@@ -9,7 +9,7 @@
       "title": "Row-level security: restricted member sees only their rows; admin sees all",
       "since": "v15",
       "status": "active",
-      "revision": 5,
+      "revision": 6,
       "priority": "P0",
       "surface": "api",
       "personas": [
@@ -21,6 +21,9 @@
         "requires": [
           "showcase_private_note (OWD private, member_default grants create/read/edit)",
           "two fresh sign-ups, e.g. rls-a@verify.test / rls-b@verify.test"
+        ],
+        "knownGaps": [
+          "acceptance[5]'s D11 spot-check can be scored only by a runner holding the PRIVATE D11 write-up and its private fix card (maintainer-held, #7463 ruling). The environment this leg needs is that maintainer channel; no public run record, CI job or checkout carries it, by design. Without it, score the D11 spot-check blocked(dependency) (QA run #21720, parked on #22017 row 11), and still score the clause's other half, every skipped object in the verify report explained by its detail line, which needs nothing private. Never restate the defect to justify the verdict"
         ]
       },
       "steps": [
@@ -115,6 +118,12 @@
           "date": "2026-10-01",
           "change": "checklist-accuracy findings of QA run #21056. The private handle D11 collided with the public D11 row FOLLOW-UPS.md §7c later assigned to an unrelated two-factor defect; clause 5 and the naming-collision negative now say so (FOLLOW-UPS §7c carries the same note), still non-disclosing. Numbering, for every cross-reference here and in this item's history: \"clause N\" counts from 0 (acceptance[N]); run records number clauses from 1, so clause 5 here is a run record's A6. steps[0] mints A and B invite-first under the invite_only default",
           "ref": "#21060"
+        },
+        {
+          "revision": 6,
+          "date": "2026-10-06",
+          "change": "partial-coverage gap of QA run #21720 parked on #22017 (row 11). A6 was blocked(dependency): the clause forbids ticking it without the private D11 write-up. Disposition: recorded knownGap. The item gains a knownGap naming the environment the D11 spot-check needs (the maintainer's private write-up and fix card, which no public record or CI carries by design) and separating the skipped-object half, which a public run can still score. Non-disclosing, as the clause requires",
+          "ref": "#22017"
         }
       ]
     },
@@ -123,7 +132,7 @@
       "title": "Write-path guards: readonly strip, owner_id forge/transfer denied, bulk validation",
       "since": "v16",
       "status": "active",
-      "revision": 3,
+      "revision": 4,
       "priority": "P0",
       "surface": "api",
       "personas": [
@@ -193,11 +202,11 @@
       ],
       "negative": [
         "run the forge/transfer clauses as ADMIN too and confirm they SUCCEED where legitimately privileged — the guard must gate on privilege, not break the admin path (wrong-persona trap, both sides)",
-        "isSystem writes must still set readonly fields (A1's isSystem carve-out): verify via an objectql write with context {isSystem:true} that lead_score IS settable system-side"
+        "isSystem writes must still set readonly fields (A1's isSystem carve-out): verify via an objectql write with context {isSystem:true} that lead_score IS settable system-side. No REST door reaches an in-process isSystem write, by design, so score this from the two objectql pins `automated` names for it (the exemption is one engine function, gated on isSystem, for every object)"
       ],
       "automated": {
         "kind": "dogfood",
-        "ref": "packages/qa/dogfood/test/owner-anchor-and-bulk-writes.dogfood.test.ts (+ showcase-static-readonly.dogfood.test.ts, showcase-readonly-when-parent.dogfood.test.ts)"
+        "ref": "packages/qa/dogfood/test/owner-anchor-and-bulk-writes.dogfood.test.ts (+ showcase-static-readonly.dogfood.test.ts, showcase-readonly-when-parent.dogfood.test.ts); negative[1] (the isSystem exemption, which no REST door reaches by design) by packages/objectql/src/engine-insert-static-readonly-strip.test.ts ('isSystem seeds the readonly column — the exemption the ruling names', the INSERT path) + packages/objectql/src/engine-readonly-strip-caller-values.test.ts ('an isSystem caller is untouched by any of this', the UPDATE path on a static readonly column), both on a real engine"
       },
       "traps": [
         "wrong-persona"
@@ -228,6 +237,12 @@
           "date": "2026-10-01",
