QA run · priority:P0 + 17.6-risk (42/42) · 617f25f8 · 2026-10-02 · 30 PASS / 3 PARTIAL / 9 FAIL / 0 BLOCKED / 0 NOT-RUN #21330

17.6.0 release verification run: the standing P0 smoke plus the 23 checklist items most exposed to 17.6.0's changes, against the 17.6.0 release build. Text only; the durable truth stays in docs/qa/platform-checklist/areas/.

Environment fingerprint

• Framework (subject): objectstack-ai/objectstack 617f25f8 (chore: version packages (#20639)), the commit @objectstack/*@17.6.0 was published from (tags @objectstack/<pkg>@17.6.0). Built in a dedicated worktree: pnpm install --frozen-lockfile && pnpm build → Tasks: 72 successful, 72 total.
• Console: objectui pin .objectui-sha = 31971ff1e28f, built by pnpm objectui:build under Node v22.22.2 (the container's v22.22.0 is below the pinned objectui's jsdom engine floor; environment note). packages/console/dist/.objectui-sha = the pin. Single-zod canary over the shipped assets: exactly one zod version literal {major:4,minor:6,patch:5} (2450 files read). Spec-injection check: the bundle carries this tree's @objectstack/spec only.
• Checklist: items, RUNNER.md and scripts/checklist-select.mjs taken from main at 393ae878; the revision of every item run is recorded below.
• App / boots: examples/app-showcase, OS_PORT=<p> objectstack dev --ui --seed-admin -p <p> -d file:/tmp/qa1760/<lane>/<item>.db — one file DB and one port per item, lanes on disjoint ranges 41000–42199 with the egress proxy port 41333 excluded. Banner Seeds: com.example.showcase 132 rows; Flows: 30 flow(s) 20 bound … 7 draft. Members minted by admin invite-member + sign-up/email (stock audience posture invite_only), identity proved by GET /auth/get-session before each persona cell.
• Execution: 9 parallel runner subagents (L1–L9) + 4 independent verifiers (V1–V4, RUNNER rule 7), Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-02 03:55–05:25Z. Environment prep ≈ 30 min (framework build 7m40s, console build ≈ 15 min); per-lane runner time 14–41 min, of which 4–8 min env prep each.

Scope

One record for one release-verification selection, by maintainer direction: priority:P0 (node scripts/checklist-select.mjs priority:P0 --json → 19 runnable) + 23 named 17.6-risk items = 42 items. Hidden as blocked (not run): access-security.no-active-org-session-semantics. Planned (not run, not counted): records-forms.picklist-shared-across-objects, records-forms.picklist-org-append — see "Checklist-accuracy findings".

Totals: 30 PASS / 3 PARTIAL / 9 FAIL / 0 BLOCKED / 0 NOT-RUN. Of the 9 fails, 4 are product defects (2 of them on P0 items, both already tracked) and 5 are checklist clauses that 17.6.0 or earlier design deliberately contradicts. Every P0 fail and every new product-defect candidate was re-derived by an independent verifier from a fresh reproduction.

vs #21056 (2026-10-01, ef1ed17f, Console db11afd4967c: 13 PASS / 6 FAIL)

Per-clause verdicts

Clauses are numbered A1..An (acceptance) and N1..Nn (negative) in array order. Evidence is server truth unless it says screenshot.

P0

access-security.rls-both-sides (rev 5) — PASS

access-security.write-path-guards (rev 3) — PASS

access-security.crud-permission-matrix (rev 4) — FAIL

access-security.owd-sharing-matrix (rev 3) — PASS

access-security.anonymous-deny-surfaces (rev 3) — PASS

ai.mcp-stdio-fail-closed (rev 4) — PASS

api-backend.query-contract-matrix (rev 3) — PASS

api-backend.packaged-action-disabled-dispatch (rev 3) — PASS

automation.packaged-flow-disable-durable (rev 2) — PASS

platform-core.seed-integrity (rev 3) — PASS

cli.dev-boot-contract (rev 3) — PASS

platform-core.boot-health (rev 6) — PASS

integration-system.datasource-credential-refusal-matrix (rev 2) — PARTIAL

platform-core.console-login (rev 4) — PASS

platform-core.nav-surfaces-render (rev 5) — PASS

platform-core.builtin-apps-nav-render (rev 4) — PASS

records-forms.crud-roundtrip (rev 8) — PARTIAL

approvals.account-app-entry (rev 2) — FAIL

studio-authoring.first-run-loop (rev 3) — PASS

17.6-risk items

access-security.fls-mask-and-strip (rev 3) — PASS

access-security.record-access-explain (rev 2) — PASS

access-security.audit-log-browser (rev 2) — FAIL (stale clause)

