docs(qa): 57 platform-checklist rows from the #23104 browser pass re-pointed to the product at the pin (#23169)

[objectstack-fleet]

Part of #23169
Clause-②: no

The browser pass of #23104 recorded two runs: QA run #23163 (surface:browser) and QA run #23166 (surface:mixed). Both ran at objectstack 36b2889c with objectui 1fb1ced36243. After #23121 closed, they parked 59 checklist rows on it, and two more rows were appended to it after its claim. #23169 carries all 61.

This PR lands 57 of the 61 rows. It revises 51 items across 15 area files, two area recipes and one RUNNER.md environment fact. Each revised item gets revision +1 and one appended history entry. The entry names the row, its run and the fields it touched. No product code, test or fixture changes.

#23169 stays open after this PR:

• access-security.share-link-landing-page C3 waits for PR feat(plugin-security)!: retire the four security-catalog row objects (#15204 stage 8) #23222, which edits access-security.json.
• platform-core.lifecycle-retention-sweep steps[4] waits on a maintainer ruling (below).

How each row was checked. .objectui-sha on main is still 1fb1ced36243, the console both runs drove.

• Console rows: re-read from objectui source at that pin.
• Framework rows: re-read from this repo's source at the base, 6d7f4df3c.
• No browser was driven and no app was booted. Where only a live run can show the behaviour, the row rests on the run record's evidence, and its history entry names the run.
• Clause and step indices below are zero-based, like a run record's. The run's own lane label (A0, C2, …) is in brackets.

