[sweep] v18.2.0 release test sweep #25807

Activity

1. objectstack-fleet

   added

   documentationImprovements or additions to documentationImprovements or additions to documentation

   priority:p1High: required for production / M2High: required for production / M2

   domain:devx

   target:v18

   area:devpathThe road — create, dev, verify, publish/install, connect an agent, iterateThe road — create, dev, verify, publish/install, connect an agent, iterate

   on Oct 25, 2026
2. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   From #25815 (release-18.2.0-tier1, 156 items) — §2 checklist-accuracy findings, part 1/2 (areas: access-security, ai, api-backend, approvals, attachments-storage, automation, cli, i18n, identity-auth, integration-system, platform-core). Each line is a ledger edit for the lane owning docs/qa/platform-checklist/**: revise the item, bump revision, append history citing #25815. Clause labels: aK = acceptance[K], nK = negative[K].

   Highlights (each is also in the list below): stale clause text — records-forms.field-unique-enforcement a4 still says org-less rows fold to ONE bucket while both pins assert they are exempt (ADR-0131 D1); cli.dev-automigrate-policy a4/n2 name two ADR-0120 D4 tightening cases that no longer exist (the file now asserts "no tightening proposed", ADR-0131 D1); records-forms.conditional-rules-header a2 claims a client lock on tax_rate the spec asserts the opposite of (objectui#13436). Refs that miss their own pins: e.g. access-security.no-active-org-session-semantics (two HTTP dogfood suites would cover a1–a3, n0, n1), attachments-storage.upload-session-abort, ai.mcp-coded-refusals-and-runtime-exposure, integration-system.email-template-render a3/a5, identity-auth.auth-method-matrix a3/a6/a9. Parser-hostile spellings: refs naming dropped files in prose (records-forms.conditional-rules-grid, records-forms.action-param-widgets, records-forms.adhoc-filter-sort-builder, records-forms.master-detail-atomic-save, records-forms.concurrent-edit-conflict), a brace glob in records-forms.bulk-select-all-matching, a source file named as a pin in access-security.rls-both-sides.

   access-security

   • access-security.activation-write-operator-gate a0/n2: ref claims the 'full posture x identity matrix' but automation-activation-posture-gate.test.ts has no caller-without-manage_metadata case; FLOW_ENABLEMENT_DENY_MESSAGE is asserted by no test in the repo
   • access-security.activation-write-operator-gate a1: action-activation-posture-gate.test.ts › REFUSES a caller without manage_metadata, in every posture asserts only toContain('manage_metadata') at the unit layer — not the 'functionally equivalent to deleting it' rationale nor 'a packaged action' subject, and it runs only single
   • access-security.activation-write-operator-gate a3: packages/qa/dogfood/test/packaged-activation-ledger-reach.dogfood.test.ts (not in ref) asserts one deployment-level row with no tenant column over HTTP, but as the dev admin, not a manage_metadata-without-platform_admin persona
   • access-security.activation-write-operator-gate a5: boot-log restart re-hydration corroboration is not covered by any pin (test half only)
   • access-security.anonymous-deny-surfaces a4: pin's /meta member contrast is .not.toBe(401), clause demands 200
   • access-security.anonymous-deny-surfaces a5: ref lists seven families but not the public-forms both-sides contrast; no pin covers it
   • access-security.anonymous-deny-surfaces n0: ref does not cover the post-DELETE authed GET /automation/showcase_reassign_wizard 200 read-back
   • access-security.anonymous-floor-v18-doors a1: the sweep's EVERYTHING_ELSE expectation checks status 401 + an error envelope, never error.code; UNAUTHENTICATED is asserted only in the unit pins (i18n, settings, api-description), none for /notifications, /keys, /share-links
   • access-security.anonymous-floor-v18-doors a3: DOOR_CLASSES[1] (share-link token face) uses REFUSED_WITHOUT_A_SUBJECT, which accepts 401 — the clause's 'not 401' is not asserted by any pin
   • access-security.anonymous-floor-v18-doors a2: rest-docs-viewer-retired.pin asserts no registration on RestServer/route manager; no pin compares GET /api/v1/docs to the never-served control path, anonymous and admin
   • access-security.anonymous-floor-v18-doors a4: the dogfood submit asserts 2xx and keys ['id'] on the showcase (step 4's forged owner_id/status not sent); exact 201 is asserted only by the Hono-transport pin over a protocol double
   • access-security.crud-permission-matrix ref: packages/verify/src/verify.ts / rls.ts (objectstack verify --rls) are a CLI proof, not test files — no pin here drives them; the object-level RLS half is unscored by the dogfood pins.
   • access-security.crud-permission-matrix a3: ref says the pin reaches clause 3; it probes only showcase_private_note (inquiry/invoice/invoice_line VAMA reads not asserted).
   • access-security.crud-permission-matrix a6: verify text says '45 rows × 4 verbs at revision 6'; the pin judges 41 rows (164 cells) and explicitly excludes the 4 sys_* rows, so clause 6 cannot be pinned whole.
   • access-security.crud-permission-matrix ref says 'showcase-permission-zoo pins on both sides' the delegate subtree gate: its out-of-subtree case asserts only non-2xx, not 403 PERMISSION_DENIED as the ref states.
   • access-security.crud-permission-matrix ref header comment in the pin says '6 showcase_field_ops_delegate × sys_* rows'; the ref and the pin's own assertion say 4 (2 retired).
   • access-security.deployment-tables-platform-only a0: packages/plugins/plugin-security/src/authz-identity-objects-boot-refusal.test.ts asserts SecurityPlugin's boot refusal when sys_user/sys_member/sys_organization are missing — nothing about the seven deployment tables or manage_platform_settings
   • access-security.deployment-tables-platform-only a1/a2: no pin drives either door over HTTP; both remain live-run clauses
   • access-security.fls-mask-and-strip a2: admin-side budget write (both sides of the lock) is asserted by neither pin, and the ref's STILL MANUAL list does not name it
   • access-security.fls-mask-and-strip a0: zoo FLS case asserts the name PATCH status only; the clause's 're-reads changed' leg is unpinned
   • access-security.grant-table-write-contract a1/a3/a4: api-oracle clauses are pinned only at the engine layer (real ObjectQL + SqlDriver, errors mapped by resolveThrownHttpError); no pin in the ref drives the /data door over HTTP for them
   • access-security.grant-table-write-contract a2: permission-set-assignment-window.dogfood.test.ts › 'the door refuses a window whose end is not after its start…' asserts [400, VALIDATION_FAILED] and fields [[valid_until, rule_violation]] only; the authored message, constraint absent/not 'unevaluable' and the valid-window 201 control are not asserted over HTTP
   • access-security.me-permissions-aggregation-parity a2: me-apps-and-everyone-baseline pin asserts only the member side (no gated app); the admin-sees-gated-app half is unpinned.
   • access-security.me-permissions-aggregation-parity a3: the anonymous trio's 200 shapes are pinned only in hono-current-user-endpoints.test.ts on a bare HonoServerPlugin with no auth service or auth gate — the 401-floor regression the clause guards is not reachable there; the dogfood anonymous /me/apps case asserts body.apps ?? [] only, never the status.
   • access-security.me-permissions-aggregation-parity a5: packages/plugins/plugin-hono-server/src/current-user-endpoints-localization.test.ts asserts the locale/timezone floors (unit) and is not in the ref.
   • access-security.meta-authoring-trail-and-audience-gates a2: meta-view-dashboard-audience-gate.test.ts drives RestServer with a mock server/protocol (unit) and covers list pruning + by-name refusal only — no /published, /layers or ?state=draft door, and no /history case for a studio.access holder lacking the view's requiredPermissions
   • access-security.meta-authoring-trail-and-audience-gates n0: the 304 assertion ('a caller who no longer holds the capability is never answered a 304…') exists only at the unit layer
   • access-security.no-active-org-session-semantics ref prose is stale: it describes a group CONTROL 'a NON-EMPTY membership set lands, even with no active organization'; on this tree that case is 'a NON-EMPTY membership set with NO active organization: an insert has nowhere to land, and is refused the same way' (asserts refusal)
   • access-security.no-active-org-session-semantics a1/a2/n1: packages/qa/dogfood/test/no-active-organization-write-refusal.dogfood.test.ts (HTTP 403 naming the missing org + nothing written) exists and is not in the ref
   • access-security.no-active-org-session-semantics a3/n0: packages/qa/dogfood/test/sharing-rule-org-less-caller.dogfood.test.ts (plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158 org-scoped manage_sharing holder over HTTP) exists and is not in the ref
   • access-security.no-active-org-session-semantics a7 (group, engine layer): packages/plugins/plugin-security/src/no-active-organization-insert-union-scope.test.ts (real ObjectQL + SqlDriver, group refusal and nothing stored) exists and is not in the ref; still in-process, not the live walled boot a7 requires
   • access-security.no-active-org-session-semantics ref says the pin 'pins every clause of this item at unit level' — a3, a4, a5, a6 have no case in it at any level
   • access-security.org-admin-assignment-boundary n2: the three-posture posture file only exercises admin_full_access out-of-boundary; the full set list (adminScope, platform-capability, org-admin sets, mcp agent ceilings) is asserted only by the unit gate in delegated-admin-gate.test.ts, not per posture
   • access-security.owd-sharing-matrix a0: verify's admin re-read of the denied PATCH is not asserted by showcase-private-owd (status only); clause text otherwise pinned; by-id GET asserted as not-200 rather than non-2xx
   • access-security.owd-sharing-matrix a2/a3/a5: ref implies all four OWD models pinned, but no pin covers modifyAllRecords bypass, public_read_write, or auditor VAMA
   • access-security.owd-sharing-matrix a4: showcase-invoice-cbp boots a test-local fallback set (showcase_cbp_member), not the showcase C1/C2 personas, and asserts no list exclusion; controlled-by-parent.dogfood.test.ts uses a synthetic cbp_account/cbp_note fixture, not showcase_invoice_line
   • access-security.parent-and-organization-write-guards a1/a2/n0: the walled organization-removal refusal and the unreadable-header parity are pinned only in-process (engine + SecurityPlugin over SQL drivers, thrown statusCode / resolveThrownHttpError) — the api-oracle legs have no HTTP pin; precedent QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 scored them PASS (rev 4) before the layer rule.
   • access-security.platform-owner-email-anchor n0: admin-standing-surface.test.ts never asserts ADMIN_STANDING_NON_TABLE_INPUTS (the OS_PLATFORM_OWNER_EMAIL non-table declaration n0 cites); the declaration is unpinned
   • access-security.platform-owner-email-anchor a0-a3: ref correctly records these as STILL MANUAL live-HTTP arms; unit pins do not score them
   • access-security.public-form-withdrawal-layers a0: ref concedes the no-organization read of step 4 has no end-to-end pin, so a0 cannot score from pins alone (the save 200 /env-wide/ and both doors 404 FORM_NOT_FOUND, landed 0, are pinned)
   • access-security.public-form-withdrawal-layers a2-a5: the rest pin is a unit (RestServer over a mocked protocol), the protocol pin an in-process protocol over a stub registry; both fit the [test] oracle
   • access-security.record-access-explain a1: ref 'explain vama_bypass case' asserts vama_bypass via in-process security.explain() (isSystem context), not the POST /api/v1/security/explain door the oracle names
   • access-security.record-access-explain a2/a3/n0: pin has no plain-member (deny-side) explain call; only the GET denial half is pinned
   • access-security.record-view-read-audit n0: the item says the ledger failure is 'reported once per process'; read-audit.test.ts '[finding] plugin-audit: a THIRD copy of both #15166 defects lives in read-audit.ts — process-wide boolean plus an unconditional datasource remedy #18247' cases pin once per CAUSE (a second distinct cause reports again at error) — item text is stale.
   • access-security.record-view-read-audit a4: verify cites sys_job as the excluded name; the pin probes sys_audit_log / sys_session, and no pin observes the AuditPlugin install line ('record-view auditing installed on N object(s)').
   • access-security.rls-both-sides a4: ref names packages/verify/src/rls.ts, a source file, not a test; no pin runs runRlsProofs over the showcase (rls-fixture/rls-multitenant dogfood run it on purpose-built fixtures only)
   • access-security.rls-both-sides a2/n0: the pin's foreign PATCH asserts only status >=300; the row-unchanged re-read the clause requires is pinned for a fixture object in packages/qa/dogfood/test/rls-fixture.dogfood.test.ts, not for showcase_private_note
   • access-security.security-catalog-activation-and-clone-doors a2: the audience-anchor 400 (everyone/guest) is asserted only in packages/runtime/src/domains/catalog-activation-door.test.ts (handler with fakes); the dogfood pin drives the 404 arm only
   • access-security.security-catalog-activation-and-clone-doors a3: dogfood clone pin drives 200 + dropped keys, 409 (another set's name), 404, bad-name 400, 403; anonymous 401, the source's own name 409 and the closed-body 400 are unit-only
   • access-security.security-catalog-one-holder-and-boot-report a1: packages/cloud-connection/src/marketplace-install-local-catalog-name-collision.test.ts (not in ref) asserts 422 PLUGIN_REGISTER_FAILED + nothing registered on POST /marketplace/install-local (in-process plugin, stubbed cloud fetch) — the ref's pins only reach manifest.register / boot refusal
   • access-security.security-catalog-one-holder-and-boot-report a2: permission-set-owner-registration.test.ts proves VALIDATION_ERROR/400 at registerApp, not on a permission-set save door; no HTTP pin for the save
   • access-security.security-catalog-one-holder-and-boot-report a3: CLI is run via MigrateSecurityCatalogOverlays.run in-process (oclif), not a spawned process — acceptable for the build oracle
   • access-security.security-catalog-one-holder-and-boot-report a4: catalog-reference-report.test.ts asserts the [security] error/info lines on a vi.fn logger; the ≤50-names cap is not visibly asserted
   • access-security.share-link-combined-gates a1/a2: packages/runtime/src/domains/share-links-refusal-order.test.ts asserts the anonymous no-password-oracle and email-audience identical-refusal rows but is not in the ref (in-process layer, would not score the api clause either)
   • access-security.share-link-combined-gates a3: ref names share-links-messages-audience.test.ts for acceptance[3]; its harness is in-process route entries (no Hono/HTTP), so it scores a0 only, not the api oracle
   • access-security.walled-environment-metadata-operator-only a2: single-posture leg is pinned as a manage_metadata holder below the operator (stronger than 'admin'); no case drives the seeded admin specifically on single
   • access-security.write-path-guards a4/a6: ref names owner-anchor-and-bulk-writes for bulk writes, but its bulk cases are engine-direct ql.update/ql.delete owner scoping — no createMany stamping, no per-row validation
   • access-security.write-path-guards a5: showcase-readonly-when-parent asserts single-row PATCH strips + header X-ObjectStack-Dropped-Fields; the mixed updateMany results[i].droppedFields leg and the line's product field are unpinned
   • access-security.write-path-guards a0: showcase-static-readonly asserts no droppedFields on the INSERT strip (verify names droppedFields)
   • access-security.write-path-guards n1: objectql pins use a recording/fake driver (real engine) and other objects, not showcase lead_score

