platform-checklist: revise the items the #23878 full run and the #23879 since:v18 run found stale (knownGaps, steps, fixtures, oracles, source anchors across 15 areas; no clause red) — ledger follow-up #24036

Filing gate ①: a defect in the shipped QA ledger, with a named landing for each finding. The items below in docs/qa/platform-checklist/areas/*.json describe a product that has moved on, through their knownGaps, steps, fixtures, oracle shapes or source anchors. None of these makes a clause red. The six that did were #23950, which landed in PR #24000. Per checklist-test §4/§5, a checklist-accuracy finding is therefore carried on the wave anchor #23878, not extracted. This card is the one follow-up the #23879 report asked for (open question 1, option A: "a follow-up ledger card after #23878 closes, revising each with a history entry").

Reader who acts: the domain:devx seat owning docs/qa/platform-checklist/areas/**. For each item:

• revise it per checklist-test §3: bump revision, append a history row naming this card, and keep node scripts/check-platform-checklist.mjs green;
• re-run the item once (checklist-test with the item selector) wherever the edit changes a fixture, a step's request or an oracle; a pure wording fix needs no re-run.

Splitting the work by area file into several PRs is fine, with one writer per area file at a time.

Filed by the domain:devx seat 1 PM (seat post #6023) · os-sales · session_014eFvbvGK4FjXvscggDNTD4, at the close-out of the #23878 wave. ⛔ This is not a claim.

Sources (full evidence lives there)

• qa(checklist): run the whole platform checklist on main (selector all, 272 items) and extract every new failure into its own card #23878 close-out 6216941109:
  • § "Checklist-accuracy findings", from the main runner: access-security, ai, search, api-backend, approvals, cli, integration-system, platform-core and records-forms. Some lines are cut at about 200 characters in that comment; where a line below ends early, re-measure on the item.
  • § "The two PM-carried readings".
• The cloud slices' reports on qa(checklist): run the whole platform checklist on main (selector all, 272 items) and extract every new failure into its own card #23878:
  • 6216199424: dashboards;
  • 6216468427: automation;
  • 6216550639: studio-authoring;
  • 6216631966: identity-auth;
  • 6216814713: attachments-storage, i18n and ux-conventions.
  • The last sections of records QA run · area:i18n (5/5) · 2034975a · 2026-10-16 · 4 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #23951 and QA run · area:ux-conventions (3/3) · 2034975a · 2026-10-16 · 0 PASS / 0 PARTIAL / 3 FAIL / 0 BLOCKED / 0 NOT-RUN #23953.
• The qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879 report 6215306571, out_of_scope_findings: the stale existing items and the two carried readings.

Already landed or dropped (not in scope here)

• PR docs(qa): re-point six stale platform-checklist clauses across five items to the shapes their rulings shipped #24000 (platform-checklist: 6 clauses across 5 items pin shapes the product has since ruled away (found by the #23878 full run on 94114c1f) - re-point each (family card) #23950) landed:
  • ai.mcp-stdio-fail-closed clauses 6 and 1;
  • all of cli.migrate-meta-codemod, r5, including the protocol-18 and step-8 notes;
  • approvals.approver-resolution-matrix clauses 4 and 5, plus the team and manager fixtures;
  • platform-core.shell-nav-personalization clause 5;
  • platform-core.activation-ledger-row-contract clause 4.
• PR docs(qa): re-point identity-auth.api-key-ui-lifecycle's revoke oracle to 403 API_KEY_REVOKED #24012 landed identity-auth.api-key-ui-lifecycle A2 (403 API_KEY_REVOKED).
• Findings on those revised items that still hold on main fd0e72a are listed below, marked "(residual)".
• Dropped as disproved: qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879's "platform-core.shell-nav-personalization drag reorder removed (unchecked)". QA run · area:platform-core (30/30) · 94114c1f · 2026-10-16 · 27 PASS / 1 PARTIAL / 2 FAIL / 0 BLOCKED / 0 NOT-RUN #23939 drove pointer and keyboard reorder on clause 2, and both passed.