           "change": "checklist-accuracy findings of QA run #21056. acceptance[5] said a bulk update touching a locked row drops the field for the batch; updateMany runs engine.update per row with its own drop listener (metadata-protocol updateManyData), so only the locked row loses the field and the report is per row, results[i].droppedFields. steps[0] mints the members invite-first under the invite_only default",
           "ref": "#21060"
+        },
+        {
+          "revision": 4,
+          "date": "2026-10-06",
+          "change": "partial-coverage gap of QA run #21720 parked on #22017 (row 12). N2 was not runnable: there is no REST door for an in-process isSystem write, and no pin targeted it. Disposition: pin. engine-insert-static-readonly-strip.test.ts and engine-readonly-strip-caller-values.test.ts already prove the isSystem exemption on a real engine, on INSERT and UPDATE. `automated` names them for negative[1], and the negative says to score it from them",
+          "ref": "#22017"
         }
       ]
     },
 
@@ -596,7 +596,7 @@
       "title": "Console AI affordances gate on the access-filtered agent catalog: an agent-less boot hides FAB / chat dock / ⌘⇧I / top-bar link and redirects a stale /ai bookmark without flash — with the ungated bare system/ai-approvals route pinned as an expected-fail probe",
       "since": "v16",
       "status": "active",
-      "revision": 2,
+      "revision": 3,
       "priority": "P2",
       "surface": "browser",
       "personas": ["admin (form sign-in — the pending-actions poll sends the COOKIE half only, credentials:'include' with no bearer header, so an injected-token session reads as anonymous there)"],
@@ -608,7 +608,7 @@
           "a REAL form sign-in (not an injected localStorage token): the AI Approvals page's poll authenticates by cookie only (usePendingActions call() sends credentials:'include' and no Authorization header), so without the cookie half the poll answers 401 AUTH_REQUIRED instead of the 501 this item pins (RUNNER.md console-session fact)"
         ],
         "knownGaps": [
-          "the ENTITLED side of the gate (catalog >= 1 agent ⇒ FAB/dock/link/route all appear) has NO open-framework fixture: service-ai is Cloud/EE and no stock agent-serving harness exists. The only lever is the VITE_AI_BASE_URL opt-in pointing the catalog fetch at an external AI server (useAiSurface.ts resolveAiApiBase), which needs a console REBUILD plus such a server — score those clauses blocked(fixture), never inferred from the hook's source",
+          "the ENTITLED side of the gate (catalog >= 1 agent ⇒ FAB/dock/link/route all appear) has NO open-framework fixture: service-ai is Cloud/EE and no stock agent-serving harness exists. The only lever is the VITE_AI_BASE_URL opt-in pointing the catalog fetch at an external AI server (useAiSurface.ts resolveAiApiBase), which needs a console REBUILD plus such a server — score those clauses blocked(environment), never inferred from the hook's source. The environment this side needs is a deployment whose agent catalog serves at least one agent to the admin: the Cloud/Enterprise @objectstack/service-ai, or the VITE_AI_BASE_URL rebuild above. Neither exists in the open framework, by design, and CI has neither (QA run #21782, parked on #22017 row 9). objectui unit-pins the signal's mechanism (packages/app-shell/src/hooks/__tests__/useAiSurface.test.ts, 'is enabled when the catalog serves at least one agent'; packages/app-shell/src/console/__tests__/RequireAiSurface.test.tsx, 'renders the AI surface when the server serves agents'). Those pin the hook, not the affordance sweep, so they do not score the entitled side",
           "the PER-SEAT half of the signal (ai_seat holder sees agents, seat-less user gets an empty catalog on the SAME deployment — ADR-0068, the objectui#1992 revert) is equally cloud-only: on an open boot the catalog is empty for every principal, so per-seat differentiation is unobservable here",
           "the /_console bundle is vendored and may be stale — verify affordance absence against current objectui app-shell or a fresh build before scoring (stale-console-bundle)"
         ]
@@ -632,7 +632,7 @@
           "evidence": "the catalog request/response trace"
         },
         {
-          "clause": "every gated affordance is ABSENT on the empty catalog: no FAB, no chat dock (⌘⇧I inert — the listener is not armed), no top-bar AI entry, no Home AI CTAs — hidden-during-load is the designed flash-free behavior, so a settled screenshot precedes every DOM read. The ENTITLED side (>= 1 agent ⇒ all of them appear) is blocked(fixture) on the open framework — record it blocked, never ticked from the hook's source",
