QA run · since:v18 (48/48) · 5b14b7f3 · 2026-10-19 · 38 PASS / 7 PARTIAL / 3 FAIL / 0 BLOCKED / 0 NOT-RUN #24558

Activity

1. objectstack-fleet

   added

   qa-run

   on Oct 19, 2026
2. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Checklist-accuracy findings / fixture gaps (record continuation)

   Continuation of the run record above (since:v18, 5b14b7f). For the wave anchor card; not extracted.

   Checklist-accuracy

   • access-security.anonymous-floor-v18-doors — knownGaps[1] is stale: on this sha an anonymous non-POST /keys (GET, PATCH) answers 401 UNAUTHENTICATED, not 405; the 405 is now only what an authenticated caller gets. DELETE/PUT /keys/:id answer 404 ENDPOINT_NOT_FOUND to anon AND admin alike (route not mounted on HonoServer), so they are not floor doors here
   • access-security.walled-environment-metadata-operator-only — fixtures.requires asks for an OS_TENANCY_POSTURE=isolated boot, which 18.0 refuses at boot by design (serve.ts walledPostureRefusal: 18.0 supports 'single' only). The item cannot be live-run against an 18.0 server; its live clauses should be re-scoped to the single control or marked planned for the 18.x that lifts the…
   • access-security.walled-environment-metadata-operator-only — step 4 control: a minimal object body needs sharingModel or the save is refused 400 security-owd-unset
   • access-security.meta-authoring-trail-and-audience-gates — for a setup.access-only member the /history door answers 403 FORBIDDEN (trail gate) before the audience gate's PERMISSION_DENIED; the 'every by-name door → PERMISSION_DENIED' clause holds literally only for a caller who passes the trail gate (measured with a manage_metadata member)
   • access-security.security-catalog-activation-and-clone-doors — step 3 'for an unknown name' and the type segment: the activation types are position, permission, sharing_rule — permission_set answers 400 'Path must be /security/_activation/:type/:name'
   • access-security.security-catalog-one-holder-and-boot-report — clause 4's clean-boot info line is only visible with OS_LOG_LEVEL=info (default os dev output shows no [security] report line on a clean boot); the error line prints at error level
   • access-security.grant-table-write-contract — clause 2 names 'constraint.rule validity_window_order': a genuine rule violation carries no constraint object — rule-validator.ts emits constraint{rule,reason:'unevaluable'} only on an unevaluable fault; the pin (sys-user-permission-set-window-order.test.ts) asserts only reason !== 'unevaluable'. Judged on the inten…
   • access-security.parent-and-organization-write-guards — the stock showcase has no non-cbp master-detail whose header a member cannot read (projects are public_read_write); a scratch pair is required for clause 2's reference_not_found arm (on the stock cbp invoice_line the cbp gate answers 403 first, still identical for both ids)
   • access-security.parent-and-organization-write-guards — no stock showcase cbp child has a master the member can read but not edit with files enabled — a scratch pair was authored (object PUT is admitted env-wide on single)
   • access-security.share-link-combined-gates — clause 3 'answers identically … status+code pairs' contradicts the shipped design and its pin: /messages answers every refusal with one generic 404 NOT_FOUND (share-link-routes.ts messages route; runtime share-links-messages-audience.test.ts expects 404 NOT_FOUND / 400 UNSUPPORTED) while /resolve differentiates 401 SI…
   • access-security.share-link-combined-gates — fixture: links must be minted on showcase_client_brief (the only publicSharing-enabled object; status published) — showcase_task answers 422 SHARING_NOT_ENABLED
   • access-security.share-link-combined-gates — step 2 'no matching email session': the email audience has no session concept; its input is the caller-supplied ?email= checked against the allowlist (see authHoleDetail)