access-security

• capability-declaration-lifecycle:
  • sys_capability is no longer a registered object (GET /data/sys_capability → 404 OBJECT_NOT_FOUND), yet steps 7–8 still describe a sys_capability upsert (qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879 flags this too).
  • Step 3 says not to probe /api/v1/actions/…, but the dispatcher's /actions domain is mounted at /api/v1/actions/:object/:action[/:recordId] and enforces actionPermissionError. Name it as the surface to drive.
  • The REGRANT step edits showcase_ops, which is now sealed (PUT /meta/permission/showcase_ops → 403 NOT_OVERRIDABLE, ADR-0126). Use a scratch or cloned set carrying showcase.export_data.
• record-share-grant-revoke (carried reading, confirmed): source[1] says the record-shares family is "registered inline, under no registrar of its own". In fact registerSharingEndpoints (packages/rest/src/sharing-routes.ts L101) registers GET/POST …/:id/shares and DELETE …/shares/:shareId.
• crud-permission-matrix:
  • knownGaps[4] ("A1 is a KNOWN FAIL until [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057") is stale. [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057 closed on 2026-10-08; the seeded sys_business_unit rows carry organization_id, and the delegate's in-subtree sys_user_position create answers 201.
  • access-matrix.json has 45 rows (41 showcase_* plus 4 delegate × sys_*). Fixtures, knownGaps and steps still say 47 rows and 6 delegate rows.
• sharing-rules-widen:
  • The position-audience variant is confounded. The manager position binds showcase_manager, which has readScope org on showcase_contact, so the audience member sees non-matching contacts through depth (explain decidedBy depth).
  • Step 7 / clause 5 (A13) says "edit a materialized share", but sys_record_share is get/list only (PATCH → 405). The editable seeded artifact is the sys_sharing_rule row.
• write-path-guards: the steps leave out wire shapes:
  • createMany takes a bare JSON array, and updateMany takes {records:[{id,data}]};
  • the bulk run stops at the first validation failure by default (later rows NOT_ATTEMPTED), which clause 6's mixed-outcome step has to account for.
• readonly-package-locks-studio, step 5:
  • The POST /api/v1/packages install door needs a manifest with type (for example app), or it answers 400 VALIDATION_ERROR.
  • An object authored into the scratch base needs sharingModel, or it answers 422 security-owd-unset.
• fls-mask-and-strip, clause 3: it asks for the disabled state of three budget controls, but the edit form renders only budget and spent. budget_remaining is a formula and is not on the form.
• audit-log-browser, clause 0: a fresh member is refused sys_audit_log at object level (403), rather than being served an empty filtered list.
• share-link-landing-page: knownGaps[2] and history r2 say objectui 1fb1ced36243 is "still this repo's .objectui-sha". The pin is now daeb77fc84dd, and the behaviour still holds there.
• share-link-capability-tokens:
  • Clause 8 says public routes carry "exactly" Vary: X-Share-Password, X-Share-Password-Encoding. Live answers append Origin (the CORS middleware), and authenticated routes carry Vary: Origin. Reword it to "Vary includes".
  • qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879 also marks the item stale against v18's combined gates; see the new access-security.share-link-combined-gates.
• sharing-rule-authoring-ui:
  • knownGaps[0] says four rules are seeded and none covers showcase_contact. Stock serves two, one of them "Key-Account Qualified Contacts → Managers" on showcase_contact (position manager).
  • fixtures/source cite objectui plugin-sharing/src/sharing-plugin.ts#nav_sharing_rules, which does not exist at daeb77fc. The Setup nav comes from platform-objects' setup app.
• record-view-read-audit:
  • The install line logs at INFO and os dev defaults to warn, so "boot log lacks install line" is vacuous on a default boot. The steps should set OS_LOG_LEVEL=info.
  • The configured half has no stock fixture. A scripted scratch-copy recipe is worth adding: symlinked node_modules plus @objectstack/plugin-audit and @objectstack/platform-objects.
• platform-owner-email-anchor: the step order runs the malformed variant while M is still unverified, so its refusal cannot be told apart from the unverified arm. The well-formed-sibling check only bites once M is verified. Reorder the steps.
• public-form-intake:
  • Clause 1 speaks of "the server-stamped owner", but the landed anonymous row's owner_id is null. The forged value is stripped either way.
  • /forms/contact-us redirects to /_console/f/contact-us; /_console/forms/:name is the authed internal route.
  • The heading showing the raw view name is product-side; see the end of this card.
• activation-write-operator-gate: no API exposes the tenancy posture. The proof used was the boot banner line "Tenancy: single"; the item should name it.

