B` does nothing, `Ctrl+B` toggles — display and binding agree, since objectui#11674 ("the dialog lists only shortcuts whose handler is mounted"). The defect this expected-fail records is gone: flip the clause to the positive assertion.
`#23104 · platform-core.keyboard-shortcut-surface · C3` (rev 2)	stale spec	EXPECTED-FAIL K1b: `⌘/`, `N`, `R`, `⌘E`, `⌘D` advertised with no handler	none of the five is advertised any more (same objectui#11674); each still does nothing, measured against its own effect (no search focus, no dialog, no refetch, no edit surface, no theme flip). "Advertised but unwired" no longer exists — revise the clause to assert the advertised set equals the wired set.

Generated by Claude Code

os-dev-report
{
"issue": 23121,
"status": "done",
"branch": "claude/issue-23121-checklist-stale-clauses",
"pr": "#23132",
"session": "session_012dGTuJen61ECNHXYXKChoC — subagent of the PM seat (the parent's id)",
"premise_still_valid": true,
"summary": "All six rows checked out against code and tests (no browser, no app boot), and the six clauses were revised across the five items. Each item got revision +1 and one appended history entry: platform-core.home-admin-cluster-links 2 to 3 (A2), identity-auth.auth-method-matrix 6 to 7 (A9), identity-auth.self-signup-gate 2 to 3 (N5), access-security.owd-save-gate 3 to 4 (A3), api-backend.formula-stdlib-matrix 1 to 2 (C1 and C6). Each row also revised the fields of the same item that restate the same stale fact (title, steps, knownGaps, variants, sources), so no item contradicts itself; the deviations list them. No product code, test or fixture changed, and no fixture package was built. Draft PR #23132: its first line closes this card, Clause-② no, assignee os-justin, label skip-changeset (read back). The card's latest Claim (6136897543) names this branch. No rows were appended after the claim: the thread has 3 comments, and the claim is the newest.",
"tests": "Gates at head c84cc23: 12 of 13 exit 0. pnpm check:platform-checklist exits 1 with the same 8 problems it reports at base f931e76 (sorted problem lines diff empty), none in the five items. dispatch-gates --repo objectstack-ai/objectstack --ran (no paths; 4 paths vs merge base f931e76): '✓ … 13 derived famil(ies) accounted for — 13 run, 0 NOT-MEASURED (a DERIVED zero …)', the same 13 as the dispatch list. check:doc-formula-expressions first exited 3 (PREREQUISITE NOT MET: lint unbuilt). That run measured nothing and was re-run after the lint build (exit 0). Anchor census after the edits: access-security 64, api-backend 66, identity-auth 90, platform-core 67, all at or above the floors in checklist-symbol-anchor-baseline.json. Builds, under os-verify-lock (slot issue-23121): pnpm --filter '@objectstack/formula...' build (VERDICT command-exit 0, 117s) and pnpm --filter '@objectstack/lint...' build (VERDICT command-exit 0, 136s). C1 probe against the built packages/formula/dist/index.mjs: joinNonEmpty(['a', null, ' ', 'b'], '-') gives ok:false 'List elements must have the same type'; the record-field form gives 'a-b'; isoDate(date('2026-02-28T13:45:00Z')) gives '2026-02-28'; isoDatetime gives '2026-02-28T13:45:00.000Z'; isoDate(today()) at 2026-08-30T22:00Z Asia/Shanghai gives '2026-08-31'; isoDate('2026-01-01') gives no matching overload; sqrt(4) gives no matching overload. No ablation or reverse verification: the change is ledger text only.",
"gates": [
"node scripts/check-ci-filter-parity.mjs :: exit 0 :: OK: all 197 declared cross-package glob(s) (144 unique) are covered by core or crosspkg …",
"node scripts/check-closing-keyword-parity.mjs :: exit 0 :: check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators …)",
"node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0 :: ✓ check-closing-keyword-parity --self-test: 40 assertions, 5 mutations of the shipped parsers each driven to red.",
"node scripts/check-comment-mask-corpus.mjs :: exit 0 :: ✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 8933 files, 0 disagree, 0 unparseable",
"pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0 :: ✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 474 files / 1390 TS blocks judged clean by @objectstack/formula. (first run exit 3 PREREQUISITE NOT MET, not a measurement)",
"pnpm check:cross-package-test-inputs :: exit 0 :: OK: 30 package(s) read outside themselves, all declared …",
"pnpm check:doc-authoring :: exit 0 :: ✓ doc authoring guard: 421 files clean — no bare metadata literals.",
"pnpm check:driver-memory-census :: exit 0 :: check-driver-memory-census: OK — every declaration is ledgered, every ledger entry is live …",
"pnpm check:gitlink-declared :: exit 0 :: check-gitlink-declared: OK (11177 index entries -- 0 gitlink(s) at mode 160000 …)",
"pnpm check:nul-bytes :: exit 0 :: check-nul-bytes: OK (scanned 11168 text file(s) … no raw ASCII control bytes).",