   • ai.mcp-coded-refusals-and-runtime-exposure — step 3 'an action the caller may not run': stock showcase AI-exposes only showcase_portfolio_snapshot (system-elevated script, succeeds for a member) and the other actions refuse with 'not exposed to AI' (an uncoded bare message); the PERMISSION_DENIED producer needed a planted ai-exposed declarative update action
   • ai.mcp-coded-refusals-and-runtime-exposure — PUT /meta/object for a runtime object needs sharingModel (422 security-owd-unset otherwise)
   • api-backend.second-object-exposure-and-internal-fields — step 1 dotted path filter [["t_ref.name","=","x"]] is refused 400 INVALID_FIELD as an unsupported dotted path; the relation condition shape is nested: filter={"t_ref":{"name":"x"}} (judged on the corrected shape)
   • api-backend.second-object-exposure-and-internal-fields — step 2 by-id door rejects $expand 400 VALIDATION_ERROR ("Supported parameters: expand, select"); by-id uses expand=, list uses $expand=
   • api-backend.second-object-exposure-and-internal-fields — clause 1 says the refusal names 'where.t_ref'; live message locates it as 'filter.t_ref' (field object=target object)
   • api-backend.data-request-shape-and-query-arity — code is VALIDATION_FAILED on the /data doors (clause 1/2 say so); the dispatcher arity refusal is VALIDATION_ERROR (clause 3) — both as stated
   • api-backend.data-request-shape-and-query-arity — step 5 'a row the member cannot read': showcase_task is public_read_write, so the unreadable row was a showcase_private_note (private OWD) owned by admin
   • api-backend.meta-read-doors-v18 — step 5 names showcase_task, but the showcase declares no FLS on showcase_task; the FLS-denied field is showcase_project.budget for the client_liaison position (showcase_client_liaison set) — judged there
   • api-backend.meta-read-doors-v18 — 'marked unsortable' is realised as the field being absent from sortability.fields (not sortable:false)
   • api-backend.meta-read-doors-v18 — fixtures: showcase ships only an en-US member of showcase_task_done_email; the zh-CN member must be authored (a PUT with body locale zh-CN, no ?member= on PUT)
   • api-backend.error-sentences-and-unique-violation-wire-code — fixture 'a beforeInsert hook on sys_sharing_rule' cannot be authored: compile refuses Hook … references object 'sys_sharing_rule' which is not defined in objects; used hand-built doors over package objects (forms submit, data batch) instead
   • api-backend.error-sentences-and-unique-violation-wire-code — step 3 'malformed adapter config' realised as storage.local_root=/dev/null/… via PUT /api/settings/storage
   • approvals.act-door-and-admin-rescue-slate — Clause 1 / title expect PUT → 405 Allow: GET, POST. Live PUT answers 404 ENDPOINT_NOT_FOUND, and the item's own pin packages/runtime/src/domains/approvals-act.test.ts asserts exactly that the dispatcher domain claims only GET/HEAD/POST and an unclaimed PUT is 'the dispatcher's ordinary miss' (404 ROUTE_NOT_FOUND) with…
   • approvals.act-door-and-admin-rescue-slate — Fixture 'approval email action token (dev mail transport capture)': on a stock boot no approval email is sent; action tokens are minted only by the submitter's remind. The working fixture recipe is withheld with the authorization finding on this item (detail withheld pending maintainer).
   • attachments-storage.upload-limits-scope-and-ownership — step 5 'an id copied from another record' cannot be produced through the REST write doors: POST and PATCH of a record with another record's file id re-mint it into a fresh copy (new sys_file id) for admin and member alike; the copied state needed a direct DB plant (showcase_task.cover = '"‹F>"')
   • attachments-storage.chunked-upload-integrity — clause 1 expects details.missingChunks [2] for 'PUT chunks 1 and 3'; chunk indexes are zero-based, so the run PUT 0 and 2 and the server answered [1] — reword the item to zero-based
