[sweep] v18.2.0 release test sweep #25807

Activity

1. objectstack-fleet

   added

   documentationImprovements or additions to documentationImprovements or additions to documentation

   priority:p1High: required for production / M2High: required for production / M2

   domain:devx

   target:v18

   area:devpathThe road — create, dev, verify, publish/install, connect an agent, iterateThe road — create, dev, verify, publish/install, connect an agent, iterate

   on Oct 25, 2026
2. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   From #25815 (release-18.2.0-tier1, 156 items) — §2 checklist-accuracy findings, part 1/2 (areas: access-security, ai, api-backend, approvals, attachments-storage, automation, cli, i18n, identity-auth, integration-system, platform-core). Each line is a ledger edit for the lane owning docs/qa/platform-checklist/**: revise the item, bump revision, append history citing #25815. Clause labels: aK = acceptance[K], nK = negative[K].

   Highlights (each is also in the list below): stale clause text — records-forms.field-unique-enforcement a4 still says org-less rows fold to ONE bucket while both pins assert they are exempt (ADR-0131 D1); cli.dev-automigrate-policy a4/n2 name two ADR-0120 D4 tightening cases that no longer exist (the file now asserts "no tightening proposed", ADR-0131 D1); records-forms.conditional-rules-header a2 claims a client lock on tax_rate the spec asserts the opposite of (objectui#13436). Refs that miss their own pins: e.g. access-security.no-active-org-session-semantics (two HTTP dogfood suites would cover a1–a3, n0, n1), attachments-storage.upload-session-abort, ai.mcp-coded-refusals-and-runtime-exposure, integration-system.email-template-render a3/a5, identity-auth.auth-method-matrix a3/a6/a9. Parser-hostile spellings: refs naming dropped files in prose (records-forms.conditional-rules-grid, records-forms.action-param-widgets, records-forms.adhoc-filter-sort-builder, records-forms.master-detail-atomic-save, records-forms.concurrent-edit-conflict), a brace glob in records-forms.bulk-select-all-matching, a source file named as a pin in access-security.rls-both-sides.