   ai

   • ai.mcp-coded-refusals-and-runtime-exposure a1: packages/mcp/src/mcp-coded-refusal.test.ts ('<tool>: RECORD_NOT_FOUND from <member> answers code, message and status') asserts the clause at unit layer but is not in the ref
   • ai.mcp-coded-refusals-and-runtime-exposure a2: no pin drives query_records on an apiEnabled:false runtime object across a restart; plugin-runtime-object-metadata-copy asserts the metadata copy/listing only
   • ai.mcp-http-surface a3: the pin asserts status 401 only; the 'Unauthorized: a valid API key is required' wording and the OAuth WWW-Authenticate form are unasserted
   • ai.mcp-http-surface a4: the pin's tool-discovery case uses a session bearer token (not an API key), skips initialize, and checks two tool names, not the documented 12
   • ai.mcp-http-surface ref is bare (one file) while the item has six acceptance clauses: a0–a2 and a5 have no pin at any layer
   • ai.mcp-oauth-private-host-transport a0-a4: item is api/log-oracle throughout but the only pin (auth-manager.mcp-oauth.test.ts) is a unit test of isOAuthEligibleBaseUrl / AuthManager getters — no booted server, no log capture; it corroborates the rule but scores no clause
   • ai.mcp-oauth-private-host-transport a4: '… is reachable by no configuration key and no environment variable' (unit) covers the predicate half only
   • ai.mcp-stdio-fail-closed a0: the pin regex /OS_MCP_STDIO_API_KEY/ checks the var name only, not the remedy text nor 'the process does not serve'; scored from the verify's own oracle (plugin.start throws).
   • ai.mcp-stdio-fail-closed a1/a6/n4: no test in packages/mcp asserts the API_KEY_REVOKED arm ([Decision] API key 的生命周期与存放：到期上限与不活动失效取多长，key 继续放自有 sys_api_key 还是迁到 @better-auth/api-key（#23287 裁决 C′ 的留项） #23367) — grep for 'REVOKED' over packages/mcp tests finds none; ref is a single unit file for an item whose clauses are mostly live api/log.
   • ai.mcp-validate-expression a2: pin never runs the SAME expression under both sites (flow_condition case uses a different expression than the formula bare-field case)
   • ai.mcp-validate-expression a0/a1/a3: pin harness is a fake describeObject bridge, not the served MCP door the api oracle names
   • ai.skill-instructions-mcp-prompts a3: verify cites skill-prompts.test.ts as the pin, but it drives only an unknown name ('no_such_skill') through a stub bridge; a non-projected (inactive or instruction-less) name on prompts/get is not asserted
   • ai.skill-instructions-mcp-prompts n1: no pin asserts prompts/get refuses an inactive skill (only prompts/list omission is asserted)

   api-backend

   • api-backend.action-activation-door-contract a6: ref/verify says 'both owners named'; the ambiguity case asserts only messageOf(res) toContain('crm_account')
   • api-backend.action-activation-door-contract a5: ledger-reach asserts the key set via rows.find, never that exactly one row exists, and does not read the 200 body {name, objectName, enabled}
   • api-backend.action-activation-door-contract a2: ref claims 'unknown-key/non-boolean 400s' — pin asserts code VALIDATION_FAILED only, not fields[0] unknown_field/invalid_type or the non-object-body arm
   • api-backend.bulk-write-contract ref '(bulk halves)' overclaims: the pin's bulk cases call ql.update/ql.delete({multi:true}) on the engine with a resolved authz context; none of the createMany/updateMany/deleteMany HTTP doors the clauses name is driven, so no clause a0-a5/n0 is asserted
   • api-backend.bulk-write-contract a3: packages/rest/src/rest-batch-size-cap.test.ts pins BATCH_TOO_LARGE at the unit layer (mock protocol) and is not in this item's ref; it still would not score an api oracle
   • api-backend.data-request-shape-and-query-arity a1-a4: every pin invokes RestServer route handlers / HttpDispatcher.dispatch directly (real ObjectQL+SqlDriver for data-write-request-gate, data-delete-expected-version, data-conflict-caller-visibility; stubs for the arity files) — none boots the Hono adapter, so the api-oracle clauses stay a live leg
   • api-backend.data-request-shape-and-query-arity a1: the empty-version-token leg is in data-delete-expected-version.test.ts (DELETE), while the clause speaks of PATCH bodies + an empty version token — check the clause intends DELETE for the token
   • api-backend.declarative-endpoint-execution a1: no pin asserts the 401 body's code (UNAUTHENTICATED); showcase case checks success:false only, policy case status only
   • api-backend.declarative-endpoint-execution a2: spec gate (a) asserts the fix sentence but not that the message names the endpoint; the api 注册表条目声明 allowRuntimeCreate: true,但运行时创建的端点匹配器永远看不见 —— 声明的能力运行时不兑现(真实 boot 实测) #5488 runtime-authoring withdrawal is unasserted; the build oracle's os validate/os build run is not a pin
   • api-backend.error-sentences-and-unique-violation-wire-code a1: the verify names rest-hook-script-fault-envelope.test.ts for the 'live /data door' — that file imports mapDataError only, so the live leg is unit, not the door
   • api-backend.error-sentences-and-unique-violation-wire-code a2: dispatcher-unique-violation-wire-code.test.ts uses a real engine + SqlDriver behind HttpDispatcher; no Hono adapter, so the wire body is the dispatcher's result, not an HTTP answer
   • api-backend.meta-read-doors-v18 a4: no ref pin asserts the data-sort 403 on F (the 'two agree' half); showcase-fls-read-mask-strip.dogfood.test.ts has a sort-403 case but is not in this ref
   • api-backend.meta-read-doors-v18 a1-a3: precedent QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 carried these as pass from QA run · surface:api (116/130) · 580fd4ed · 2026-10-20 · 62 PASS / 54 PARTIAL / 0 FAIL / 0 BLOCKED / 14 NOT-RUN #24779; on this tree every ref pin drives route handlers with a stub server/response (no Hono adapter), so they score a0 only
   • api-backend.packaged-action-disabled-dispatch a0: dogfood asserts status 409 and text toMatch(/ACTION_DISABLED|is disabled/) — neither the exact code nor the describeDisabledAction sentence, and no task re-read for side effects; the exact sentence is unit-only (action-activation-dispatch.test.ts › the shared guard itself › answers 409 ACTION_DISABLED with the ENGINE's own sentence)
   • api-backend.packaged-action-disabled-dispatch a3/a6/n1: ref credits action-activation-dispatch.test.ts for the 403-not-an-oracle, flow-type and absence-means-active legs, but it is a unit HttpDispatcher over fakes — it stops above the HTTP layer the api oracle needs
   • api-backend.packaged-action-disabled-dispatch a5: ref correctly says the restart leg stays manual
   • api-backend.query-contract-matrix a4: engine.test.ts '[Security: $expand bypasses RLS/FLS on the referenced object (data leak on lookups) #2850] routes the expand sub-read through the middleware … tagged __expandRead' proves the sub-read is routed through middleware on a mock driver — not that a contributor's expand withholds the contact over HTTP; under rule 6 it cannot score a4 (round 4 QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 scored it pass)
   • api-backend.query-contract-matrix n0: request-schema-gate.conformance.test.ts drives RestServer with a mocked protocol — the ref says so itself
   • api-backend.query-contract-matrix whole item: Tier 1 in name only — no clause has a pin at its oracle's layer
   • api-backend.rest-batch-config-contract a5: rest-sub-config-parse-not-cast.test.ts §E › 'refuses batch.operations.upsertMany and batch.defaultAtomic' asserts the key and /never built/ resp. /options.atomic/; it does not assert that the messages name BatchEndpointsConfigSchema, nor the upsert replacement (an operation type of the generic batch door)
   • api-backend.rest-crud-config-contract a3: packages/rest/src/discovery-services-route-follows-mount.test.ts ('[finding] discovery contradicts itself under a non-default crud.dataPrefix: routes.data follows the key, services.data.route stays hard-coded at /api/v1/data #16674 — a moved crud.dataPrefix moves BOTH halves of the document') pins the discovery-advertisement half at a non-default prefix and is not in the ref; the moved-route-table half has no pin.
   • api-backend.rest-crud-config-contract a4: ref says §E pins acceptance[4]; the case asserts 'crud.patterns' + 'CrudEndpointsConfigSchema' + /was removed in @objectstack/spec 17/ only — the declarative-api-endpoint prescription is never matched, and the objectParamStyle refusal is checked for its key and /was removed/ only.
   • api-backend.rest-metadata-config-contract a1: ref says §D 'pins prefix … survival' — true, but no pin mounts at prefix '/metadata' or reads the discovery body's routes.metadata; the clause's move-together claim is unpinned
   • api-backend.rest-metadata-config-contract a5: §E's cacheTtl case asserts the key, MetadataEndpointsConfigSchema and /was removed/; the endpoints.schema case asserts the key and /does not exist/ only — neither asserts the replacement named in the verify
   • api-backend.rest-metadata-config-contract a3: only the normalizeConfig half is pinned; ref concedes the masking-effect half has no pin
   • api-backend.rest-route-generation-tombstones a0: §E › 'refuses every routes.* key' asserts routes.<key>, RouteGenerationConfigSchema and /was removed/ — not the clause's 'was removed in @objectstack/spec 17'; nameTransform driven with 'none' only (ref concedes)

   approvals

   • approvals.decision-only-via-service all clauses: the ref (kind 'test') is packages/services/service-automation/src/resume-authority-gate.test.ts, an AutomationEngine + InMemorySuspendedRunStore unit — every clause's oracle is the api (route status, run/actions reads); precedent QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 scored rev 1 PASS from it before the layer rule. Needs an HTTP pin (generic resume route + approvals API) to be Tier 1.
   • approvals.email-action-token-door a0: clause's live at-rest sys_notification read stays a run leg; FORBIDDEN arm is exercised with 'stranger' (not an approver at all) rather than a non-pending approver
   • approvals.email-action-token-door a1: pin asserts status pending + no decisions, not byte-identity of the actions timeline / token consumed_at
   • approvals.email-action-token-door a3: 'a decide that fails still burns it' (consume-first under a failing decide) is not asserted by any named pin
   • approvals.request-page-reply-and-reader-visibility a1: no pin asserts the approval_comment reply landing in the timeline, or the pending-approver/submitter-only restriction on replying
   • approvals.request-page-reply-and-reader-visibility a2: ref says request-read-gate covers acceptance[2]; it drives ObjectQL/protocol in-process, never /data/sys_approval_request over HTTP
   • approvals.status-mirror-field a2: the clause names the SLA auto-decision as a second user-less machine transition; the pin drives only the dead-run sweep (the verify asks only for the sweep)
   • approvals.status-mirror-field a0/a1/a3/a4: the ref is the only pin and covers a2/n2 alone; the api/log clauses have no automation

   attachments-storage

   • attachments-storage.attach-requires-parent-edit a2: the uploader legs of '(a) granted member: uploader may delete…' are an admin (who edits everything) and memberA on att_case (public_read_write, so memberA edits it); 'the uploader succeeds even without parent edit' is not driven
   • attachments-storage.attach-requires-parent-edit n1: none of the refused-attach cases ((b), (item 3), ([objectui/framework] enable.files: generic Attachments related-list (Salesforce Notes & Attachments parity) #2727)) re-reads sys_attachment for a row the refusal left
   • attachments-storage.chunked-upload-integrity a1: the clause names details.missingChunks [1] (chunk 1 not sent); the dogfood pin withholds chunk 0 and asserts [0] — same behaviour, the clause's literal does not match the pin's fixture.
   • attachments-storage.download-authz-both-sides a2: ref claims 'the uploader/entitled 200' covers clause 2; the owner case is the admin, who also owns/reads the parent, so the uploader-bypass-against-unreadable-parent leg and the 'url serves the bytes' leg are unasserted
   • attachments-storage.inline-grid-receipt-cells a2: the spec does not capture the /api/v1/storage/* upload requests; storage routing is inferred from the file door returning the uploaded bytes
   • attachments-storage.inline-grid-receipt-cells a3: the spec never reads the sys_file row (status 'committed', ref_object/ref_id/ref_field, acl 'private') nor asserts the batch response succeeded — only the request payload and GET /storage/files/:id
   • attachments-storage.inline-grid-receipt-cells n1: a data: URL would satisfy typeof==='string' && !contains('receipt.png'); the n1 guard rests on the follow-up storage GET answering 200 with the PNG bytes
   • attachments-storage.orphan-tombstone-reap a1: the dogfood sweep is lifecycle.sweep() called in-process after HTTP-driven setup (no door exists for it); the failed-byte-delete-leaves-the-row leg and its warn log are pinned only in attachment-lifecycle.test.ts with a fake engine.
   • attachments-storage.presigned-upload-roundtrip ref is bare: attachments-permission-matrix is a permission-matrix file whose uploadFile helper drives presign/PUT/complete but asserts only statuses; a0–a3's field, pending→committed, byte-equality and 302 halves are unpinned
   • attachments-storage.presigned-upload-roundtrip a4: the anonymous case asserts 401 + AUTH_REQUIRED but never counts sys_file rows around the attempt
   • attachments-storage.read-inherits-parent-rls a3: the probe half (D5 classes, warning text, probe-failure deny) is in-process/unit only; the item states it is unreachable from a run, so scoring it from those pins follows the item's own verify — note the warning's exact '[storage] attachment read visibility' text is asserted only at unit
   • attachments-storage.sys-file-status-pipeline a2: the live-holder half is scored, as the item directs, from tombstone-download-live-reference.test.ts, a unit test (mock HTTP server + fake engine); the live holder-less 404 FILE_NOT_FOUND and the post-re-attach /url 200 legs have no pin.
   • attachments-storage.sys-file-status-pipeline a1: tombstone-download-live-reference.test.ts 'leaves pending refused — only the tombstone limb widened' is a unit route test; the api-oracle 404 FILE_NOT_FOUND has no HTTP pin.
   • attachments-storage.upload-limits-scope-and-ownership a1–a3: storage-limits, upload-scope-vocabulary and upload-door-ownership call registered RouteHandlers with hand-built IHttpRequest/IHttpResponse — no HTTP adapter; a1's 'takes effect without restart' is at the plugin/kernel, not a served request
   • attachments-storage.upload-limits-scope-and-ownership a5: both hydrate pins are engine-level; no pin reads a copied file id over /data
   • attachments-storage.upload-session-abort a2/a3/n0/n1: packages/services/service-storage/src/attachment-lifecycle.test.ts › createUploadSessionReapGuard ('does NOT abort a completed session', 'reaps a session with no backend_upload_id without calling abort', 'VETOES on abort failure...', 'reaps the row when the adapter cannot abort at all') asserts these at unit layer but is not in the ref
   • attachments-storage.upload-session-abort a5: packages/services/service-storage/src/storage-routes.test.ts ('stamps expired and 410s a chunk PUT / a completion past the session deadline', 'does not expire a session still inside its deadline') asserts the 410 at route-handler unit layer, not in the ref (would not score the api oracle)
   • attachments-storage.upload-session-abort bare ref names only the dogfood matrix file; it scores a1 alone

   automation

   • automation.durable-suspend-restart a0/a1/a4: the pin drives its own fixture (flow_durable_suspend, a screen-node pause) — not the showcase showcase_task_follow_up timer or the showcase_project_closure → showcase_closure_signoff nested pair the steps name; the generic persistence/consumption assertions hold, the per-kind rows are not observed
   • automation.durable-suspend-restart a1: the pin's 'cold boot' is a second bootStack kernel over the same file inside one test process, not a separately spawned server process
   • automation.flow-authoring-refusals-v18 ref is accurate: it scopes the nine unit files to acceptance[0] only and says a1-a3 are manual; all nine files exist with ≥1 test
   • automation.flow-run-semantics-v18 a2/n0: the ref's two elevated-door pins (packages/runtime/src/{action,endpoint}-flow-elevated-door.test.ts) are unit door pins over a scripted automation service and never drive the trigger door the step names (POST /automation/:name/trigger); the wire pins that do — packages/verify/src/automation-trigger-elevated-door.test.ts (HTTP injection, 403 PERMISSION_DENIED, runs 0 by listRuns) and packages/qa/dogfood/test/flow-door-elevated-start.dogfood.test.ts — are not in the ref (the runtime file's own header names them as the wire half)
   • automation.flow-run-semantics-v18 a1: no pin in the ref reads back a field a record-triggered run stamped over HTTP; flow-cel-current-user.test.ts drives the engine only
   • automation.inbound-hook-timestamped-signature a2: no pin byte-compares the refusal arms' bodies against each other; rows assert code + typeof message only (member-vs-mount parity is per row, not across arms)
   • automation.paused-run-trigger-record-masked a0: the column parse is an engine (isSystem) read of sys_automation_run, plus an HTTP data-door read that checks only variables_json.record; 'null where unset' is not exercised
   • automation.paused-run-trigger-record-masked a3: the 'second process' is a second bootStack over the same SQLite file inside the same vitest process, not a spawned server
   • automation.paused-run-trigger-record-masked n0: every reader in the pin is the dev admin token; 'whichever persona reads it' is not driven across personas
   • automation.scheduled-work-opt-in a1/a2: both pins assert that flows are ARMED (or not) and the refusal sentence on a LiteKernel; neither observes a served boot log line or run rows after intervals
   • automation.screen-flow-roundtrip a4: the spec's final assertion is page.getByText(assignee) on the grid — exactly the 'not just the refreshed grid cell' the clause excludes
   • automation.screen-flow-roundtrip a0/a3: the spec never reads the run (status paused/completed); only request capture and UI toast
   • automation.setup-packaged-automation-board a0: the objectui ref→URL half names PackagedAutomationPage.navContribution.test.tsx (exists at the pin) in the clause's verify but not in automated.ref; it is component-layer and scores nothing either way.
   • automation.trigger-type-matrix n0: names packages/qa/dogfood/test/showcase-anonymous-deny-surfaces.dogfood.test.ts › 'anonymous POST /automation/:name/trigger is denied (401)' (exists, line 587) but the file is not in automated.ref, so a ref-driven run never executes it