ai and search

• ai.mcp-validate-expression: fixtures and steps name showcase_task.est_hours, but the field is estimate_hours (est_hours answers "unknown field").
• ai.mcp-run-action-exposure-gate, step 1: it calls list_actions with objectName. list_actions takes no arguments and refuses it with -32602 (unrecognized key).
• ai.mcp-http-surface, clause 4: the tool list omits resume_run, which tools/list now returns.
• ai.agent-tool-skill-metadata-roundtrip, clause 3: it says a GET with ?mode=draft serves the active item or 404s. It now answers 400 VALIDATION_ERROR "The mode query parameter is not supported by this endpoint".
• ai.mcp-stdio-fail-closed (residual): os start sign-in needs an Origin header (403 MISSING_OR_NULL_ORIGIN). This is a runner note for minting keys on the start boot.
• ai.skill-instructions-mcp-prompts, step "flip active, reload metadata": under os dev, /meta serves the built dist artifact, so a restart alone leaves /meta stale against the MCP projection. Rebuild before re-listing.
• search.pinyin-flag-both-sides, clause 2: it lists wf as an account initials form, but wf is 王芳, a contact. The roster numbers 48/47 are now 52/51.
• search.global-search-skips-unreadable: knownGaps calls pinyin OFF "the stock default". On showcase the flag defaults ON through the zh-CN locale.

api-backend

• error-envelope-ledger, step 6: it uses options {atomic:false}. batch.zod strips that, so the batch succeeds (200, creates a row). The BATCH_NOT_ATOMIC sample needs a top-level atomic:false, as batch-transactional-discovery already says.
• bulk-write-contract:
  • updateMany/deleteMany are id-based (records[{id,data}], ids[]), so the steps' "where clause" body answers 400 VALIDATION_FAILED.
  • The baseline member holds no allowDelete on the target object.
• package-rest-lifecycle, step 2:
  • The manifest's scope: 'custom' is invalid; the allowed values are cloud|system|project, and anything else answers 400.
  • The semver message reads "version must be a SemVer 2.0.0 string (e.g. 1.0.0, 2.0.0-beta.1)".
• route-ledger-live-parity: the REST ledger carries 18 families, since reports was retired (retire the saved-report stack — sys_saved_report / sys_report_schedule, /api/v1/reports, client.reports, IReportService, the reports capability and @objectstack/plugin-reports (zero consumers; not the report metadata kind) #20102). "19 REST families" and the variants list are stale.
• server-timing-admin-gated: the span list total/auth/db/hooks/serialize is stale. The hono adapter emits parse, db, serialize, handler and total.
• rest-metadata-config-contract: the masking step names showcase_account, but no stock persona has FLS there. The stock FLS fixture is showcase_project, where client_liaison cannot read budget/spent/budget_remaining.
• aggregate-contract-matrix: neither named restricted persona gives a differing visible set. Mei is refused 403 at the object gate, and Ada is VAMA. Use search:qa-contributor-bound-member.
• batch-transactional-discovery: the fixture says showcase_task accepts baseline creates, but a create needs the required project lookup.
• enforce-or-remove-authoring-gates: no concrete "silently-stripped-by-design display annotation" key is named, and none was found in spec docblocks. Name one, or drop the leg.
• retired-def-refusal: RETIRED_DEFS entries are schema-export definitions with no metadata-type binding or stack collection. "A stack that declares metadata of each sampled retired type" can therefore only be an invented key; reword the step.
• declarative-endpoint-execution: os build reports "3 APIs" on stock showcase, while the fixture text names two.
• date-range-preset-matrix (from qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879): the rolling presets now end today.

approvals

• approver-resolution-matrix (residual): the fixtures still call approver-bindings.flow.ts "a DRAFT designer specimen, not a runnable fixture". Draft flows fire their triggers, so every showcase_field_zoo update opens an admin_rescue request. Reword this once app-showcase: showcase_approver_bindings is status: 'draft' on the belief that draft "keeps it out of the runtime" — draft flows fire, so every showcase_field_zoo edit opens an admin_rescue approval request on the org admins #23965 settles the showcase flow.
• ooo-delegation-reroute: the knownGap "authoring the scratch flow needs a writable/scratch package" is stale. POST /api/v1/automation registers a runtime flow on stock showcase. The same holds for approver-resolution-matrix and status-mirror-field.
• record-page-decisions:
  • The both-sides clause should name a non-override persona: the dev admin sees Override Approve/Reject on a record routed away from them.
  • The item's route /apps/showcase_app/showcase_project/:id is not the served one; re-measure it.
• pending-count-surfaces: knownGap The Account app's Notifications entry 403s for every non-admin — no permission set grants sys_inbox_message #7344 ("a plain member's notification count is structurally 0") did not hold. nina (contributor and finance positions) saw "2 notifications".
• per-group-signoff, clause 5: the wording ("actorId is a hint … regardless of any actorId") describes a silent override, but the server refuses a mismatched actorId with 403 "cannot act as". Align the wording with the stricter behaviour.
• decision-action-matrix: request-info is approver-only (the admin got 403 after reassigning away), so that step needs the pending approver.
• email-action-token-door: the step "reassign the bound approver away first" needs the approver themselves or a from-slot. An admin reassign replaces the caller's slot, so the target token stays live.
• quorum-m-of-n: the drawer's "N eligible approvers" counts duplicate slots. That is product-side (approvals: the decision-progress line's "N eligible approvers" counts pending_approvers slots, so one person holding two slots is counted twice (5 eligible shown for 3 people) objectui#12781), with no ledger edit.