   access-security

   • access-security.activation-write-operator-gate a0/n2: ref claims the 'full posture x identity matrix' but automation-activation-posture-gate.test.ts has no caller-without-manage_metadata case; FLOW_ENABLEMENT_DENY_MESSAGE is asserted by no test in the repo
   • access-security.activation-write-operator-gate a1: action-activation-posture-gate.test.ts › REFUSES a caller without manage_metadata, in every posture asserts only toContain('manage_metadata') at the unit layer — not the 'functionally equivalent to deleting it' rationale nor 'a packaged action' subject, and it runs only single
   • access-security.activation-write-operator-gate a3: packages/qa/dogfood/test/packaged-activation-ledger-reach.dogfood.test.ts (not in ref) asserts one deployment-level row with no tenant column over HTTP, but as the dev admin, not a manage_metadata-without-platform_admin persona
   • access-security.activation-write-operator-gate a5: boot-log restart re-hydration corroboration is not covered by any pin (test half only)
   • access-security.anonymous-deny-surfaces a4: pin's /meta member contrast is .not.toBe(401), clause demands 200
   • access-security.anonymous-deny-surfaces a5: ref lists seven families but not the public-forms both-sides contrast; no pin covers it
   • access-security.anonymous-deny-surfaces n0: ref does not cover the post-DELETE authed GET /automation/showcase_reassign_wizard 200 read-back
   • access-security.anonymous-floor-v18-doors a1: the sweep's EVERYTHING_ELSE expectation checks status 401 + an error envelope, never error.code; UNAUTHENTICATED is asserted only in the unit pins (i18n, settings, api-description), none for /notifications, /keys, /share-links
   • access-security.anonymous-floor-v18-doors a3: DOOR_CLASSES[1] (share-link token face) uses REFUSED_WITHOUT_A_SUBJECT, which accepts 401 — the clause's 'not 401' is not asserted by any pin
   • access-security.anonymous-floor-v18-doors a2: rest-docs-viewer-retired.pin asserts no registration on RestServer/route manager; no pin compares GET /api/v1/docs to the never-served control path, anonymous and admin
   • access-security.anonymous-floor-v18-doors a4: the dogfood submit asserts 2xx and keys ['id'] on the showcase (step 4's forged owner_id/status not sent); exact 201 is asserted only by the Hono-transport pin over a protocol double
   • access-security.crud-permission-matrix ref: packages/verify/src/verify.ts / rls.ts (objectstack verify --rls) are a CLI proof, not test files — no pin here drives them; the object-level RLS half is unscored by the dogfood pins.
   • access-security.crud-permission-matrix a3: ref says the pin reaches clause 3; it probes only showcase_private_note (inquiry/invoice/invoice_line VAMA reads not asserted).
   • access-security.crud-permission-matrix a6: verify text says '45 rows × 4 verbs at revision 6'; the pin judges 41 rows (164 cells) and explicitly excludes the 4 sys_* rows, so clause 6 cannot be pinned whole.
   • access-security.crud-permission-matrix ref says 'showcase-permission-zoo pins on both sides' the delegate subtree gate: its out-of-subtree case asserts only non-2xx, not 403 PERMISSION_DENIED as the ref states.
   • access-security.crud-permission-matrix ref header comment in the pin says '6 showcase_field_ops_delegate × sys_* rows'; the ref and the pin's own assertion say 4 (2 retired).
   • access-security.deployment-tables-platform-only a0: packages/plugins/plugin-security/src/authz-identity-objects-boot-refusal.test.ts asserts SecurityPlugin's boot refusal when sys_user/sys_member/sys_organization are missing — nothing about the seven deployment tables or manage_platform_settings
   • access-security.deployment-tables-platform-only a1/a2: no pin drives either door over HTTP; both remain live-run clauses
   • access-security.fls-mask-and-strip a2: admin-side budget write (both sides of the lock) is asserted by neither pin, and the ref's STILL MANUAL list does not name it
   • access-security.fls-mask-and-strip a0: zoo FLS case asserts the name PATCH status only; the clause's 're-reads changed' leg is unpinned
   • access-security.grant-table-write-contract a1/a3/a4: api-oracle clauses are pinned only at the engine layer (real ObjectQL + SqlDriver, errors mapped by resolveThrownHttpError); no pin in the ref drives the /data door over HTTP for them
   • access-security.grant-table-write-contract a2: permission-set-assignment-window.dogfood.test.ts › 'the door refuses a window whose end is not after its start…' asserts [400, VALIDATION_FAILED] and fields [[valid_until, rule_violation]] only; the authored message, constraint absent/not 'unevaluable' and the valid-window 201 control are not asserted over HTTP
   • access-security.me-permissions-aggregation-parity a2: me-apps-and-everyone-baseline pin asserts only the member side (no gated app); the admin-sees-gated-app half is unpinned.
   • access-security.me-permissions-aggregation-parity a3: the anonymous trio's 200 shapes are pinned only in hono-current-user-endpoints.test.ts on a bare HonoServerPlugin with no auth service or auth gate — the 401-floor regression the clause guards is not reachable there; the dogfood anonymous /me/apps case asserts body.apps ?? [] only, never the status.
   • access-security.me-permissions-aggregation-parity a5: packages/plugins/plugin-hono-server/src/current-user-endpoints-localization.test.ts asserts the locale/timezone floors (unit) and is not in the ref.
   • access-security.meta-authoring-trail-and-audience-gates a2: meta-view-dashboard-audience-gate.test.ts drives RestServer with a mock server/protocol (unit) and covers list pruning + by-name refusal only — no /published, /layers or ?state=draft door, and no /history case for a studio.access holder lacking the view's requiredPermissions
   • access-security.meta-authoring-trail-and-audience-gates n0: the 304 assertion ('a caller who no longer holds the capability is never answered a 304…') exists only at the unit layer
   • access-security.no-active-org-session-semantics ref prose is stale: it describes a group CONTROL 'a NON-EMPTY membership set lands, even with no active organization'; on this tree that case is 'a NON-EMPTY membership set with NO active organization: an insert has nowhere to land, and is refused the same way' (asserts refusal)
   • access-security.no-active-org-session-semantics a1/a2/n1: packages/qa/dogfood/test/no-active-organization-write-refusal.dogfood.test.ts (HTTP 403 naming the missing org + nothing written) exists and is not in the ref
   • access-security.no-active-org-session-semantics a3/n0: packages/qa/dogfood/test/sharing-rule-org-less-caller.dogfood.test.ts (plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158 org-scoped manage_sharing holder over HTTP) exists and is not in the ref
   • access-security.no-active-org-session-semantics a7 (group, engine layer): packages/plugins/plugin-security/src/no-active-organization-insert-union-scope.test.ts (real ObjectQL + SqlDriver, group refusal and nothing stored) exists and is not in the ref; still in-process, not the live walled boot a7 requires
   • access-security.no-active-org-session-semantics ref says the pin 'pins every clause of this item at unit level' — a3, a4, a5, a6 have no case in it at any level
   • access-security.org-admin-assignment-boundary n2: the three-posture posture file only exercises admin_full_access out-of-boundary; the full set list (adminScope, platform-capability, org-admin sets, mcp agent ceilings) is asserted only by the unit gate in delegated-admin-gate.test.ts, not per posture
   • access-security.owd-sharing-matrix a0: verify's admin re-read of the denied PATCH is not asserted by showcase-private-owd (status only); clause text otherwise pinned; by-id GET asserted as not-200 rather than non-2xx
   • access-security.owd-sharing-matrix a2/a3/a5: ref implies all four OWD models pinned, but no pin covers modifyAllRecords bypass, public_read_write, or auditor VAMA
   • access-security.owd-sharing-matrix a4: showcase-invoice-cbp boots a test-local fallback set (showcase_cbp_member), not the showcase C1/C2 personas, and asserts no list exclusion; controlled-by-parent.dogfood.test.ts uses a synthetic cbp_account/cbp_note fixture, not showcase_invoice_line
   • access-security.parent-and-organization-write-guards a1/a2/n0: the walled organization-removal refusal and the unreadable-header parity are pinned only in-process (engine + SecurityPlugin over SQL drivers, thrown statusCode / resolveThrownHttpError) — the api-oracle legs have no HTTP pin; precedent QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 scored them PASS (rev 4) before the layer rule.
   • access-security.platform-owner-email-anchor n0: admin-standing-surface.test.ts never asserts ADMIN_STANDING_NON_TABLE_INPUTS (the OS_PLATFORM_OWNER_EMAIL non-table declaration n0 cites); the declaration is unpinned
   • access-security.platform-owner-email-anchor a0-a3: ref correctly records these as STILL MANUAL live-HTTP arms; unit pins do not score them
   • access-security.public-form-withdrawal-layers a0: ref concedes the no-organization read of step 4 has no end-to-end pin, so a0 cannot score from pins alone (the save 200 /env-wide/ and both doors 404 FORM_NOT_FOUND, landed 0, are pinned)
   • access-security.public-form-withdrawal-layers a2-a5: the rest pin is a unit (RestServer over a mocked protocol), the protocol pin an in-process protocol over a stub registry; both fit the [test] oracle
   • access-security.record-access-explain a1: ref 'explain vama_bypass case' asserts vama_bypass via in-process security.explain() (isSystem context), not the POST /api/v1/security/explain door the oracle names
   • access-security.record-access-explain a2/a3/n0: pin has no plain-member (deny-side) explain call; only the GET denial half is pinned
   • access-security.record-view-read-audit n0: the item says the ledger failure is 'reported once per process'; read-audit.test.ts '[finding] plugin-audit: a THIRD copy of both #15166 defects lives in read-audit.ts — process-wide boolean plus an unconditional datasource remedy #18247' cases pin once per CAUSE (a second distinct cause reports again at error) — item text is stale.
   • access-security.record-view-read-audit a4: verify cites sys_job as the excluded name; the pin probes sys_audit_log / sys_session, and no pin observes the AuditPlugin install line ('record-view auditing installed on N object(s)').
   • access-security.rls-both-sides a4: ref names packages/verify/src/rls.ts, a source file, not a test; no pin runs runRlsProofs over the showcase (rls-fixture/rls-multitenant dogfood run it on purpose-built fixtures only)
   • access-security.rls-both-sides a2/n0: the pin's foreign PATCH asserts only status >=300; the row-unchanged re-read the clause requires is pinned for a fixture object in packages/qa/dogfood/test/rls-fixture.dogfood.test.ts, not for showcase_private_note
   • access-security.security-catalog-activation-and-clone-doors a2: the audience-anchor 400 (everyone/guest) is asserted only in packages/runtime/src/domains/catalog-activation-door.test.ts (handler with fakes); the dogfood pin drives the 404 arm only
   • access-security.security-catalog-activation-and-clone-doors a3: dogfood clone pin drives 200 + dropped keys, 409 (another set's name), 404, bad-name 400, 403; anonymous 401, the source's own name 409 and the closed-body 400 are unit-only
   • access-security.security-catalog-one-holder-and-boot-report a1: packages/cloud-connection/src/marketplace-install-local-catalog-name-collision.test.ts (not in ref) asserts 422 PLUGIN_REGISTER_FAILED + nothing registered on POST /marketplace/install-local (in-process plugin, stubbed cloud fetch) — the ref's pins only reach manifest.register / boot refusal
   • access-security.security-catalog-one-holder-and-boot-report a2: permission-set-owner-registration.test.ts proves VALIDATION_ERROR/400 at registerApp, not on a permission-set save door; no HTTP pin for the save
   • access-security.security-catalog-one-holder-and-boot-report a3: CLI is run via MigrateSecurityCatalogOverlays.run in-process (oclif), not a spawned process — acceptable for the build oracle
   • access-security.security-catalog-one-holder-and-boot-report a4: catalog-reference-report.test.ts asserts the [security] error/info lines on a vi.fn logger; the ≤50-names cap is not visibly asserted
   • access-security.share-link-combined-gates a1/a2: packages/runtime/src/domains/share-links-refusal-order.test.ts asserts the anonymous no-password-oracle and email-audience identical-refusal rows but is not in the ref (in-process layer, would not score the api clause either)
   • access-security.share-link-combined-gates a3: ref names share-links-messages-audience.test.ts for acceptance[3]; its harness is in-process route entries (no Hono/HTTP), so it scores a0 only, not the api oracle
   • access-security.walled-environment-metadata-operator-only a2: single-posture leg is pinned as a manage_metadata holder below the operator (stronger than 'admin'); no case drives the seeded admin specifically on single
   • access-security.write-path-guards a4/a6: ref names owner-anchor-and-bulk-writes for bulk writes, but its bulk cases are engine-direct ql.update/ql.delete owner scoping — no createMany stamping, no per-row validation
   • access-security.write-path-guards a5: showcase-readonly-when-parent asserts single-row PATCH strips + header X-ObjectStack-Dropped-Fields; the mixed updateMany results[i].droppedFields leg and the line's product field are unpinned
   • access-security.write-path-guards a0: showcase-static-readonly asserts no droppedFields on the INSERT strip (verify names droppedFields)
   • access-security.write-path-guards n1: objectql pins use a recording/fake driver (real engine) and other objects, not showcase lead_score