+          "clause": "every gated affordance is ABSENT on the empty catalog: no FAB, no chat dock (⌘⇧I inert — the listener is not armed), no top-bar AI entry, no Home AI CTAs — hidden-during-load is the designed flash-free behavior, so a settled screenshot precedes every DOM read. The ENTITLED side (>= 1 agent ⇒ all of them appear) is blocked(environment) on the open framework (fixtures.knownGaps names the environment) — record it blocked, never ticked from the hook's source",
           "oracle": "screenshot",
           "verify": "settled screenshots of shell chrome + Home show none of the affordances; post-screenshot DOM reads confirm; ⌘⇧I produces no mount (ConsoleLayout.tsx gates the listener on dockEnabled = the same signal)",
           "evidence": "the region screenshots + the ⌘⇧I non-event"
@@ -681,7 +681,8 @@
       ],
       "history": [
         { "revision": 1, "date": "2026-08-30", "change": "new item (sweep 2026-08-30, cross-angle hit 1+4): the console-side AI gating had no coverage — the catalog-signal design (useAiSurfaceEnabled) hides FAB/dock/⌘⇧I/header/Home affordances and no-flash-redirects /ai on an agent-less boot, while SystemHubPage's 'AI Approvals' card is built ungated and its page polls the dead /ai/pending-actions endpoint every 5s (501) rendering a fake empty queue beside the error alert. Authored as a NEW browser sibling of ai.open-edition-honest-degradation (which keeps the API half) rather than extending it, so neither surface double-covers the other; the two K2 defect clauses are expected-fail probes, the defect row itself is the sweep's FOLLOW-UPS entry", "ref": "#sweep-2026-08-30" },
-        { "revision": 2, "date": "2026-10-05", "change": "clause 4, steps 6-7, negative 3, the title and the source re-pointed (stale, #21782 VF4). objectui 9eea12a2b (objectui#10507, fixing objectui#3743) removed SystemHubPage and its 'AI Approvals' card before 17.6.0, so K2's card half is moot. The clause now asserts that no console surface advertises the entry (verifier's wording). The route half of K2 remains: system/ai-approvals is still registered ungated (AppContent systemRoutes), so steps 6-7 reach it by URL and clause 6 keeps its expected-fail scoring. Negative 3 names clause 6 only. Re-read at objectui 9dfaca6543: unchanged", "ref": "#21797" }
+        { "revision": 2, "date": "2026-10-05", "change": "clause 4, steps 6-7, negative 3, the title and the source re-pointed (stale, #21782 VF4). objectui 9eea12a2b (objectui#10507, fixing objectui#3743) removed SystemHubPage and its 'AI Approvals' card before 17.6.0, so K2's card half is moot. The clause now asserts that no console surface advertises the entry (verifier's wording). The route half of K2 remains: system/ai-approvals is still registered ungated (AppContent systemRoutes), so steps 6-7 reach it by URL and clause 6 keeps its expected-fail scoring. Negative 3 names clause 6 only. Re-read at objectui 9dfaca6543: unchanged", "ref": "#21797" },
+        { "revision": 3, "date": "2026-10-06", "change": "partial-coverage gap of QA run #21782 parked on #22017 (row 9). A2's entitled side was blocked(fixture) as the clause prescribed. Disposition: recorded knownGap. The side cannot be reached in the open framework by design (service-ai is Cloud/Enterprise). The knownGap names the environment it needs, says CI lacks it, and reclassifies the verdict blocked(environment); A2's clause follows. It also names the objectui hook pins as mechanism-only", "ref": "#22017" }
       ]
     },
     {
 
@@ -873,7 +873,7 @@
       "title": "Metadata-authored `api` endpoints mount as real URLs with their declared auth/cache policy",
       "since": "v17",
       "status": "active",
-      "revision": 1,
+      "revision": 2,
       "priority": "P1",
       "surface": "api",
       "personas": [
@@ -891,13 +891,13 @@
         "flow target — delegates to a flow",
         "policy: authRequired (default true)",
         "policy: cacheTtlSeconds → Cache-Control",
-        "script/proxy target — answer 501 in the open framework"
+        "script/proxy target — refused at authoring, never served; the runtime's 501 is a second door, pinned"
       ],
       "steps": [
         "boot showcase isolated; sign in as admin",
         "GET /api/v1/apps/showcase/tasks authed; capture status, body, and response headers",
         "GET the same endpoint unauthenticated; capture status",