attachments-storage

• attach-requires-parent-edit (from qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879): a non-reader outsider now gets 404.
• download-authz-both-sides, step 7: persona B never reaches the panel. The reachable shape is a stale panel after the grant is revoked.
• sys-file-status-pipeline, step 8 vs step 9: the hooked attach un-tombstones before any download.
• upload-session-abort, step 8: a bogus eTag list now answers 409 before the backend is called, so failed is reachable only through the test seam.
• field-accept-maxsize-server-enforced, knownGaps WIRE-ENVELOPE and clause 2: the wire is now 400 ERR_FILE_CONSTRAINT with prose, not a sanitized 500.
• qa-scratch-authz recipe, step 6: members hold no baseline grant on runtime-authored objects. Pin the three permission-set payloads; their bodies are in QA run · area:attachments-storage (9/9) · 2034975a · 2026-10-16 · 9 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23929.

automation

• trigger-type-matrix, time-relative-trigger and RUNNER: the schedule and time_relative legs need OS_AUTOMATION_SCHEDULED_WORK_ENABLED=1; on a default boot both showcase flows are unbound by deployment policy. qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879 flags the same, and also for platform-core.notification-center.
• flow-node-type-matrix, flow-error-handling, packaged-flow-subflow-disable-refusal, connector-dispatch-matrix and flow-toggle-kill-switch: "POST a task, PATCH done" fails as written. showcase_task requires project, and status → done is allowed only from in_review (task_status_flow).
• trigger-status-contract, clause 3: the qa-flow-status-doors recipe's qa_always_fails should author an errorMessage, or details.errorMessage never appears.
• connector-dispatch-matrix and RUNNER: GET /automation/connectors exposes no baseUrl. The premise-guard step and RUNNER's self-URL fact point at a key that isn't there.
• packaged-flow-disable-durable, clause 2: the activation-ledger boot line logs at info, so the log corroboration needs --log-level info (dev defaults to warn).
• packaged-flow-clone-contract, clause 6: the automation: a cloned packaged flow reaches no Studio surface — the clone is stored with no package, and every Studio Automations rail lists only package-scoped flows #21332 expected-fail is stale. Studio /_console/studio/~org/automations lists and opens the package-less clone.
• flow-runs-page-test-trigger, step 2: the step names the label "Batch Task Reminders (Loop)", but the picker shows machine names. That is a product defect (console Flow Runs page: the flow picker shows only machine names — it reads the label from it.spec.label, but meta.getItems('flow') serves flattened items whose label is top-level objectui#12783), so leave the step as written.
• flow-node-type-matrix, http node: the stock owners need egress. Success was located on a self-pinging scratch flow; name that recipe.

cli

• hook-body-extraction-gates: the clause 6 EXPECTED-FAIL has flipped. The default build prints "N handlers could not be lowered…" with per-hook reasons, and --json carries bodyExtractionWarnings. The title, the clause and the knownGaps ("invisible on a default build") are stale (qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879, 22853).
• build-own-contract, step 6 (排查「手抄 spec 清单 + "keep in sync" 注释」模式:一天内确认三例,全部曾静默漂移 #3786 undeclared key): as written this is now a hard refusal, because object, field, report and enable shapes are closed. The advisory is reachable only at a nested strip-mode site (for example a field's visibleWhen) under defineStack(…, {strict:false}).
• dev-automigrate-policy: the fixture and steps are stale.
  • A config-declared datasource named default is refused by defineStack.
  • required: true no longer makes a NOT NULL column (storage.notNull, ADR-0113).
  • relax_not_null is needs_confirm, not safe.
• migrate-duplicates-inventory, step 5: the index recipe is stale. sys_metadata has no organization_id, and idx_sys_metadata_overlay_active is (type,name,package_id,bundle_member).
• doctor-health-report: orphan-view staging needs defineStack strict:false. The default load refuses it, and doctor then skips config analysis.
• dev-boot-contract: the variant "config-declared default datasource" is a datasourceMapping {default:true, datasource: NAME} rule; a datasource literally named default is refused.
• scaffold-console-first-paint:
  • It probes port 3000, so runners confined to a port range must use OS_PORT/-p.
  • The published scaffold serves its own console, so this item does not exercise the vendored .objectui-sha bundle.
• datasource-introspect-codegen: wiring the draft into a scratch config requires the manifest namespace to equal the draft object's prefix.
• scaffold-first-run (from qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879): skills now come from @objectstack/skills.