   • attachments-storage.chunked-upload-integrity — clause 3's org switch is unreachable on 18.0 (single posture only); the item should be gated to a release carrying walled postures or name the fixture
   • automation.flow-registration-verdict-on-read — fixtures say 'pnpm dev -- --fresh'; a persistent file DB was used so the cold-boot bind could also be observed (no effect on verdict)
   • automation.flow-authoring-refusals-v18 — clause 2 ('the same bodies at PUT /meta/flow → 422') is wrong for the unbound-CEL-root arms (record.x on a flow no entrance hands a record; user.id): the runtime publish gate stands down for that judgement by design and the item's own pin (validate-expressions.flow-cel-root.test.ts) asserts it; PUT answers 200 and the…
   • automation.flow-authoring-refusals-v18 — the job retryPolicy and anonymous-endpoint arms cannot be PUT to /meta/flow: job and api are code-only metadata types (PUT /meta/job|api → 403). The 'nothing stored' intent holds; the clause should say 403-code-only for those arms.
   • automation.flow-authoring-refusals-v18 — 'a REST-triggered flow reading record.x' is ambiguous: a type:'api' inbound-hook flow binds record (validates clean, and needs config.secret else flow-api-trigger-secret-missing); the refused shape is an autolaunched flow with no record entrance started via POST /automation/:name/trigger.
   • automation.flow-authoring-refusals-v18 — the anonymous-endpoint arm also needs an armed rateLimit, otherwise ADR-0121 D6 rate-limit refusal fires beside the D2b one.
   • automation.flow-run-semantics-v18 — step 1 needs a record the member may UPDATE: a minted member gets 403 PERMISSION_DENIED on PATCH showcase_task (it can create one); showcase_private_note (owner-private) was used instead
   • automation.scheduled-work-opt-in — item title says OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true; =1 was used (both truthy per resolveScheduledWorkEnabled)
   • cli.migrate-meta-write-stored-and-all — clause 2 / step 2 expects mechanical edits from 'v17 spellings' like view striped; striped retired in 17.0 so --from 17 does not convert it (stays as a schema refusal). Planting a protocol-18 conversion (dashboard refreshInterval) is what exercises --write.
   • cli.migrate-meta-write-stored-and-all — The showcase itself already carries 3 protocol-18 mechanical sites (flow decision mode inclusive) — a --write on an unplanted showcase copy edits src/automation/flows/index.ts.
   • cli.organization-ownership-ceremony — ITEM STALE vs subject 5b14b7f: 18.0 deliberately ships os migrate organization-ownership as a NOT_IMPLEMENTED refusal (fresh-installs-only ruling 6259608309; packages/cli/src/commands/migrate/organization-ownership.ts ORGANIZATION_OWNERSHIP_UPGRADE_UNAVAILABLE). Clauses 1,2,4 and the checkpoint half of 3 describe a…
   • cli.organization-ownership-ceremony — os migrate comment-reactions --apply still runs in 18.0 (not withdrawn): on cr.db with 2 planted sys_comment rows → run1 '2 converted', 1 not-JSON value listed, exit 1 (column cannot be dropped until every value reads); run2 '2 already converted, 0 converted' (idempotent), sys_comment_reaction holds 2 rows (dup user…
   • cli.meta-package-flags-and-explain — step 1 qa_view.json named qa_view cannot be saved: a view ITEM name must be dotted (showcase_project.qa_view, 422 invalid_format), and a container named qa_view on showcase_project is refused 400 (collides with showcase_project.default). Used showcase_project.qa_view.
   • cli.meta-package-flags-and-explain — --package com.example.showcase writes are refused 422 WRITABLE_PACKAGE_REQUIRED (read-only code package) — fine for proving ?package= is sent, but a positive package-addressed save needs a writable package (used com.qa.p18 installed via POST /api/v1/packages).
   • cli.meta-package-flags-and-explain — fixture says pnpm dev -- --fresh; used the canonical file-DB boot instead