access-security.public-form-intake (rev 2) — FAIL

access-security.packaged-flow-write-door-parity (rev 1) — PASS

api-backend.filter-comparand-conformance (rev 2) — FAIL (stale clause)

api-backend.aggregate-contract-matrix (rev 1) — PASS

api-backend.date-range-preset-matrix (rev 1) — FAIL (assertion defect)

dashboards.cube-query (rev 3) — PASS

dashboards.dataset-report-authoring (rev 1) — PASS

dashboards.global-filters-rescope (rev 2) — PASS

dashboards.strict-widget-rejects-stray-keys (rev 2) — PASS

records-forms.field-type-matrix (rev 2) — PASS

records-forms.import-transform-matrix (rev 1) — FAIL (stale clause)

records-forms.named-import-mapping (rev 1) — PASS

automation.packaged-flow-subflow-disable-refusal (rev 1) — PASS

automation.packaged-flow-clone-contract (rev 1) — FAIL

automation.flow-toggle-kill-switch (rev 2) — PASS

automation.setup-packaged-automation-board (rev 2) — PARTIAL

integration-system.datasource-admin-lifecycle (rev 3) — PASS

platform-core.metadata-authoring-roundtrip (rev 2) — PASS

studio-authoring.view-authoring-live (rev 1) — FAIL (assertion defect)

studio-authoring.custom-page-source-tiers (rev 1) — PASS

Fails — reproduction rules and dispositions

Product defects:

R1 · access-security.crud-permission-matrix · A1 — product defect, already tracked at #21057 (fails closed: over-refusal, not an exposure). Verifier V1: CONFIRMED.

1. Fresh boot; admin invites + signs up a delegate D and a target T.
2. Admin POST /api/v1/data/sys_user_permission_set {"user_id":D,"permission_set_id":<id of showcase_field_ops_delegate>} → 201; POST /api/v1/data/sys_business_unit_member {"business_unit_id":"bu_field_ops","user_id":D} → 201.
3. D POST /api/v1/data/sys_user_position {"user_id":T,"position":"contributor","business_unit_id":"bu_west_coast"}.
4. Expected 2xx (adminScope = Field Operations + subtree). Actual 403 PERMISSION_DENIED "delegated 'insert' on sys_user_position rejected — business unit 'bu_west_coast' is outside the delegated subtree" — also for bu_field_ops itself. Admin with the identical payload → 201.
5. Mechanism oracle: every seeded sys_business_unit row reads organization_id: null; after admin PATCHes the active org onto the seeded units, D's create → 201 and an out-of-subtree create (bu_hq_finance) stays 403.

R2 · access-security.public-form-intake · A7 — product defect. Detail withheld pending maintainer (RUNNER rule 2). Verifier V1: CONFIRMED.

R3 · automation.packaged-flow-clone-contract · A7 (reachability half) — product defect, not previously filed (it was the FOLLOW-UPS §8 D18 row, marked "safe to file"). Verifier V2: CONFIRMED.

1. Admin POST /api/v1/automation/showcase_urgent_task_alert/clone {"name":"qa_urgent_alert_clone","label":"QA urgent alert clone"} → 200.
2. POST /api/v1/data/sys_metadata/query {"where":{"name":"qa_urgent_alert_clone"}} → package_id: null, scope: platform.
3. GET /api/v1/meta/flow?package=com.example.showcase → 30 flows without the clone; bare GET /api/v1/meta/flow → 31 with it.
4. Console /_console/studio → "No writable packages yet"; /_console/studio/com.example.showcase/automations lists the 30 packaged flows, not the clone; …?surface=flow%3Aqa_urgent_alert_clone redirects to another flow.
5. Expected (ADR-0126 §1.3 / §7.1, the Setup page's "Editing happens in Studio") the clone is listed on a Studio Automations rail; actual no Studio surface at the pin lists or opens a package-less flow (the rail is loadPackageSurfaces(client,'flow',packageId)).

R4 · approvals.account-app-entry · A7 — product defect in the console, objectui#11326, still present at the pin (fixed upstream in objectui d0fba91aa, not an ancestor of 31971ff1e28f). Verifier V4: CONFIRMED (the zh catalogue at the pin holds every expected string, so the clause is not stale).

1. Fresh boot; sign in; open /_console/apps/com.objectstack.account/component/approvals/inbox.
2. Avatar → Preferences → Language → 中文（中国）; then a full load of the same URL.
3. Expected h1 / tabs / badge in Chinese (审批中心 · 待我审批 / 我发起的 / 全部 · 待审批). Actual "Approvals Inbox", "My Pending / Submitted by me / All", "Pending"; localStorage['objectui-locale']="zh-CN", <html lang="zh-CN">, the server-served nav label 待我审批; only i18n-locale-en-*.js fetched although i18n-locale-zh-*.js is in dist. Mechanism at the pin: packages/i18n/src/locales/registry.ts keys built-in loaders by base language, and the provider asks with the region-tagged code.