   cli

   • cli.dev-automigrate-policy a4/n2: ref names cases 'auto-tightens at boot under autoMigrate: safe when the probe is clean' and 'BLOCKS the tightening on duplicate NULL-organization rows — old index kept, rows reported' in a describe 'bare-composite tightening + duplicate pre-flight (ADR-0120 D4)' — none exist in sql-driver-unique-tenancy.test.ts on this tree; the file now has 'bare composite from a pre-18 database — no tightening proposed (ADR-0131 D1)' asserting zero drift and 'duplicate NULL-organization rows are no longer a blocker — no op proposed, rows and index kept'. The clause text (D4 tighten, blocked report) is stale against ADR-0131 D1
   • cli.dev-automigrate-policy a4: a BLOCKED unique create_index is still pinned elsewhere (packages/drivers/driver-sql/src/sql-driver-25031-blocked-unique-apply-limit.test.ts), not in the ref — if a4 is rewritten around it, add it
   • cli.dev-automigrate-policy a2: the production case asserts the warning prefix only; the 'Run os migrate deliberately' remedy is unasserted (the ref says so)
   • cli.meta-package-flags-and-explain a1: verify names 'server log' as evidence; the pin observes the wire (?package= on the PUT) and the door's parsed request instead — equivalent, but no server log is read
   • cli.migrate-meta-write-stored-and-all a4: canonicalize-stored-flow.test.ts and refused-shapes.test.ts pin the TODO sink (canonicalizeStoredFlow todos / refused-shape onTodo); no file in the ref runs os migrate meta --stored and reads the printed TODO lines
   • cli.organization-ownership-ceremony a1: occupancy pin's plan run mocks boot; no pin compares a DB checksum before/after a bare plan run
   • cli.organization-ownership-ceremony a2: organization-ownership-apply.generation-1.test.ts › runs every step in order, certifies, and records this release's shape generation in the checkpoint calls apply() over a fake ledger — the CLI's --apply --plan-file --backup-taken exit 0 is not asserted
   • cli.organization-ownership-ceremony a3: organization-ownership-boot-guard.test.ts asserts assertOrganizationOwnershipMigrated's error code/message directly; the served-boot error line and the migrated boot's ready line need a live boot
   • cli.organization-ownership-ceremony a4: 'checksums before/after' approximated by columnsOf() still containing organization_id and applied: []
   • cli.scaffold-first-run ref .github/workflows/scaffold-e2e.yml exists but is a CI workflow, not a vitest/Playwright file: a Tier 1 pin run collects nothing for this item (scores via the workflow's own CI run only)

   i18n

   • i18n.flow-copy-translation-and-host-override a2: no file in the ref touches os i18n extract; the extraction of refusal, screen, option and toast keys is pinned in packages/cli/test/i18n-flow-{refusal,screen,toast-option}-coverage.test.ts (extractTranslations, the function the command runs — not the command's file write), none of them in the ref
   • i18n.flow-copy-translation-and-host-override a3: translation.test.ts › 'refuses a single-brace {token} in a translated title, through the one text-slot judge (i18n(flows): a translated screen title is not judged by the text-slot judge, so a single-brace {name} in a translated heading renders literally while the description and refusal message beside it are refused #22627)' pins the schema rule and its {{ name }} remedy; nothing in the ref runs os validate for the exit code
   • i18n.surface-matrix a5: ref is accurate that the two objectui component pins cover only the confirm half (plus successMessage→toast props); they render under a mocked ActionRunner/I18nProvider with no server round-trip, so the network-oracle clause stays the run's
   • i18n.surface-matrix a6/a7/a9: the i18n routes have HTTP coverage elsewhere (e.g. showcase-anonymous-deny-surfaces' I18N_FACES member 200 control) but nothing asserts the locale set, group vocabulary or zz-ZZ empty-map shape named here

   identity-auth

   • identity-auth.admin-lifecycle-operations a4: verify says the 'target's next PROTECTED request still 2xx' is pinned by admin-platform-admin-standing.dogfood.test.ts; that file asserts the 403 + code only, no protected request as the target
   • identity-auth.admin-lifecycle-operations a0/n1: C0 case asserts sys_user.banned/ban_reason and unban; no sign-in by the banned user is attempted, so the enforcement half is unpinned
   • identity-auth.admin-lifecycle-operations ref-parse: packages/plugins/plugin-auth/src/remove-user-atomicity.test.ts is named in the ref only as a contrast ('deliberately does NOT copy'), not as a pin; the parent's pins list includes it — it scores no clause
   • identity-auth.api-key-expiry-lifecycle a2: the dogfood case asserts 400 API_KEY_EXPIRY_TOO_LONG but not that the key count is unchanged; 'nothing is stored' is asserted only in packages/runtime/src/api-key-lifecycle.pin.test.ts over a fake objectql
   • identity-auth.api-key-expiry-lifecycle a3: the three 403 codes are pinned only at unit layer (rest-api-key-lifecycle.pin.test.ts over HTTP_STUB + fake ql; runtime dispatcher over a fake kernel); the dogfood file drives no revoked or expired key
   • identity-auth.auth-gate-held-session-raw-host-families a2: held-session-vendor-admin-doors arms PASSWORD_RESET_REQUIRED by a system write of must_change_password + auth.noteMustChangePasswordIssued() (simulating the forced-reset route), not by driving the admin's forced-reset door
   • identity-auth.auth-gate-held-session-raw-host-families a3: rest-api-key-account-posture.pin drives RestServer.enforceAuth with a hand-built req/res and a fake auth; http-dispatcher.api-key-account-posture drives HttpDispatcher with fakes — neither answers an HTTP x-api-key call
   • identity-auth.auth-gate-held-session-raw-host-families a1: 'raw-host families' are proven at mixed layers: storage, settings, share-link and cloud-connection pins call registered handlers with fake IHttpRequest/IHttpResponse
   • identity-auth.auth-method-matrix a3: verify names packages/plugins/plugin-auth/src/phone-otp-no-sms-service-refusal.test.ts as the pin — it exists but is not in automated.ref, and it drives AuthManager (unit), not the NODE_ENV=production boot's send-otp door.
   • identity-auth.auth-method-matrix a6: verify names packages/qa/dogfood/test/two-factor-lockout.dogfood.test.ts as the end-to-end pin for the 2FA gate — exists, not in automated.ref.
   • identity-auth.auth-method-matrix a9: verify names packages/plugins/plugin-auth/src/change-email-delete-user-wiring.test.ts ('auth-method-matrix: change-email and delete-user are booked as mounted in auth-route-ledger.ts but plugin-auth never configures better-auth's user.changeEmail / user.deleteUser — no switch to enable them #7735 — POST /delete-user stays unwired') — exists, not in automated.ref; AuthManager unit layer.
   • identity-auth.auth-method-matrix ref: a single OIDC pin (a7) for a 10-clause, 5-negative mixed item; kind 'e2e' over-implies coverage.
   • identity-auth.cookie-session-renewal-in-process a1: the runtime pin's DOORS are GET /data/:object, /auth/me/permissions and /i18n/locales — the clause's 'meta reads' leg has no door in it
   • identity-auth.implicit-account-linking-ownership a0-a3: the ref's 'end to end' cases drive the real better-auth handler (AuthManager.handleRequest) but over a hand-rolled in-memory data engine and with sys_account read off that fake, not an admin read through a booted server — they assert each clause's facts at the unit layer only
   • identity-auth.import-invitation-and-sso-domain-answers a1: the ref's admin-import-users-invite-link.test.ts asserts the auth.account_invitation template id on the import but never the 'self-requested reset still uses password_reset' half; packages/plugins/plugin-auth/src/admin-import-users-account-invitation.test.ts (cases ① and ②) asserts both and is not in the ref
   • identity-auth.import-invitation-and-sso-domain-answers a3: sso-domain-verification-unknown-provider.pin.test.ts mounts the real AuthPlugin on Hono but over createMemoryEngine (a hand-rolled engine fake), so it scores the doors at unit layer only
   • identity-auth.invitation-scope-gates a0: ref states its pending half is scored live — consistent
   • identity-auth.invitation-scope-gates n1: server-side denial of the forged request is pinned; the UI-hidden half is a5/a4 browser work

   integration-system

   • integration-system.connector-auth-kind-application a2: verify says 'pinned by connector-materialization.test.ts (fails boot loudly when credentialRef does not resolve)'; that case asserts /credentialRef 'MISSING' did not resolve/ only — not the connector, provider or the two remedies the clause requires, and it is an in-process kernel boot, not a boot log
   • integration-system.connector-auth-kind-application a3/n1: packages/spec/src/integration/connector-provider.test.ts ('rejects inline authentication secrets on a catalog descriptor / on a provider-bound instance (§3)') pins the [security] sys_metadata.metadata is a general cleartext sink: any authored artefact whose schema permits an inline credential lands it there (datasource config.password, connector authentication) #7990 half at schema level but is not in the ref; no pin found for the oauth2 discriminator refusal (spec/src/integration/connector.test.ts still parses oauth2 under AuthConfigSchema)
   • integration-system.connector-declarative-boot n1 says 'any of the four malformed-entry builds' while a3 lists three rejections — the counts disagree
   • integration-system.connector-declarative-boot ref's self-description matches the pin on this tree (two cases; halves only for a0–a2)
   • integration-system.connector-descriptor-audit a2: plugin.ts calls auditDeclaredConnectors on both the boot and the reload path; connector-descriptor-audit.test.ts drives only kernel:ready, so the reload half has no pin
   • integration-system.connector-descriptor-audit a1(c)/n1: no case in the ref feeds a provider-bound connector instance to findInertDeclaredConnectors or the kernel audit
   • integration-system.connector-stdio-default-deny ref is accurate: it scopes mcp-provider.test.ts to negative[0] at the provider unit and says a0-a2 are evidence-only, a3/n1 need the run
   • integration-system.datasource-admin-lifecycle a8: the ledger half names packages/services/service-datasource/src/datasource-route-ledger.conformance.test.ts as citable evidence, but it is not in automated.ref; the 404 half is pinned over a stubbed service only
   • integration-system.email-template-render a5: packages/qa/dogfood/test/email-template-overlay-survives-boot.dogfood.test.ts ('after a cold boot the metadata door and the rendered mail both carry the admin's wording') pins the redeploy-survival half and is not in the ref.
   • integration-system.email-template-render a3: packages/qa/dogfood/test/email-template-two-locales-survive-boot.dogfood.test.ts ('control: a locale nobody saved keeps the package ladder') touches the locale ladder and is not in the ref.
   • integration-system.email-template-render ref: one e2e pin for an 8-clause item; kind 'e2e' over-implies coverage (a1, a2, a4, a6, a7 unpinned).
   • integration-system.external-schema-drift-gate a4/a6: oracle is 'test' and the pins assert them, but each verify/evidence also asks for a live 'armed background drift check' log line — scored from the pin; the live line remains a boot leg
   • integration-system.external-schema-drift-gate n3: no pin asserts renderDiffMessage's text (datasource/object/per-column diff) — the fail-default case asserts rejects.toBeInstanceOf only
   • integration-system.external-schema-drift-gate n5: 'is a no-op when the external-datasource service is absent' asserts resolves undefined, not the absence of warn/error logs
   • integration-system.external-schema-introspection a3: remote-tables-twin.equivalence.test.ts only twins listRemoteTables; the object-draft ≡ external/tables/:remote/draft twin and the shared 400 EXTERNAL_DATASOURCE_ERROR refusal across spellings are not pinned (admin-routes covers the admin spelling's 400 only)
   • integration-system.external-schema-introspection a4: twin admission cases compare status+code across spellings but never assert the 403 message names manage_platform_settings
   • integration-system.external-schema-introspection n0/n2: admin-routes.test.ts drives a real HonoHttpServer with vi.fn services (route-level HTTP, not a booted stack)
   • integration-system.inbound-mailbox-association a2: scored at in-process — the clause's 'api' oracle is the stored rows, which the pin reads through the real engine after a real ingest; no HTTP read was made
   • integration-system.inbound-mailbox-association a1: inline-forward.test.ts pins the parser's participant extraction, not that an inline-forwarded message is ASSOCIATED with the original participants' records
   • integration-system.notification-org-and-redeliver-eligibility a1: notification-organization-follows-event.integration.test.ts proves organization_id on every row at the engine (ObjectQL+SqlDriver), but asserts nothing about the '[notify] no organization in scope' log line
   • integration-system.notification-org-and-redeliver-eligibility a2: the foreign mark-read is pinned only at unit level (messaging-service.test.ts › [security(service-messaging): a mark-read receipt takes the organization of whichever notification the caller names, with no check that the caller was its recipient #22026] markRead writes a read receipt only for a notification delivered to that user › ⛔ the non-recipient half…)
   • integration-system.notification-org-and-redeliver-eligibility a3: the redeliver pin drives the door through Request→Response (member handler + Hono canonical app) on a LiteKernel, not a full served stack

   platform-core

   • platform-core.activation-ledger-registration-home a4: packages/spec/src/system/constants/platform-object-names.test.ts ('registers exactly the objects each package declares') ties PLATFORM_OBJECTS_BY_PACKAGE to the declaring sources and would pin the one-owner membership, but is not in the ref
   • platform-core.activation-ledger-registration-home n2: platform-objects/src/plugin.test.ts asserts exactly one registering manifest; no pin drives a second registrant to observe the 'already owned by package' boot failure
   • platform-core.activation-ledger-row-contract n5/a4 (door half): packages/qa/dogfood/test/catalog-activation-door.dogfood.test.ts › 'a type with no switch is refused 400 by the door itself' and packages/runtime/src/domains/catalog-activation-door.test.ts (audience anchors 400, nothing written) exist and are not in this item's ref
   • platform-core.activation-ledger-row-contract a2: the dogfood key-set reading proves the physical table lacks organization_id but not the step-7 refused INSERT / control INSERT pair the verify names
   • platform-core.activation-ledger-row-contract a3: pins assert update-not-delete for the action (HTTP) and flow (store) kinds only; position/permission/sharing_rule re-enable rows are not covered here
   • platform-core.lifecycle-retention-sweep ref is accurate on scope (a2 pinned half, a3, n0-n1; a0/a1/a4 live; a5 a source read)
   • platform-core.lifecycle-retention-sweep a3: live sweep-line corroboration of the reaped count stays the run's
   • platform-core.lifecycle-retention-sweep n0: the unit proves the onlyWhen predicate reaches the reap filter/candidate read on a recording fake engine, not that real paused/running rows survive
   • platform-core.metadata-authoring-roundtrip ref is accurate: package-first-authoring.dogfood.test.ts and studio-object-designer.spec.ts are declared as scoring no clause; studio-record-page.spec.ts scores a2 only
   • platform-core.metadata-registry-serving a0: the pin never checks the registered kinds against DEFAULT_METADATA_TYPE_REGISTRY (step 2's presence table); it asserts only dashboard/action/report entries
   • platform-core.nav-surfaces-render a0/n0/n1/n3 score only if the parent can run pnpm -C examples/app-showcase test:smoke (Playwright + a live showcase with a console); otherwise not-run (browser)
   • platform-core.nav-surfaces-render a1: nothing in the ref computes the served-nav vs SURFACES diff — the 'coverage is current' clause has no automation
   • platform-core.serve-composition-v18 run note: serve-organization-record-page.e2e.test.ts is a *.e2e.test.ts file — it collects only under OS_TEST_TIERS=nightly; a run without it reports 0 tests for that file (a2 then not scored)
   • platform-core.v18-boot-refusals a3: scored from the pin by the clause's own fallback ('with no such boot run, this clause rests on authz-identity-objects-boot-refusal.test.ts — record which'); the run record must say the live steps[1] boot was not run.

