docs(qa): author the v18 line's capabilities into the platform checklist (48 since:v18 items)

[objectstack-fleet]

Fixes #23879
Clause-②: no

What this does

The platform checklist carried no since: "v18" item, so node scripts/checklist-select.mjs since:v18 resolved to nothing and a v18 release sweep re-ran only the P0 smoke. This PR authors 48 since: "v18" items across 14 area files — QA data only, no package touched.

Premise re-measured before writing: on origin/main 94114c1f, since:v18 --json returned [] (exit 1, "nothing matched"), and .changeset/pre/ held 714 consumed changesets (29 major, 363 minor, 322 patch). On this head the same selector resolves 48 runnable items.

How the delta was enumerated

Six independent read-only passes (SWEEP.md method, scoped to the v18 delta rather than a whole-ledger re-sweep):

• four over the 392 major/minor changesets (about 150 capability rows, grouped);
• one over the 322 patch changesets (82 that add or change runner-observable behaviour; the other ~240 are fixes of existing behaviour or text);
• one over the ADR-0087 step-18 registries (MAJOR_18_CONVERSIONS 72, RETIRED_KEYS_BY_MAJOR[18] 239, RETIRED_DEFS_BY_MAJOR[18] 170, 389 18.* semantic entries) and the landed ADR-0131 stages.

Rows were grouped into one item per capability family (each item lists its contributing changesets in source). Every item carries its permanent pins in automated.ref plus live steps against a booted showcase. Every pin path and cited source file was checked to exist; all 87 new symbol anchors resolve (symbol anchors: 822/832, the 10 being the existing named residual).

area	new items
access-security	9
identity-auth	5
automation · cli	5 each
api-backend · platform-core · records-forms	4 each
studio-authoring	3
approvals · attachments-storage · integration-system	2 each
ai · dashboards · i18n	1 each

P0: identity-auth.default-organization-boot-invariant, access-security.walled-environment-metadata-operator-only, platform-core.v18-boot-refusals, cli.organization-ownership-ceremony (the 17 → 18 upgrade end to end — nothing in the ledger exercised it before).

No item — pure retirements already pinned

A retirement is refused at parse with its tombstone, so its honest answer is the pin, not an item:

• element flat data-binding keys: packages/spec/src/ui/element-flat-binding-retirement.test.ts
• manifest permissions string list: packages/spec/src/kernel/manifest-permissions-string-list.test.ts
• the four catalog row objects: packages/qa/dogfood/test/wall-catalog-refusal.dogfood.test.ts
• sys_view_definition: packages/metadata-protocol/src/plugin.metadata-objects-retired.test.ts
• sys_approval_token generic door: packages/plugins/plugin-approvals/src/sys-approval-token-generic-door.integration.test.ts
• email template category / isSystem: packages/spec/src/system/email-template-category-is-system-retirement.test.ts
• view provider: 'api': packages/spec/src/ui/view-data-api-provider-retirement.test.ts
• document-family schemas: packages/spec/src/data/document-schemas-retirement.test.ts
• allowOrgOverride → allowEnvironmentOverlay: packages/spec/src/kernel/metadata-type-registry-allow-org-override-retirement.test.ts
• legacy OBJECTSTACK_METADATA_WRITABLE: packages/rest/src/rest-meta-managed-seal-hatch.test.ts
• storage scope public (also asserted live in attachments-storage.upload-limits-scope-and-ownership): packages/services/service-storage/src/upload-scope-vocabulary.test.ts
• sys_comment.reactions column (also live in records-forms.comment-reactions-and-edit-stamps): packages/plugins/plugin-audit/src/sys-comment-reactions-door.integration.test.ts
• externalSharingModel, guest recipient, the i18n plugin's own routes, bare unique: true on an index, and the 23421 / 23487 / 23488 / 23543 retirements: pins listed per row in the dev report on qa(checklist): no ledger item carries since: "v18" — author the v18 line's new and changed capabilities into the platform checklist, then run them #23879.