   ai

   • ai.mcp-coded-refusals-and-runtime-exposure a1: packages/mcp/src/mcp-coded-refusal.test.ts ('<tool>: RECORD_NOT_FOUND from <member> answers code, message and status') asserts the clause at unit layer but is not in the ref
   • ai.mcp-coded-refusals-and-runtime-exposure a2: no pin drives query_records on an apiEnabled:false runtime object across a restart; plugin-runtime-object-metadata-copy asserts the metadata copy/listing only
   • ai.mcp-http-surface a3: the pin asserts status 401 only; the 'Unauthorized: a valid API key is required' wording and the OAuth WWW-Authenticate form are unasserted
   • ai.mcp-http-surface a4: the pin's tool-discovery case uses a session bearer token (not an API key), skips initialize, and checks two tool names, not the documented 12
   • ai.mcp-http-surface ref is bare (one file) while the item has six acceptance clauses: a0–a2 and a5 have no pin at any layer
   • ai.mcp-oauth-private-host-transport a0-a4: item is api/log-oracle throughout but the only pin (auth-manager.mcp-oauth.test.ts) is a unit test of isOAuthEligibleBaseUrl / AuthManager getters — no booted server, no log capture; it corroborates the rule but scores no clause
   • ai.mcp-oauth-private-host-transport a4: '… is reachable by no configuration key and no environment variable' (unit) covers the predicate half only
   • ai.mcp-stdio-fail-closed a0: the pin regex /OS_MCP_STDIO_API_KEY/ checks the var name only, not the remedy text nor 'the process does not serve'; scored from the verify's own oracle (plugin.start throws).
   • ai.mcp-stdio-fail-closed a1/a6/n4: no test in packages/mcp asserts the API_KEY_REVOKED arm ([Decision] API key 的生命周期与存放：到期上限与不活动失效取多长，key 继续放自有 sys_api_key 还是迁到 @better-auth/api-key（#23287 裁决 C′ 的留项） #23367) — grep for 'REVOKED' over packages/mcp tests finds none; ref is a single unit file for an item whose clauses are mostly live api/log.
   • ai.mcp-validate-expression a2: pin never runs the SAME expression under both sites (flow_condition case uses a different expression than the formula bare-field case)
   • ai.mcp-validate-expression a0/a1/a3: pin harness is a fake describeObject bridge, not the served MCP door the api oracle names
   • ai.skill-instructions-mcp-prompts a3: verify cites skill-prompts.test.ts as the pin, but it drives only an unknown name ('no_such_skill') through a stub bridge; a non-projected (inactive or instruction-less) name on prompts/get is not asserted
   • ai.skill-instructions-mcp-prompts n1: no pin asserts prompts/get refuses an inactive skill (only prompts/list omission is asserted)

   api-backend

   • api-backend.action-activation-door-contract a6: ref/verify says 'both owners named'; the ambiguity case asserts only messageOf(res) toContain('crm_account')
   • api-backend.action-activation-door-contract a5: ledger-reach asserts the key set via rows.find, never that exactly one row exists, and does not read the 200 body {name, objectName, enabled}
   • api-backend.action-activation-door-contract a2: ref claims 'unknown-key/non-boolean 400s' — pin asserts code VALIDATION_FAILED only, not fields[0] unknown_field/invalid_type or the non-object-body arm
   • api-backend.bulk-write-contract ref '(bulk halves)' overclaims: the pin's bulk cases call ql.update/ql.delete({multi:true}) on the engine with a resolved authz context; none of the createMany/updateMany/deleteMany HTTP doors the clauses name is driven, so no clause a0-a5/n0 is asserted
   • api-backend.bulk-write-contract a3: packages/rest/src/rest-batch-size-cap.test.ts pins BATCH_TOO_LARGE at the unit layer (mock protocol) and is not in this item's ref; it still would not score an api oracle
   • api-backend.data-request-shape-and-query-arity a1-a4: every pin invokes RestServer route handlers / HttpDispatcher.dispatch directly (real ObjectQL+SqlDriver for data-write-request-gate, data-delete-expected-version, data-conflict-caller-visibility; stubs for the arity files) — none boots the Hono adapter, so the api-oracle clauses stay a live leg
   • api-backend.data-request-shape-and-query-arity a1: the empty-version-token leg is in data-delete-expected-version.test.ts (DELETE), while the clause speaks of PATCH bodies + an empty version token — check the clause intends DELETE for the token
   • api-backend.declarative-endpoint-execution a1: no pin asserts the 401 body's code (UNAUTHENTICATED); showcase case checks success:false only, policy case status only
   • api-backend.declarative-endpoint-execution a2: spec gate (a) asserts the fix sentence but not that the message names the endpoint; the api 注册表条目声明 allowRuntimeCreate: true,但运行时创建的端点匹配器永远看不见 —— 声明的能力运行时不兑现(真实 boot 实测) #5488 runtime-authoring withdrawal is unasserted; the build oracle's os validate/os build run is not a pin
   • api-backend.error-sentences-and-unique-violation-wire-code a1: the verify names rest-hook-script-fault-envelope.test.ts for the 'live /data door' — that file imports mapDataError only, so the live leg is unit, not the door
   • api-backend.error-sentences-and-unique-violation-wire-code a2: dispatcher-unique-violation-wire-code.test.ts uses a real engine + SqlDriver behind HttpDispatcher; no Hono adapter, so the wire body is the dispatcher's result, not an HTTP answer
   • api-backend.meta-read-doors-v18 a4: no ref pin asserts the data-sort 403 on F (the 'two agree' half); showcase-fls-read-mask-strip.dogfood.test.ts has a sort-403 case but is not in this ref
   • api-backend.meta-read-doors-v18 a1-a3: precedent QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 carried these as pass from QA run · surface:api (116/130) · 580fd4ed · 2026-10-20 · 62 PASS / 54 PARTIAL / 0 FAIL / 0 BLOCKED / 14 NOT-RUN #24779; on this tree every ref pin drives route handlers with a stub server/response (no Hono adapter), so they score a0 only
   • api-backend.packaged-action-disabled-dispatch a0: dogfood asserts status 409 and text toMatch(/ACTION_DISABLED|is disabled/) — neither the exact code nor the describeDisabledAction sentence, and no task re-read for side effects; the exact sentence is unit-only (action-activation-dispatch.test.ts › the shared guard itself › answers 409 ACTION_DISABLED with the ENGINE's own sentence)
   • api-backend.packaged-action-disabled-dispatch a3/a6/n1: ref credits action-activation-dispatch.test.ts for the 403-not-an-oracle, flow-type and absence-means-active legs, but it is a unit HttpDispatcher over fakes — it stops above the HTTP layer the api oracle needs
   • api-backend.packaged-action-disabled-dispatch a5: ref correctly says the restart leg stays manual
   • api-backend.query-contract-matrix a4: engine.test.ts '[Security: $expand bypasses RLS/FLS on the referenced object (data leak on lookups) #2850] routes the expand sub-read through the middleware … tagged __expandRead' proves the sub-read is routed through middleware on a mock driver — not that a contributor's expand withholds the contact over HTTP; under rule 6 it cannot score a4 (round 4 QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 scored it pass)
   • api-backend.query-contract-matrix n0: request-schema-gate.conformance.test.ts drives RestServer with a mocked protocol — the ref says so itself
   • api-backend.query-contract-matrix whole item: Tier 1 in name only — no clause has a pin at its oracle's layer
   • api-backend.rest-batch-config-contract a5: rest-sub-config-parse-not-cast.test.ts §E › 'refuses batch.operations.upsertMany and batch.defaultAtomic' asserts the key and /never built/ resp. /options.atomic/; it does not assert that the messages name BatchEndpointsConfigSchema, nor the upsert replacement (an operation type of the generic batch door)
   • api-backend.rest-crud-config-contract a3: packages/rest/src/discovery-services-route-follows-mount.test.ts ('[finding] discovery contradicts itself under a non-default crud.dataPrefix: routes.data follows the key, services.data.route stays hard-coded at /api/v1/data #16674 — a moved crud.dataPrefix moves BOTH halves of the document') pins the discovery-advertisement half at a non-default prefix and is not in the ref; the moved-route-table half has no pin.
   • api-backend.rest-crud-config-contract a4: ref says §E pins acceptance[4]; the case asserts 'crud.patterns' + 'CrudEndpointsConfigSchema' + /was removed in @objectstack/spec 17/ only — the declarative-api-endpoint prescription is never matched, and the objectParamStyle refusal is checked for its key and /was removed/ only.
   • api-backend.rest-metadata-config-contract a1: ref says §D 'pins prefix … survival' — true, but no pin mounts at prefix '/metadata' or reads the discovery body's routes.metadata; the clause's move-together claim is unpinned
   • api-backend.rest-metadata-config-contract a5: §E's cacheTtl case asserts the key, MetadataEndpointsConfigSchema and /was removed/; the endpoints.schema case asserts the key and /does not exist/ only — neither asserts the replacement named in the verify
   • api-backend.rest-metadata-config-contract a3: only the normalizeConfig half is pinned; ref concedes the masking-effect half has no pin
   • api-backend.rest-route-generation-tombstones a0: §E › 'refuses every routes.* key' asserts routes.<key>, RouteGenerationConfigSchema and /was removed/ — not the clause's 'was removed in @objectstack/spec 17'; nameTransform driven with 'none' only (ref concedes)