   ---

   Generated by Claude Code
3. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   From #25815 (release-18.2.0-tier1, 156 items) — §2 checklist-accuracy findings, part 2/2 (areas: records-forms, search, studio-authoring). Each line is a ledger edit for the lane owning docs/qa/platform-checklist/**: revise the item, bump revision, append history citing #25815. Clause labels: aK = acceptance[K], nK = negative[K].

   records-forms

   • records-forms.action-param-widgets ref-parse: the parent's pins include objectui e2e/live/action-modal.spec.ts, which the ref names only as DROPPED ('cited here until revision 3 … so it was dropped') — a parser false positive; it scores nothing here.
   • records-forms.adhoc-filter-sort-builder a4: the pin reproduces the filter on page.reload() and checks the URL param + record-count-bar '2' only — it never captures the data request the clause's network oracle names, nor compares row identity.
   • records-forms.adhoc-filter-sort-builder ref-parse: the parent's pins include objectui e2e/live/saved-view-filter.spec.ts, which the ref names only as dropped ('cited here until revision 5 … so it was dropped') — parser false positive.
   • records-forms.bulk-select-all-matching a1/a4/n0: none of the three ref files exercises resolveBulkRows' paged fan-out or the HARD_CAP; the cross-page id resolution is unpinned even at component level
   • records-forms.bulk-select-all-matching a3/n2: bulkActionRefresh.test.tsx '[main 红：wildcard fall-through 守卫声明了一个已被删除的挂载（#4116 与 #4112 的竞态） #4140] bulk bar Clear resets both selection sources' asserts the behaviour in jsdom; the clause's dom/screenshot oracle needs the browser
   • records-forms.cascading-multilevel-and-clear a1: the spec POSTs {country:'us', province:'zj'} where the verify names {country:'cn', province:'ca'}, and asserts code invalid_option only — the verify's message key option_unavailable is not checked; the in-set answer is 201, not the verify's 200.
   • records-forms.cascading-multilevel-and-clear ref: rule-validator.option-visibility.test.ts is in the ref but by its own words scores no clause (validator layer) — the parent need not run it for this item.
   • records-forms.cascading-options a1/n0: the pin is an objectui Playwright live spec (needs a live stack + console at the objectui pin); it scores only if the parent runs it against a booted showcase.
   • records-forms.comment-reactions-and-edit-stamps a1/a2: sys-comment-reactions-door.integration.test.ts is named a 'door' test but boots ObjectKernel + ObjectQLPlugin over sqlite-wasm and maps errors with mapDataError — no HTTP adapter, so it cannot score the api clauses.
   • records-forms.concurrent-edit-conflict a3: the ref scores acceptance[3] from occSave.test.tsx › 'ObjectForm edit — OCC guarded save › 409 → "overwrite" retries re-keyed to the server currentVersion and completes the save', but that case runs over a mocked data source, so it pins the client re-key only — not the clause's api oracle (the retry answered 200 and a re-read shows one winner)
   • records-forms.concurrent-edit-conflict a1: occSave.test.tsx pins the modal Keep editing / Overwrite choice in jsdom; the dom oracle wants a rendered (screenshot-confirmed) dialog, and the inline ConcurrentUpdateDialog half has no pin
   • records-forms.concurrent-edit-conflict pins: the parent's pin list includes objectui e2e/live/inline-edit-polish-2572.spec.ts, which the ref names only to say it was DROPPED at revision 4 (no If-Match, no conflict, stale at the pin) — a ref-parse over-inclusion; it scores no clause
   • records-forms.conditional-rules-grid ref-parse over-inclusion: the parent's pins list carries objectui e2e/live/grid-file-upload.spec.ts, which the ref says was DROPPED at revision 8 and scores no clause — do not run it for this item
   • records-forms.conditional-rules-grid all objectui pins are Playwright e2e/live specs needing a live stack; they can only score in a browser run, and even green they score halves only
   • records-forms.conditional-rules-header a2: the ref claims field-conditional-rules.spec.ts pins 'acceptance[2]'s client lock … tax_rate's input giving way to the read-only field group at paid', but the spec asserts the OPPOSITE on the New dialog: at paid taxRate toBeEnabled() and the read-only group toHaveCount(0) (objectui#13436 — INSERT is exempt from readonlyWhen); no pin drives an edit form of a paid invoice
   • records-forms.conditional-rules-header pins: the parent's pin list includes objectui e2e/live/list-row-action-cel.spec.ts, which the ref names only to say it was DROPPED at revision 3 (it gates the task list's Mark Done, not the invoice's Edit/Delete) — a ref-parse over-inclusion; it scores no clause
   • records-forms.conditional-rules-header a0/a3: both pins are browser tests that read the DOM directly via Playwright locators (no screenshot step), which satisfies render-first only because Playwright waits for visibility
   • records-forms.delete-behavior-matrix a0–a4/n0–n3: every pin is engine-level (ObjectQL over a test driver); precedent QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 scored a0–a4, n0–n3 PASS from them before the layer rule — at the api oracle they score not-run until a REST pin exists.
   • records-forms.delete-behavior-matrix a5: packages/spec/src/data/field.test.ts ('deleteBehavior: set_null on master_detail is a parse-time rejection') pins the FieldSchema accepts deleteBehavior: 'set_null' on a master_detail, and the engine silently resolves it to cascade #9689 parse seam at schema level and is not in the ref; the verify's PUT refusal has no pin.
   • records-forms.encrypted-field-behavior a0: the dogfood pin scores the masked-GET half only; the 'secret:<handle>' column / sys_secret ciphertext leg is asserted only in packages/objectql/src/secret-fields.test.ts at the engine layer (the verify makes that leg conditional on DB inspection)
   • records-forms.field-history-tracking a2: objectui e2e/live/record-history-display.spec.ts (in the ref, claiming no clause) does open showcase_account's History tab, so it holds a2's flag-true half in a browser; the task-detail absence half has no pin
   • records-forms.field-type-constraints a5/a6: ref says engine-lookup-referential-integrity / engine-autonumber-runtime-owned pin these; both drive ObjectQL in-process, not the /data door the api oracle names
   • records-forms.field-type-constraints ref names field-zoo.matrix.ts — a data module, not a test file (correctly absent from pins)
   • records-forms.field-type-constraints a0-a4: the ref's 'round-trip & masking' pin asserts only accepted vectors; none of the refusal codes (max_length, min_value, max_value, invalid_number, invalid_option, invalid_type) is pinned at any layer by the ref
   • records-forms.field-type-matrix ref names field-zoo.matrix.ts (a vectors module, not a test file) — a ref parser must treat it as a fixture, not a pin; field-zoo-value-shape.test.ts (in pins) asserts no clause directly (write vectors parse under valueSchemaFor)
   • records-forms.field-type-matrix a5/n1: ref implies relational coverage incl. data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441, but field-zoo-roundtrip only seeds real ids; no dangling-id refusal is asserted
   • records-forms.field-type-matrix a4: f_autonumber is a 'present' check (non-null) — 'server-assigned' is inferred from it not being written
   • records-forms.field-unique-enforcement a4: clause text says bare unique 'NULL-organization rows fold to ONE bucket' (ADR-0120 D3); both pins now assert the opposite — 'a row with NO organization is exempt — ... the D3 bucket retired' (memory) and 'on a pre-18 nullable column, rows with no organization are NOT constrained (ADR-0131 D1)' (SQL). The clause needs re-authoring; it cannot score pass from these pins as written
   • records-forms.field-unique-enforcement a0-a3/n0-n2: ref correctly says no pin drives a REST door
   • records-forms.form-dirty-guard a0/n0: discardGuard.test.tsx covers the X close + Cancel + pristine paths for ModalForm/DrawerForm, but no Escape or backdrop-click case
   • records-forms.form-dirty-guard a2: the file holds 11 it() cases at the pin; the '14/14' cited from QA run QA run · surface:browser (65/65) · 36b2889c · 2026-10-12 · 50 PASS / 2 PARTIAL / 12 FAIL / 1 BLOCKED / 0 NOT-RUN #23163 will not match this tree's count
   • records-forms.gantt-interactions a1/a2: ref maps these clauses to component/unit cases (cases exist at pin b41ed7f), but the clauses' oracle is api (row-set diffs / server reads) — the pins stop at the component's update callback and cannot score them
   • records-forms.gantt-interactions ref names objectui commit 0abd4f9 for the per-clause mapping; the run pin is b41ed7f (the named cases are present there)
   • records-forms.import-job-undo-cancel a3: the ref says each spec covers acceptance[3] ('the job list read on undoable and revertedAt'); the specs read the list once before undo (filter undoable && !revertedAt) and confirm the revert only through the UI testid import-history-reverted-<id>, so 'revertedAt once a job is reverted' is never read off GET /import/jobs
   • records-forms.import-job-undo-cancel a1/n0: both specs count with an unfiltered GET /api/v1/data/<object> and read records.length — a page-bounded list length, not the clause's marker-filter count — and they self-skip (IMPORT_CONSOLE_LIVE / harness reachability) and default to crm_app/crm_lead, so a skip or a non-showcase target scores nothing
   • records-forms.import-wizard-encoding-and-hints pins are objectui files (repo objectui → /home/claude/ou-pin); they score a0–a2 only when the objectui pin worktree's vitest runs them
   • records-forms.list-view-capabilities a1: ref says saved-view-filter.spec.ts covers acceptance[1]; it asserts only that no showcase_task data response was >=400 and the count bar starts '2 ' — the AST filter param and the count-vs-response-total match are not captured
   • records-forms.list-view-capabilities showcase-search.dogfood.test.ts is in the ref but, as the ref itself says, scores no clause of this item
   • records-forms.master-detail-atomic-save pins list includes e2e/live/summary-rollup.spec.ts, but the ref states it was dropped at revision 5 and asserts no clause — a ref-parse over-capture (it names the file in prose)
   • records-forms.master-detail-atomic-save a0: master-detail.spec.ts pins carrier-neutrally on showcase_project_workspace with one child; the two-line invoice payload and 'not N sequential writes' (batch count) remain the run's
   • records-forms.object-hook-lifecycle a0: the pin drives POST /forms/contact-us/submit (anonymous, status 'closed' stripped), not POST /api/v1/data/showcase_inquiry omitting source/status as the verify names — the hook's 'web' stamp is engine-side so it scores, but the /data door itself is undriven
   • records-forms.object-hook-lifecycle a6/n0: hook-error-format.dogfood.test.ts proves a throwing beforeDelete (hef_ref_guard, default onError) leaves the row; no pin drives a throwing beforeInsert POST
   • records-forms.object-hook-lifecycle ref says the four objectql units ran '83 tests'; this tree has 79 it() cases across them (25+12+22+20) — count drift, not a missing file
   • records-forms.predicate-relationship-traversal a3 is scored from an engine pin by the item's own knownGaps (no restricted persona on stock showcase) — a deliberate layer exception, not a rule-6 pass for an HTTP oracle
   • records-forms.record-clone-contract ref says packages/rest/src/search-clone-route-schema-conformance.test.ts 'drives the live mount' — it calls the registered handler on RestServer(mockServer) with a mocked protocol whose cloneData returns a constant body; no HTTP adapter, no engine
   • records-forms.record-clone-contract a3: the verify names 'the Check whether sys_session.token — a live session credential — serializes over the data API (ADR-0100 channel 3 has no read protection) #7823 strip suite' but the ref names no such file; packages/metadata-protocol/src/protocol.write-response-internal-fields.tripwire.test.ts (enumerates cloneData) exists and is not in the ref
   • records-forms.record-clone-contract ref spells files as 'packages/metadata-protocol — search-clone-schema-conformance.test.ts' (package + em dash + basename, no src/ path) — a strict path parser would miss both; the parent resolved them
   • records-forms.record-discussion-mentions a5: comments-permission-matrix '(f) enable.feeds:false still answers FEEDS_DISABLED' asserts 403 + code on its cmt_nofeeds fixture; it does not read the thread's zero rows after the refusal
   • records-forms.record-discussion-mentions a6/n3: capability-gate-update-verb.test.ts is engine-level (ObjectQL + installAuditWriters), as the clause itself says
   • records-forms.record-discussion-mentions a8: the clause names objectui recordActivityFeed.test.ts as a fallback oracle, but it is not in automated.ref (objectui), so a ref-driven run never executes it
   • records-forms.record-discussion-mentions a9: mention-recipient-gate.integration.test.ts is engine-level; the ref itself says partial at most
   • records-forms.record-edit-undo UndoManager.test.ts tests only the in-memory undo/redo stack; it scores no clause of this item (none of the clauses is a stack-semantics clause) — the ref should say so explicitly
   • records-forms.view-type-gallery a5: the pin is a Playwright spec (pnpm -C examples/app-showcase test:smoke) that needs a built console and a live stack — it scores only if the parent actually runs it; a vitest-only pin run leaves a5 not-run.
   • records-forms.write-answer-advisories-rollback-and-tree-delete a1: advisory-write-answer.test.ts calls ObjectStackProtocolImplementation createData/updateData in-process — the REST PATCH body is not observed
   • records-forms.write-answer-advisories-rollback-and-tree-delete a2/n0: engine-after-hook-abort-unit.test.ts drives ObjectQL directly; no HTTP pin for the aborting afterInsert
   • records-forms.write-answer-advisories-rollback-and-tree-delete a3: scored on the referenceless tree fixture (rtl_*), not a showcase object — acceptable since the clause names no carrier

   search

   • search.cross-field-object-search a1: the pin proves the name-hit control only as 'some returned name contains retail' (names.some(...includes('retail'))), not by naming Acme Retail; it satisfies the verify's 'a name-containing-retail account'
   • search.field-scoped-narrowing a1/n0/n1: the bare ref claims the item; the pin has no $searchFields refusal case. packages/rest/src/rest-server-closed-query-params.test.ts and list-view-grouping-query-door.test.ts mention INVALID_FIELD + searchFields (route-handler level) and are not in the ref
   • search.field-scoped-narrowing a3: pin drives only POST /data/showcase_account/query with bare search/searchFields; the GET $search spelling is unpinned
   • search.global-search-skips-unreadable a0–a2: the dogfood pin runs on its own skipsearch_open / skipsearch_walled fixtures, not the showcase objects (W, showcase_invoice) the steps name; a0's unscoped case does not assert totalObjects (the mixed case does)

   studio-authoring

   • studio-authoring.expression-editors a0-a6: every pin in the ref is a jsdom component/unit test; it holds evidence for the editor's lint, inference, completion and test-run logic but scores none of the screenshot/dom/api clauses
   • studio-authoring.meta-save-preconditions-and-draft-rows a1-a3: every pin stops above HTTP (RestServer with createMockServer, HttpDispatcher.dispatch called directly, objectql repository/protocol units) — the api-oracle clauses stay the run's live leg
   • studio-authoring.metadata-diagnostics-sweep a3/n0: the ref says the pin covers the outage clause ONLY, but its '[[finding] getMetaDiagnostics scannedTypes still overstates the swept set when a type is benignly skipped — no payload field lets a caller detect partial coverage #8924] a caller error the producer classified is refused loudly' describe asserts the ?type= misspelling refusal at the protocol layer — unclaimed protocol-layer evidence; the api-oracle clauses still need the REST door.
   • studio-authoring.object-designer-roundtrip a3: F4 seeds one real option, not the three the clause judges with, and never publishes — the ref says so; the banner half is pinned under a different fixture than the clause states.
   • studio-authoring.org-override-registry-gate all clauses are api-oracle but the only pin (overlay-precedence.test.ts) is a unit test of the overlay whitelist (describe 'overlay whitelist enforcement (shared-DB invariant)'), stopping above the HTTP door; it corroborates a0/a2/a3/n0 and scores none; no pin touches a4's DELETE reset
   • studio-authoring.permission-matrix-editor-ux fieldBulk.test.tsx asserts filter narrowing, the '2 / 8' counter and bulk scope as jsdom checkbox states — evidence for a0/a1 at the component layer, but never the SAVED fields map that a2/a3/n0 make the authority
   • studio-authoring.permission-matrix-editor-ux a5: readonly.test.tsx covers the package and type gates and a capability gate; the artifact gate ('provided by a code package') sits in PermissionMatrixEditor.artifactTier.test.tsx, not in the ref
   • studio-authoring.record-page-roundtrip ref cites console pin cf153eb for the reading; the run's objectui pin is b41ed7f (both specs present and asserting as described)
   • studio-authoring.save-door-runs-authoring-rules a1-a3/n0: none of the eight pins boots HTTP (metadata-protocol saveMetaItem, objectql, spec, lint units and a RestServer unit) — the api clauses stay the run's

   ---

   Generated by Claude Code
4. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   From #25815 (release-18.2.0-tier1) — §3 fixture gaps, partial coverage and not-run handover.