Rows landed

item	rev	row (lane label)	what changed
platform-core.keyboard-shortcut-surface	2→3	C2, C3, C4 (stale spec)	acceptance[2]-[4] change from expected-fail probes to positive assertions. Since objectui#11674 the dialog lists only shortcuts whose handler is mounted, so it shows ⌘ B and none of the five dead keys, and it lists ⌘⇧O / ⌘⇧S only on the AI chat page. Read: advertisedShortcuts.ts and the pin KeyboardShortcutsDialog.wiredOnly-11674.test.tsx
platform-core.theme-mode-persistence	1→2	C0 (stale step)	the storage key is object-ui-theme (set in ConsoleShell.tsx), and ModeToggle sits in the avatar menu's Preferences group
platform-core.marketplace-console-honesty, …marketplace-install-local-lifecycle	3→4, 2→3	setup recipe gap	a boot that installs a package runs from a scratch copy. install-local caches under process.cwd() (local-manifest-source.ts#DEFAULT_INSTALLED_PACKAGES_DIR). RUNNER.md gains the same fact, with a ls check: the path is gitignored, so git status cannot see it
platform-core.lifecycle-retention-sweep	1→2	C1 (stale step; ruling owed)	the control boot and the kill-switch boot export OS_LOG_LEVEL=info: the sweep line is INFO, and os dev defaults to warn. steps[4] is not rewritten; a knownGap records the open ruling
records-forms.saved-view-management	1→2	A0 (stale spec)	create is a per-item draft (PUT …?mode=draft, ADR-0034) that lands on ?preview=draft, and the new Publish leg is POST …/publish. Read: ObjectView.tsx and createRuntimeMetadata
records-forms.list-view-capabilities	1→2	A6 (fixture gap)	new fixtures.requires[3]: a runtime permission set granting showcase_task allowRead + allowExport, bound by the set's NAME. Export is opt-in (resolveUserExportAllowed)
records-forms.record-edit-undo	2→3	A0-A3 (fixture gap)	only undoable actions push an Undo op. The showcase declares none, and runtime-authored actions are not served. The item gets a blocked annotation (see deviations)
records-forms.action-location-matrix	9→10	A4 (fixture gap)	the half (a) probe needs a PACKAGED locations-less action, because a runtime-authored one is not served. Half (a) scores blocked(fixture) on stock
records-forms.bulk-select-all-matching	2→3	stale fixture	re-pointed to the showcase_task "Bulk Actions" view with at least 55 scratch tasks. showcase_contact declares no bulkActions, and its 34 rows fit one page
records-forms.form-view-gallery	2→3	fixture gap	the overlay recipe carries item-level isDefault:true. Without it, MetadataProvider.applyViewItem never sets the default form (objectui#11539)
records-forms.form-dirty-guard	2→3	A2 (assertion defect), A0 (wording)	the pin runs from the objectui root, because objectui's vitest invocation guard refuses package-cwd runs (objectui#3378). The footer Cancel is a deliberate discard with no prompt (handleCancel), told apart from the X / Escape / backdrop closes
records-forms.import-wizard-encoding-and-hints	5→6	A0 (assertion defect)	the three pins run from the objectui root, for the same objectui#3378 refusal
records-forms.gantt-interactions	3→4	A2-leaf (fixture gap)	records the re-confirmation, and names a near-miss pin (GanttView.tree.test.tsx), which proves missing grips, not a drag
records-forms.field-group-visible-when	2→3	A3 (stale spec)	the detail half now holds: objectui#11630 writes { group } references, and record:details evaluates visibleWhen. Pin: record-details.groupVisibleWhen-11630.test.tsx
records-forms.object-hook-lifecycle	3→4	A7 (wording drift)	an onError:'log' hook logs [hook] handler failed (onError=log; suppressing) (hook-wrappers.ts runWithErrorPolicy)
dashboards.global-filters-rescope	3→4	D2 / D3 (fixture gap)	fixtures.requires[2] names the scratch dashboard D2 and D3 need: a writable package, and an optionsFrom filter, which no stock dashboard declares
dashboards.system-overview-live-counts	1→2	A1 / A3 (stale spec)	the Active Sessions oracle counts live sessions (the widget's own filter, #7531). There are two security tiles, not three. The server strips widget_organizations (filterDashboardForUser), so 8 of the 9 declared widgets are served
ux-conventions.write-feedback	1→2	knownGaps stale, A5 (fixture gap)	objectui#11817, #11807 and #11816 are fixed and become regression rows. The invite text is Invitation sent to ${result.email}. Studio discard is driven on the metadata designer. acceptance[5] scores blocked(fixture), because no stock surface offers Undo
ux-conventions.disabled-control-reason	1→2	knownGap stale	Archive (objectui#11811) becomes the calibration reference. Studio Publish calibrates hover only
ux-conventions.labels-over-machine-names	1→2	knownGaps partly stale	objectui#11866 and #11778 are fixed. objectui#11862 is fixed for the Explain principal line and the nav editor, and still open for the Access list, the Changes panel and the Display-field picker
search.command-palette-navigation	2→3	A4 (knownGaps update)	the visibility-predicate recipe is now run-proven
search.console-global-search + recipe qa-contributor-bound-member	3→4	A5 (persona recipe gap), A6 (stale step)	in recipe step 5, the own invoice sets owner to the member's email, and a recipe knownGap gives the same rule for task assignee. /search is reached by URL, because Open Full Search Page is offered only for an empty or matching query