   approvals

   • approvals.decision-only-via-service all clauses: the ref (kind 'test') is packages/services/service-automation/src/resume-authority-gate.test.ts, an AutomationEngine + InMemorySuspendedRunStore unit — every clause's oracle is the api (route status, run/actions reads); precedent QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 scored rev 1 PASS from it before the layer rule. Needs an HTTP pin (generic resume route + approvals API) to be Tier 1.
   • approvals.email-action-token-door a0: clause's live at-rest sys_notification read stays a run leg; FORBIDDEN arm is exercised with 'stranger' (not an approver at all) rather than a non-pending approver
   • approvals.email-action-token-door a1: pin asserts status pending + no decisions, not byte-identity of the actions timeline / token consumed_at
   • approvals.email-action-token-door a3: 'a decide that fails still burns it' (consume-first under a failing decide) is not asserted by any named pin
   • approvals.request-page-reply-and-reader-visibility a1: no pin asserts the approval_comment reply landing in the timeline, or the pending-approver/submitter-only restriction on replying
   • approvals.request-page-reply-and-reader-visibility a2: ref says request-read-gate covers acceptance[2]; it drives ObjectQL/protocol in-process, never /data/sys_approval_request over HTTP
   • approvals.status-mirror-field a2: the clause names the SLA auto-decision as a second user-less machine transition; the pin drives only the dead-run sweep (the verify asks only for the sweep)
   • approvals.status-mirror-field a0/a1/a3/a4: the ref is the only pin and covers a2/n2 alone; the api/log clauses have no automation

   attachments-storage

   • attachments-storage.attach-requires-parent-edit a2: the uploader legs of '(a) granted member: uploader may delete…' are an admin (who edits everything) and memberA on att_case (public_read_write, so memberA edits it); 'the uploader succeeds even without parent edit' is not driven
   • attachments-storage.attach-requires-parent-edit n1: none of the refused-attach cases ((b), (item 3), ([objectui/framework] enable.files: generic Attachments related-list (Salesforce Notes & Attachments parity) #2727)) re-reads sys_attachment for a row the refusal left
   • attachments-storage.chunked-upload-integrity a1: the clause names details.missingChunks [1] (chunk 1 not sent); the dogfood pin withholds chunk 0 and asserts [0] — same behaviour, the clause's literal does not match the pin's fixture.
   • attachments-storage.download-authz-both-sides a2: ref claims 'the uploader/entitled 200' covers clause 2; the owner case is the admin, who also owns/reads the parent, so the uploader-bypass-against-unreadable-parent leg and the 'url serves the bytes' leg are unasserted
   • attachments-storage.inline-grid-receipt-cells a2: the spec does not capture the /api/v1/storage/* upload requests; storage routing is inferred from the file door returning the uploaded bytes
   • attachments-storage.inline-grid-receipt-cells a3: the spec never reads the sys_file row (status 'committed', ref_object/ref_id/ref_field, acl 'private') nor asserts the batch response succeeded — only the request payload and GET /storage/files/:id
   • attachments-storage.inline-grid-receipt-cells n1: a data: URL would satisfy typeof==='string' && !contains('receipt.png'); the n1 guard rests on the follow-up storage GET answering 200 with the PNG bytes
   • attachments-storage.orphan-tombstone-reap a1: the dogfood sweep is lifecycle.sweep() called in-process after HTTP-driven setup (no door exists for it); the failed-byte-delete-leaves-the-row leg and its warn log are pinned only in attachment-lifecycle.test.ts with a fake engine.
   • attachments-storage.presigned-upload-roundtrip ref is bare: attachments-permission-matrix is a permission-matrix file whose uploadFile helper drives presign/PUT/complete but asserts only statuses; a0–a3's field, pending→committed, byte-equality and 302 halves are unpinned
   • attachments-storage.presigned-upload-roundtrip a4: the anonymous case asserts 401 + AUTH_REQUIRED but never counts sys_file rows around the attempt
   • attachments-storage.read-inherits-parent-rls a3: the probe half (D5 classes, warning text, probe-failure deny) is in-process/unit only; the item states it is unreachable from a run, so scoring it from those pins follows the item's own verify — note the warning's exact '[storage] attachment read visibility' text is asserted only at unit
   • attachments-storage.sys-file-status-pipeline a2: the live-holder half is scored, as the item directs, from tombstone-download-live-reference.test.ts, a unit test (mock HTTP server + fake engine); the live holder-less 404 FILE_NOT_FOUND and the post-re-attach /url 200 legs have no pin.
   • attachments-storage.sys-file-status-pipeline a1: tombstone-download-live-reference.test.ts 'leaves pending refused — only the tombstone limb widened' is a unit route test; the api-oracle 404 FILE_NOT_FOUND has no HTTP pin.
   • attachments-storage.upload-limits-scope-and-ownership a1–a3: storage-limits, upload-scope-vocabulary and upload-door-ownership call registered RouteHandlers with hand-built IHttpRequest/IHttpResponse — no HTTP adapter; a1's 'takes effect without restart' is at the plugin/kernel, not a served request
   • attachments-storage.upload-limits-scope-and-ownership a5: both hydrate pins are engine-level; no pin reads a copied file id over /data
   • attachments-storage.upload-session-abort a2/a3/n0/n1: packages/services/service-storage/src/attachment-lifecycle.test.ts › createUploadSessionReapGuard ('does NOT abort a completed session', 'reaps a session with no backend_upload_id without calling abort', 'VETOES on abort failure...', 'reaps the row when the adapter cannot abort at all') asserts these at unit layer but is not in the ref
   • attachments-storage.upload-session-abort a5: packages/services/service-storage/src/storage-routes.test.ts ('stamps expired and 410s a chunk PUT / a completion past the session deadline', 'does not expire a session still inside its deadline') asserts the 410 at route-handler unit layer, not in the ref (would not score the api oracle)
   • attachments-storage.upload-session-abort bare ref names only the dogfood matrix file; it scores a1 alone