   • Result: 156 items, 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN; 1178 clauses, 315 pass · 0 fail. No pin red (framework 374 files, 10,009 passed; objectui 29 unit files, 378 passed; objectui e2e/live 31/31; showcase Playwright 53/53; verify --rls 0 FAILED · 0 HOLES). Nothing for §5.
   • Partial coverage, parked here: one Parked-on: #25807 line per PARTIAL / NOT-RUN / BLOCKED item in QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815's close-out comment (150 lines; clause-level reasons in its three detail comments). Of the 861 unscored clauses, 254 are layer-limited (a pin asserts them below the oracle's layer — RUNNER rule 6), 132 half-asserted, 50 procedural, the rest unpinned.
   • Not-run handover (25) — each needs a live run, or a pin at the oracle's layer: access-security.me-permissions-aggregation-parity, access-security.record-access-explain, access-security.share-link-landing-page, ai.mcp-oauth-private-host-transport, ai.mcp-validate-expression, api-backend.bulk-write-contract, api-backend.query-contract-matrix, approvals.decision-only-via-service, automation.setup-packaged-automation-board, cli.scaffold-first-run, i18n.surface-matrix, integration-system.connector-descriptor-audit, platform-core.url-overlay-contract, records-forms.bulk-select-all-matching, records-forms.concurrent-edit-conflict, records-forms.conditional-rules-grid, records-forms.delete-behavior-matrix, records-forms.field-type-constraints, records-forms.gantt-interactions, records-forms.import-job-undo-cancel, records-forms.list-view-capabilities, records-forms.record-clone-contract, records-forms.record-discussion-mentions, studio-authoring.org-override-registry-gate, studio-authoring.permission-matrix-editor-ux.
   • New fixture gap: records-forms.import-job-undo-cancel — e2e/import-console/import-console-undo.spec.ts needs IMPORT_CONSOLE_LIVE=1 and an app-crm boot (crm_app/crm_lead); its twin e2e/import-harness/import-undo.spec.ts needs the plugin-grid demo harness on :5200 over app-crm on :3002. Neither runs on the stock showcase.
   • cli.scaffold-first-run: its only evidence is the nightly scaffold-e2e.yml, last green at 4cc17db3c0 (run 40158961882), not this subject.
   • BLOCKED, unchanged: access-security.no-active-org-session-semantics (QA run · priority:P0 · e4e5c6e3 · 2026-08-17 · 7 PASS / 7 PARTIAL / 2 FAIL / 2 BLOCKED #9334), records-forms.record-edit-undo (no packaged undoable update action).

   ---

   Generated by Claude Code
5. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   Last edited by objectstack-fleet

   ContributorAuthor

   More actions

   T3 manual set recorded: #25817 (release-18.2.0-manual-set, 29/29 at 6679644a, pin b41ed7f68956: 25 PASS / 4 PARTIAL / 0 FAIL).

   Parked here (fixture gaps):

   • approvals.decision-action-matrix A9: there is no org-less request on stock. Both remaining candidates are refuted: a schedule-triggered approval, and an api-hook on an object with no organization column.
   • automation.trigger-status-contract A4: the 503 STORE_UNAVAILABLE arm.
   • automation.packaged-flow-subflow-disable-refusal N1: a second packaged caller needs a package-loader-installed package. A ?package=-authored flow counts as deployment-authored.
   • records-forms.action-location-matrix knownGaps[2]: A3 fail-closed and A4 (a).

   Checklist-accuracy findings: All of them are listed in #25817 under "Checklist-accuracy findings and fixture gaps". They include one RUNNER.md environment-fact correction: on os dev at 6679644a, the connector meta read shows the compiled baseUrl (3000) while live dispatch follows OS_PORT, so the prescribed Check misreports the fixture.

   Coverage gap: no ledger item asserts #25626's walled Create User join or 400 NO_ACTIVE_ORGANIZATION. This is pending confirmation by the addendum record on 17f8217b.

   Extracted product defects: #25818, #25819, #25820, #25821, #25822.

   Superseded: #25479. Its 7 un-rerun verdicts are carried forward on #25817.
6. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   T3 addendum: #25823 (identity-auth.admin-lifecycle-operations 1/1 PASS at 17f8217b, after #25626). Parked here:

   • Coverage gap. No item asserts feat(plugin-auth): multi-org Create User joins the administrator's current organization #25626's walled Create User join. The missing clauses are:

     • joins the caller's active organization as member, and a body organizationId chooses nothing;
     • 400 NO_ACTIVE_ORGANIZATION with no row;
     • invite-only still joins.

     The candidate pin is packages/qa/dogfood/test/create-user-organization-join.dogfood.test.ts.

   • Stale after feat(plugin-auth): multi-org Create User joins the administrator's current organization #25626:

     • access-security.no-active-org-session-semantics rev 8, its member-less operator create-user producer;
     • identity-auth.workspace-org-switch rev 5, personas[2];
     • RUNNER.md "Walled personas come from the admin door".

     Each recipe now needs the operator to create and set-active an organization first.

   • identity-auth.admin-lifecycle-operations's automated.ref overclaims. The A0 sign-ins, the A4 live-session half, the A6 stop half and the A9 state read-back beyond two routes are unpinned.
7. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   Triage: state — pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-25T16:00Z

   ⛔ Not a claim, ⛔ not a dispatch.

   • Grade stands as filed (p1 · domain:devx · target:v18). This is the 18.2.0 wave anchor: the checklist-accuracy ledger edits from QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815 and QA run · release-18.2.0-manual-set (29/29) · 6679644a · 2026-10-25 · 25 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #25817 close out here, in the lane owning docs/qa/platform-checklist/**.

   ---

   Generated by Claude Code
8. objectstack-fleet

   added

   pm:queue

   on Oct 25, 2026
9. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   Checklist-accuracy findings carded — maintainer-directed (project thread, 2026-10-25 22:55Z, verbatim: 「写issue，不派发」). ⛔ Not dispatched; ⛔ not a claim.

   The accuracy findings parked on this anchor from #25812, #25815, #25817 and #25823 are now one card per ledger file, each listing its lines verbatim with the record they come from. They carry documentation · priority:p2 · domain:devx · area:devpath and no target:v18 (not release blockers). This anchor's §2 and the part 1/2 + 2/2 comments stay as the evidence; close-out of each line happens on its card.

   card	ledger file	lines
   #25835	access-security	65
   #25836	ai	14
   #25837	api-backend	28
   #25838	approvals	19
   #25839	attachments-storage	18
   #25840	automation	24
   #25841	cli	12
   #25842	i18n	9
   #25843	identity-auth	23
   #25844	integration-system	26
   #25845	platform-core	19
   #25846	records-forms	60
   #25847	search	6
   #25848	studio-authoring	9
   #25849	ux-conventions	5
   #25850	RUNNER.md	3

   Not carded here (still parked on this anchor): the fixture gaps and PARTIAL coverage in §3, the 25 not-run items, and the #25626 coverage gap's fixture side (its missing clauses are on the identity-auth card).

   ---

   Generated by Claude Code
10. objectstack-fleet commented on Oct 25, 2026

    

    objectstack-fleetBot

    on Oct 25, 2026

    ContributorAuthor

    More actions

    Triage: the 16 ledger-edit cards are pm:on-hold · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-25T23:56Z

    ⛔ Not a claim, ⛔ not a dispatch.

    • Cards: qa(checklist): access-security — 65 ledger edits from the 18.2.0 release sweep (#25807) #25835, qa(checklist): ai — 14 ledger edits from the 18.2.0 release sweep (#25807) #25836, qa(checklist): api-backend — 28 ledger edits from the 18.2.0 release sweep (#25807) #25837, qa(checklist): approvals — 19 ledger edits from the 18.2.0 release sweep (#25807) #25838, qa(checklist): attachments-storage — 18 ledger edits from the 18.2.0 release sweep (#25807) #25839, qa(checklist): automation — 24 ledger edits from the 18.2.0 release sweep (#25807) #25840, qa(checklist): cli — 12 ledger edits from the 18.2.0 release sweep (#25807) #25841, qa(checklist): i18n — 9 ledger edits from the 18.2.0 release sweep (#25807) #25842, qa(checklist): identity-auth — 23 ledger edits from the 18.2.0 release sweep (#25807) #25843, qa(checklist): integration-system — 26 ledger edits from the 18.2.0 release sweep (#25807) #25844, qa(checklist): platform-core — 19 ledger edits from the 18.2.0 release sweep (#25807) #25845, qa(checklist): records-forms — 60 ledger edits from the 18.2.0 release sweep (#25807) #25846, qa(checklist): search — 6 ledger edits from the 18.2.0 release sweep (#25807) #25847, qa(checklist): studio-authoring — 9 ledger edits from the 18.2.0 release sweep (#25807) #25848, qa(checklist): ux-conventions — 5 ledger edits from the 18.2.0 release sweep (#25807) #25849, qa(checklist): RUNNER.md — 3 stale environment facts from the 18.2.0 release sweep (#25807) #25850. Each keeps its grade as filed (documentation · p2 · domain:devx · area:devpath).
    • On hold, not queued: the maintainer's words on filing were 「写issue，不派发」 (file the issues, do not dispatch). pm:queue would let any PM loop pick them up, so they wait for the maintainer's go. This comment is the hold record for all 16.

    Restart-when: the maintainer says to dispatch the 18.2.0 ledger-edit cards, on this card, on any of them, or in the project thread.

    ---

    Generated by Claude Code
11. objectstack-fleet commented on Oct 26, 2026

    

    objectstack-fleetBot

    on Oct 26, 2026

    ContributorAuthor

    More actions

    Released: the 16 ledger-edit cards → pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-26T10:41Z

    ⛔ Not a claim, ⛔ not a dispatch.

    • The maintainer's word, in the triage thread on 2026-10-26: 「16 张清单卡：应该可以回归队列吧」. This meets the Restart-when on the hold record above.
    • qa(checklist): access-security — 65 ledger edits from the 18.2.0 release sweep (#25807) #25835–qa(checklist): RUNNER.md — 3 stale environment facts from the 18.2.0 release sweep (#25807) #25850 go from pm:on-hold to pm:queue. Grades are unchanged (documentation · p2 · domain:devx · area:devpath). The domain:devx lane picks them up by its usual round. Each card's done-when stays a ledger edit: revise the item, bump revision, append history citing QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815 / QA run · release-18.2.0-manual-set (29/29) · 6679644a · 2026-10-25 · 25 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #25817, and keep pnpm check:platform-checklist green.
    • Paths under ui/ moved with the merge, so a checklist item that cites an objectui path is re-read against ui/ in the same edit.

    ---

    Generated by Claude Code
12. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    18.2.0 sweep — wave 2 on the post-merge head · session_012YjcDon6BvR9MN93ZsFq3U · 2026-10-27T04:05Z

    Filing gate: ③ a maintainer-directed task — the maintainer, in this session on 2026-10-27, verbatim: 「准备发版本，评估运行哪些 checklist，可以用云卡运行」, then, on the plan below: 「同意」, and on writing: 「你应该使用 pm-dispatch 技能写入」.

    Why a second wave. Wave 1 (#25812, #25815, #25817) judged 6679644a against the objectui pin b41ed7f68956. Since then main moved 287+ commits:

    • the ui/ merge landed — .objectui-sha is gone and the Console is built in-repo with pnpm console:build, so every wave-1 browser verdict was taken against a console build path that no longer exists;
    • 182 of the 322 runnable items changed revision (the wave-1 ledger edits landed), and 223 cite a source file or pin that changed;
    • the Version Packages PR chore: version packages #25640 (18.2.0) now carries 59 Clause-②: yes changesets, against 14 in wave 1;
    • the five wave-1 extractions aggregate query answers wrong data under 200: dateGranularity on a non-date field, a duplicate alias, and an alias equal to a groupBy field #25818–spec: a translation item accepts any locale string ("not a locale!!" saves 200, valid) — LocaleSchema is a bare z.string() #25822 are closed (SKILL §5 trigger 2).

    A delta-only rerun saves little, so this is a release-candidate rerun (SKILL §5 trigger 1). node scripts/check-platform-checklist.mjs is green on the subject.

    Subject: framework main @ 756220c4a7adcbb1228864607cb4b6a1ca486dc0; Console built in-repo from that same commit (pnpm console:build). Every card pins this sha; none follows the Version PR as it regenerates.

    card	selector / set	items	surface	carries
    W2-C1	priority:P0	23	browser-heavy	supersedes #25812
    W2-C2a	Tier 1 (automated.ref items), areas access-security · ai · api-backend · approvals · attachments-storage · automation · cli	~80	per-area vitest batches	the #25815 not-run handover items in these areas
    W2-C2b	Tier 1, areas dashboards · i18n · identity-auth · integration-system · platform-core · records-forms · search · studio-authoring · ux-conventions	~73	per-area vitest + showcase / ui Playwright	the #25815 not-run handover items in these areas; with C2a supersedes #25815
    W2-C3a	manual set, api · cli · build surface	~30	live REST / CLI	—
    W2-C3b	manual set, browser · mixed surface	~36	live browser	with C3a supersedes #25817

    Manual set (same rule as #25817 / #25479): the unpinned since:v18.x items, plus the unpinned P0/P1 items whose source[] cites a file changed by a Clause-②: yes changeset in #25640 — 66 ids, listed in each card's dispatch. Deferred: the 67 unpinned P2 items (Tier 3), untouched by this wave.

    Backend: one mode:cloud session per card (create_session with source_url), model tier default (opus, dispatch-gates --tier gives no path mandate). Each card files one qa-run record per selector under this anchor and runs the supersede protocol (carry forward before closing the wave-1 record). Product defects are extracted as their own cards; accuracy findings and gaps close out here.

    ---

    Generated by Claude Code
13. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    Maintainer rulings on QA-run writes and security findings · session_012YjcDon6BvR9MN93ZsFq3U · 2026-10-27T04:12Z

    Recorded verbatim from the maintainer, in the wave-2 session on 2026-10-27, in this order:

    1. 「你是跑测试啊，和车道有什么关系」 — a QA run is not a lane card: runners are dispatched directly, with no lane claim or seat-post act.
    2. 「你应该使用 pm-dispatch 技能写入」 — every GitHub write of a run goes through the scripts/pm/ doors (issue-create, post-stamped, close-cards, behind write-pace; the fleet relay in a cloud container).
    3. 「测试结果怎样，测试中遇到的问题应该创建 issue」 — every product defect a run meets is filed as its own issue in the same run.
    4. 「如果有安全问题不能写issue的，直接派卡修复」 and 「使用 pm-dispatch 技能 派卡修复」 — an authentication/authorization finding gets a withheld-detail card, and its fix is dispatched at once through pm-dispatch (in-seat os-dev, the reproduction only in the dispatch prompt), never waiting on the maintainer.
    5. 「以上应该写入你的 checklist skills」 — written into .claude/skills/checklist-test/SKILL.md and its twin, docs/qa/platform-checklist/RUNNER.md rule 2, on branch claude/sweet-fermat-jrcd80 (commit d49a510).

    The five wave-2 runner sessions are posting their records and defect cards through these doors now.