i18n.surface-matrix	6→7	knownGap stale	the task record page names its sections (#22036). _sections is read on the New form, the record page and the contact form. …/view/tabbed renders the grid
i18n.studio-follows-app-locale	4→5	A2 (stale step)	relative dates are read on the Studio Data pillar's records grid
api-backend.api-console-discovery-execute	1→2	C0 (stale step)	the page is reached by deep link at /_console/apps/setup/developer/api-console. nav_api_console lives only in studio.app.ts
ai.console-ai-surface-gating	3→4	C5 (stale spec)	K2 changes from expected-fail to positive: one 501 read stops the poll, and the error replaces the empty queue (objectui#11736, pins named)
approvals.notification-deep-link	5→6	A0 (assertion defect)	the notification is minted by opening a request or by /reassign, not by /remind. remind is submitter-only (approval-service.ts)
approvals.ooo-delegation-reroute	4→5	A0 (assertion defect)	the scratch flow starts from a record (record-after-create). POST …/trigger cannot open an approval, because buildAutomationContext passes params only and the approval node reads $record
automation.screen-flow-roundtrip	3→4	A0 (stale spec)	the launch is POST /api/v1/actions/showcase_task/showcase_bulk_reassign, the declared-action door (objectui#12037)
automation.setup-packaged-automation-board	2→3	A7 (maintainer question)	records the measured member posture and does not adjudicate it: Setup is unreachable, and the activation read answers 403
automation.flow-runs-page-test-trigger	1→2	A2 (assertion defect, minor)	new_assignee is left empty, so the run pauses
automation.flow-node-type-matrix	4→5	A1 (recipe note)	the run-created task carries an assignee and a project with an owner, the recipients notify needs
studio-authoring.packaged-automation-studio-lock	1→2	A2 / A3 (stale spec)	the switch and the inspector honour readOnly since objectui#11124 (pin StudioDesignSurface.automationsReadOnly-11124.test.tsx). The expected-fail wording is dropped
studio-authoring.custom-page-source-tiers	1→2	A5 (assertion defect, minor)	a faulting html source is refused 422 at save or publish (HTML_PAGE_SOURCE_COMPILE). Its panel shows only in the designer's draft preview
studio-authoring.metadata-diagnostics-sweep	2→3	A1 (stale spec)	stats.locked is the served envelope lock (#21694)
studio-authoring.object-designer-roundtrip	2→3	A3 (assertion defect)	the empty picklist row is added after the real options
studio-authoring.record-page-roundtrip	3→4	A0 (stale step)	the step sets Page type = record. The create form defaults to list
studio-authoring.draft-publish-lifecycle	4→5	A8 (assertion defect)	the diff names the two publish versions read off /history. History counts drafts too, so the publishes are v2 and v4
studio-authoring.doc-on-app-menu	1→2	A0 (knownGap stale)	the doc editor saves an env-wide draft, so the recipe writes to the writable base over ?package=
integration-system.flow-connector-picker	3→4	A0 (knownGap stale)	an env-wide flow created through POST /api/v1/automation opens editable. The older reading, for flows written over the metadata API, is kept and marked not re-measured
integration-system.webhook-lifecycle	5→6	A1 (stale spec), A2 (dependency)	delivery runs on an in-organization scratch webhook: the shipped one materializes org-less and never fans out. A2 is blocked(dependency), with the maintainer question open
integration-system.email-template-render	5→6	A0 / A5 / A6 (stale spec)	reads go to the registry (GET /api/v1/meta/email_template/NAME); no sys_email_template row exists since #22875. category is retired (#22876). The declared-source half needs a writable showcase copy
integration-system.external-schema-browser-ui	2→3	A1 / A4 (stale spec)	the fixture reports 7 columns per table. unreachable is labelled at the pin
integration-system.notify-inbox-delivery	2→3	A3-501 (fixture gap)	new knownGap: the showcase requires messaging, so no showcase boot can serve the 501 half
integration-system.notification-preference-suppression	1→2	A3-mandatory (fixture gap)	new knownGap: mandatoryTopics is a plugin constructor option. The bypass's unit pin is named
identity-auth.workspace-org-switch	2→3	fixtures (gap), C3b (stale spec)	the walled boot needs @objectstack/organizations, OS_PLATFORM_OWNER_EMAIL, OS_AUTH_MEMBERSHIP_POLICY and accept-invitation. The /meta read is now identical across the switch, because metadata is deployment-level (ADR-0131 D6/D7)
identity-auth.email-verification-loop	2→3	C2 (stale step)	verify-email is GET only; a POST answers 404 (objectui#11633, VerifyEmailPage.tsx)
identity-auth.implicit-account-linking-ownership	1→2	C3 (fixture note)	W's IdP identity is a distinct sub
cli.scaffold-first-run	3→4	C2 (stale wording)	there is one template, blank
attachments-storage.download-authz-both-sides + recipe qa-scratch-authz	3→4	A4 (persona recipe gap)	persona B needs sys_attachment read. Without it, the panel refuses before any download is attempted