"pnpm check:platform-checklist :: exit 1 :: check-platform-checklist: 8 problem(s), the same 8 lines at base f931e76: 5 ABSENT SYMBOL in access-security.public-form-withdrawal-layers, 1 ABSENT SYMBOL plus SYMBOL ANCHORS LOST (27 of floor 28) in attachments-storage.attach-requires-parent-edit, 1 ABSENT SYMBOL in search.rls-both-personas. None in the five items; none added by this PR",
"pnpm check:refd-timer-probe :: exit 0 :: OK check-refd-timer-probe: 8927 source file(s) swept …",
"pnpm check:watch-hint-literal :: exit 0 :: ✓ check-watch-hint-literal: 73 declaration(s) across 4 rostered name(s) …"
],
"verification_readings": [
"H-A2 holds. objectui apps/console/src/AppContent.tsx:167-171 (SystemCatalogRedirect) and :289-293 (system/roles and system/positions go to type position, system/permissions to type permission; users and organizations stay on SystemObjectRedirect). apps/console/src/tests/AppContent.systemHubRoutes.test.tsx:344-382 pins /apps/setup/metadata/position?scope=environment and /apps/setup/metadata/permission?scope=environment. packages/app-shell/src/views/metadata-admin/catalog-scope.ts:55 defines ENVIRONMENT_SCOPE_QUERY = scope=environment. All @ 1fb1ced36243. roles lands on position, read from source, not the table",
"H-A9 holds. packages/plugins/plugin-auth/src/change-email-delete-user-wiring.test.ts:320-375 @ f931e76: anonymous POST /delete-user gives 401 (:349), authed gives 404 with empty body (:352), the callback with a session gives 404 NOT_FOUND (:372). auth-route-ledger.ts:157 books the route disposition 'disabled'. The 401 code UNAUTHORIZED is from better-auth's sensitiveSessionMiddleware (node_modules better-auth 1.7.3 dist/api/routes/session.mjs:304-311); the pin asserts the status only",
"H-N5 holds. objectui packages/app-shell/src/console/auth/signUpOffer.ts:144-157 (decideSignUpOffer), apps/console/src/pages/auth/RegisterPage.tsx:125-143 and :229-257 (data-testid register-by-invitation, no form), LoginPage.tsx:146-153 and :361-362 (registerUrl only when the offer is 'form'), tests/signUpFollowsPosture-11691.test.tsx:156-260, all @ 1fb1ced36243. The server is unchanged: packages/plugins/plugin-auth/src/auth-manager.ts:6809-6816 @ f931e76 (disableSignUp deliberately not forced by the posture)",
"H-A3 holds. packages/metadata-protocol/src/protocol.ts:20652 (refusePackagedBaseOverride in saveMetaItem, ahead of runAuthoringGate at :21233), :17465-17537 (403 NOT_OVERRIDABLE, or ITEM_LOCKED for a named read-only base) and :16669-16672 (isSealedManagedItem = artifact-backed and the registry opens no overlay channel). packages/spec/src/kernel/metadata-plugin.zod.ts:786 gives object allowEnvironmentOverlay: false. packages/rest/src/meta-object-owd-gate.test.ts:346-430 pins the package door answering before lint and R1, hatch open, 403 NOT_OVERRIDABLE with no declaredCode. packages/plugins/plugin-security/src/object-posture-gate.test.ts:61-131 holds R1's unit pins. All @ f931e76. Commits 35afb15 (#22338, the door on every topology) and e02833c (#22401, ADR-0131 D6)",
"H-C1 holds. packages/formula/src/stdlib.ts:261-423 @ f931e76 has 29 chained registerFunction calls, counted from source (awk plus grep: 29 names, 29 call sites); the extra names are isoDate and isoDatetime (345d3f3, #22347). One more registration, the receiver method dyn.can, comes from registerPermissionPredicate (:267 calls :196) and is not bare-callable. packages/formula/src/validate.ts:1240-1280 tallies '29 added by registerStdLib'. content/docs/data-modeling/formulas.mdx:178-198 lists the same 29 names in 19 rows. The built-dist probe is in tests",
"H-C6 holds, with a unit pin found. packages/metadata-protocol/src/protocol.runtime-authoring-gate.test.ts:1630-1700 @ f931e76, the block 'runtime authoring gate on OBJECT writes — the formula field verdict (#22019)': sqrt(record.amount) is refused 422 INVALID_METADATA, rule expression-invalid, message contains 'sqrt is not a callable name here', and nothing lands, on an active save and on a draft's promotion. Also packages/lint/src/runtime-gate.object-formula-writes.test.ts:66-107, packages/formula/src/validate.ts:548 (the NAME-fault text) and packages/objectql/src/engine-formula-fault-log.test.ts (the read-path residual). Commit f85a83b (#22031; its body names card #22019 as the one it closes)"
],
"deviations": [
"Pin: the dispatch named .objectui-sha 7578323a544e, but origin/main carries 1fb1ced36243 (moved by f451a59, #23110, after the PM's read at e9e10fd). I read at 1fb1ced36243. git diff --quiet 7578323a544e 1fb1ced36243 over every cited objectui file exits 0 (byte-identical)",
"Coupled fields beyond the six clauses, each named in the item's history entry. A2: title, step 4, AppContent source note. A9: step 9. N5: title, step 1, step 2's 'submit the register form' half (dropped; the direct POST kept, since the stock /register has no form for an uninvited visitor), and one new objectui source note. A3: title, step 5, the R1 knownGap, the first knownGap's 'packaged tighten-only' parenthetical, the R1 variant, and two new source notes (anchor protocol.ts#refusePackagedBaseOverride). C1: title, step 1, step 3, the 27-function knownGap, clause 1's evidence, and the registerStdLib source note. C6: title, step 7, negative[2], and two new source notes (anchors validate.ts#CEL_STDLIB_FUNCTIONS and authoring-rules.ts#EXPRESSION_INVALID). Reason: each restates the stale fact its row corrects. Other clauses and fields were left as they were; out_of_scope_findings names them",