   automation

   • automation.durable-suspend-restart a0/a1/a4: the pin drives its own fixture (flow_durable_suspend, a screen-node pause) — not the showcase showcase_task_follow_up timer or the showcase_project_closure → showcase_closure_signoff nested pair the steps name; the generic persistence/consumption assertions hold, the per-kind rows are not observed
   • automation.durable-suspend-restart a1: the pin's 'cold boot' is a second bootStack kernel over the same file inside one test process, not a separately spawned server process
   • automation.flow-authoring-refusals-v18 ref is accurate: it scopes the nine unit files to acceptance[0] only and says a1-a3 are manual; all nine files exist with ≥1 test
   • automation.flow-run-semantics-v18 a2/n0: the ref's two elevated-door pins (packages/runtime/src/{action,endpoint}-flow-elevated-door.test.ts) are unit door pins over a scripted automation service and never drive the trigger door the step names (POST /automation/:name/trigger); the wire pins that do — packages/verify/src/automation-trigger-elevated-door.test.ts (HTTP injection, 403 PERMISSION_DENIED, runs 0 by listRuns) and packages/qa/dogfood/test/flow-door-elevated-start.dogfood.test.ts — are not in the ref (the runtime file's own header names them as the wire half)
   • automation.flow-run-semantics-v18 a1: no pin in the ref reads back a field a record-triggered run stamped over HTTP; flow-cel-current-user.test.ts drives the engine only
   • automation.inbound-hook-timestamped-signature a2: no pin byte-compares the refusal arms' bodies against each other; rows assert code + typeof message only (member-vs-mount parity is per row, not across arms)
   • automation.paused-run-trigger-record-masked a0: the column parse is an engine (isSystem) read of sys_automation_run, plus an HTTP data-door read that checks only variables_json.record; 'null where unset' is not exercised
   • automation.paused-run-trigger-record-masked a3: the 'second process' is a second bootStack over the same SQLite file inside the same vitest process, not a spawned server
   • automation.paused-run-trigger-record-masked n0: every reader in the pin is the dev admin token; 'whichever persona reads it' is not driven across personas
   • automation.scheduled-work-opt-in a1/a2: both pins assert that flows are ARMED (or not) and the refusal sentence on a LiteKernel; neither observes a served boot log line or run rows after intervals
   • automation.screen-flow-roundtrip a4: the spec's final assertion is page.getByText(assignee) on the grid — exactly the 'not just the refreshed grid cell' the clause excludes
   • automation.screen-flow-roundtrip a0/a3: the spec never reads the run (status paused/completed); only request capture and UI toast
   • automation.setup-packaged-automation-board a0: the objectui ref→URL half names PackagedAutomationPage.navContribution.test.tsx (exists at the pin) in the clause's verify but not in automated.ref; it is component-layer and scores nothing either way.
   • automation.trigger-type-matrix n0: names packages/qa/dogfood/test/showcase-anonymous-deny-surfaces.dogfood.test.ts › 'anonymous POST /automation/:name/trigger is denied (401)' (exists, line 587) but the file is not in automated.ref, so a ref-driven run never executes it

   cli

   • cli.dev-automigrate-policy a4/n2: ref names cases 'auto-tightens at boot under autoMigrate: safe when the probe is clean' and 'BLOCKS the tightening on duplicate NULL-organization rows — old index kept, rows reported' in a describe 'bare-composite tightening + duplicate pre-flight (ADR-0120 D4)' — none exist in sql-driver-unique-tenancy.test.ts on this tree; the file now has 'bare composite from a pre-18 database — no tightening proposed (ADR-0131 D1)' asserting zero drift and 'duplicate NULL-organization rows are no longer a blocker — no op proposed, rows and index kept'. The clause text (D4 tighten, blocked report) is stale against ADR-0131 D1
   • cli.dev-automigrate-policy a4: a BLOCKED unique create_index is still pinned elsewhere (packages/drivers/driver-sql/src/sql-driver-25031-blocked-unique-apply-limit.test.ts), not in the ref — if a4 is rewritten around it, add it
   • cli.dev-automigrate-policy a2: the production case asserts the warning prefix only; the 'Run os migrate deliberately' remedy is unasserted (the ref says so)
   • cli.meta-package-flags-and-explain a1: verify names 'server log' as evidence; the pin observes the wire (?package= on the PUT) and the door's parsed request instead — equivalent, but no server log is read
   • cli.migrate-meta-write-stored-and-all a4: canonicalize-stored-flow.test.ts and refused-shapes.test.ts pin the TODO sink (canonicalizeStoredFlow todos / refused-shape onTodo); no file in the ref runs os migrate meta --stored and reads the printed TODO lines
   • cli.organization-ownership-ceremony a1: occupancy pin's plan run mocks boot; no pin compares a DB checksum before/after a bare plan run
   • cli.organization-ownership-ceremony a2: organization-ownership-apply.generation-1.test.ts › runs every step in order, certifies, and records this release's shape generation in the checkpoint calls apply() over a fake ledger — the CLI's --apply --plan-file --backup-taken exit 0 is not asserted
   • cli.organization-ownership-ceremony a3: organization-ownership-boot-guard.test.ts asserts assertOrganizationOwnershipMigrated's error code/message directly; the served-boot error line and the migrated boot's ready line need a live boot
   • cli.organization-ownership-ceremony a4: 'checksums before/after' approximated by columnsOf() still containing organization_id and applied: []
   • cli.scaffold-first-run ref .github/workflows/scaffold-e2e.yml exists but is a CI workflow, not a vitest/Playwright file: a Tier 1 pin run collects nothing for this item (scores via the workflow's own CI run only)

   i18n

   • i18n.flow-copy-translation-and-host-override a2: no file in the ref touches os i18n extract; the extraction of refusal, screen, option and toast keys is pinned in packages/cli/test/i18n-flow-{refusal,screen,toast-option}-coverage.test.ts (extractTranslations, the function the command runs — not the command's file write), none of them in the ref
   • i18n.flow-copy-translation-and-host-override a3: translation.test.ts › 'refuses a single-brace {token} in a translated title, through the one text-slot judge (i18n(flows): a translated screen title is not judged by the text-slot judge, so a single-brace {name} in a translated heading renders literally while the description and refusal message beside it are refused #22627)' pins the schema rule and its {{ name }} remedy; nothing in the ref runs os validate for the exit code
   • i18n.surface-matrix a5: ref is accurate that the two objectui component pins cover only the confirm half (plus successMessage→toast props); they render under a mocked ActionRunner/I18nProvider with no server round-trip, so the network-oracle clause stays the run's
   • i18n.surface-matrix a6/a7/a9: the i18n routes have HTTP coverage elsewhere (e.g. showcase-anonymous-deny-surfaces' I18N_FACES member 200 control) but nothing asserts the locale set, group vocabulary or zz-ZZ empty-map shape named here