-        "author a script-target endpoint shape in a scratch package and hit it; capture the 501",
+        "a script / proxy target cannot be authored into a live server. `api` is code-only (#5488: allowRuntimeCreate false, so no scratch package can hold one), and the stack schema refuses `type: 'script'` / `'proxy'`. Author one in a scratch config and run `os validate` (or `os build`); capture the refusal naming the endpoint, the type and the flow prescription. Do not attempt a live 501",
         "GET /apps/showcase/nope (no matching declaration); capture the transport 404"
       ],
       "acceptance": [
@@ -914,10 +914,10 @@
           "evidence": "the response"
         },
         {
-          "clause": "a script/proxy target answers 501 in the open framework (declared ≠ delivered surfaces honestly, not a fake 200)",
-          "oracle": "api",
-          "verify": "the 501 envelope",
-          "evidence": "the response"
+          "clause": "a script / proxy target is never served (declared ≠ delivered, refused loudly, never a fake 200). Authoring refuses it: the stack schema's `apis:` gate (packages/spec/src/api/endpoint-publish-gate.ts#validateApiEndpointDeclarations) rejects `type: 'script'` and `'proxy'`, naming the endpoint and the fix, and runtime authoring of `api` is withdrawn (#5488). The runtime keeps its own refusal for a declaration that reaches the store some other way: 501 NOT_IMPLEMENTED with a hint (packages/runtime/src/endpoint-executor.ts#planEndpointTarget)",
+          "oracle": "build",
+          "verify": "the scratch-config `os validate` / `os build` refusal for a script and a proxy endpoint; the runtime half from the pins in `automated` (packages/runtime/src/endpoint-executor.test.ts, '%s answers 501 NOT_IMPLEMENTED with a hint'; packages/spec/src/api/apis-publish-gates.test.ts, gate (a))",
+          "evidence": "the two refusals + the pin output"
         },
         {
           "clause": "an unmatched path under /apps/** falls through to the transport 404 — the notFound seam does not swallow it",
@@ -931,22 +931,29 @@
       ],
       "automated": {
         "kind": "dogfood",
-        "ref": "packages/qa/dogfood/test/showcase-declarative-endpoints.dogfood.test.ts + declarative-endpoint-policy.dogfood.test.ts"
+        "ref": "packages/qa/dogfood/test/showcase-declarative-endpoints.dogfood.test.ts + declarative-endpoint-policy.dogfood.test.ts; acceptance[2] (script / proxy never served) by packages/runtime/src/endpoint-executor.test.ts ('an unsupported declaration gets a structured 501, never invented semantics') + packages/spec/src/api/apis-publish-gates.test.ts ('gate (a) — the supported subset')"
       },
       "traps": [
         "dispatcher-vs-hono-route"
       ],
       "source": [
         "examples/app-showcase/src/system/apis/index.ts (the two live endpoints)",
         "ADR-0121 / #5040 (declarative endpoint E-series)",
-        "packages/runtime notFound-fallback mount seam"
+        "packages/runtime notFound-fallback mount seam",
+        "packages/spec/src/api/endpoint-publish-gate.ts#validateApiEndpointDeclarations (the authoring refusal of script / proxy targets, run by the stack schema) + packages/spec/src/kernel/metadata-plugin.zod.ts (api is code-only: allowRuntimeCreate false, #5488) + packages/runtime/src/endpoint-executor.ts#planEndpointTarget (the runtime's 501 second door)"
       ],
       "history": [
         {
           "revision": 1,
           "date": "2026-08-08",
           "change": "initial — the coverage.json `api` waiver was STALE (showcase authors two live endpoints with dogfood pins); un-waived",
           "ref": "claude/platform-test-checklist-ocwugl"
+        },
+        {
+          "revision": 2,
+          "date": "2026-10-06",
+          "change": "partial-coverage gap of QA run #21720 parked on #22017 (row 13), re-pointed clause. A3 asserted a live 501 from a script / proxy endpoint authored in a scratch package, and the run found no way to author one without editing source. No public door produces one: api is code-only (#5488), and the stack schema refuses script / proxy targets (validateApiEndpointDeclarations, packages/spec/src/api/endpoint-publish-gate.ts). The runtime's 501 is a second door for a declaration that reaches the store another way, pinned by endpoint-executor.test.ts. A3 now asserts the authoring refusal (oracle build) and cites the pins; step 4, variant 5, `automated` and source follow",
+          "ref": "#22017"
         }
       ]
     },