Checklist clauses (no product defect — the docs PR linked in the close-out re-points them):

R5 · access-security.audit-log-browser · A1 — stale clause. Admin DELETE /api/v1/data/showcase_task/<id> → 200; admin GET /api/v1/data/sys_audit_log?filter={"action":"delete"} → expected (clause) 1 row, actual total 0; the row is stored with correct attribution (direct read of the telemetry DB). Changed deliberately by 30c530e5 (#21194): the ledger serves a non-system reader, administrators included, only rows about records it can read (17.6 notes, "The compliance ledger and the activity stream…").

R6 · api-backend.filter-comparand-conformance · A5 — stale clause. POST /api/v1/data/showcase_field_zoo/query {"where":{"f_number":{"$eq":{"x":1}}}} → 400 VALIDATION_FAILED (fields[0].field = query.where.f_number.$eq); GET …?$filter={"f_number":{"$eq":{"x":1}}} → 400 INVALID_FILTER; engine door → INVALID_FILTER. Every door refuses with the same contract sentence and none returns rows; the code differs because #20116 moved the POST refusal into the request schema (cfc3bcf1 #20247, dd1b8031 #20325) — the split query-contract-matrix rev 3 already records.

R7 · api-backend.date-range-preset-matrix · A3 — assertion defect. POST /api/v1/data/showcase_account/query {"where":{"signed_on":"today"}} → 400 INVALID_FILTER with the temporal-door message; {"where":{"signed_on":{"$gte":"this_week"}}} → 400 VALIDATION_FAILED with bareDateRangePresetComparandMessage. The preset message is deliberately an ordering-position refusal (18.filter-preset-ordering-comparand-refused.ts: "Ordering positions only at the schema door"); an equality on a date field is refused by the temporal door. The guarded failure (200 with zero rows) does not occur.

R8 · records-forms.import-transform-matrix · A2 — stale clause. PUT /api/v1/meta/mapping/qa_l7_js with one entry transform:"javascript"; POST /api/v1/data/showcase_inquiry/import {"format":"csv",…,"mappingName":"qa_l7_js"} → 400 UNSUPPORTED_TRANSFORM naming the missing server-side sandbox, 0 rows; the message no longer names framework#2611 since f115b1f (#21188: refusals state each decision in words instead of a tracker number).

R9 · studio-authoring.view-authoring-live · A4 — assertion defect. PUT /api/v1/meta/view/qa_repair_asset_views?mode=draft&package=<writable pkg> with {name, object:"repair_asset", list, form}; publish; GET /api/v1/meta/view?object=repair_asset → repair_asset.default and repair_asset.form carrying the authored config; the container name appears 0 times. The object door returns expanded <object>.<key> items by design (expandViewContainer, #7163).

Fixture gaps and environment notes

• crud-permission-matrix A6: unobservable until security(core, plugin-security): an unauthenticated principal never resolves the permission sets bound to the guest anchor; ADR-0090 D9 is declared and seeded but not enforced #21158 gives anonymous callers a permission-set channel (17.6.0 deny baseline); the reason is a dependency, not a fixture.
• datasource-credential-refusal-matrix A2: no real Postgres / MySQL / Mongo in the sandbox (ECONNREFUSED).
• crud-roundtrip A7 readonly half: no readonly column is settable over HTTP on the stock seed.
• setup-packaged-automation-board A6: needs a persona with setup.access but without manage_metadata (e.g. organization_admin); a plain member never reaches Setup.
• dashboards global-filters D2 needs a writable package (the showcase package is read-only in Studio; duplicate → 422 DUPLICATE_SOURCE_NOT_A_BASE).
• Sandbox egress denies cloud.objectos.ai (marketplace catalog).
• Container memory (15 GB, 4 CPUs) was contended with 9 lanes: several vitest runs were SIGKILLed and Chromium renderers crashed until launched with --disable-dev-shm-usage; every affected run was repeated and its verdict rests on the repeat.
• Killing a recorded pnpm wrapper PID leaves the objectstack dev child listening; teardown needs the process tree or the port's listener.
• The showcase's dist/objectstack.json is converted forward on load at boot (ADR-0087 page-component-filter-record-to-rule-array) — harmless.

Close-out (extracted cards, checklist-accuracy findings, the docs PR) follows in a comment.

Generated by Claude Code