The rest of the 72 step-18 conversions are covered generically by api-backend.enforce-or-remove-authoring-gates / api-backend.retired-def-refusal and the fixture replay in packages/spec/src/conversions/conversions.test.ts.

Run — checklist-test since:v18 on this branch

Subject: framework 94114c1f (the code is origin/main; this branch changes ledger data only), fresh showcase boot on its own port and ephemeral DB, Tenancy: single. Run sequentially by one runner; the per-item verdict table is in the dev report on #23879, and the seat files the qa-run record and the defect cards from it.

• Tier 1 — every pin in automated.ref, 228 files across 32 packages: all pass (e.g. spec 24 files / 1546 tests, runtime 34 / 590, rest 20 / 802, objectql 23 / 402, qa/dogfood 15 / 181, cli 25 / 330 plus its one *.e2e.test.ts, which packages/cli collects only under OS_TEST_TIERS=nightly and which passes there, 2 tests).
• Tier 2 — live API legs: 1 item PASS, 45 PARTIAL (pins pass, live legs not all driven, or walled / scratch-app / console legs not provisioned this round), 2 FAIL:
  • access-security.anonymous-floor-v18-doors — anonymous GET /api/v1/keys answers 405, not the 401 the 23225 contract states (twice, fresh calls).
  • access-security.grant-table-write-contract — an inverted validity window is refused as an unevaluable predicate (Unknown variable: previous), never with the validity_window_order rule's own message (twice).
• Console legs: blocked(environment). pnpm objectui:build fails at the pinned .objectui-sha daeb77fc: [MISSING_EXPORT] "checkPageComponentViewData" is not exported by packages/spec/dist/ui/index.mjs — the export was deleted in a35f7a6 (feat(spec)!: delete checkPageComponentViewData; the component-props rule is the one judge of a page component's retired api data binding #23784) while the pinned objectui still imports it.

The first live pass also disproved four things in my own first draft of the items; those were corrected before any record pinned their revision (a view name is dotted OBJECT.NAME; the /meta version token is served only on the ?state=draft read; stock self-registration is closed, so the member is created by the admin and lands held; the dispatcher /ui domain is not mounted over HonoServer).

Gates

Local, on head 2d410efa, from node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (exit codes captured before any pipe): all 13 exit 0 — check-ci-filter-parity, check-closing-keyword-parity (+ --self-test), check-comment-mask-corpus, check:doc-formula-expressions, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:platform-checklist, check:refd-timer-probe, check:watch-hint-literal. --ran reconciliation: 13 derived, 13 run, 0 NOT-MEASURED (a derived zero).

Changeset: none — docs/qa/** sits outside every package's published files, so nothing publishes (skip-changeset).

Size: 3,532 changed lines (all additions, all JSON), over the 3,000-line threshold, so this lands by an authorized review or a human merge, not the queue on green alone.