   identity-auth

   • identity-auth.admin-lifecycle-operations a4: verify says the 'target's next PROTECTED request still 2xx' is pinned by admin-platform-admin-standing.dogfood.test.ts; that file asserts the 403 + code only, no protected request as the target
   • identity-auth.admin-lifecycle-operations a0/n1: C0 case asserts sys_user.banned/ban_reason and unban; no sign-in by the banned user is attempted, so the enforcement half is unpinned
   • identity-auth.admin-lifecycle-operations ref-parse: packages/plugins/plugin-auth/src/remove-user-atomicity.test.ts is named in the ref only as a contrast ('deliberately does NOT copy'), not as a pin; the parent's pins list includes it — it scores no clause
   • identity-auth.api-key-expiry-lifecycle a2: the dogfood case asserts 400 API_KEY_EXPIRY_TOO_LONG but not that the key count is unchanged; 'nothing is stored' is asserted only in packages/runtime/src/api-key-lifecycle.pin.test.ts over a fake objectql
   • identity-auth.api-key-expiry-lifecycle a3: the three 403 codes are pinned only at unit layer (rest-api-key-lifecycle.pin.test.ts over HTTP_STUB + fake ql; runtime dispatcher over a fake kernel); the dogfood file drives no revoked or expired key
   • identity-auth.auth-gate-held-session-raw-host-families a2: held-session-vendor-admin-doors arms PASSWORD_RESET_REQUIRED by a system write of must_change_password + auth.noteMustChangePasswordIssued() (simulating the forced-reset route), not by driving the admin's forced-reset door
   • identity-auth.auth-gate-held-session-raw-host-families a3: rest-api-key-account-posture.pin drives RestServer.enforceAuth with a hand-built req/res and a fake auth; http-dispatcher.api-key-account-posture drives HttpDispatcher with fakes — neither answers an HTTP x-api-key call
   • identity-auth.auth-gate-held-session-raw-host-families a1: 'raw-host families' are proven at mixed layers: storage, settings, share-link and cloud-connection pins call registered handlers with fake IHttpRequest/IHttpResponse
   • identity-auth.auth-method-matrix a3: verify names packages/plugins/plugin-auth/src/phone-otp-no-sms-service-refusal.test.ts as the pin — it exists but is not in automated.ref, and it drives AuthManager (unit), not the NODE_ENV=production boot's send-otp door.
   • identity-auth.auth-method-matrix a6: verify names packages/qa/dogfood/test/two-factor-lockout.dogfood.test.ts as the end-to-end pin for the 2FA gate — exists, not in automated.ref.
   • identity-auth.auth-method-matrix a9: verify names packages/plugins/plugin-auth/src/change-email-delete-user-wiring.test.ts ('auth-method-matrix: change-email and delete-user are booked as mounted in auth-route-ledger.ts but plugin-auth never configures better-auth's user.changeEmail / user.deleteUser — no switch to enable them #7735 — POST /delete-user stays unwired') — exists, not in automated.ref; AuthManager unit layer.
   • identity-auth.auth-method-matrix ref: a single OIDC pin (a7) for a 10-clause, 5-negative mixed item; kind 'e2e' over-implies coverage.
   • identity-auth.cookie-session-renewal-in-process a1: the runtime pin's DOORS are GET /data/:object, /auth/me/permissions and /i18n/locales — the clause's 'meta reads' leg has no door in it
   • identity-auth.implicit-account-linking-ownership a0-a3: the ref's 'end to end' cases drive the real better-auth handler (AuthManager.handleRequest) but over a hand-rolled in-memory data engine and with sys_account read off that fake, not an admin read through a booted server — they assert each clause's facts at the unit layer only
   • identity-auth.import-invitation-and-sso-domain-answers a1: the ref's admin-import-users-invite-link.test.ts asserts the auth.account_invitation template id on the import but never the 'self-requested reset still uses password_reset' half; packages/plugins/plugin-auth/src/admin-import-users-account-invitation.test.ts (cases ① and ②) asserts both and is not in the ref
   • identity-auth.import-invitation-and-sso-domain-answers a3: sso-domain-verification-unknown-provider.pin.test.ts mounts the real AuthPlugin on Hono but over createMemoryEngine (a hand-rolled engine fake), so it scores the doors at unit layer only
   • identity-auth.invitation-scope-gates a0: ref states its pending half is scored live — consistent
   • identity-auth.invitation-scope-gates n1: server-side denial of the forged request is pinned; the UI-hidden half is a5/a4 browser work

   integration-system

   • integration-system.connector-auth-kind-application a2: verify says 'pinned by connector-materialization.test.ts (fails boot loudly when credentialRef does not resolve)'; that case asserts /credentialRef 'MISSING' did not resolve/ only — not the connector, provider or the two remedies the clause requires, and it is an in-process kernel boot, not a boot log
   • integration-system.connector-auth-kind-application a3/n1: packages/spec/src/integration/connector-provider.test.ts ('rejects inline authentication secrets on a catalog descriptor / on a provider-bound instance (§3)') pins the [security] sys_metadata.metadata is a general cleartext sink: any authored artefact whose schema permits an inline credential lands it there (datasource config.password, connector authentication) #7990 half at schema level but is not in the ref; no pin found for the oauth2 discriminator refusal (spec/src/integration/connector.test.ts still parses oauth2 under AuthConfigSchema)
   • integration-system.connector-declarative-boot n1 says 'any of the four malformed-entry builds' while a3 lists three rejections — the counts disagree
   • integration-system.connector-declarative-boot ref's self-description matches the pin on this tree (two cases; halves only for a0–a2)
   • integration-system.connector-descriptor-audit a2: plugin.ts calls auditDeclaredConnectors on both the boot and the reload path; connector-descriptor-audit.test.ts drives only kernel:ready, so the reload half has no pin
   • integration-system.connector-descriptor-audit a1(c)/n1: no case in the ref feeds a provider-bound connector instance to findInertDeclaredConnectors or the kernel audit
   • integration-system.connector-stdio-default-deny ref is accurate: it scopes mcp-provider.test.ts to negative[0] at the provider unit and says a0-a2 are evidence-only, a3/n1 need the run
   • integration-system.datasource-admin-lifecycle a8: the ledger half names packages/services/service-datasource/src/datasource-route-ledger.conformance.test.ts as citable evidence, but it is not in automated.ref; the 404 half is pinned over a stubbed service only
   • integration-system.email-template-render a5: packages/qa/dogfood/test/email-template-overlay-survives-boot.dogfood.test.ts ('after a cold boot the metadata door and the rendered mail both carry the admin's wording') pins the redeploy-survival half and is not in the ref.
   • integration-system.email-template-render a3: packages/qa/dogfood/test/email-template-two-locales-survive-boot.dogfood.test.ts ('control: a locale nobody saved keeps the package ladder') touches the locale ladder and is not in the ref.
   • integration-system.email-template-render ref: one e2e pin for an 8-clause item; kind 'e2e' over-implies coverage (a1, a2, a4, a6, a7 unpinned).
   • integration-system.external-schema-drift-gate a4/a6: oracle is 'test' and the pins assert them, but each verify/evidence also asks for a live 'armed background drift check' log line — scored from the pin; the live line remains a boot leg
   • integration-system.external-schema-drift-gate n3: no pin asserts renderDiffMessage's text (datasource/object/per-column diff) — the fail-default case asserts rejects.toBeInstanceOf only
   • integration-system.external-schema-drift-gate n5: 'is a no-op when the external-datasource service is absent' asserts resolves undefined, not the absence of warn/error logs
   • integration-system.external-schema-introspection a3: remote-tables-twin.equivalence.test.ts only twins listRemoteTables; the object-draft ≡ external/tables/:remote/draft twin and the shared 400 EXTERNAL_DATASOURCE_ERROR refusal across spellings are not pinned (admin-routes covers the admin spelling's 400 only)
   • integration-system.external-schema-introspection a4: twin admission cases compare status+code across spellings but never assert the 403 message names manage_platform_settings
   • integration-system.external-schema-introspection n0/n2: admin-routes.test.ts drives a real HonoHttpServer with vi.fn services (route-level HTTP, not a booted stack)
   • integration-system.inbound-mailbox-association a2: scored at in-process — the clause's 'api' oracle is the stored rows, which the pin reads through the real engine after a real ingest; no HTTP read was made
   • integration-system.inbound-mailbox-association a1: inline-forward.test.ts pins the parser's participant extraction, not that an inline-forwarded message is ASSOCIATED with the original participants' records
   • integration-system.notification-org-and-redeliver-eligibility a1: notification-organization-follows-event.integration.test.ts proves organization_id on every row at the engine (ObjectQL+SqlDriver), but asserts nothing about the '[notify] no organization in scope' log line
   • integration-system.notification-org-and-redeliver-eligibility a2: the foreign mark-read is pinned only at unit level (messaging-service.test.ts › [security(service-messaging): a mark-read receipt takes the organization of whichever notification the caller names, with no check that the caller was its recipient #22026] markRead writes a read receipt only for a notification delivered to that user › ⛔ the non-recipient half…)
   • integration-system.notification-org-and-redeliver-eligibility a3: the redeliver pin drives the door through Request→Response (member handler + Hono canonical app) on a LiteKernel, not a full served stack