dashboards

• cube-query, clause 0: the verify text says "the meta response's cubes[] entry", but the wire is a bare array under data; there is no cubes wrapper (analytics.zod.ts).
• dataset-report-authoring, clause 5: "open_block totals + done_block totals == unfiltered totals" cannot be computed as written, because the blocks carry different measures. Reconcile it per measure.
• chart-type-matrix fixture requires[2]:
  • The compareTo probe needs a dateRange.
  • On the stock seed the previous 90-day window is empty, so the item needs tasks older than 90 days.
• system-overview-live-counts, clause 1: add a step that revokes or expires one session first.

i18n (record #23951 notes)

• notification-localized-and-clears: knownGaps[0] and step 2 are stale.
  • sys_user.locale exists, and the avatar switcher writes zh-CN.
  • The notify node has a per-recipient template path.
  • Tokens use {{ record.title }}.
• studio-follows-app-locale and surface-matrix: the cited "451 untranslated declared labels" is now 414 (scripts/i18n-coverage-baseline.json).
• studio-follows-app-locale, clause 0: the premise is wrong. The Studio object editor's strings come from objectui's metadata-admin catalogue, not the served metadataForms group.
• surface-matrix:
  • variants[5] still marks the view-empty-state variant blocked(fixture), but it runs.
  • acceptance[7]'s group counts are off: the spec declares eleven per-app and twelve platform groups.
  • The automated.ref revision is stale.
  • The dashboards and pages steps should name the translated widget key and a platform page.

identity-auth (report 6216631966)

• Mail capture in self-service-password-reset, email-verification-loop and implicit-account-linking-ownership: EMAIL_TRANSPORT_PROVIDERS is a const, not an env switch, and LogTransport logs no body or link. Name the sys_email row (admin GET /api/v1/data/sys_email) as the capture oracle.
• self-signup-gate (step 6 / A4) and first-run-owner-bootstrap (step 8 / A4): on an OS_DISABLE_SIGNUP boot, an uninvited forge is refused first by the audience gate (403 SELF_REGISTRATION_CLOSED). Only an invited address reaches the toggle (400 EMAIL_PASSWORD_SIGN_UP_DISABLED). Say which address proves which door.
• self-signup-gate: the knownGap is stale. The open posture through the env door is now measured live.
• email-verification-loop:
  • A2: verify answers {status:true,user:null}, so don't imply a user object.
  • A3: a consumed token for an already-verified user answers a silent 200.
• two-factor-verify-to-activate, A1 / step 3: the cookie-lane TOTP_NOT_ENABLED branch is unreachable over HTTP.
• two-factor-enrollment-reveal, A4: get-totp-uri re-reveals the same secret. "Shown only once" holds only for backup codes; reword it or record that as accepted design.
• two-factor-backup-codes, step 8: it cites "step-5 regenerate", but the regenerate is step 4.
• api-key-ui-lifecycle (residual):
  • showcase_task returns the same rows to member and admin, so it cannot discriminate; use sys_session.
  • The Integrations page is at /_console/apps/com.objectstack.account/developer/integrations.
• session-list-revoke:
  • revoked_at and revoke_reason live on the revoked view.
  • The owner's raw list includes their own tombstones.
• workspace-org-switch: the sentinel-absent check holds only under isolated.
• invitation-scope-gates:
  • Step 7: cancel is owner/admin only.
  • The invite affordance lives at /_console/apps/com.objectstack.account/sys_invitation, which no nav entry links to.
• org-membership-team-management, A4: name an org-membership-scoped oracle, because everyone baseline reads survive remove-member on the single posture.
• admin-lifecycle-operations: Impersonate is only in the Users list row menu.
• linked-accounts-social:
  • sys_account apiMethods are live [get,list,aggregate,export]; r4 on main still says ['get','list'].
  • link_social is retired, so A3 cannot discriminate.
  • The callbackURL lands on the "All" tab.
• sso-enforced-first-paint:
  • Step 5 is outside the console's watchdog, which covers only the hung sign-in request (20 s).
  • The sign-up half of A2 cannot discriminate on invite_only showcase.
• auth-method-matrix:
  • The no-SMS state needs NODE_ENV=production.
  • Generic oidcProviders surface as socialProviders[] of type oidc, while features.sso tracks only @better-auth/sso.
  • Magic-link is off on stock (404).
  • Generic OIDC is drivable with a localhost IdP.
• oauth-app-consent-loop, step 2: create-client defaults to type web, which refuses http and loopback redirect URIs. Use an https non-loopback URI.
• Design observations to rule on, not edit:
  • two-factor-disable-lifecycle: an MFA-gated admin gets 403 MFA_REQUIRED on PUT /api/settings/auth.
  • two-factor-enrollment-reveal: the secret re-reveal noted above.