Acceptance notes

• Stale existing items — not edited here (qa(checklist): run the whole platform checklist on main (selector all, 272 items) and extract every new failure into its own card #23878 is running the existing items at the same time, and a revision bump mid-run would orphan its pinned revisions). Each contradicts v18 behaviour:
  • cli.migrate-meta-codemod — still asserts that no --write exists (it ships, packages/cli/test/migrate-meta-write.test.ts), and still names protocol major 17;
  • access-security.capability-declaration-lifecycle — "bootstraps into sys_capability" (retired);
  • automation.trigger-type-matrix, automation.time-relative-trigger, platform-core.notification-center — assume scheduled work fires on a stock boot; on v18 it is off unless OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true (this run's boot log says so);
  • attachments-storage.attach-requires-parent-edit — an outsider who cannot read the parent now gets 404 RECORD_NOT_FOUND, not 403;
  • approvals.approver-resolution-matrix — admin_rescue now opens on the org administrators;
  • records-forms.validation-rule-type-matrix — warning hits now come back in warnings[];
  • cli.scaffold-first-run — skills now sync from @objectstack/skills;
  • automation.trigger-type-matrix also defers the body-only hook refusal that has since landed;
  • platform-core.shell-nav-personalization — drag reorder of the app menu was removed (probably stale; not checked against its steps);
  • api-backend.date-range-preset-matrix — rolling presets now end on today.
• Readings carried from the seat post, verified, not touched (my edits do not reach those items): records-forms.concurrent-edit-conflict cites packages/rest/src/approvals-routes.ts#mapping for CONCURRENT_UPDATE → 409, but that map has no CONCURRENT_UPDATE row (the mapping lives in rest-server.ts); access-security's record-shares source text says the family is "registered inline, under no registrar of its own", while packages/rest/src/sharing-routes.ts documents and serves it under RestServer#registerSharingEndpoints.
• ADR-0131 C8 has not landed: SqlDriver applyTenantScope still carries .orWhereNull(field). The ADR puts that removal on the v18 line after C7, which has landed.
• POST /api/v1/keys drops an unrecognised body key without a word (a camelCase expiresAt 400 days out mints a 90-day key and answers 201); the response echoes the real expires_at, and the drop is in the safe direction.
• Pins by registry id: 12 of the 72 step-18 conversions and 297 of the 389 18.* semantic entries are named by no test (excluding the 169-id guidance roster); two retirements have no pin found at all (the discard-overlay route, os meta resync).

Not in this PR: running the existing items (#23878); fixing what the run found (one card each, filed by the seat from the dev report).

---

Generated by Claude Code

[objectstack-fleet]

维护者速读

改了什么:测试清单(docs/qa/platform-checklist)新增 48 个 v18 测试项,分布在 14 个功能区,只加不改(+3535 / −0),不碰任何发布包。之前 since:v18 一项都选不出来,v18 发版扫测只能重跑 19 个 P0 冒烟;现在能选出 48 项(4 个 P0 / 28 个 P1 / 16 个 P2)。其中 4 个 P0 第一次把 17 → 18 升级端到端测到(组织归属迁移仪式、启动拒绝等)。

为什么改:您的原话「v18 新能力在测试清单里一项都没有。 这个也应该派卡处理」(#23879)。

风险与代价(含回滚):零运行时影响,纯 QA 数据。风险是测试项本身写错,以后会把对的判成错;所以这批项已经实跑过一遍(1 PASS / 45 PARTIAL / 2 FAIL),dev 在实跑中自己修正了 4 处写错的细节。两个 FAIL 是真产品缺陷,已立卡 #23909、#23910。回滚 = revert 本 PR。

席位意见:ACCEPT。门禁全绿,232 个测试 pin 文件全部存在,check:platform-checklist 通过。只因改动 3535 行超过 3000 行的人工合并线才需要您过目;内容是测试数据,不是代码。主干目前因 #23885 是红的(Console Pin Gate,与本 PR 无关),合并时机由您定。

你要做的:批准(或直接合并)本 PR。

席位核对 · ACCEPT

Seat domain:devx#1 (seat post #6023) · os-sales · session_014eFvbvGK4FjXvscggDNTD4 · reviewed at head 2d410efa16.