Where this differs from the card's suggested edit

1. records-forms.record-edit-undo gets a blocked: { by: 'fixture', ref: … } annotation, so the item "stays BLOCKED" as the card says.
   • No card tracks the packaged-undoable fixture, so ref names the gap in words.
   • Consequence: scripts/checklist-select.mjs hides the item from default runs, and --include-blocked lists it.
2. dashboards.system-overview-live-counts A3. The card says system_overview has "no widget_organizations".
   • The source declares 9 widgets, and widget_organizations is one of them.
   • The server strips it on an unmet requiresService, so the served body carries 8. The run read the served body.
   • The item now names both layers.
3. integration-system.notify-inbox-delivery A3-501. The card lists it as "(in knownGaps)", but the item had no such knownGap. One was added.
4. platform-core.lifecycle-retention-sweep C1. Only the step-3 half is applied. steps[4] (idle sweep) is left with a "ruling owed" knownGap and is not rewritten.
5. Coupled fields. Where other fields of the same item restate the same stale fact, they are revised too, and each one is named in the item's history entry. This is the same practice as docs(qa): six platform-checklist clauses re-pointed to the behaviour the product has since ruled (#23121) #23132.
   • email-template-render: title, steps[3], acceptance[0] / [2], source[2].
   • draft-publish-lifecycle: steps[8], acceptance[7].
   • keyboard-shortcut-surface: title, knownGaps, sources.
   • setup-packaged-automation-board: one more note. acceptance[5]'s member cell cannot be reached through the page while the measured posture holds.
6. write-feedback, disabled-control-reason and labels-over-machine-names. Besides retiring the fixed knownGaps, the edits name the run's new cards (objectui#12303, server-authored UI text (family card): the approvals drawer's Approve says only "Approved.", and Explain access's Principal resolution prose names the user by raw id #23157), so the next run cites them rather than re-filing.
7. Recipe edits (search:qa-contributor-bound-member step 5, attachments-storage:qa-scratch-authz step 6). Recipes carry no revision, so only the item each row names is bumped.
   • Other consumers whose clauses did not change are not bumped: search.rls-both-personas, search.global-search-skips-unreadable, records-forms.crud-roundtrip, and the other two qa-scratch-authz users.
   • Each recipe's provenance names the correction.

Rows not edited

row	why
approvals.quorum-m-of-n A0 (fixture gap, known)	knownGaps[0] and [1] already record the clamp, the runtime fixture and the seed line that would retire it. seed-approval-demo.ts is unchanged at 6d7f4df3c (Ada holds only auditor). Shipping a distinct-holder fixture is showcase work
approvals.decision-action-matrix A9-wire (fixture gap, in knownGaps)	knownGaps[0] already records it in full
studio-authoring.metadata-diagnostics-sweep A6 (fixture gap, in knownGaps)	knownGaps[0] already records it in full. The item's A1 row is landed above
integration-system.webhook-lifecycle N1 / N2	the run did not attempt them, and the item's text for them is right. The new knownGaps[1] says a re-run owes them
access-security.share-link-landing-page C3	deferred: it waits for PR #23222

Maintainer ruling owed

platform-core.lifecycle-retention-sweep steps[4]: should an idle sweep log nothing? It logs 18 policy(ies) applied, ~0 rows reaped today.

• The print gate tests report.swept.length. Every applied policy pushes an entry, deleted: 0 included, and LifecycleSweepReport.swept's docblock says "one entry per (object, policy)".
• That reads like "one aggregate line per sweep" (ADR-0057 §3.3) working as designed. If so, the step is stale.
• The step's reading, that the line prints only when rows moved, is also plausible. If so, it is a product defect.
• The item now says how a run scores the step until this is ruled, and no acceptance clause rests on it.

Gates

All gates ran at ec744f7fd3, the head after merging origin/main (b4d573a0e). Each ran in its own process with its own log, and its exit code was read before any pipe.