    ---

    Generated by Claude Code
14. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    W2-C2b (Tier 1 half B: dashboards · i18n · identity-auth · integration-system · platform-core · records-forms · search · studio-authoring · ux-conventions), recorded at #26450: release-18.2.0-w2-tier1-b (80/80) at 756220c4, 15 PASS / 64 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN. 657 clauses: 273 pass · 226 partial · 1 fail · 157 not-run.

    • Pins: none red. Framework vitest: 184 files, 4,496 passed. ui vitest: 26 files, 361 passed. Extra pins the mapping found: 22 files, 577 passed. ui/e2e/live: 25/25. Showcase smoke: 49/49.
    • Wave-1 NOT-RUN items: all 15 now have a verdict, from a live leg on their own boots (L1–L5). 13 PASS, records-forms.record-discussion-mentions PARTIAL (a9's walled leg), i18n.surface-matrix FAIL.
    • FAIL: i18n.surface-matrix n1. On /_console/forms/:name, option labels ignore the user's chosen language. This is a product defect, extracted as console: the standalone /forms/:name route renders select option labels untranslated — a zh-CN user on an en-US browser reads Chinese field labels over English options (FormPage normalizeOptions skips the localizer) #26452.
    • Probe: an authorization-class observation on mention notifications, extracted as records-forms.record-discussion-mentions: authorization-class finding (18.2.0 wave-2 sweep) — detail withheld pending maintainer #26453 with detail withheld.
    • Parked here:
      • one Parked-on: #25807 line per PARTIAL/FAIL item in QA run · release-18.2.0-w2-tier1-b (80/80) · 756220c4 · 2026-10-27 · 15 PASS / 64 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #26450's close-out;
      • fixture gaps: app-crm + IMPORT_CONSOLE_LIVE=1 and the :5200 harness for the two import specs; a walled boot for record-discussion a9's cross-org leg;
      • about 160 checklist-accuracy one-liners in QA run · release-18.2.0-w2-tier1-b (80/80) · 756220c4 · 2026-10-27 · 15 PASS / 64 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #26450's detail comments and the mapping notes. Examples: field-type-constraints a2 and knownGaps[0] are stale (currency scale is now refused at save; number scale/precision are enforced); the qa-feeds-disabled recipe's qa_nofeeds now answers 422 NAMESPACE_PREFIX; permission-matrix-editor-ux should read min-w-[1248px], not 960px (Permission matrix (Setup / Studio Access): readScope and writeScope cannot be set or seen, though ADR-0084 declares the record-scope column #26187); i18n.surface-matrix a7 declares 15 groups, not 12, and a10's feed premise no longer holds after plugin-audit: an activity summary is rendered once, at write time, in the workspace locale — store it as a key and render it in the reader's language #26167; org-override-registry-gate codes are upper-case; several refs omit pins that exist, e.g. measure-column-aggregate.test.ts, protocol-clone-real-engine.test.ts, mail-message-pool-read-gate.dogfood.test.ts, showcase-object-extension-scalar-divergence.dogfood.test.ts, admin-routes-auth-guard.test.ts.
    • Supersede: QA run · release-18.2.0-w2-tier1-b (80/80) · 756220c4 · 2026-10-27 · 15 PASS / 64 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #26450 carries Carried-forward: #25815 · records-forms.record-edit-undo · BLOCKED. Every other QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815 item in these areas was re-judged. QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815 is not closed here; the PM session closes it with Superseded-by: once both Tier 1 halves are posted.

    ---

    Generated by Claude Code
15. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    W2-C3b recorded: #26456 (release-18.2.0-w2-manual-browser, 34/34 at 756220c4, console built in-repo from ui/): 30 PASS / 3 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN. Six runners ran in two staggered waves, never more than three browser runners at once. Environment prep took about 15 min; testing about 140 runner-minutes, probes included.

    • FAIL: ux-conventions.write-feedback A1. The showcase's Mark Done toast "Task marked done." names no record (a product defect in the fixture's copy, extracted).
    • spec: a translation item accepts any locale string ("not a locale!!" saves 200, valid) — LocaleSchema is a bare z.string() #25822 retest: the fix holds for not a locale!!, zh_CN, padded values and multi-word names, at both doors. Single-word language names (Chinese, English) still pass; extracted as a new card.
    • Extracted (5): app-showcase: record-action success messages name no record ("Task marked done.") — fails the write-feedback naming rule (ruling C on #25849); the runner fills {{ }} holes, so the copy can name the record #26459, app-shell: the full-page record form (/new, /edit route) still toasts "Task updated successfully" — #26172's fix covered AppContent's dialog paths only; RecordFormPage passes the object label alone #26461 (Record create/update success toasts name the record by its title, not only the object (ruling C on #25849) #26172's fix missed RecordFormPage's page route), metadata-protocol: GET /meta/:type/:name/diff answers 200 for a version that does not exist — "no change" or "everything removed" — while rollback refuses the same version 404 VERSION_NOT_FOUND #26462 (meta diff answers 200 for nonexistent versions), spec: a single-word language name ("Chinese", "English", "Japanese") still passes as a translation locale — the #25822 fix refuses multi-word names only, though its changeset and refusal text say "a language name" is refused #26463, service-settings: sys_setting_audit.old_hash is never written (hard-coded null) and new_hash for a non-secret value is an FNV-32 digest, while both columns declare "SHA-256 of the … value" #26465 (sys_setting_audit.old_hash is never written).
    • Parked here:
      • decision-action-matrix A9 (no org-less request on stock)
      • action-location-matrix A3/A4 (knownGaps[2]: runtime actions are not served)
      • webhook-lifecycle A2 (QA run · surface:mixed (90/90) · 36b2889c · 2026-10-12 · 72 PASS / 10 PARTIAL / 8 FAIL / 0 BLOCKED / 0 NOT-RUN #23166) and A4 (cross-org and parked arms are pin-only on single)
    • Checklist-accuracy findings (about 30 lines across 20 items, plus one RUNNER environment fact and one shared recipe) and 8 not-extracted observations are in the record's first comment.
    • Supersede: QA run · release-18.2.0-manual-set (29/29) · 6679644a · 2026-10-25 · 25 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #25817 is left open for W2-C3a, which finishes second, to close.

    ---

    Generated by Claude Code
16. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    Wave 2, card W2-C2a (Tier 1 half A: access-security · ai · api-backend · approvals · attachments-storage · automation · cli) recorded: #26468 (release-18.2.0-w2-tier1-a, 73/73 at 756220c4, console built in-repo). 13 PASS / 60 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN, 499 clauses: 238 pass · 132 partial · 1 blocked · 128 not-run · 0 fail.

    • Pins: 261 vitest files, 7,275 passed · 0 failed · 3 skipped; ui/e2e/live 2/2; verify --rls 0 FAILED · 0 HOLES.
    • Live legs: all nine wave-1 not-run items named on the card now have a verdict. Eight are PASS. automation.setup-packaged-automation-board is PARTIAL: its a5 member cell is blocked by its own knownGaps[2].
    • Extracted product defects (off-clause probes, each reproduced on a fresh boot):
      • oauth: on a private plain-HTTP deployment the authorization-server metadata publishes an https:// issuer while authorization_servers[0] and every endpoint are http:// (RFC 8414 §3.3 mismatch) #26472: OAuth AS metadata publishes an https issuer on a private plain-HTTP boot.
      • automation: switching off a packaged flow or a packaged action writes the activation-ledger row and its audit row with a null actor, so nothing records which admin did it #26474: the packaged flow toggle and action activation write ledger and audit rows with a null actor.
    • Supersede: QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815 stays open until card W2-C2b's record exists. Whichever card finishes second closes it with Superseded-by: naming both records. This record carries forward the two QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815 items in its areas that were not re-judged: access-security.no-active-org-session-semantics BLOCKED and approvals.decision-only-via-service NOT-RUN.

    Parked here:

    • Partial coverage: one Parked-on: #25807 line per PARTIAL item in QA run · release-18.2.0-w2-tier1-a (73/73) · 756220c4 · 2026-10-27 · 13 PASS / 60 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #26468's close-out (60 lines). Clause reasons are in its three detail comments: 132 clauses are pinned below the oracle's layer, and 128 are unpinned, half-asserted or procedural.
    • Fixture gaps:
      • the board's a5 member cell (the member cannot open Setup);
      • the OAuth item's step 4, which needs a second host (this container has no RFC 1918 address);
      • cli.scaffold-first-run's published path, which installs 18.1.0. The pre-release verdaccio variant is the one that measures an unreleased subject.
    • Probe observations, not filed (seen once, or a design question):
      • explain for an unknown userId answers 200 allowed:true;
      • anonymous share-link resolve returns organization_id/created_by/updated_by/owner_id unless redacted per link;
      • an empty-string share-link password mints a link with no gate;
      • $count=maybe answers 200, and an empty $select= returns full rows;
      • the template-site validate_expression accepts a misspelt field;
      • OAuth create-client's wording for http://127.0.0.1 says "non-loopback";
      • the scaffolder exits 0 after its own install fails, and accepts a name that is not a legal npm name.
    • Coverage gap: no clause asserts that the AS metadata issuer equals authorization_servers[0] (see oauth: on a private plain-HTTP deployment the authorization-server metadata publishes an https:// issuer while authorization_servers[0] and every endpoint are http:// (RFC 8414 §3.3 mismatch) #26472).

    Checklist-accuracy findings follow in the next comment.

    ---

    Generated by Claude Code
17. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    W2-C3a recorded: #26476 (release-18.2.0-w2-manual-api, 29/29 at 756220c4: 27 PASS / 2 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN). Every clause was driven live by six parallel runners. Env prep was about 14 min (cold pnpm build 12 min) and testing was about 19 min of wall clock.

    Wave-1 extraction retests: all five fixes hold, #25818, #25819, #25820, #25821 and #25822.

    Parked here (fixture gaps, unchanged from wave 1):

    • automation.trigger-status-contract A4: the 503 STORE_UNAVAILABLE arm.
    • automation.packaged-flow-subflow-disable-refusal N1: a package-loader-installed second caller.

    Checklist-accuracy findings: listed in the record body under "Checklist-accuracy findings". Highlights:

    • the attachments-storage media recipe object must be media_qa_media (422 NAMESPACE_PREFIX);
    • cli.hook-body-extraction-gates says 14 FORBIDDEN_PATTERNS, but there are 13 since hook sandbox: a metadata-only hook body cannot read ctx.provenance (flowRunId), so a guard that tells a flow write from a user's own write must ship bundled (hotcrm#2285) #25905;
    • batch-transactional-discovery still says rest: POST /api/v1/batch answers 500 for an update or delete op whose id is the empty string, where a missing id answers 400 VALIDATION_FAILED #24781 is open, but it is fixed;
    • trigger-status-contract is missing the 422 FLOW_INPUT_SCHEMA_INVALID row;
    • packaged-flow-clone-contract A6 needs a console on a surface:api item;
    • two RUNNER.md facts: the tree's .objectstack/data/ upload root and external datasource escape a per-boot DB, and the process-kill hook refuses a grep + kill command.

    Extracted product defects: #26477, #26478, #26479, #26480.

    Supersede: the api/cli/build half of #25817 is re-judged in full (nothing carried forward). #25817 closes when W2-C3b's record lands.

    ---

    Generated by Claude Code
18. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    W2-C1 recorded: #26481 (priority:P0, 23/23 at 756220c4, Console built in-repo from ui/): 20 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN. Of 204 clauses, 201 pass, 3 are blocked by fixtures, 0 fail. Every pin is green, Playwright smoke 49/49; the served entry chunk matches packages/console/dist byte for byte, so stale-console-bundle is ruled out.

    • access-security.walled-environment-metadata-operator-only moved PARTIAL → PASS against wave 1 (QA run · priority:P0 (23/23) · 6679644a · 2026-10-25 · 19 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #25812).
    • Parked here: the three blocked clauses (rls-both-sides c5, crud-permission-matrix c5, organization-ownership-ceremony c5) — see QA run · priority:P0 (23/23) · 756220c4 · 2026-10-27 · 20 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #26481's close-out.
    • No product defect, no auth/authz finding. Checklist-accuracy findings are in QA run · priority:P0 (23/23) · 756220c4 · 2026-10-27 · 20 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #26481's first comment.
    • QA run · priority:P0 (23/23) · 6679644a · 2026-10-25 · 19 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #25812 is closed as superseded by QA run · priority:P0 (23/23) · 756220c4 · 2026-10-27 · 20 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #26481.

    Posted by the PM session on the runner's behalf (the runner session's own write was refused there).

    ---

    Generated by Claude Code
19. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    From #26468 (release-18.2.0-w2-tier1-a, 73 items at 756220c4): checklist-accuracy findings. These come from the four mapping passes, which re-derived every clause from the pin source, and from the three live legs. Each line is a ledger edit for the lane owning docs/qa/platform-checklist/**; many duplicate or refine lines already on the wave-1 cards #25835–#25841. Clause labels: aK = acceptance[K], nK = negative[K]. Lines that read "ref accurate" are kept as confirmations.