1. Form — draft, base main, first line Fixes #23879, no other closing keyword in the body; assignee os-sales equals the card's. skip-changeset holds: 14 files, all under docs/qa/platform-checklist/areas/, outside every package's files[]. Diff +3535 / −0 — no existing item is touched, so qa(checklist): run the whole platform checklist on main (selector all, 272 items) and extract every new failure into its own card #23878's pinned revisions stay valid.
2. Premise, measured by the seat — detached worktree at 2d410efa16: node scripts/check-platform-checklist.mjs exit 0 ("16 areas, 327 items (322 active, 1 planned) … symbol anchors: 822/832"); node scripts/checklist-select.mjs since:v18 --json → 48 runnable (P0 4 · P1 28 · P2 16); every automated.ref path of the 48 items, split on + — 232 paths — exists, 0 missing.
3. Gates — check-runs on 2d410efa16 — 43 runs, none failing: Lint & Repo Gates, TypeScript Type Check, Test Core (6/6 shards), Governed Surface Queue Guard, Check Changeset, and the three claim guards all success; the full-battery legs (Console Pin Gate, Dogfood*, Temporal Conformance, Build Core, Build Docs) skipped by the PR-event filter.
4. Accepted deviations — the report's summary says 27 P1 / 17 P2; the head carries 28 P1 / 16 P2 (count in 2). Cosmetic; no rework.
5. Out-of-scope dispositions (dev report 6215306571):
   • anonymous non-POST /api/v1/keys → 405 · filed runtime(dispatcher): anonymous GET / PUT / PATCH / DELETE on /api/v1/keys answer 405 METHOD_NOT_ALLOWED instead of the 401 UNAUTHENTICATED the v18 anonymous floor states for every /keys verb — only POST is mounted #23909 (domain:cli). Answers the dev's second open question: A — the code moves to the declared contract.
   • validity_window_order unevaluable on insert · filed objectql(validation): a rule that reads previous is unevaluable on insert — the insert path never binds it, so validity_window_order refuses an inverted grant window as unevaluable, not with its message #23910 (domain:engine), as the class fix: the validation insert path binds previous: null the way the flow engine does.
   • objectui:build [MISSING_EXPORT] checkPageComponentViewData · carried by hourly full run: red on main (CI) #23885 (the main-red card; seat 2's diagnosis 6214926932).
   • the 13 stale existing items and the two carried anchor readings · owed by this seat: one follow-up ledger card at qa(checklist): run the whole platform checklist on main (selector all, 272 items) and extract every new failure into its own card #23878's close-out, folding qa(checklist): run the whole platform checklist on main (selector all, 272 items) and extract every new failure into its own card #23878's own accuracy findings, one writer per area file. Answers the dev's first open question: A.
   • ADR-0131 C8 (.orWhereNull(field) still in applyTenantScope) · carried by feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212.
   • changeset text the shipped code contradicts (22573 vs 23281; 22360) · owed by this seat, filed next fire (this fire's filing quota is spent).
   • POST /keys drops unknown body keys (safe direction, documented whitelist) · Acceptance notes — no wrong answer at a public door.
   • 12 of 72 step-18 conversions and 297 of 389 18.* semantic entries named by no test; two retirements unpinned · Acceptance notes — coverage observation, carrier none.
   • the dormant flow-start-admission branch for a third-party automation service without getFlow · dropped — no in-tree reach.
   • the run record for this PR's items · filed QA run · since:v18 (48/48) · 94114c1f · 2026-10-16 · 1 PASS / 45 PARTIAL / 2 FAIL / 0 BLOCKED / 0 NOT-RUN #23912 (qa-run).
6. Landing — 3,535 changed lines > 3,000: not the queue on green. Lands on an APPROVED review from an authorized account (os-zhuang, hotlong — both requested now) followed by the seat, or by a human merge. While main is red (hourly full run: red on main (CI) #23885) no lane PR arms the queue, so the seat lands it only after main is green again.

---

Generated by Claude Code

[objectstack-fleet]

Maintainer's word on the PR line · director seat (summon #43 continuation 2, session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-16T13:19Z

• The word: 「同意」 in this session's chat on batch 🔗 Broken links detected in documentation #356, which carried this PR as a line (approve or not), on the seat record 6215561472 and the 速读.
• Approval, read at this write: APPROVED by os-zhuang (review 5547949766, 2026-10-16T12:46Z, on 2d410efa16f1). The click was the maintainer's; this seat clears the needs-user-decision label in this act (it marks a PR as awaiting the maintainer's review).
• What lands it from here: the over-3,000-line human-merge rule is met by the approval; the domain:devx seat 1 lands it only after main is green again (hourly full run: red on main (CI) #23885), as its ACCEPT says.
• Merged at this read: true.

---

Generated by Claude Code