"C1 judgment: the item now names the receiver method can as outside the 29-function count. It matches validate.ts's own tally, the QA reading and formulas.mdx. Without it, a literal 'registered by registerStdLib' count reads 30, and the both-directions docs clause would fail against a product that is right",
"Reading the dispatch's 'node scripts/check-platform-checklist.mjs 绿' literally cannot be met: the gate is red at base with 8 problems outside this card's file surface. The edit adds none (problem lines identical at base and head)",
"Builds not named in the dispatch, both run under the lock: '@objectstack/formula...' for the C1 probe against the built evaluator, and '@objectstack/lint...' for check:doc-formula-expressions' prerequisite",
"Commit trailers: I used AGENTS.md's model-free pair (Claude-Session plus 'Co-authored-by: Claude'), not the harness reminder's model-named Co-Authored-By, per the reminder's own precedence clause. Reported only. The PR body ends with the AGENTS.md session-URL footer, not the reminder's form",
"Cleanup: worktree /home/user/objectstack-issue-23121 removed (root node_modules deleted, then git worktree remove without --force: exit 0). Branch head c84cc23 is on the remote. This report was posted with the shared checkout's scripts/pm/post-stamped.mjs; scripts/pm/ is identical at e9e10fd and c84cc23 (git diff --stat empty)"
],
"files_changed": [
"docs/qa/platform-checklist/areas/platform-core.json (+12 -6)",
"docs/qa/platform-checklist/areas/identity-auth.json (+16 -13, two items)",
"docs/qa/platform-checklist/areas/access-security.json (+14 -11)",
"docs/qa/platform-checklist/areas/api-backend.json (+21 -13)"
],
"mcp_calls": "0 — no MCP tool used",
"api_writes": "3 relay dispatches, each POST /repos/objectstack-ai/objectstack/dispatches, executing 4 REST writes as objectstack-fleet[bot]. (1) pr_create, run 38339489825: POST /repos/objectstack-ai/objectstack/pulls (draft) and POST /repos//issues/23132/assignees (os-justin); body read back 13613 bytes sent and stored, identical. (2) labels_add via scripts/pm/label-write.mjs, run 38339539865: POST /repos//issues/23132/labels (skip-changeset); read back as size/m and skip-changeset. (3) this os-dev-report comment via scripts/pm/post-stamped.mjs: POST /repos//issues/23121/comments. Plus git push (not REST): 5 pushes to claude/issue-23121-checklist-stale-clauses (the empty-branch probe, then 4 commits ending at c84cc23). Reads used gh api GET only",
"open_questions": [],
"out_of_scope_findings": [
"carrier: platform-checklist-watchdog workflow (daily on main; files or refreshes one issue while the gate is red) · noted, not filed · evidence: pnpm check:platform-checklist at f931e76 gives 8 problems, all outside this card's surface. access-security.public-form-withdrawal-layers: protocol.ts#anonymousFormIntakeOrgScopeRefusal, #anonymousFormIntakeReopenRefusal and #envWideRawViewRows absent (5 lines). attachments-storage.attach-requires-parent-edit: attachment-access-hooks.ts#canEdit absent, anchors 27 against floor 28. search.rls-both-personas: protocol.ts#countable absent",
"carrier: 承接者:无 (suggested as a later row on this family card) · noted in the PR's Acceptance notes, not filed · evidence: identity-auth.self-signup-gate acceptance[2] ends 'which is exactly why the register form stays rendered under the closed posture'. After objectui#11691 that is true for an invitee only. The same item's older source notes cite objectui line ranges (RegisterPage.tsx,69-88 and LoginPage.tsx,136,298) that no longer match pin 1fb1ced36243",
"carrier: 承接者:无 (suggested as a later row on this family card) · noted, not filed · evidence: access-security.owd-save-gate fixtures.requires[1] still says to author the R2 probe with ?mode=draft, while step 3 (unchanged since rev 2) says the clause is unobservable there and to drive the active door",
"carrier: 承接者:无 · noted, not filed (observation: a dead path, not a defect) · evidence: through PUT /api/v1/meta/object/NAME, no write reaches plugin-security R1's packaged-baseline comparison on any topology, because the package door refuses first (packages/rest/src/meta-object-owd-gate.test.ts R1 block comment). R1 keeps only its in-process unit pins",
"carrier: 承接者:无 · noted, not filed (documentation observation) · evidence: current_user.can(object, verb) is registered inside registerStdLib (registerPermissionPredicate, #18781) but documented nowhere outside content/docs/releases. Neither the formulas.mdx stdlib table nor its variable-scope table mentions it"
]
}