   • cli.validate-v18-authoring-verdicts — build exit codes differ by arm (1 for author-time lint rules, 2 for defineStack/define* parse refusals) — both non-zero, clause holds
   • cli.verify-derived-proof-families — step 2 'plant a wrong deleteBehavior' alone does not produce a contradiction (the engine enforces whatever is declared); the planted defect must be a declaration the runtime contradicts — e.g. a hook that undoes the cascade, as the pin does. Hook body API is ctx.api.object(x).find/update({id,…}) with capabilities ['ap…
   • dashboards.analytics-exposure-gate-and-measure-aggregate — clause 1: querying the configured cube over the unexposed object answers 404 CUBE_NOT_FOUND (registration refused it, consistent with clause 2); OBJECT_API_DISABLED is reached by the object's inferred cube or an inline dataset
   • dashboards.analytics-exposure-gate-and-measure-aggregate — step 4: sys_user_metrics has no dimensions, so 'dimension columns carry none' needs a dimensioned dataset (showcase_task_metrics)
   • i18n.flow-copy-translation-and-host-override — step 3: plain os i18n extract defaults to --objects-only and emits NO flow keys; --no-objects-only is required to see refusal/screen/option/toast keys
   • i18n.flow-copy-translation-and-host-override — clause 4 'in either load order' cannot be driven live (one boot = one order); left to the pin
   • identity-auth.auth-gate-held-session-raw-host-families — The fixture's 'API key minted by the member before the hold' cannot be met with the cheap admin/create-user path (the member is held from first sign-in); worked order: create → change-password → mint key → re-hold via set-user-password / policy settings
   • identity-auth.import-invitation-and-sso-domain-answers — fixtures.requires names only OS_SSO_DOMAIN_VERIFICATION toggled per leg; the ON leg also needs OS_SSO_ENABLED=1 — with OS_SSO_DOMAIN_VERIFICATION=1 alone (sso plugin not loaded) the door answers 400 DOMAIN_VERIFICATION_DISABLED (isSsoDomainVerificationEnabled requires isSsoWired; documented in auth-manager.ts). Judged…
   • integration-system.inbound-mailbox-association — knownGaps says 'no in-repo app composes the mailbox service' — the showcase DOES (requires includes 'mailbox'; MailboxServicePlugin loads, sys_mail_* objects served). What is missing is the IMAP sync composition (new MailboxServicePlugin({ imap: { accountFor } })) plus an IMAP double.
   • integration-system.notification-org-and-redeliver-eligibility — fixture 'the showcase outbound webhook (shipped inactive) with one delivery' cannot exist: an inactive webhook is never dispatched, so it has no delivery. Recipe: activate (or create) a webhook pointing at a reachable sink, let a delivery reach success/failed/dead, then deactivate/delete. A still-'pending' row answers…
   • integration-system.notification-org-and-redeliver-eligibility — step 4 (MCP stdio connector cwd) has no acceptance clause beyond the pin clause 0; not driven
   • platform-core.v18-boot-refusals — step 1 says os serve … -d file:COPY.db: serve has no -d flag (INVOCATION ERROR — Nonexistent flag: -d); use OS_DATABASE_URL (or os start -d/os dev -d).
   • platform-core.v18-boot-refusals — clause 2 'checksum before == after' is insufficient in WAL mode: the 18.x driver leaves changes in COPY.db-wal, so the main file can hash identical while the DB differs — compare a logical dump or checkpoint first.
   • platform-core.v18-boot-refusals — step 2 os dev with DevPlugin services:{auth:false}: (a) defineStack refuses a DevPlugin instance under devPlugins (manifest shape), (b) under plugins it double-registers 'storage' inside os dev, (c) an os dev stack with no auth tier is refused earlier by the no-auth data-API refusal. The AuthzIdentityObjectsMissingE…
   • platform-core.v18-boot-refusals — the refusal code ORGANIZATION_OWNERSHIP_MIGRATION_REQUIRED is not in the CLI output; the clause should match the message (tables + command) rather than the code literal.