   platform-core

   • platform-core.activation-ledger-registration-home a4: packages/spec/src/system/constants/platform-object-names.test.ts ('registers exactly the objects each package declares') ties PLATFORM_OBJECTS_BY_PACKAGE to the declaring sources and would pin the one-owner membership, but is not in the ref
   • platform-core.activation-ledger-registration-home n2: platform-objects/src/plugin.test.ts asserts exactly one registering manifest; no pin drives a second registrant to observe the 'already owned by package' boot failure
   • platform-core.activation-ledger-row-contract n5/a4 (door half): packages/qa/dogfood/test/catalog-activation-door.dogfood.test.ts › 'a type with no switch is refused 400 by the door itself' and packages/runtime/src/domains/catalog-activation-door.test.ts (audience anchors 400, nothing written) exist and are not in this item's ref
   • platform-core.activation-ledger-row-contract a2: the dogfood key-set reading proves the physical table lacks organization_id but not the step-7 refused INSERT / control INSERT pair the verify names
   • platform-core.activation-ledger-row-contract a3: pins assert update-not-delete for the action (HTTP) and flow (store) kinds only; position/permission/sharing_rule re-enable rows are not covered here
   • platform-core.lifecycle-retention-sweep ref is accurate on scope (a2 pinned half, a3, n0-n1; a0/a1/a4 live; a5 a source read)
   • platform-core.lifecycle-retention-sweep a3: live sweep-line corroboration of the reaped count stays the run's
   • platform-core.lifecycle-retention-sweep n0: the unit proves the onlyWhen predicate reaches the reap filter/candidate read on a recording fake engine, not that real paused/running rows survive
   • platform-core.metadata-authoring-roundtrip ref is accurate: package-first-authoring.dogfood.test.ts and studio-object-designer.spec.ts are declared as scoring no clause; studio-record-page.spec.ts scores a2 only
   • platform-core.metadata-registry-serving a0: the pin never checks the registered kinds against DEFAULT_METADATA_TYPE_REGISTRY (step 2's presence table); it asserts only dashboard/action/report entries
   • platform-core.nav-surfaces-render a0/n0/n1/n3 score only if the parent can run pnpm -C examples/app-showcase test:smoke (Playwright + a live showcase with a console); otherwise not-run (browser)
   • platform-core.nav-surfaces-render a1: nothing in the ref computes the served-nav vs SURFACES diff — the 'coverage is current' clause has no automation
   • platform-core.serve-composition-v18 run note: serve-organization-record-page.e2e.test.ts is a *.e2e.test.ts file — it collects only under OS_TEST_TIERS=nightly; a run without it reports 0 tests for that file (a2 then not scored)
   • platform-core.v18-boot-refusals a3: scored from the pin by the clause's own fallback ('with no such boot run, this clause rests on authz-identity-objects-boot-refusal.test.ts — record which'); the run record must say the live steps[1] boot was not run.

   ---

   Generated by Claude Code
3. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   From #25815 (release-18.2.0-tier1, 156 items) — §2 checklist-accuracy findings, part 2/2 (areas: records-forms, search, studio-authoring). Each line is a ledger edit for the lane owning docs/qa/platform-checklist/**: revise the item, bump revision, append history citing #25815. Clause labels: aK = acceptance[K], nK = negative[K].