ACCEPT — PR #23132 @ c84cc2314 · seat domain:skills#2 · session_012dGTuJen61ECNHXYXKChoC · 2026-10-13T03:04Z

Checked against GitHub and origin/main, not the report alone (os-dev-report on this card):

Shape. Draft, base main, first line closes this card, Clause-②: no, assignee os-justin, skip-changeset (docs/qa/** publishes no package). Four files, +63/−43: platform-core.json, identity-auth.json, access-security.json, api-backend.json.
Not governed. check-governed-merges.mjs --pr 23132 reads NOT governed, 106 changed lines, so ordinary queue landing applies.
Content read by the seat (the identity-auth.json hunks in full, the others by their history entries):
- Each of the five items has revision +1 and one appended history entry naming the row (A2, A9, N5, A3, C1+C6).
- Each revised clause cites the pin that now carries it: change-email-delete-user-wiring.test.ts for A9, meta-object-owd-gate.test.ts for A3, protocol.runtime-authoring-gate.test.ts for C6, and objectui AppContent.systemHubRoutes.test.tsx and signUpFollowsPosture-11691.test.tsx @ 1fb1ced36243 for A2 and N5.
- C1's count of 29 is read from stdlib.ts, not copied from the card. The joinNonEmpty literal was probed against the built evaluator: it is refused, and the record-field form returns 'a-b'.
- The coupled fields (titles, steps, knownGaps and variants that restate the same stale fact) are revised in the same items, so no item contradicts itself. Each one is named in its history entry.
No product change. No code, test or fixture changed, and no fixture package was built (triage's ⛔).
CI on this head. Nothing red. Two Test Core shards were still running at this reading; auto-merge waits on the required contexts. pnpm check:platform-checklist is out of per-PR CI by design (checklist-status.yml). Locally it reports the same 8 problems at the base and at the head, none in these five items.
Noted, not filed. These come from the report's out_of_scope_findings, for whoever revises these items next:
- identity-auth.self-signup-gate acceptance[2]'s "the register form stays rendered under the closed posture", and that item's older objectui line ranges;
- access-security.owd-save-gate fixtures.requires[1]'s ?mode=draft against step 3;
- current_user.can is undocumented outside the release notes.
The 8 red checklist problems on main are the platform-checklist watchdog's to report.
Landing. Ready and auto-merge through the relay, in this act.

Generated by Claude Code

Landed — PR #23132 MERGED as 1ca7a805c (ready and auto-merge by this seat's relay stroke, through the queue) · seat domain:skills#2 · session_012dGTuJen61ECNHXYXKChoC · 2026-10-13T03:15Z

Content read on origin/main after the merge:
- The four area JSONs are byte-identical to the PR head c84cc2314 (git diff c84cc2314 origin/main on each file is empty).
- api-backend.formula-stdlib-matrix reads revision 2.
The card closed by Fixes; pm:dispatched is stripped in this act.
Rows carried in the ACCEPT 6137279285 as noted-not-filed: self-signup-gate acceptance[2], owd-save-gate fixtures.requires[1], and current_user.can. They are for the next family card or the next reviser of these items. The 8 red checklist problems on main stay with the platform-checklist watchdog.

Generated by Claude Code

Rows added from the browser pass's two run records · record composer, PM seat domain:devx#2, session_016JB93R2KcQP4GgKaUnseVF · 2026-10-13T04:57Z

The two records of #23104's browser pass now exist: #23163 (surface:browser) and #23166 (surface:mixed), at subject 36b2889c with objectui pin 1fb1ced36243. This comment adds only what this card does not already hold. That means the checklist-accuracy notes the lanes recorded on PASSING clauses, plus the stale knownGaps and fixture gaps. Every row's evidence is in the record named in its first column, and each record's closeout carries the matching Parked-on: #23121 line. Revisions are the ones the run judged.