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 13 families for the 16 paths. --ran with exit codes printed ✓ … 13 derived famil(ies) accounted for — 13 run, 0 NOT-MEASURED (a DERIVED zero …).

command	exit	verdict line
node scripts/check-ci-filter-parity.mjs	0	OK: all 21 build input(s) turbo.json declares outside the packages …
node scripts/check-closing-keyword-parity.mjs	0	check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords …)
node scripts/check-closing-keyword-parity.mjs --self-test	0	✓ … 40 assertions, 5 mutations of the shipped parsers each driven to red.
node scripts/check-comment-mask-corpus.mjs	0	✓ comment-mask corpus sweep …: 8975 files, 0 disagree, 0 unparseable
pnpm --filter @objectstack/lint run check:doc-formula-expressions	0	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 474 files … (after pnpm --filter '@objectstack/lint...' build under os-verify-lock, VERDICT command-exit 0)
pnpm check:cross-package-test-inputs	0	OK: 30 package(s) read outside themselves, all declared …
pnpm check:doc-authoring	0	✓ doc authoring guard: …
pnpm check:driver-memory-census	0	check-driver-memory-census: OK …
pnpm check:gitlink-declared	0	check-gitlink-declared: OK (11258 index entries …)
pnpm check:nul-bytes	0	check-nul-bytes: OK (scanned 11249 text file(s) … no raw ASCII control bytes).
pnpm check:platform-checklist	1	check-platform-checklist: 8 problem(s). These are the same 8 lines as at base 6d7f4df3c (the sorted problem lines diff empty), and none is in an item this PR touches
pnpm check:refd-timer-probe	0	OK check-refd-timer-probe: 8969 source file(s) swept …
pnpm check:watch-hint-literal	0	✓ check-watch-hint-literal: 73 declaration(s) across 4 rostered name(s) …

• Anchor census: symbol anchors only rose (--anchor-census base vs head: 716 → 725 resolved). Per file: api-backend 66 → 67, dashboards 22 → 24, identity-auth 90 → 91, platform-core 67 → 69, records-forms 94 → 96, studio-authoring 36 → 37. No file fell.
• Edits were scripted and span-checked: every edit asserts its anchor occurs exactly once inside its item. The script also checked that every untouched item parses identical to base, and that each touched item gained exactly +1 revision and one history entry.
• skip-changeset: docs/qa/** ships in no package, and no package.json names it.

Acceptance notes

These are noted, not filed: each is a source read without a reproduction, or an observation.

• The 8 red check:platform-checklist problems predate this PR. They are in access-security.public-form-withdrawal-layers, attachments-storage.attach-requires-parent-edit and search.rls-both-personas. The daily platform-checklist watchdog reports them; check:platform-checklist is red on main #23139 closed them not_planned.
• The console's boot splash reads vite-ui-theme, while the shell stores object-ui-theme. At objectui 1fb1ced36243, apps/console/index.html reads the first key and ConsoleShell.tsx stores the second. From source, a user who picked Dark on a light-OS machine may get a light first frame. Not reproduced.
• sys-metadata-activation.object.ts says "Reads stay open", but QA run QA run · surface:browser (65/65) · 36b2889c · 2026-10-12 · 50 PASS / 2 PARTIAL / 12 FAIL / 1 BLOCKED / 0 NOT-RUN #23163 measured a member's activation read answering 403. That item's maintainer question covers it.
• Runtime-authored actions are not joined into the served object's actions[]. QA run QA run · surface:browser (65/65) · 36b2889c · 2026-10-12 · 50 PASS / 2 PARTIAL / 12 FAIL / 1 BLOCKED / 0 NOT-RUN #23163 measured this and recorded it as a fixture gap, and this PR records it the same way. Whether runtime action authoring should reach the served object is not judged here.
• The shipped showcase_task_changed webhook shows active:true in Setup but can never fan out on the org-walled showcase, because it materializes org-less. The run's maintainer question on in-org bulk events is the nearest open thread.
• The run records name a few Studio routes by observation only: the Data pillar records grid and the metadata designer's Discard draft. The edits cite them as the runs saw them.

---

Generated by Claude Code