   • platform-core.protocol-18-handshake-and-stored-replay — clause 3 artifact had to be hand-crafted (compile output edited) — no 'built before a retirement' artifact fixture exists
   • platform-core.settings-organization-isolation-and-platform-rung — Item requires a second boot with OS_TENANCY_POSTURE=isolated, but 18.0 refuses walled postures at boot (FATAL NOT_IMPLEMENTED for isolated and group). Clauses 2 and 3 cannot run on any 18.0 build — they should move to fixtures.knownGaps / a planned split until walled postures ship (18.x).
   • platform-core.serve-composition-v18 — fixture says 'a datasourceMapping (examples/app-crm declares one)': app-crm no longer declares one (its config comments explain the mapping was removed as decorative); used the pin's fixture shape.
   • platform-core.serve-composition-v18 — leg 5 'boot a tree whose console is not built' cannot be reproduced from a workspace checkout without touching shared dist: resolveConsolePath also resolves from the CLI's own location, and the bin shim's NODE_PATH (/home/user/objectstack/node_modules/.pnpm/node_modules) makes createRequire find the built workspace co…
   • platform-core.serve-composition-v18 — knownGaps note (serve-organization-record-page is .e2e, nightly-only) still holds — orchestrator's concern
   • records-forms.write-answer-advisories-rollback-and-tree-delete — records-forms.validation-rule-type-matrix still describes the warning-severity hit as server-log only; live answer carries warnings[] (already noted on this item's history)
   • records-forms.v18-semantic-defaults — fixtures.knownGaps (pinned objectui does not build) is stale at this subject: the console is built and its stamp matches pin 4016370a, so the browser clauses ran
   • records-forms.v18-semantic-defaults — step 1 'GET /api/v1/meta/view/VIEW and read the resolved pageSize / editInline': the meta read serves the authored view with no pagination or userActions block, so nothing resolved can be read there; the default shows up only in the renderer (top=50, the Edit inline switch)
   • records-forms.v18-semantic-defaults — step 2's affordance is the 'Edit inline' switch in the list's Display popover (per the D3 entry's acceptance text), not a cell editor: on a list that declares neither key, clicking a cell opens the record for every persona until the switch is turned on
   • studio-authoring.multi-package-item-rows — step 3 'PUT /api/v1/meta/object/showcase_task?package=A' cannot reach the OBJECT_OVERLAY_PACKAGE_MISMATCH refusal on stock showcase: showcase_task is code-packaged (com.example.showcase) and sealed, so it answers 403 NOT_OVERRIDABLE first. The 422 needs a Studio-owned object: create qa_owned_obj in package A, then PUT…
   • studio-authoring.multi-package-item-rows — step 5 'publish package A' — POST /packages/:id/publish answers 200 {data:{success:false,itemsPublished:0,validationErrors:['No metadata items found for package …']}} for a Studio package whose items are stored drafts/rows; the revert's 'published version' is created by POST /packages/:id/publish-drafts. The step shou…
   • studio-authoring.save-door-runs-authoring-rules — clause 1 says every refusal carries 'the rule id': the spec-validation refusals (slots pair, chart binding, url target, protection, _lock) carry path + code:'custom' and no rule key — only the lint-gate refusals (component-props-unknown-key, expression-invalid) name a rule id. The pins assert path/code only; the cla…
   • platform-core.serve-composition-v18 — the verify recipe omits OS_TEST_TIERS=nightly: packages/cli/test/serve-organization-record-page.e2e.test.ts is a nightly-tier file, so the recipe as written runs nothing for it ("FILTER SELECTED NOTHING"); with the switch: 1 file, 2 passed.
   • walled-posture clauses (several items) — 18.0 refuses to boot OS_TENANCY_POSTURE=isolated|group; every clause that needs the walled posture cannot be run live on 18.0 and should move to fixtures.knownGaps or a planned split.