⚠ This card is closed, and two of its rows never landed. PR #23132 took the six rows named in its claim. The two platform-core.keyboard-shortcut-surface rows (C2 / C3, comment 6136937010) were appended after that claim, and the item still reads rev 2 on main. Those two rows and the rows below need this card reopened, or a successor family card. That call belongs to the PM seat; this comment only records the rows.

QA-source	kind	what the item says	what the run found / the edit it suggests
`#23163 · records-forms.saved-view-management · A0` (rev 1)	stale spec	steps 0–1: create a view, and it is live after reload	the Create View dialog is draft-first (`PUT …?mode=draft`, lands on `?preview=draft`), and the view goes live only after Publish (`POST …/publish`). Add the publish leg. Rename / default / pin / delete write the live overlay directly.
`#23163 · records-forms.list-view-capabilities · A6` (rev 1)	fixture gap	export as the seeded admin	no stock permission set grants `allowExport` (export is opt-in): Export is hidden and the route answers 403 EXPORT_NOT_PERMITTED. Add a provisioning note: a runtime set `{object_permissions.showcase_task:{allowRead, allowExport}}` bound through `sys_user_permission_set` by the set's NAME.
`#23163 · records-forms.record-edit-undo · A0–A3` (rev 2)	fixture gap	"an inline edit or an action flagged undoable"	at objectui `1fb1ced36243` inline edits push no Undo op; only `undoable` actions do. The showcase declares none, and runtime-authored actions are not served. Ship a packaged `undoable` action (operation update + patch); the item stays BLOCKED until then.
`#23163 · records-forms.action-location-matrix · A4` (rev 9)	fixture gap	step 6(a): a runtime-authored, locations-less probe action	runtime-authored actions are not joined into the served object's `actions[]` (the positive control was invisible too), so the probe proves nothing. Use a packaged specimen, as with `showcase_new_task`.
`#23163 · records-forms.bulk-select-all-matching` (rev 2)	stale fixture	`showcase_contact` bulk actions; 26 contacts exceed a page	`showcase_contact` declares no bulkActions, and its 34 contacts fit page 1 (50 rows). The run re-pointed to the `showcase_task` "Bulk Actions" view with 55 scratch tasks. Re-point the item.
`#23163 · records-forms.form-view-gallery` (rev 2)	fixture gap	overlay recipe `PUT /api/v1/meta/view/showcase_task.form?mode=draft`	without item-level `isDefault:true`, publish drops the flag and the console falls back to the all-fields layout (objectui#11539). Add it to the recipe.
`#23163 · records-forms.form-dirty-guard · A2` (rev 2)	assertion defect	verify `pnpm --filter @object-ui/plugin-form exec vitest run src/discardGuard.test.tsx`	refused by objectui's vitest guard (objectui#3378). Use `pnpm exec vitest run packages/plugin-form/src/discardGuard.test.tsx` from the objectui root (14/14 there).
`#23163 · records-forms.import-wizard-encoding-and-hints · A0` (rev 5)	assertion defect	verify `pnpm --filter @object-ui/plugin-grid exec vitest run src/…`	the same objectui#3378 refusal. Run from the objectui root.
`#23163 · records-forms.form-dirty-guard · A0` (rev 2)	wording	step 1 / negative: closing a dirty form prompts	the footer Cancel discards without a prompt by design (`ModalForm.tsx` L739, pinned in `discardGuard.test.tsx`). Distinguish the deliberate Cancel from X / Escape.
`#23163 · records-forms.gantt-interactions · A2-leaf` (rev 3)	fixture gap	drag on a locked leaf bar	the stock gantt view has no lockField, no pin reaches a locked leaf, and the knownGaps view-overlay recipe is not run-proven.
`#23163 · dashboards.global-filters-rescope · D2 / D3` (rev 3)	fixture gap	dataset-sourced filter options; field override	no stock dashboard declares a globalFilter with `optionsFrom`, and D2 needs a writable package. Both were scored on runtime scratch dashboards; add them to fixtures.requires.
`#23163 · ux-conventions.write-feedback` (rev 1)	knownGaps stale	objectui#11817 (Invite feedback), objectui#11807 (Studio Publish), objectui#11816 (inline no-op dirty); quoted "Invitation sent"	all three are fixed at the pin. Invite toasts "Invitation sent to EMAIL", the declared successMessage interpolating the result email. Studio discard lives on the metadata designer (Discard draft, native confirm), not the pillars, and a scratch object needs the namespace prefix.
`#23163 · ux-conventions.write-feedback · A5` (rev 1)	fixture gap	Undo offered on feedback	no stock surface offers Undo (same root as record-edit-undo).
`#23163 · ux-conventions.disabled-control-reason` (rev 1)	knownGap stale	objectui#11811 (Archive has no reason); Studio Publish as the known PASS	Archive now carries a tooltip and aria-describedby on a focusable wrapper. The Publish calibration holds for hover only: its title sits on a disabled button with no focusable wrapper.
`#23163 · ux-conventions.labels-over-machine-names` (rev 1)	knownGaps partly stale	objectui#11866, objectui#11778, objectui#11862	objectui#11866 is fixed. objectui#11778 is fixed for the Node Type value. objectui#11862 is fixed for the Explain principal line and the nav editor, but still reproduces for the Access permission-set list and the Changes panel.
`#23163 · search.command-palette-navigation · A4` (rev 2)	knownGaps update	visibility-predicate recipe unproven	the scratch-copy recipe (visible `'true'` / `'false'` nav leaves) is run-proven at `36b2889c` + `1fb1ced36243`.
`#23163 · i18n.surface-matrix` (rev 6)	knownGap stale	tabbed form at `…/view/tabbed`; record-page sections render EN in every locale	`…/view/tabbed` renders the grid. Named sections render zh on the New form, the task record page and the contact form, so the knownGap is stale.