integration-system

• job-scheduled-run:
  • Fixtures and steps do not name OS_AUTOMATION_SCHEDULED_WORK_ENABLED.
  • acceptance[4] calls the enabled:false skip LOUD, but it logs at debug.
• notify-inbox-delivery, acceptance[4]: it says the dispatcher records the dead-letter. In fact emit refuses the delivery row up front (WARN "refused 1 delivery row(s)…"), and no sys_notification_delivery row exists.
• external-datasource-federated-read: OData $filter is refused with 400 INVALID_FILTER. The JSON filter param and top work.
• email-template-render, knownGaps[1]: name the workable door, a scratch notify flow authored through POST /api/v1/automation that lands in sys_email.
• notification-preference-suppression, acceptance[4] "with locale fallback": the store ladder only walks down (en-US → en), so a recipient with no locale resolves en and an en-US-only template row is never used. Author the fixture row at a locale the ladder reaches.
• flow-connector-picker: the picker is a native datalist that a screenshot cannot show open. Say to read it from the DOM.
• webhook-lifecycle: creating a showcase_task needs project.

platform-core

• settings-hub-roundtrip:
  • steps[1]: on os dev --seed-admin the dev seed already writes localization.timezone at tenant scope.
  • Clause 11 / steps[11] expect anon 403 SETTINGS_FORBIDDEN. The ADR-0056 D2 floor answers 401 UNAUTHENTICATED first.
  • Clause 7 names sys_setting.value_enc, but global-scope secrets live in sys_platform_setting.value_enc.
  • steps[3] has no stock observable for the analytics date bucket.
• metadata-authoring-roundtrip:
  • steps[1]: a plain PUT saves state=active. ?mode=draft is required, and view names must be qualified (OBJECT.view).
  • Clause 2: the create form is /_console/apps/showcase_app/metadata/page/new, and Page type defaults to "list".
• manifest-install-contract:
  • The steps use scope:"custom", which is refused.
  • The legacy engine.objectstack range must be full semver (^17.0.0).
• app-management-toggle, knownGap and clause 5: it is 403 ITEM_LOCKED, not NOT_OVERRIDABLE. Delete shows an info toast on reset:false.
• shell-nav-personalization (residual): the favorites star is in the record header's More actions menu ("Add to favorites"), and nav pinning is under the per-entry More actions menu. There is no hover pin button and no star button.
• notification-center:
  • GET /notifications?view=mine rows carry no notification_id.
  • The scheduled-digest fixture needs OS_AUTOMATION_SCHEDULED_WORK_ENABLED (qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879).
• activation-ledger-registration-home, acceptance[3]: sys_automation_run is a same-answer parity check (both undefined), not an anti-vacuity control.
• activation-ledger-row-contract (residual):
  • The 405 allowed set is [get,list,aggregate,search,export], not apiMethods ['get','list'].
  • PRAGMA also lists a __search column.
• packaged-object-extend-only, steps[2] (qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879 too): the NOT_OVERRIDABLE refusal now reads "provided by a managed package and is sealed", in one sentence.
• marketplace-install-local-lifecycle: storageDir sits on the listing envelope, not on each entry.
• marketplace-console-honesty, steps[2] / acceptance[2]: reseed and purge are in the package Details page's "More install options" menu (objectui#11627), not on the Installed Apps list. The stale note is objectui#12684.
• lifecycle-retention-sweep: the knownGaps say there is no telemetry datasource on stock. Stock serve now provisions one (data.telemetry.db).
• seed-mode-matrix:
  • The seed body refuses a name key, and a scratch object needs sharingModel.
  • Replace routing is at seed-loader.ts ~2650, not :2106.
• settings-audit-secret-fingerprint: the non-secret digest is FNV-1a 32 (fnv32:) of canonical JSON, not SHA-256. Step 6, acceptance[4] and the N4 control must compute FNV-1a.
• keyboard-shortcut-surface: the settled inventory matches steps[3] at daeb77fc too; update the pin note.

