QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840

QA run record — 18.0 round-4 supplementary sweep, the #24681 targeted pass (18.x steps 5 and 6, the upgrade ceremony opened), record 1 of 3: Tier 1 re-run of every pinned item a #24681 source file maps to. Framework 307ce4c4. Maintainer-approved (dispatch session session_01CfRDy7SuTfUqaTu2AEH2Hi, 2026-10-20). Wave anchor: #24579. Previous round: round 3 at 580fd4ed (#24779 surface:api, #24786 surface:cli, #24787 surface:build). Sister records: #24838 (upgrade:ceremony) and t2:24681-touched (close-out comment).

Environment fingerprint

• Framework 307ce4c4b42503347d7f85825f572e4ca058b05f (pinned, detached). No console build; objectui-only pins are not runnable here.
• Cold tree: pnpm install --frozen-lockfile (21 s), pnpm build --concurrency=2 (76/76, 7m29s), check-dev-prereqs green.
• vitest per package, one package at a time, --maxWorkers=1, JSON reporter per package; cli *.e2e.test.* pins in their own invocation under OS_TEST_TIERS=nightly, every other cli pin without it (RUNNER OS_TEST_TIERS fact). No server of the run was alive while the pins ran except this pass's own HTTP runners (never more than 2).
• Timestamps (UTC, 2026-10-20): unit pins 08:13–08:33; nightly + dogfood pins 08:34–08:42; one missed pin re-run 09:06; clause mapping 08:47–09:05.
• Clause mapping: three parallel read-only mapping subagents (28/27/27 items), each re-deriving clause by clause from the item text and the pin source, re-read by the parent. Sequential pin execution by the parent.

Scope

Selector tier1:24681-touched. Population: the #24681 merge commit 12d14765c7's changed files (git diff --name-only 12d14765c7^1 12d14765c7) minus tests, changesets, .md/.mdx, the checklist area JSONs and .github/ — 49 files — each resolved with node scripts/checklist-select.mjs file:PATH --json. Union: 176 runnable items (no planned), of which 82 carry automated.ref (read from areas/AREA.json). Those 82 are this record's denominator. (With the two checklist area JSONs and lint.yml counted, the union is 178 / 84; the extra two pinned items are ai.mcp-oauth-private-host-transport and identity-auth.teams-bu-membership, reached only through docs/qa/platform-checklist/areas/*.json — not product source, so not in this pass.)

Revisions: each row below carries the revision its verdict is valid for.

Pin run

189 pin files, 4953 tests passed, 0 failed, 0 skipped across 29 packages; every named file that exists in this checkout was collected and ran at least one test (none collected zero). One pin was first missed by the ref parser (integration-system.datasource-admin-lifecycle's parenthesised "(+ tests/envelope.conformance.test.ts)") and run separately: 24/24.

Not runnable here, scored not-run:

• objectui-only refs: automation.screen-flow-roundtrip, i18n.surface-matrix, records-forms.cascading-options, records-forms.master-detail-atomic-save, records-forms.related-list-server-pagination (its pin is marked stale), records-forms.bulk-select-all-matching; the objectui halves of records-forms.cascading-multilevel-and-clear, records-forms.list-view-capabilities, automation.setup-packaged-automation-board, platform-core.metadata-authoring-roundtrip.
• Playwright spec examples/app-showcase/e2e/showcase-smoke.spec.ts (platform-core.nav-surfaces-render, records-forms.view-type-gallery): browser, not run (no console this pass).

How a pin scores (RUNNER rule 6, "a pin scores only the layer it drives")

PR #24811 (which adds that paragraph to rule 6) is not on main at 307ce4c4; this record applies its meaning. Each row names the layer its pins drive: unit (functions or handlers with fakes), in-process (a real kernel/engine/driver in the test process), http-in-process (a real Hono adapter in-process, e.g. the dogfood harness), live-boot (a spawned server or CLI). A clause whose oracle is an API answer, a boot log or a shell exit code is scored pass (pin) only when a pin drives that layer; otherwise it is not-run with "pin drives only LAYER". A negative that states only a runner or recording rule is procedural and counts as not-run.

Result

No pin failed; no clause failed.

Against round 3 (580fd4ed)