`#23163 · i18n.studio-follows-app-locale · A2` (rev 4)	stale step	step 4: relative dates on metadata list / history	there are none there (history is absolute). Relative dates live on the Studio Data pillar's records grid (6天前).
`#23163 · access-security.share-link-landing-page · C3` (rev 1)	knownGap stale	knownGaps[2]: the `signed_in` audience falls to the password prompt	the console renders a dedicated "Sign in required" state for SIGN_IN_REQUIRED, and the item asks to be revised when this happens.
`#23163 · api-backend.api-console-discovery-execute · C0` (rev 1)	stale step	step 1: Studio → Developer → API Console	that nav exists only in `studio.app.ts` (`nav_api_console`), which a stock boot does not load. Reach `/_console/apps/setup/developer/api-console` by deep link.
`#23163 · ai.console-ai-surface-gating · C5` (rev 3)	stale spec	EXPECTED-FAIL K2: empty queue under the 501 alert, and a poll that never backs off	fixed (objectui#11736): one 501 read, no re-arm, no empty state under the alert. Drop the expected-fail wording.
`#23163 · platform-core.keyboard-shortcut-surface · C4` (rev 2)	stale premise	⌘⇧O / ⌘⇧S listed globally but page-scoped	not listed in the global dialog at all; the AI-chat rows appear only while AiChatPage's handler is mounted (objectui#11674). Fold into the open C2 / C3 revision.
`#23163 · platform-core.theme-mode-persistence · C0` (rev 1)	stale step text	storage key `vite-ui-theme`; ModeToggle in the AppHeader	the key is `object-ui-theme` (`ConsoleShell.tsx:157`), and ModeToggle lives under the avatar menu › Preferences (`AppHeader.tsx:999`). Also reported on #21782's closeout; still rev 1.
`#23163 · platform-core.marketplace-console-honesty` (rev 3)	setup recipe gap	per-boot `OS_HOME` + `OS_STORAGE_LOCAL_ROOT` isolate a boot	`install-local` caches the manifest under the working directory's `.objectstack/installed-packages`, so an install from the shared tree lands in it. Items that install a package (this one and `platform-core.marketplace-install-local-lifecycle`) must boot from a scratch copy; RUNNER's environment facts should say so.
`#23163 · approvals.notification-deep-link · A0` (rev 5)	assertion defect	step 1: `POST …/remind` as the dev admin on a seeded request	remind is submitter-only (403 "only the submitter may send reminders"), and the admin is an approver. Use the opening path or `/reassign`.
`#23163 · approvals.quorum-m-of-n · A0` (rev 4)	fixture gap (known)	the stock `showcase_committee_quorum` exercises M-of-N	every slot resolves to the admin, clamping 2-of-3 to 1-of-1. The item was scored on the runtime-fixture recipe from #21845; ship a fixture with distinct holders.
`#23163 · automation.screen-flow-roundtrip · A0` (rev 3)	stale spec	verify: a POST matching `/automation/[^/]+/trigger`	the console launches through `POST /api/v1/actions/OBJECT/ACTION`, which runs the flow and returns the pause. The paused-run contract holds.
`#23163 · automation.setup-packaged-automation-board · A7` (rev 2)	maintainer question	a plain member reaches the page and sees the switches; activation reads are open	at this build the member cannot open the setup app, and the activation read answers 403. Recorded, not adjudicated, as the clause asks.
`#23163 · studio-authoring.packaged-automation-studio-lock · A2 / A3` (rev 1)	stale spec	knownGaps[0] and "CURRENT RECORDED FINDING": a clickable switch the server refuses	both the switch and the inspector honour readOnly (disabled with a reason title; a forced click sends nothing). Drop the expected-fail wording.
`#23163 · integration-system.flow-connector-picker · A0` (rev 3)	knownGap stale	an installed-package lock on the editable flow	an env-wide flow authored through `POST /api/v1/automation` opens editable, with no lock banner.
`#23166 · identity-auth.workspace-org-switch` (rev 2)	fixture gap	fixtures.requires: `OS_TENANCY_POSTURE=group/isolated`	a walled posture refuses to boot without `@objectstack/organizations` declared in the host `package.json` (ADR-0093 D5), `OS_PLATFORM_OWNER_EMAIL`, and `OS_AUTH_MEMBERSHIP_POLICY`. With invite-only, the invitee must also `accept-invitation`.
`#23166 · identity-auth.workspace-org-switch · C3b` (rev 2)	stale spec	the meta half: an id existing only in the previous org is absent	metadata writes are deployment-level ("no metadata write is organization-scoped any more", `protocol.ts`), so no org-only metadata id exists. Re-ground the clause.
`#23166 · platform-core.lifecycle-retention-sweep · C1` (rev 1)	stale step + ruling owed	step 3 greps the `[lifecycle]` line; step 5: an idle sweep logs nothing	the line is INFO and `os dev` defaults to warn, so it needs `OS_LOG_LEVEL=info`. An idle sweep still logs "18 policy(ies) applied, ~0 rows reaped": `report.swept` gets an entry per applied policy (`lifecycle-service.ts:1705`), and the print gate tests `swept.length` (`:781`). Stale step or product defect? A ruling is owed.
`#23166 · identity-auth.email-verification-loop · C2` (rev 2)	stale step	a POST verify-email variant	`POST /api/v1/auth/verify-email` answers 404; the console uses GET `?token=` (`VerifyEmailPage.tsx:47-56`).
`#23166 · cli.scaffold-first-run · C2` (rev 3)	stale wording	verify: "each of the six templates"	the variants have been `[blank]` since rev 2, and the published scaffolder offers only blank.
`#23166 · records-forms.field-group-visible-when · A3` (rev 2)	stale spec	the detail half is expected to FAIL (objectui#11630)	the detail page gates the group per record at the pin.
`#23166 · dashboards.system-overview-live-counts · A1 / A3` (rev 1)	stale spec	A1 caveat "no active-only filter"; A3 names `widget_organizations` and a permission KPI	the Active Sessions widget filters revoked_at null and expires_at > now. `system_overview` declares 8 widgets, with no `widget_organizations` and no permission-events KPI.