records-forms

• concurrent-edit-conflict:
  • (Carried reading, confirmed.) source[] cites packages/rest/src/approvals-routes.ts#mapping for CONCURRENT_UPDATE → 409. That map (L106–127) has no such row. The row is in packages/types/src/data-error-classification.ts (~L1046), and the error class is in packages/metadata-protocol/src/protocol.ts (~L2887).
  • Step 5 / acceptance[2] say "in B choose Reload". The modal-form dialog offers only Keep editing and Overwrite; Reload exists on the inline-edit ConcurrentUpdateDialog.
• validation-rule-type-matrix:
  • variants[3] says cross_field names end_date, but the server targets fields[0] = start_date.
  • The write answer now carries warnings[] (qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879).
• adhoc-filter-sort-builder:
  • The toolbar filter and sort live in sys_user_preference (objectui#12418), not in localStorage list-filters:….
  • The negative should say whether uf__sort counts.
• list-view-capabilities:
  • The console sends filter/top/skip/search/sort without $.
  • The aggregate dispatch body carries _selectedIds at the top level, to /api/v1/apps/showcase/recalc.
  • Name a fixture with more rows than the page size.
  • Export sits in the Display popover footer.
• crud-roundtrip, negative[0]: the Lifecycle select cannot be emptied; use Account Name.
• field-type-matrix, clause 1: the richtext, markdown, html and code widgets are textarea-based by design. Say what counts.
• action-location-matrix, steps[3]: select a row before the toolbar dispatch.
• object-hook-lifecycle:
  • The ctx.log.info oracles need OS_LOG_LEVEL=info.
  • An uncompilable condition is refused at authoring (422), so the fail-closed scratch must be runtime-unevaluable.
• predicate-relationship-traversal, acceptance[1]: the 400 carries the authored message, not the rule name.
• grid-personalization:
  • Column state and row height now also persist to a user-scoped sys_user_preference.
  • Step 4: summarizeField totals are a kanban config; the grid shows counts.
  • Step 6 has no row-color authoring surface named.
• field-group-visible-when, step 2: the scratch needs highlightFields (for example ['kind']) for the detail half to be observable.
• lookup-picker-create-new, step 6: the picker debounces, sending one request per settled term.
• import-job-undo-cancel: no showcase object has name/email/status, so name the scratch object.
• field-unique-enforcement, acceptance[0]: on SQLite the object-naming sentences are in developerMessage; the user-facing error is generic.
• cascading-multilevel-and-clear, step 2: the canonical URL uses showcase_app, not the package id.
• conditional-rules-grid (QA run · area:records-forms (40/40) · 94114c1f · 2026-10-16 · 39 PASS / 1 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23949 note for the next author): the objectui pin asserts only the inline required flag. A client-blocked grid save still sends one batch, which the server refuses; this is by design, per the recheck 6218243967 item 13.

studio-authoring (report 6216550639)

• org-override-registry-gate: the variants still say "field (… create open)", but field has had allowRuntimeCreate:false since meta-field-write-inert: an accepted field PUT never reaches the object — a runtime-created field is stored valid=true and is absent from fields forever #7893.
• metadata-diagnostics-sweep, clause 1: the envelope's lock is absent from the default GET /meta/TYPE/NAME by design. Name GET /meta/TYPE/NAME/layers in the verify text.
• object-designer-roundtrip:
  • In a namespaced writable package the object must be NS_repair_asset.
  • /apps/com.objectstack.studio/… renders in Showcase chrome.
• draft-publish-lifecycle, clause 6:
  • "Changes · n" is now a numbered pill (objectui#12459).
  • Stage the draft in a writable package.
• packaged-automation-studio-lock:
  • Clause 1: the forged write answers 403 ITEM_LOCKED or NOT_OVERRIDABLE, not 422.
  • Clause 2 / step 4: the reason is in aria-describedby and a tooltip, not in a title (objectui#12303).
• packaged-display-class-direct-edit:
  • The banner text is "This item is locked and cannot be edited or deleted."
  • The showcase ships individual views, not a container.
  • system_overview /layers reports com.objectstack.plugin-auth.
• permission-matrix-editor-ux, clause 5: there are three read-only reasons, and the type gate is unreachable on stock.
• custom-page-source-tiers, step 8(a): the compile panel is reachable only for a page in a writable package that an app's nav references.
• doc-on-app-menu, knownGaps: daeb77fc is past the fork window.

ux-conventions (record #23953 notes)

• write-feedback:
  • The knownGaps are stale at daeb77fc: Save All toasts "1 row saved", Discard gives feedback, and Approve toasts Approved "EXP-2001".
  • acceptance[3] should admit "blocked in the browser, no request".
  • The approvals and inline-edit variants name the wrong surfaces.
• disabled-control-reason, knownGaps[1]: this is stale for Studio Publish and import Next, which are now keyboard-reachable with a description.
• labels-over-machine-names:
  • knownGaps[0] (objectui#11862) is mostly stale.
  • Clause 3 does not say whether ADR references in server prose, or tracker ids in authored labels, count.