   Fixture gaps

   • access-security.walled-environment-metadata-operator-only — walled posture (group/isolated) is refused at boot on 18.0 by design (serve.ts walledPostureRefusal, no escape hatch) — every walled clause is unrunnable on a live server in this release; only the kernel-level pins (bootStack) exercise it
   • access-security.grant-table-write-contract — walled posture (group/isolated) is refused at boot on 18.0 by design (serve.ts walledPostureRefusal, no escape hatch) — every walled clause is unrunnable on a live server in this release; only the kernel-level pins (bootStack) exercise it
   • access-security.parent-and-organization-write-guards — walled posture (group/isolated) is refused at boot on 18.0 by design (serve.ts walledPostureRefusal, no escape hatch) — every walled clause is unrunnable on a live server in this release; only the kernel-level pins (bootStack) exercise it
   • ai.mcp-coded-refusals-and-runtime-exposure — no stock ai-exposed action produces PERMISSION_DENIED
   • api-backend.second-object-exposure-and-internal-fields — stock showcase has no apiEnabled:false / apiMethods-whitelisted object, no lookup into one and no internal:true field — scratch app required
   • api-backend.second-object-exposure-and-internal-fields — rows of an apiEnabled:false / get-only object cannot be created through any API door; seeded by direct sqlite insert
   • api-backend.meta-read-doors-v18 — no demo persona holds client_liaison; minted via admin/create-user + sys_user_position binding
   • api-backend.error-sentences-and-unique-violation-wire-code — no showcase hook refuses with a sentence and no unique field + duplicate-inserting action exist on stock showcase — scratch app required
   • approvals.request-page-reply-and-reader-visibility — a stock-showcase org member holds NO object read on sys_approval_request / sys_approval_action, so a non-participant's by-id read is refused 403 PERMISSION_DENIED at the object gate and the row-level 404 / total-exclusion the clause names is unobservable. The item should name how the member gets object read (this run:…
   • attachments-storage.chunked-upload-integrity — no second organization possible on 18.0 for the org-switch leg
   • automation.inbound-hook-timestamped-signature — the accepted run itself failed: 'create_record(showcase_task) failed: Project is required' — the showcase_inbound_task_webhook flow guards project with has() → null but showcase_task.project is required, so a body without project never creates a task (not this item's clause; fixture note)
   • cli.organization-ownership-ceremony — no v17 DB fixture in the tree: minted one from npm @objectstack/cli@17.7.0 (npm install fails with arborist 'edgesOut' null; pnpm add --ignore-workspace works)
   • dashboards.analytics-exposure-gate-and-measure-aggregate — stock showcase has no cube over an unexposed object and no internal field — scratch app required
   • i18n.flow-copy-translation-and-host-override — no showcase flow carries a refusing end node; showcase_reassign_wizard's zh screen title exists but the authored screen has no title, so a scratch flow was needed
   • integration-system.inbound-mailbox-association — need: an app/host composing MailboxServicePlugin({imap:{accountFor}}) + a local IMAP double (none ships; python has only an imaplib client) — or an in-process ingest door
   • platform-core.v18-boot-refusals — no v17-shaped SQLite fixture in the tree; minted from npm @objectstack/cli@17.7.0 via pnpm add --ignore-workspace (npm install fails: arborist 'edgesOut' null)
   • platform-core.protocol-18-handshake-and-stored-replay — no pre-retirement ^18 artifact fixture; crafted from a compiled minimal app
   • platform-core.settings-organization-isolation-and-platform-rung — walled-posture boot (two orgs A/B with non-platform-admin owners) unavailable on 18.0
   • records-forms.comment-reactions-and-edit-stamps — stock showcase grants a plain org member NO object permission on sys_comment or sys_comment_reaction (/auth/me/permissions objects lacks both; member POST /data/sys_comment_reaction and GET /data/sys_comment → 403 PERMISSION_DENIED). Item fixture should say how the member obtains them; this run cloned showcase_member_…
   • records-forms.v18-semantic-defaults — the updater persona needs task edit rights AND visible rows: contributor's task RLS is assignee == current_user.email, so this run assigned two tasks to the updater (admin PATCH assignee)

   ---

   Generated by Claude Code
3. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Close-out

   Every fail in this record has its four-way disposition (checklist-test SKILL §5), and every product defect found during the run is extracted:

   Extracted: #24561 · api-backend.error-sentences-and-unique-violation-wire-code · acceptance[1]
   Extracted: #24564 · approvals.act-door-and-admin-rescue-slate · X1
   Extracted: #24565 · access-security.parent-and-organization-write-guards · side finding
   Extracted: #24566 · cli.organization-ownership-ceremony · acceptance[3]
   Extracted: #24567 · platform-core.v18-boot-refusals · acceptance[2]
   Extracted: #24568 · access-security.security-catalog-one-holder-and-boot-report · acceptance[1]
   

   • api-backend.error-sentences-… acceptance[1] — product defect → rest/metadata-protocol: POST /api/v1/data/:object/batch withholds a hook's business refusal as a per-row INTERNAL_ERROR, while /data, /createMany and /import return the hook's sentence #24561.
   • approvals.act-door-… X1 — authorization finding, detail withheld pending maintainer → approvals: authorization defect in approval action links (18.0 QA sweep) — detail withheld pending maintainer #24564 (withheld card; RUNNER rule 7 confirmed; candidate 18.0 release blocker).
   • access-security.parent-and-organization-write-guards — product defect seen outside the authored clauses → plugin-audit: object definitions are cached for the process lifetime, so enabling files on an object at runtime still answers 403 FILES_DISABLED on attachments until a restart #24565.
   • cli.organization-ownership-ceremony acceptance[3] — low-severity message defect → cli: the os migrate apply drop-gate refusal prescribes os migrate organization-ownership, which 18.0 refuses NOT_IMPLEMENTED — the remedy dead-ends #24566.
   • platform-core.v18-boot-refusals acceptance[2] — assertion defect → test-fix platform-checklist + cli: three findings from the 18.0 QA sweep at 5b14b7f3 — two clauses mis-asserted against documented contracts, and a refusal that prescribes a withdrawn command (family card) #24567.
   • access-security.security-catalog-one-holder-… acceptance[1] — assertion defect → test-fix checklist test-fix: access-security.security-catalog-one-holder-and-boot-report acceptance[1] expects conflicts[] on the install-local refusal, which that door's ledger contract does not carry #24568.
   • PARTIAL coverage gaps and the checklist-accuracy / fixture-gap list (first comment) go to the wave anchor card through the dispatch session; no anchor number exists yet, so no Parked-on: line is written here. No not-run item.

   ---

   Generated by Claude Code
4. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Close-out correction

   The filing rules for this wave cap a session at three standalone defect cards. #24566 and #24568 are closed as folded into the family card #24567 (one row per location). Current extraction lines, replacing the earlier list:

   Extracted: #24561 · api-backend.error-sentences-and-unique-violation-wire-code · acceptance[1]
   Extracted: #24564 · approvals.act-door-and-admin-rescue-slate · X1
   Extracted: #24565 · access-security.parent-and-organization-write-guards · side finding
   Extracted: #24567 · platform-core.v18-boot-refusals · acceptance[2]
   Extracted: #24567 · access-security.security-catalog-one-holder-and-boot-report · acceptance[1]
   Extracted: #24567 · cli.organization-ownership-ceremony · acceptance[3]
   

   ---

   Generated by Claude Code
5. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Parked-on: #24579 · this record's checklist-accuracy findings, fixture gaps, partial coverage gaps and not-run handover (wave anchor §2–§4)

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 19, 2026

   

   objectstack-fleetBot

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Closure complete (checklist-test §5): every FAIL in this record has a disposition (the Extracted: / Parked-on: lines above), and its partial coverage gaps and not-run handover are parked on #24579.
   Closed by: the 18.0 QA wave dispatch session session_01CfRDy7SuTfUqaTu2AEH2Hi, on the maintainer's instruction there on 2026-10-19, verbatim 「qa-run的卡片处理完的是不是可以关闭」.

   ---

   Generated by Claude Code
7. objectstack-fleet

   closed this as completedon Oct 19, 2026
8. os-warren

   added a commit that references this issue on Oct 20, 2026

   docs(qa): 18.0 sweep round 7 — integration-system checklist-accuracy …

   ...

   f73b68d