`#23166 · records-forms.object-hook-lifecycle · A7` (rev 3)	wording drift	log `[hook] async handler error (fire-and-forget)`	the log reads `ERROR [hook] handler failed (onError=log; suppressing)`.
`#23166 · search.console-global-search · A5` (rev 3)	persona recipe gap	`search:qa-contributor-bound-member` step 5 owns an invoice	a member-created `showcase_invoice` is invisible to its creator unless `owner` is set to the member's email (`invoice_own_rows` reads owner == current_user.email). The same class applies to `showcase_task` (assignee).
`#23166 · search.console-global-search · A6` (rev 3)	stale step	step 6: Open Full Search Page from the palette	it is offered only for an empty query or one matching "search all results full page". Reach `/search` by URL or through that query.
`#23166 · attachments-storage.download-authz-both-sides · A4` (rev 3)	persona recipe gap	qa-scratch-authz step 6, persona B	B also needs `sys_attachment` read, or the panel refuses before any download is attempted.
`#23166 · approvals.ooo-delegation-reroute · A0` (rev 4)	assertion defect	steps 3–4: an autolaunched flow via `POST /api/v1/automation/FLOW/trigger`	that route cannot open an approval: `buildAutomationContext` maps the record into params only, the engine seeds `$record` from `context.record`, and the answer is 400 "no record id in $record". Use a record-triggered start.
`#23166 · studio-authoring.custom-page-source-tiers · A5` (rev 1)	assertion defect (minor)	step 8 / knownGaps[0]: the html compile-error panel on the rendered page	the server compiles html at save / publish (422 INVALID_METADATA), so a faulty html page never publishes. The panel is reachable only in the designer's draft preview.
`#23166 · studio-authoring.metadata-diagnostics-sweep · A1` (rev 2)	stale spec	"locked counts rows whose _lock != none"	`stats.locked` is the served envelope lock (#21694). Compare against the item envelope's lock.
`#23166 · studio-authoring.object-designer-roundtrip · A3` (rev 2)	assertion defect	step 4: no banner for an empty picklist row	with no real option yet, the select-needs-options banner fires (the empty rows ARE dropped), and objectui's F4 `toHaveCount(0)` collides the same way. Assert with real options present.
`#23166 · studio-authoring.record-page-roundtrip · A0` (rev 3)	stale step	step 1: Label + Object + Save	Page type now defaults to `list`. Add "set Page type = record".
`#23166 · studio-authoring.draft-publish-lifecycle · A8` (rev 4)	assertion defect	step 10: `?from=1&to=2`	history counts draft saves and publishes, so v1 → v2 is a draft and its own publish (`changed []`); the published revisions were v2 and v4. Name the publish versions read off `/history`.
`#23166 · studio-authoring.doc-on-app-menu · A0` (rev 1)	knownGap stale	the doc editor refuses the read-only package with 422	it saves an env-wide draft and offers no package picker. Drive the writable base over `?package=` so the books and docs share one package.
`#23166 · automation.flow-runs-page-test-trigger · A2` (rev 1)	assertion defect (minor)	step 6: fill recordId + new_assignee	supplying `new_assignee` completes the run without pausing. Leave it empty to exercise the hand-off.
`#23166 · automation.flow-node-type-matrix · A1` (rev 4)	recipe note	notify steps on run-created records	tasks and projects created without an assignee or owner fail notify loudly, which is a correct refusal. Set an assignee in the recipe.
`#23166 · integration-system.webhook-lifecycle · A1` (rev 5)	stale spec	steps 2–3 enable the shipped `showcase_task_changed`	it materializes org-less, so on the org-walled showcase it never fans out, while Setup reads active:true. Author it inside the organization, or org-stamp the fixture.
`#23166 · integration-system.webhook-lifecycle · A2 / N1 / N2` (rev 5)	dependency + coverage gap	aggregate bulk delivery; unknown-trigger and connector tombstones	A2 is blocked: in-org bulk flow events carry no organizationId, and the org-owned subscription refuses them (maintainer question, in #23166). N1 / N2 were not attempted (time budget); a re-run is owed.
`#23166 · integration-system.email-template-render · A0 / A5 / A6` (rev 5)	stale spec	templates materialize to `sys_email_template`; the fixture line names `category`	`sys_email_template` holds 0 rows: the registry serves the item, and the email-template door closes the table. Rewrite step 1 and A5 against `GET /api/v1/meta/email_template/NAME`. `category` is retired. A5's declared-source half needs a writable showcase copy.
`#23166 · integration-system.external-schema-browser-ui · A1 / A4` (rev 2)	stale spec	5 columns each; knownGap "ValidationPanel lacks unreachable"	the fixture carries 7 columns (API and panel agree), and `ValidationPanel.tsx` maps unreachable at the pin.
`#23166 · identity-auth.implicit-account-linking-ownership · C3` (rev 1)	fixture note	a second identity re-points U's sub	the local IdP derives `sub` from the email, so W's identity is a distinct sub.
`#23166 · studio-authoring.metadata-diagnostics-sweep · A6` (rev 2)	fixture gap (in knownGaps)	an invalid stored row	not plantable on a stock boot, because every save door validates. Pending a stale-row DB snapshot fixture.
`#23166 · approvals.decision-action-matrix · A9-wire` (rev 4)	fixture gap (in knownGaps)	the live 500 `APPROVAL_ACTION_FAILED` envelope	needs an org-less request, which no stock flow opens on demand.
`#23166 · integration-system.notify-inbox-delivery · A3-501` (rev 2)	fixture gap (in knownGaps)	the 501 capability-unavailable arm	needs a boot without MessagingServicePlugin, and the showcase requires messaging.
`#23166 · integration-system.notification-preference-suppression · A3-mandatory` (rev 1)	fixture gap	the mandatoryTopics bypass	the stock showcase declares none, and they are not runtime-writable.