Not ledger edits (dispositions, so nothing is lost)

• Product defects found inside these sections:
  • The public form page heading shows the raw view name. This is the same root cause as meta read: a view stored with no label is served with label = its qualified name (recheck_gate.default), invented by the read-side translator, so the console view tab shows the machine name #23967: GET /api/v1/forms/:slug serves label: match.view?.label, which is the machine-name fallback when no label is authored. It goes to meta read: a view stored with no label is served with label = its qualified name (recheck_gate.default), invented by the read-side translator, so the console view tab shows the machine name #23967 as a second surface.
  • The approvals "N eligible approvers" count includes duplicate slots: approvals: the decision-progress line's "N eligible approvers" counts pending_approvers slots, so one person holding two slots is counted twice (5 eligible shown for 3 people) objectui#12781.
  • The Flow Runs picker shows machine names, because it reads only spec.label while listed items are flat: console Flow Runs page: the flow picker shows only machine names — it reads the label from it.spec.label, but meta.getItems('flow') serves flattened items whose label is top-level objectui#12783.
• From qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879's report (6215306571):
  • ADR-0131 C8 (applyTenantScope still carries .orWhereNull) is feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212's scope. That card is open and carries protocol 18.
  • POST /api/v1/keys dropping unknown body keys is the documented whitelist, in the safe direction: by design.
  • The dormant flow-start-admission arm needs a third-party automation service without getFlow, and the in-tree engine has one. Not filed.
  • The registry-id pin counts (12 of 72 MAJOR_18_CONVERSIONS, 297 of 389 18.* semantic entries, and two retirements with no pin: the discard-overlay route 15204-s7pre and os meta resync 15204-s6b2a) are a coverage input for the next checklist-author sweep.
  • The plugin-audit reactions CHANGELOG line is changelog(plugin-audit): the published 18.0.0-next entry still says stored comment reactions "are not converted" and are gone after the upgrade — os migrate comment-reactions (23281) converts them; amend the entry, not an erratum #23938. Changeset 22360's sys_position wording could not be located on main or in history, so it is unverified and not filed.

Dedupe

• MCP search_issues on objectstack-ai/objectstack, closed included, query platform-checklist revise stale items checklist-accuracy findings knownGaps full run follow-up ledger card: 260 hits, top 10 read. Only qa-run records (QA run · ai.mcp-stdio-fail-closed (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23995–QA run · platform-core.activation-ledger-row-contract (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23999 from PR docs(qa): re-point six stale platform-checklist clauses across five items to the shapes their rulings shipped #24000's re-run, and this wave's), plus platform-checklist: 6 clauses across 5 items pin shapes the product has since ruled away (found by the #23878 full run on 94114c1f) - re-point each (family card) #23950 (closed, its six red clauses), matched; no open ledger card covers these items.
• Re-run at filing, sorted newest first: platform-checklist revise stale items checklist-accuracy findings knownGaps ledger follow-up → 247 hits, newest 8 read: the qa-run records QA run · ai.mcp-stdio-fail-closed (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23995–QA run · platform-core.activation-ledger-row-contract (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23999, Audit log: confirm the sys_user_preference exclusion (#23804) reaches a published platform; HotCRM on 18.0.0-next.2 still logs every ui.recent write #23961 (audit-log exclusion, unrelated), and this wave's closed records and platform-checklist: 6 clauses across 5 items pin shapes the product has since ruled away (found by the #23878 full run on 94114c1f) - re-point each (family card) #23950. No open ledger card exists. git log fd0e72a..origin/main -- docs/qa/platform-checklist/areas/ is empty, so no finding above has been fixed since it was measured.
• The two PRs that touched these items since the run are docs(qa): re-point six stale platform-checklist clauses across five items to the shapes their rulings shipped #24000 and docs(qa): re-point identity-auth.api-key-ui-lifecycle's revoke oracle to 403 API_KEY_REVOKED #24012 (git log origin/main -- docs/qa/platform-checklist/areas/). Their scope is excluded above.

QA-source: #23878 · wave close-out 6216941109 · checklist-accuracy
QA-source: #23879 · report 6215306571 · stale existing items