    • access-security.rls-both-sides: ref names showcase-private-owd only; its PATCH/GET assertions are not<300 / not 200 (a1's 'non-200' is satisfied; a2 needs >=400 + re-read). The row-unchanged re-read exists for rls_note in rls-fixture.dogfood.test.ts (fixture, not showcase) — ref states this honestly. rls-fixture/rls-multitenant are named in prose but are not pins for any clause; listed for completeness.
    • access-security.write-path-guards: Accurate ref. All three dogfood pins are http-in-process over the shared showcase; showcase-readonly-when-parent drives as admin (not member). n1's objectql pins run on own test objects, not showcase_contact.lead_score (ref says so).
    • access-security.record-access-explain: Ref accurate. The zoo explain case calls security.explain() in-process under {isSystem:true, tenantId: defaultOrg} — engine layer. Explain response shape (rest/src/security-routes.ts): GET|POST /api/v1/security/explain, body {object, operation, userId?, recordId?|recordIds?}; 401 UNAUTHORIZED anon; ExplainDecision {allowed, object, operation, principal, layers[{layer,contributors[]}], record?:{recordId,visible,decidedBy?}} (spec security/explain.zod.ts). Related HTTP explain pins exist for other fixtures (explain-write-door-parity.dogfood, cbp-explain-master-write.dogfood on write verbs/cpg_board) — not this item's read/showcase oracle.
      • live: Probe-side note, not a defect: the auditor's depth layer reads 'org' with no contributors, so the VAMA-implied depth is not attributed to any set. Cosmetic attribution gap only.
      • live: No step names who owns the probe record. The fixture says 'owned by a third user'; a member can create one directly because showcase_member_default grants allowCreate on showcase_private_note, so no admin system write is needed. Worth stating in steps[0].
    • access-security.crud-permission-matrix: Ref accurate (41 showcase_* rows, 87 allow / 77 deny, 9 baseline flips match the pin). It also names showcase-permission-zoo as context. The objectstack verify --rls half is a CLI proof (otherPins), not a pin. The matrix pin boots its own showcase (bootShowcase with showcaseAppDefaultSecurity), http-in-process.
    • access-security.owd-sharing-matrix: Ref understates: acceptance[2] and acceptance[3] ARE pinned at HTTP by showcase-crud-persona-matrix.dogfood.test.ts (modifyAllRecords case; contributor/member_default × showcase_project cells) — ref says 'no pin'. controlled-by-parent.dogfood.test.ts runs a synthetic cbp_account/cbp_note fixture (ref says so) and scores no clause here.
    • access-security.fls-mask-and-strip: Ref accurate (a0 re-read leg, a2 admin side, a3 and the UI half of a4 manual). a4's API half is fully pinned at HTTP; scored partial only for the UI (browser) half.
    • access-security.anonymous-deny-surfaces: Ref says acceptance[5] has 'no case in any pin' — overclaims the gap: anonymous-door-sweep.dogfood.test.ts class-1 case drives anon GET /api/v1/forms/contact-us → 200 on the showcase (http-in-process).
    • access-security.public-form-withdrawal-layers: Ref accurate. Dogfood pin boots its own showcase with orgContext:true and the stock SecurityPlugin; doors probed anonymously via stack.api. rest pin drives RestServer over a mocked protocol (unit); metadata-protocol pin is in-process over stub registry.
    • access-security.activation-write-operator-gate: Ref accurate and candid. All runtime pins are domain handlers over fakes (unit). The only HTTP pin (packaged-activation-ledger-reach) drives as the dev admin.
    • access-security.platform-owner-email-anchor: Ref accurate. All three pins are in-process derivations over fakes; a0–a3 need restarts per variant (memoized per raw string).
    • access-security.me-permissions-aggregation-parity: Ref accurate. hono-current-user-endpoints pins run on a bare Hono app with no auth service/gate; dogfood anonymous /me/apps asserts body only (no status). Extra HTTP observation of /auth/me/permissions exists in organization-update-door.dogfood.test.ts.
      • live: steps[4]: a showcase_project create needs the required lookup 'account' (400 VALIDATION_FAILED 'Account is required' without it). The step says 'create a showcase_project as W' with no body hint; add account:‹a showcase_account id›.
      • live: acceptance[5].verify says to 'configure localization.currency and localization.timezone' without naming the door. It is PUT /api/settings/localization {currency,timezone} as admin (note: /api/settings, not /api/v1). Worth naming, plus a revert step, since it mutates tenant settings.
      • live: W's objects map also carries a literal '*' key (the plain wildcard entry, allowEdit:true). Clause a6 does not mention it; a consumer that enumerates objects will see a non-object key. Not scored.
    • access-security.record-view-read-audit: Ref accurate (sys_job not probed; install line unobserved). read-audit.test.ts runs a real engine (in-process) with installReadAuditWriter; audit-plugin.test.ts is provisioning/plumbing and scores no clause directly.
    • access-security.share-link-landing-page: Stale knownGaps[0]/ref: 'objectui-repo-only, not runnable from this checkout' is no longer true — ui/ is imported in this tree (pnpm-workspace includes ui/apps/*), shared-record-shape.test.ts and SharedRecordPage-11649.test.tsx exist at ui/apps/console/src/pages/ and run with the @object-ui/console vitest project. SharedRecordPage-11649.test.tsx (jsdom over stubbed fetch) partially pins a1 and a3 and is missing from the ref.
      • live: knownGaps[0] / automated.ref still call the objectui pins 'objectui-repo-only / not runnable'. Per RUNNER they resolve under ui/apps/console/src/pages/ (shared-record-shape.test.ts, SharedRecordPage-11649.test.tsx) and are runnable from this checkout. Stale wording (RUNNER already flags this class).
      • live: Steps use /s/‹token›; the live route is /_console/s/‹token› (App.tsx mounts it inside the console basename). The Sign-in href is /_console/login?redirect=%2Fs%2F‹token›, so the redirect carries the router path without the /_console basename, as the source comment says. Worth stating, so a runner does not misread the redirect value as wrong.
      • live: Step 1 'the API item's step shapes' works: POST /api/v1/share-links {object,recordId,password|audience|expiresAt|redactFields}; revoke is DELETE /api/v1/share-links/‹token›. The liaison has to create a status:'published' brief first (eligibility).
    • access-security.anonymous-floor-v18-doors: Ref accurate. a4: the showcase sweep asserts 2xx + keys ['id'] (not exact 201, no forged owner_id/status sent); exact 201 is from public-form-submit-answer over the real Hono transport and a protocol double — scored pass on the pair. a2 has an extra HTTP pin outside the ref (member, not admin). share-link-routes / notifications-every-verb / api-key-lifecycle are named in ref prose as outside-ref corroboration.
    • access-security.walled-environment-metadata-operator-only: Ref accurate. Walled dogfood pins boot bootStack with multiTenant 'posture-only' (isolated/group) — a purpose-built fixture, not the showcase; http-in-process.
    • access-security.meta-authoring-trail-and-audience-gates: Ref accurate.
    • access-security.security-catalog-activation-and-clone-doors: Ref accurate on which arms are unit-only. Doors: POST /api/v1/security/_activation/:type/:name {enabled?} and POST /api/v1/security/permission-sets/:name/clone {name,label}.
    • access-security.security-catalog-one-holder-and-boot-report: Ref accurate.
    • access-security.grant-table-write-contract: Ref accurate.
    • access-security.parent-and-organization-write-guards: Ref accurate (in-process pins for a1/a2/n0; the 18.0 PASS predates the layer rule).
    • access-security.deployment-tables-platform-only: Ref accurate. sys-presence.object.test.ts asserts no tenant column and requiredPermissions [manage_platform_settings] (lines ~88-103).
    • access-security.share-link-combined-gates: Ref accurate: the runtime pins are route entries over a minimal IHttpServer stand-in + real engine (no Hono/HTTP).
    • access-security.org-admin-assignment-boundary: Ref accurate: n2's full set list is unit-only (no posture dimension); per posture only admin_full_access is exercised. App 'none' — the pin boots ObjectQL over SQLite with SecurityPlugin per posture.
    • ai.mcp-http-surface: Ref accurate on halves. Divergence: a2 scored pass — mcp-skill-method-not-allowed.hono.integration.test.ts asserts status, Allow: GET and the exact envelope message over a real Hono socket with the real dispatcher; the faked services are never reached for a 405 (ref claims no file scores alone). Missing from ref: packages/cli/test/serve-mcp-capability-collision.e2e.test.ts (spawned live server, osk_ key, initialize+tools/list>0, /mcp/skill 200 — nightly tier). scopes test's READ_TOOLS omits resume_run (11 tools vs clause's 12). hono-mcp-skill-raw-body.conformance.test.ts asserts content-disposition only on a stubbed dispatcher response, so it does not pin a1.
    • ai.mcp-stdio-fail-closed: Ref accurate: no API_KEY_REVOKED pin in packages/mcp (grep). Missing from ref (corroborating only): plugin-execution-context.test.ts (per-call identity re-resolution; generic 'no longer valid' refusal — the pre-[Decision] API key 的生命周期与存放：到期上限与不活动失效取多长，key 继续放自有 sys_api_key 还是迁到 @better-auth/api-key（#23287 裁决 C′ 的留项） #23367 arm, not the coded one) and plugin.test.ts's own 'Transport not auto-started' assertions for a7. stdio-api-key-account-posture.pin.test.ts / stdio-tenancy-posture-api-key-matrix.test.ts cover adjacent posture arms, not these clauses.
    • ai.mcp-validate-expression: Ref accurate. Pin's 'accepts a sound formula and reports its inferred type' case asserts ok/errors/warnings/inScope only — inferredType is never checked, so a0's inferredType half has no pin even at unit. Fixture fields (estimate_hours/title on showcase task) verified present in examples/app-showcase.
      • live: variants[2] says flow_condition 'fields bound BARE — a record.-prefixed ref is the error here'; live 'record.estimate_hours > 8' under flow_condition → ok:true, errors []. The flattened scope binds the record root as well as bare fields (packages/formula/src/validate.ts scope docblock; VALIDATE_SITE_MAP flow_condition = predicate/flattened). The variant text is wrong, no clause depends on it
      • live: flow_condition responses carry no inferredType (only formula/value role does); fine, but no clause says so
    • ai.skill-instructions-mcp-prompts: Ref accurate; all named cases exist.
    • ai.mcp-oauth-private-host-transport: Ref accurate (both files plugin units). Base URL is set via OS_AUTH_URL (also BETTER_AUTH_URL / OS_BASE_URL; packages/cli/src/commands/serve.ts AUTH_BASE_URL_ENV_NAMES). Log sentences live in packages/plugins/plugin-auth/src/auth-plugin.ts (~4427/4437/4540). https re-boot leg needs a TLS terminator in front (OS_AUTH_URL=https://$LAN:8443); no pin. oidc-discovery-sync-mount.test.ts mounts discovery over a stub origin, not a private one — not a pin here.
      • live: fixtures (a) needs 'a PRIVATE address the host actually holds'; this container holds only 127.0.0.1 and 192.0.2.2. 192.0.2.2 (TEST-NET-1) is PUBLIC to the rule, so it is a reachable boot-(b) fixture here. Worth recording in fixtures.knownGaps
      • live: the item never names how to set the deployment base URL: OS_AUTH_URL (or BETTER_AUTH_URL / OS_BASE_URL — packages/cli/src/commands/serve.ts AUTH_BASE_URL_ENV_NAMES); the https re-boot can use OS_AUTH_URL=https://… or os dev --cert/--key
      • live: missing clause: nothing asserts that the AS metadata issuer equals the protected-resource authorization_servers[0]. On boots a/a2/b they disagree (probe finding F1)
    • ai.mcp-coded-refusals-and-runtime-exposure: Item revision moved 2→3: ref now also names mcp-coded-refusal.test.ts and mcp-stdio-runtime-object-exposure.test.ts (both exist). Layers as ref states.
    • approvals.email-action-token-door: Ref accurate per clause; all named cases exist. action-page-member harness is a real ObjectKernel (ObjectQLPlugin + ApprovalsServicePlugin + SqlDriver in-memory) with the plugin's own Hono mount — http-in-process, so a4/n2 page bytes are asserted at HTTP, but not on the showcase boot.
    • approvals.status-mirror-field: Missing from ref (corroborating, lower layer): record-lock-multi-update.integration.test.ts 'exempts a status-mirror write (only the approvalStatusField changes)' (a1 at engine — contradicts the item's 'no pin binds the record lock'), status-mirror-declared-values.integration.test.ts (engine mirror values), approval-service.test.ts mirror cases incl. sendBack 'returned' (unit). Item revision 3→4.
    • approvals.request-page-reply-and-reader-visibility: Ref accurate. Item revision 2→3. approval-service.test.ts comment cases (service unit) corroborate a1, not in ref.
    • approvals.act-door-and-admin-rescue-slate: Ref accurate. approvals-act.test.ts asserts PUT → 404 ROUTE_NOT_FOUND through the real dispatcher (unit); the self-hosted ENDPOINT_NOT_FOUND arm has no pin.
    • cli.scaffold-first-run: automated.ref is a CI workflow, not a test (otherPins). Subject versions are 18.1.0 (create-objectstack/cli/spec), so the scaffolded template's @objectstack/* range resolves to the published 18.1.x line — the repo-bin path measures the template against the registry, not this tree's packages; measuring this tree requires the pre-release local-registry variant. Corroborating unit tests not in ref: packages/create-objectstack/src/scaffold-skills-single-copy.test.ts, scaffold-e2e-boot-probe.test.ts. Local equivalent of scaffold-e2e.yml job scaffold-local (repo-built scaffolder, registry deps): (1) pnpm install --frozen-lockfile; pnpm --filter create-objectstack build. (2) cd $SCRATCH && node /home/user/objectstack/packages/create-objectstack/bin/create-objectstack.js e2e-app --skip-install --skip-skills. (3) cd e2e-app && npm install --no-fund --no-audit; on failure (repo version 18.1.0 unpublished) rewrite every @objectstack/* dep to 'latest', npm install again, and re-stamp objectstack.config.ts engines.protocol to ^‹installed @objectstack/spec major› (record this fallback). (4) npm run validate && npm run build && npm test (each exit 0). (5) refuse if :8080 already answers /api/v1/health; npx os start --artifact ./dist/objectstack.json --port 8080 > server.log 2>&1 &; poll curl -fsS http://localhost:8080/api/v1/health every 2s ×30 (fail with server.log if the PID dies or never healthy); curl -fsS http://localhost:8080/api/v1/ready; kill PID. (6) skills boundary: scaffold skills-probe --skip-install --skip-skills; expected = sorted basenames of /home/user/objectstack/skills// holding SKILL.md; npx -y skills add /home/user/objectstack/skills --all --copy; installed = find . -name SKILL.md -not -path '/node_modules/' → dirname basenames sort -u; assert installed == expected; npx -y skills add /home/user/objectstack --list → must not contain 'dogfood-verification' and must say 'Found ‹expected_count› skill'. (7) pinned shape: scaffold pinned-probe (no --skip-install); if node_modules/@objectstack/cli exists, Dockerfile 'FROM ghcr.io/objectstack-ai/objectstack:‹tag›' tag == installed cli version; else if registry has no cli matching the range, tag must be 'latest'. (8) skills catalog: in pinned-probe, .claude/skills/ (real dirs with SKILL.md, no symlinks, no .agents) names == node_modules/@objectstack/skills/dist/skills/* names. (9) docker (optional locally): docker build -t ghcr.io/objectstack-ai/objectstack:‹tag› --build-arg OS_CLI_VERSION=‹cli ver› /home/user/objectstack/docker; docker build e2e-app; docker run -p 18080:8080 with OS_SECRET_KEY/OS_AUTH_SECRET; poll /api/v1/health. Job registry-canary (nightly): npx -y create-objectstack@latest canary-app -t blank --skip-skills; validate/build/test if scripts exist; same boot+health+ready probe. Pre-release variant (item fixtures): pack all public workspace packages, publish to a localhost registry with no upstream for @objectstack/* + create-objectstack, npm_config_registry=‹it› node packages/create-objectstack/bin/create-objectstack.js qa-first-run -t blank --skip-skills, verify lockfile integrity == local tarballs.
      • live: steps[0]: 'its exit code and its install output are the install step's evidence' — the exit code alone is NOT evidence: probed at 756220c with an unreachable registry, the scaffolder printed 'ERR_PNPM_META_FETCH_FAIL … ⚠ Dependency installation failed. Run pnpm install manually.' then '✓ Environment created!' and exited 0 with no node_modules (index.ts catch arm, deliberate). The step should require node_modules/@objectstack/cli present / no 'Dependency installation failed' line, not exit 0.
      • live: history rev 6 says 'all seven clauses stayed not-run' — the item has five acceptance clauses.
      • live: published path (create-objectstack@latest = 18.1.0) is not the subject: the tree carries 208 pending changesets and its skills/ catalog has 11 skills (adds objectui) vs the published @objectstack/skills 18.1.0's 10 — a verdict 'valid for this subject' needs the pre-release variant, which the item lists only as an alternative; worth saying in knownGaps[1] that during a sweep of an unreleased commit the pre-release variant is the required path.
      • live: steps[4] wording 'compare that set … with node_modules/@objectstack/skills/dist/skills by name and count': dist/skills also contains README.md — a naive ls count is 11 vs 10 on the published package; say 'directories holding SKILL.md' for both sides (the workflow does).
    • cli.dev-automigrate-policy: Ref under-claims: packages/cli/test/dev-standalone-self-heal.integration.test.ts spawns the built CLI (dev --no-watch ×2, serve) over a blank scaffold and asserts the auto-reconciled line on a keyless dev restart and its absence on a production serve — scores a5 pass and halves of a0/a1/n1 at live-boot; packages/drivers/driver-sql/src/sql-driver-14902-plain-unique-duplicate-preflight.test.ts pins the 'safe boot over a blocked create' half the item says is hand-staged; packages/runtime/src/dev-auto-migrate.test.ts pins the injection decision. Revision 6→7: a4 text now matches ADR-0131 D1 pins (wave-1 'stale' finding resolved). The self-heal spawner needs packages/cli dist built (requireBuiltCli).
    • cli.migrate-meta-write-stored-and-all: Divergence from wave-1: a3 scored partial (meta.report-order.test.ts drives printMigrationReport directly, not the command). Revision 2→3.
    • cli.organization-ownership-ceremony: Ref files all exist. Revision 4→5.
    • cli.meta-package-flags-and-explain: Ref accurate. Revision 2→3.
    • cli.validate-v18-authoring-verdicts: Ref accurate (states a1/a2 unpinned).
    • cli.verify-derived-proof-families: Ref accurate.
    • api-backend.query-contract-matrix: Ref accurate at rev 6: no ref'd pin reaches HTTP. engine.test.ts [Security: $expand bypasses RLS/FLS on the referenced object (data leak on lookups) #2850] runs on a mocked driver (scores a4 partial alone). Missing from ref: packages/qa/dogfood/test/showcase-expand-crud-gate.dogfood.test.ts ([security] $expand bypasses the CRUD gate and OWD row scope — a contributor reads records they are 403'd from, because the #2850 expand waiver keys on the wrong axis #7626) drives the contributor/admin expand pair over the in-process HTTP stack through all three expand doors — it scores a4 at HTTP and should be named in automated.ref. request-schema-gate.conformance.test.ts has no $nin scalar case (only the {limit:'ten'} / null / array bodies) so it does not touch a5 at all. engine-filter-array-lowering asserts code INVALID_FILTER, which the POST door no longer answers (VALIDATION_FAILED since spec: FilterConditionSchema (the save-time door) admits a non-boolean $null / $exists flag, so a stored dataset or widget filter carrying one saves clean and is refused 400 on every query face #20116) — a lower-layer pin with a different code.
      • live: variants list omits operators AST_OPERATOR_MAP serves: icontains→$icontains, ilike→$ilike, is_empty/is_not_empty→$empty, before/after (date $lt/$gt). Coverage gap, not a defect (packages/spec/src/data/filter.zod.ts AST_OPERATOR_MAP)
      • live: AST is_null / is_not_null work with NO comparand (['churn_reason','is_not_null'] → 2 rows); step 2 could name that spelling
    • api-backend.bulk-write-contract: Ref accurate at rev 5: owner-anchor-and-bulk-writes bulk cases are ql.update/ql.delete({multi:true}) engine calls (lines ~165-195), never an HTTP bulk door; its single-door cases are HTTP but concern owner anchoring, not this item. rest-batch-size-cap.test.ts is RestServer over a mocked protocol (pins count/max/BATCH_TOO_LARGE). No HTTP-booted pin of createMany/updateMany/deleteMany on showcase_private_note exists. Every clause stays a live leg.
      • live: variants list door:per-object-batch (POST /data/:object/batch) but no step or clause drives it; this run drove it ad hoc (update on foreign id → RECORD_NOT_FOUND, own → success, create x201 → BATCH_TOO_LARGE)
      • live: member deleteMany on a foreign OR nonexistent id answers PERMISSION_DENIED (object-level allowDelete gate fires before lookup) — uniform, so no oracle; step 6 could state this so a runner does not expect RECORD_NOT_FOUND there
    • api-backend.declarative-endpoint-execution: Dogfood files boot the showcase through @objectstack/verify (real Hono app via app.request) — http-in-process. apis-publish-gates gate (a) is a describe block (script /does not execute/, proxy /SSRF|egress/); neither asserts endpoint naming. Ref accurate.
    • api-backend.packaged-action-disabled-dispatch: Ref accurate. The dogfood dispatch probe sends params:{recordId} rather than a top-level recordId. Restart leg, param-ordering contrast, anonymous probe and live MCP transport have no pin.
    • api-backend.action-activation-door-contract: Ref accurate. a7 is test-oracle and both unit cases exist. The 4-segment unit case ('a deeper path under _activation is still GATED') runs under isolated and answers 403, a different claim from a1's router 404. field-error-code-catalog.test.ts ('activation-gate.ts readActivationBody') pins the shared body reader only, not this door.
    • api-backend.rest-crud-config-contract: Ref accurate. discovery-services pin uses dataPrefix '/objects' (the step names '/records'); route-table re-basing has no pin.
    • api-backend.rest-batch-config-contract: Ref accurate. a1's survival of POST /api/v1/batch rides the both-direction diff (baseline lists it; comment at line ~174).
    • api-backend.rest-metadata-config-contract: Ref accurate. meta-object-fls.test.ts runs the shared OBJECT_SCHEMA_MASK_CASES over RestServer exits with a security double (unit). Cache-branch has no pin.
    • api-backend.rest-route-generation-tombstones: Ref accurate (rev 3 already states the per-clause reach). §E's 'the plugin path refuses the same keys' drives batch.defaultAtomic, not routes.
    • api-backend.second-object-exposure-and-internal-fields: Missing from ref: packages/qa/dogfood/test/second-object-exposure.dogfood.test.ts (security(data, analytics): a lookup target's exposure declaration is not judged when the data door's $expand, or the dataset door's dimension-label pass, reads it — detail withheld pending maintainer #22661/security(data): a nested-relation filter condition on a lookup target is evaluated without asking the target's exposure (census row 4 of #22661) #22737, real stack) and packages/qa/dogfood/test/internal-field-data-door-positions.dogfood.test.ts (security(data): the data door's filter and group-by positions do not honour a field's internal: true the way its row read does — detail withheld pending maintainer #22646, showcase sys_api_key.key) — both HTTP-in-process and they lift a2, a3, n0. No pin asserts the filter.t_ref location (a1).
    • api-backend.data-request-shape-and-query-arity: Ref accurate (rev 3 states per-file layers). None boots the Hono adapter.
    • api-backend.meta-read-doors-v18: Ref accurate. a0's oracle (files green) includes the dogfood file. The data-sort 403 dogfood uses a scratch readable:false set on showcase_project.budget, not the client_liaison position the step names.
    • api-backend.error-sentences-and-unique-violation-wire-code: Ref accurate. a1's 'no code' design is pinned through mapDataError only.
    • attachments-storage.presigned-upload-roundtrip: Ref accurate. Extra pin storage-unclaimed-download.dogfood.test.ts follows /url bytes and the 302→Location→bytes for bearer and cookie callers, but on a scope-less file, so a2/a3 stay partial for the attachments-scope fixture. owner_id/status reads in the matrix are engine reads (ql.findOne isSystem) on the HTTP-booted stack.
    • attachments-storage.download-authz-both-sides: Ref accurate for a0–a3. Extra component pin ui/packages/app-shell/src/views/tests/RecordAttachmentsPanel.test.tsx (not in ref) asserts the friendly-copy mapping for both envelope dialects; it lifts a4/n1 from unpinned to partial (component), never pass. a2's admin-owner case is also the parent owner, so it never isolates the uploader bypass.
    • attachments-storage.read-inherits-parent-rls: Ref accurate. a0 nit: the clause/steps scope the list by parent_object+parent_id; the matrix pin lists unscoped and asserts absence — semantically covers it. The probe-warning prefix '[storage] attachment read visibility' is asserted nowhere (unit asserts fragments only), as the clause itself admits.
    • attachments-storage.attach-requires-parent-edit: Ref accurate (rev 8). Unit companion attachment-access-hooks.test.ts 'installAttachmentAccessHooks does not authorize an UNSCOPED multi-delete: no id + no where reads as "nothing to authorize" and deleteMany runs over the whole table #4757 through the wired engine' block confirmed. a5/n2 are engine-only, as the ref states.
    • attachments-storage.sys-file-status-pipeline: Ref accurate. attachment-lifecycle.test.ts (not in this item's ref; it is in orphan-tombstone-reap's) carries unit/engine pins for a5 and n1 — add it to the ref. Matrix reads sys_file through the engine (isSystem), writes through HTTP.
    • attachments-storage.orphan-tombstone-reap: Ref accurate. The dogfood 'abandoned pending uploads' case asserts the row reaped only (not bytes); bytes best-effort is unit-pinned.
    • attachments-storage.upload-session-abort: Ref accurate. storage-chunked-resume-integrity.dogfood.test.ts (extra) drives the chunked round-trip over HTTP but never reads sys_upload_session status, so a0 stays unpinned. storage-routes.test.ts also has "reports 'expired' on progress rather than refusing the poll" and 'leaves a completed session alone once its deadline passes' (unit).
    • attachments-storage.inline-grid-receipt-cells: Ref accurate. Spec navigates /apps/showcase_app/... on the console dev server (LIVE_APP_URL, default :5180); on a showcase boot serve the same under /_console.
    • attachments-storage.upload-limits-scope-and-ownership: Ref accurate. Extras not in ref: packages/qa/dogfood/test/storage-upload-limits.dogfood.test.ts (HTTP 413 + restartless save) and packages/plugins/organizations/src/storage-upload-door-ownership.wall.test.ts (HTTP 403 on complete/progress, walled boot) — consider adding both; the latter makes a3 pass at the HTTP layer.
    • attachments-storage.chunked-upload-integrity: ACCURACY: knownGaps[0] is STALE — packages/plugins/organizations/src/storage-upload-organization-change.wall.test.ts now pins the chunked chunk-PUT 409, chunked-complete 409, progress 200, and progress-with-due-expiry 409 after an organization switch, over a booted wall. Add it to automated.ref and retire the 'unpinned' gap (a0's 'org-switch guard has no chunked-door pin' text is also stale).
    • automation.trigger-type-matrix: Ref accurate (rev 8). inbound-hook-member.test.ts (extra) covers n1's refusal below the showcase; screen-flow.spec.ts carries a4's network half.
    • automation.screen-flow-roundtrip: Ref accurate (rev 6; wave-1 cited rev 5). Extra engine pin packages/services/service-automation/src/builtin/screen-resume-validation.test.ts covers a5/n0 below the door. The spec's launch regex expects the collection form /actions/showcase_task/showcase_bulk_reassign (no /:recordId).
    • automation.durable-suspend-restart: Ref accurate. Fixture packages/qa/dogfood/test/fixtures/flow-durable-suspend-fixture.ts is a non-test support file (otherPins).
    • automation.paused-run-trigger-record-masked: Ref accurate (rev 5).
    • automation.setup-packaged-automation-board: Ref accurate (rev 9). All ui pins are jsdom component tests over stubbed fetch (runnable: cd ui && pnpm --filter @object-ui/app-shell exec vitest run ‹file›, or the package's 'vitest run --root ../..'); framework nav pin runs in packages/platform-objects. Clone dialog now opens PREFILLED (‹source›_copy, '‹label› (copy)', objectui#13344), so step 6's 'submit with name empty' requires clearing the field first. Member toggle sentence confirmed in packages/runtime/src/domains/automation.ts FLOW_ENABLEMENT_DENY_MESSAGE (the actions half uses a different activation-gate sentence). Needs a console bundle built from ui/ (pnpm console:build) served at /_console.
      • live: personas[1] and steps[7] still say 'fresh runtime sign-up' — on stock showcase that is 403 SELF_REGISTRATION_CLOSED; minted via invite-member → sign-up (RUNNER env facts). Spell the invite in fixtures.requires.
      • live: steps[5] says 'try submitting with name empty, label empty' — the dialog now opens PREFILLED (‹source›_copy / '‹label› (copy)', objectui#13344) with submit enabled; the run must clear the fields first. acceptance[6] 'submit control is disabled until both fields are non-empty' still holds but the step should say the fields start filled.
      • live: acceptance[5] verify still frames the member alert as reachable through the page; with knownGaps[2]'s posture re-measured here at 756220c (member 403 at app open), the clause's member cell is structurally unscorable via dom — consider moving the member sentence check to an api oracle (forged toggle) or marking the cell conditional.
      • live: acceptance[7] verify says 'sys_metadata_activation reads are open by ruling' — measured 403 for a member at 756220c (2nd run to see this; also QA run · surface:browser (65/65) · 36b2889c · 2026-10-12 · 50 PASS / 2 PARTIAL / 12 FAIL / 1 BLOCKED / 0 NOT-RUN #23163). The verify text still asserts the opposite.
    • automation.flow-registration-verdict-on-read: Ref accurate.
    • automation.flow-authoring-refusals-v18: Ref accurate; 9 files exist. a1/a3/n0 need the CLI on a scratch app, a2 a boot.
    • automation.flow-run-semantics-v18: Ref accurate. ref string's bare 'flow-cel-current-user.test.ts' token resolves to packages/services/service-automation/src/.
    • automation.inbound-hook-timestamped-signature: Ref accurate.
    • automation.scheduled-work-opt-in: Ref accurate.