Generated by Claude Code

Successor: the rows this card held after its claim — platform-core.keyboard-shortcut-surface C2 / C3 (comment 6136937010) — and the 59 rows parked here by the browser pass's records (comment 6138566194) are carried on #23169. This card's landed six (1ca7a805c, PR #23132) are untouched; no reopen is asked. · PM seat domain:devx#2, session_016JB93R2KcQP4GgKaUnseVF · 2026-10-13T05:04Z

Generated by Claude Code

Navigation Menu

Repository navigation

platform-checklist: items whose clauses pin shapes the product has since ruled away — found by the browser pass at objectui 1fb1ced36243; re-point or re-word each (family card) #23121

Triage: first grade, `tooling` · `priority:p3` · `domain:skills` · `area:devpath`, into `pm:queue`. Maintainer-directed (③), so the queue rule's exemption applies

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

platform-checklist: items whose clauses pin shapes the product has since ruled away — found by the browser pass at objectui 1fb1ced36243; re-point or re-word each (family card) #23121

Description

Activity

objectstack-fleet commented on Oct 13, 2026

Triage: first grade, tooling · priority:p3 · domain:skills · area:devpath, into pm:queue. Maintainer-directed (③), so the queue rule's exemption applies

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

objectstack-fleet commented on Oct 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade, `tooling` · `priority:p3` · `domain:skills` · `area:devpath`, into `pm:queue`. Maintainer-directed (③), so the queue rule's exemption applies