• PASS in round 3, FAIL now: none. No item failed, so RULE 7 had nothing to re-derive here.
• Lower than round 3, no behaviour regressed — every move is the layer rule or a revision change, never a red pin:
  • PASS → PARTIAL: cli.organization-ownership-ceremony (rev 2 → 3 rewrote a1–a4; a1 checksum and a3 served-boot line need a live run), cli.migrate-meta-write-stored-and-all (a4 --stored output not pinned at the command), cli.verify-derived-proof-families (a1 "on the showcase"), integration-system.connector-stdio-default-deny, records-forms.field-unique-enforcement (rev 3 → 4; driver-level pins with a test-local 409 mapper), integration-system.notification-org-and-redeliver-eligibility, access-security.security-catalog-activation-and-clone-doors, api-backend.error-sentences-and-unique-violation-wire-code, automation.scheduled-work-opt-in, automation.flow-run-semantics-v18, records-forms.write-answer-advisories-rollback-and-tree-delete, api-backend.declarative-endpoint-execution, platform-core.v18-boot-refusals (rev 4 → 5).
  • PARTIAL → NOT-RUN: cli.migrate-plan-apply-json (its only pin is a unit emitJson test; a2 asks for echo $?), cli.verify-verdict-exit-mapping, attachments-storage.field-accept-maxsize-server-enforced (its ref itself disclaims the wired lane).
  • Fewer clauses inside PARTIAL: integration-system.external-schema-drift-gate, cli.dev-automigrate-policy, api-backend.packaged-action-disabled-dispatch, ai.mcp-stdio-fail-closed, platform-core.settings-audit-secret-fingerprint (a0–a4 now need the API read; they PASS live in QA run · upgrade:ceremony (9/9) · 307ce4c4 · 2026-10-20 · 6 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #24838).
• 27 items carry round 3's mapping unchanged where the revision is the same and no pin file changed since 580fd4ed; the rest were re-derived (rows say which).
• Items with no round-3 Tier 1 verdict: the browser/mixed-surface items (round 3 ran surface:api / cli / build only).

Per-item verdicts

Columns: item · rev · pins (files, tests passed) · layer · clauses passed · uncovered (not-run reason) · verdict · source.

Checklist-accuracy findings / fixture gaps (for #24579)

Refs that claim more than their pins assert:

• cli.migrate-plan-apply-json: "covers acceptance[2]" — the pin is a unit emitJson test; a2 asks for echo $? per subcommand.
• cli.verify-verdict-exit-mapping: "covers acceptance[4]" — the pin tests resolveVerifyMultiTenant only.
• records-forms.field-unique-enforcement: says the SQL pins assert "409 UNIQUE_VIOLATION over real REST"; they are driver-level with a test-local createAsApi mapper.
• integration-system.connector-stdio-default-deny, dashboards.dataset-report-authoring, platform-core.protocol-18-handshake-and-stored-replay, integration-system.webhook-lifecycle (rev 9): bare refs over-imply coverage.
• automation.flow-node-type-matrix, records-forms.list-view-capabilities: Tier 1 in name only (no complete clause pinned; the list-view ref says so itself).
• attachments-storage.field-accept-maxsize-server-enforced: the ref disclaims the wired lane — NOT-RUN until a REST pin exists.
• cli.dev-automigrate-policy: the production-force-off case stages relax_not_null, which ADR-0113 made needs_confirm, so it passes with or without the guard; it should stage replace_unique_index and assert the warning.
• platform-core.metadata-authoring-roundtrip a3's verify names the dogfood pin as covering the PUT door; it calls protocol.saveMetaItem in-process.
• records-forms.encrypted-field-behavior: a2/a4 guards are pinned at the engine only.
• Sweep-wide: several item texts tell the runner to score api/log clauses from unit or driver pins ("unit fallback", knownGaps "score from the pin") — they contradict rule 6's layer paragraph (field-unique a1–a3, drift-gate a0/a3, cascading-multilevel a1, approvals a9, settings-audit a0–a4).

Refs that miss their own pins:

• integration-system.datasource-admin-lifecycle: second file spelled "(+ tests/envelope.conformance.test.ts)" — respell with " + " so a ref parser finds it.
• dashboards.empty-null-bucket-boundaries a4: packages/qa/dogfood/test/empty-group-bucket-parity.test.ts exists, is named in a4's verify, and is not in the ref.
• automation.trigger-type-matrix n0: showcase-anonymous-deny-surfaces.dogfood.test.ts not in the ref.
• identity-auth.admin-lifecycle-operations a5/n3: the [#3023] case in security-plugin.test.ts not in the ref.
• cli.dev-automigrate-policy: sql-driver-unique-tenancy.test.ts (a4/n2) named in GAPS, missing from the ref.

Other:

• approvals.decision-action-matrix: the pin also asserts n1 (THROTTLED), unclaimed by the ref.
• records-forms.related-list-server-pagination: its only pin is stale.
• platform-core.lifecycle-retention-sweep a5 is checked by the item's enumSource gate, not a pin.

Item verdicts (derived)

10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN of 82.

NOT-RUN (19): objectui-only or Playwright pins — automation.screen-flow-roundtrip, i18n.surface-matrix, records-forms.cascading-options, records-forms.master-detail-atomic-save, records-forms.related-list-server-pagination, records-forms.bulk-select-all-matching, platform-core.nav-surfaces-render, records-forms.view-type-gallery; a runnable pin that scores no clause at its oracle's layer — cli.migrate-plan-apply-json, cli.verify-verdict-exit-mapping, cli.datasource-introspect-codegen, access-security.record-access-explain, automation.flow-node-type-matrix, records-forms.cascading-multilevel-and-clear, attachments-storage.field-accept-maxsize-server-enforced, integration-system.webhook-lifecycle, records-forms.crud-roundtrip, automation.setup-packaged-automation-board, records-forms.list-view-capabilities. Each of these needs a live run (or a pin at the right layer) — handover for the next sweep.

Generated by Claude Code