    ---

    Generated by Claude Code
20. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    PARTIAL coverage carried · session_012YjcDon6BvR9MN93ZsFq3U · 2026-10-27T08:42Z

    The Parked-on: #25807 lines of wave 2 for three areas are now carried by per-area pin-upgrade cards (maintainer: 「同意」): access-security → #26571 (18 items), api-backend → #26572 (11), records-forms → #26573 (21). The other areas stay parked here.

    Also landed from this wave: #26453 fixed by #26497 (merged); the ledger edit for records-forms.record-discussion-mentions and the checklist-test rule changes ride #26567.

    ---

    Generated by Claude Code
21. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    Post-release smoke of the published 18.2.0 (npm), filed as #26629: smoke:npm-18.2.0 (25/25) · 22 PASS / 0 PARTIAL / 3 FAIL / 0 BLOCKED / 0 NOT-RUN.

    • Headline: the first Console built from the in-repo ui/ tree serves from @objectstack/console@18.2.0 (the entry chunk is byte-identical to the package). A real browser sign-in as the dev admin lands on home with 0 console errors after sign-in. A record created through the Console reads back over REST.
    • Onboarding (both scaffolder spellings, npm-only included), the production path on a fresh SQLite file, the upgrades 18.1.0 to 18.2.0 and 17.7.0 to 18.2.0 (the ceremony, upgrading.mdx steps 1-8 matched verbatim), PostgreSQL CRUD, and the two checklist items on the published path (cli.scaffold-first-run r6, cli.scaffold-console-first-paint r6): all PASS.
    • QA run · smoke:npm-18.0.0 (27/27) · 06cab484 · 2026-10-20 · 22 PASS / 0 PARTIAL / 5 FAIL / 0 BLOCKED / 0 NOT-RUN #24908 B1 (fresh DB refused) and D1 (wrong pg remedy) are fixed on 18.2.0.
    • FAIL, each extracted: PostgreSQL: the NULL-safe row identity of sys_setting and sys_notification_preference never lands — DROP INDEX is refused by the declared UNIQUE constraint (2BP01) and CREATE UNIQUE INDEX IF NOT EXISTS then no-ops as success (18.2.0) #26630 PostgreSQL never gets the NULL-safe sys_setting / sys_notification_preference identity (2BP01 on every PG boot, and duplicate tenant settings are accepted). docs(upgrading): the Per-release specifics table has no v18.2.0 row — 18.2.0 is published and its upgrade checklist (releases/v18/18-2) is not linked from the upgrade guide #26631 upgrading.mdx has no v18.2.0 row. console: every record page on a deployment without the approvals service logs two console errors for the designed 501 of GET /approvals/records/OBJECT/ID/lock (18.2.0 scaffold) #26632 the console logs two errors for the designed approvals-lock 501 on every record page of a scaffold.
    • Checklist-accuracy findings, fixture gaps, not-run: none.

    ---

    Generated by Claude Code
22. objectstack-fleet commented on Oct 27, 2026

    

    objectstack-fleetBot

    on Oct 27, 2026

    ContributorAuthor

    More actions

    Re-verification of the wave-2 observations that were seen but not filed, 2026-10-27T11:23Z. Record: #26639, at fb91e979 on showcase, two fresh boots per observation, plus the published create-objectstack 18.2.0.

    • CONFIRMED, 5, each extracted:
      • security(plugin-audit): a sys_secret confidentiality gap, observed beside the 18.2.0 wave-2 clauses — detail withheld pending maintainer #26640, observation 3, sys_audit_log / sys_secret. Authorization class, detail withheld pending maintainer.
      • security explain answers 200 allowed:true for a userId that matches no sys_user row, built from the synthesized baseline principal #26641, observation 4, explain for an unknown userId answers allowed:true.
      • create-objectstack accepts a project name that is not a legal npm package name and writes it to package.json, where npm publish later refuses it #26642, observation 6, the scaffolder accepts an illegal npm name. The install-failure half is by design (create-objectstack: when the dependency install fails, "Next steps" leaves out the install step, so the next command it lists runs against an empty node_modules #23865).
      • data list door: a blank $select answers every column and an unrecognised $count value counts — malformed values are read as the absent default #26644, observation 8, a blank $select and $count=maybe are read as absent.
      • object door: fieldGroups[].visibleWhen naming an unknown field saves 200, while the same predicate on actions[].visible or fields.*.visibleWhen is refused 422 #26646, observation 9, a field-group visibleWhen is not validated at the object door.
    • BY DESIGN, 4, no card:
      • observation 1, API keys minting keys (keys.ts, ADR-0069 D3);
      • observation 2, share-link system columns (object-default ∪ per-link redactFields is the contract);
      • observation 5, an empty share-link password means none (ShareDialog trims a blank field to none);
      • observation 7, /meta/webhook serves the definition, and the activation ledger is separate (ADR-0126 §4).
    • NOT REPRODUCED: 0.

    ---

    Generated by Claude Code