   records-forms

   • records-forms.action-param-widgets ref-parse: the parent's pins include objectui e2e/live/action-modal.spec.ts, which the ref names only as DROPPED ('cited here until revision 3 … so it was dropped') — a parser false positive; it scores nothing here.
   • records-forms.adhoc-filter-sort-builder a4: the pin reproduces the filter on page.reload() and checks the URL param + record-count-bar '2' only — it never captures the data request the clause's network oracle names, nor compares row identity.
   • records-forms.adhoc-filter-sort-builder ref-parse: the parent's pins include objectui e2e/live/saved-view-filter.spec.ts, which the ref names only as dropped ('cited here until revision 5 … so it was dropped') — parser false positive.
   • records-forms.bulk-select-all-matching a1/a4/n0: none of the three ref files exercises resolveBulkRows' paged fan-out or the HARD_CAP; the cross-page id resolution is unpinned even at component level
   • records-forms.bulk-select-all-matching a3/n2: bulkActionRefresh.test.tsx '[main 红：wildcard fall-through 守卫声明了一个已被删除的挂载（#4116 与 #4112 的竞态） #4140] bulk bar Clear resets both selection sources' asserts the behaviour in jsdom; the clause's dom/screenshot oracle needs the browser
   • records-forms.cascading-multilevel-and-clear a1: the spec POSTs {country:'us', province:'zj'} where the verify names {country:'cn', province:'ca'}, and asserts code invalid_option only — the verify's message key option_unavailable is not checked; the in-set answer is 201, not the verify's 200.
   • records-forms.cascading-multilevel-and-clear ref: rule-validator.option-visibility.test.ts is in the ref but by its own words scores no clause (validator layer) — the parent need not run it for this item.
   • records-forms.cascading-options a1/n0: the pin is an objectui Playwright live spec (needs a live stack + console at the objectui pin); it scores only if the parent runs it against a booted showcase.
   • records-forms.comment-reactions-and-edit-stamps a1/a2: sys-comment-reactions-door.integration.test.ts is named a 'door' test but boots ObjectKernel + ObjectQLPlugin over sqlite-wasm and maps errors with mapDataError — no HTTP adapter, so it cannot score the api clauses.
   • records-forms.concurrent-edit-conflict a3: the ref scores acceptance[3] from occSave.test.tsx › 'ObjectForm edit — OCC guarded save › 409 → "overwrite" retries re-keyed to the server currentVersion and completes the save', but that case runs over a mocked data source, so it pins the client re-key only — not the clause's api oracle (the retry answered 200 and a re-read shows one winner)
   • records-forms.concurrent-edit-conflict a1: occSave.test.tsx pins the modal Keep editing / Overwrite choice in jsdom; the dom oracle wants a rendered (screenshot-confirmed) dialog, and the inline ConcurrentUpdateDialog half has no pin
   • records-forms.concurrent-edit-conflict pins: the parent's pin list includes objectui e2e/live/inline-edit-polish-2572.spec.ts, which the ref names only to say it was DROPPED at revision 4 (no If-Match, no conflict, stale at the pin) — a ref-parse over-inclusion; it scores no clause
   • records-forms.conditional-rules-grid ref-parse over-inclusion: the parent's pins list carries objectui e2e/live/grid-file-upload.spec.ts, which the ref says was DROPPED at revision 8 and scores no clause — do not run it for this item
   • records-forms.conditional-rules-grid all objectui pins are Playwright e2e/live specs needing a live stack; they can only score in a browser run, and even green they score halves only
   • records-forms.conditional-rules-header a2: the ref claims field-conditional-rules.spec.ts pins 'acceptance[2]'s client lock … tax_rate's input giving way to the read-only field group at paid', but the spec asserts the OPPOSITE on the New dialog: at paid taxRate toBeEnabled() and the read-only group toHaveCount(0) (objectui#13436 — INSERT is exempt from readonlyWhen); no pin drives an edit form of a paid invoice
   • records-forms.conditional-rules-header pins: the parent's pin list includes objectui e2e/live/list-row-action-cel.spec.ts, which the ref names only to say it was DROPPED at revision 3 (it gates the task list's Mark Done, not the invoice's Edit/Delete) — a ref-parse over-inclusion; it scores no clause
   • records-forms.conditional-rules-header a0/a3: both pins are browser tests that read the DOM directly via Playwright locators (no screenshot step), which satisfies render-first only because Playwright waits for visibility
   • records-forms.delete-behavior-matrix a0–a4/n0–n3: every pin is engine-level (ObjectQL over a test driver); precedent QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 scored a0–a4, n0–n3 PASS from them before the layer rule — at the api oracle they score not-run until a REST pin exists.
   • records-forms.delete-behavior-matrix a5: packages/spec/src/data/field.test.ts ('deleteBehavior: set_null on master_detail is a parse-time rejection') pins the FieldSchema accepts deleteBehavior: 'set_null' on a master_detail, and the engine silently resolves it to cascade #9689 parse seam at schema level and is not in the ref; the verify's PUT refusal has no pin.
   • records-forms.encrypted-field-behavior a0: the dogfood pin scores the masked-GET half only; the 'secret:<handle>' column / sys_secret ciphertext leg is asserted only in packages/objectql/src/secret-fields.test.ts at the engine layer (the verify makes that leg conditional on DB inspection)
   • records-forms.field-history-tracking a2: objectui e2e/live/record-history-display.spec.ts (in the ref, claiming no clause) does open showcase_account's History tab, so it holds a2's flag-true half in a browser; the task-detail absence half has no pin
   • records-forms.field-type-constraints a5/a6: ref says engine-lookup-referential-integrity / engine-autonumber-runtime-owned pin these; both drive ObjectQL in-process, not the /data door the api oracle names
   • records-forms.field-type-constraints ref names field-zoo.matrix.ts — a data module, not a test file (correctly absent from pins)
   • records-forms.field-type-constraints a0-a4: the ref's 'round-trip & masking' pin asserts only accepted vectors; none of the refusal codes (max_length, min_value, max_value, invalid_number, invalid_option, invalid_type) is pinned at any layer by the ref
   • records-forms.field-type-matrix ref names field-zoo.matrix.ts (a vectors module, not a test file) — a ref parser must treat it as a fixture, not a pin; field-zoo-value-shape.test.ts (in pins) asserts no clause directly (write vectors parse under valueSchemaFor)
   • records-forms.field-type-matrix a5/n1: ref implies relational coverage incl. data: a lookup accepts an id that does not exist in the referenced object — including the RBAC permission-set link tables #4441, but field-zoo-roundtrip only seeds real ids; no dangling-id refusal is asserted
   • records-forms.field-type-matrix a4: f_autonumber is a 'present' check (non-null) — 'server-assigned' is inferred from it not being written
   • records-forms.field-unique-enforcement a4: clause text says bare unique 'NULL-organization rows fold to ONE bucket' (ADR-0120 D3); both pins now assert the opposite — 'a row with NO organization is exempt — ... the D3 bucket retired' (memory) and 'on a pre-18 nullable column, rows with no organization are NOT constrained (ADR-0131 D1)' (SQL). The clause needs re-authoring; it cannot score pass from these pins as written
   • records-forms.field-unique-enforcement a0-a3/n0-n2: ref correctly says no pin drives a REST door
   • records-forms.form-dirty-guard a0/n0: discardGuard.test.tsx covers the X close + Cancel + pristine paths for ModalForm/DrawerForm, but no Escape or backdrop-click case
   • records-forms.form-dirty-guard a2: the file holds 11 it() cases at the pin; the '14/14' cited from QA run QA run · surface:browser (65/65) · 36b2889c · 2026-10-12 · 50 PASS / 2 PARTIAL / 12 FAIL / 1 BLOCKED / 0 NOT-RUN #23163 will not match this tree's count
   • records-forms.gantt-interactions a1/a2: ref maps these clauses to component/unit cases (cases exist at pin b41ed7f), but the clauses' oracle is api (row-set diffs / server reads) — the pins stop at the component's update callback and cannot score them
   • records-forms.gantt-interactions ref names objectui commit 0abd4f9 for the per-clause mapping; the run pin is b41ed7f (the named cases are present there)
   • records-forms.import-job-undo-cancel a3: the ref says each spec covers acceptance[3] ('the job list read on undoable and revertedAt'); the specs read the list once before undo (filter undoable && !revertedAt) and confirm the revert only through the UI testid import-history-reverted-<id>, so 'revertedAt once a job is reverted' is never read off GET /import/jobs
   • records-forms.import-job-undo-cancel a1/n0: both specs count with an unfiltered GET /api/v1/data/<object> and read records.length — a page-bounded list length, not the clause's marker-filter count — and they self-skip (IMPORT_CONSOLE_LIVE / harness reachability) and default to crm_app/crm_lead, so a skip or a non-showcase target scores nothing
   • records-forms.import-wizard-encoding-and-hints pins are objectui files (repo objectui → /home/claude/ou-pin); they score a0–a2 only when the objectui pin worktree's vitest runs them
   • records-forms.list-view-capabilities a1: ref says saved-view-filter.spec.ts covers acceptance[1]; it asserts only that no showcase_task data response was >=400 and the count bar starts '2 ' — the AST filter param and the count-vs-response-total match are not captured
   • records-forms.list-view-capabilities showcase-search.dogfood.test.ts is in the ref but, as the ref itself says, scores no clause of this item
   • records-forms.master-detail-atomic-save pins list includes e2e/live/summary-rollup.spec.ts, but the ref states it was dropped at revision 5 and asserts no clause — a ref-parse over-capture (it names the file in prose)
   • records-forms.master-detail-atomic-save a0: master-detail.spec.ts pins carrier-neutrally on showcase_project_workspace with one child; the two-line invoice payload and 'not N sequential writes' (batch count) remain the run's
   • records-forms.object-hook-lifecycle a0: the pin drives POST /forms/contact-us/submit (anonymous, status 'closed' stripped), not POST /api/v1/data/showcase_inquiry omitting source/status as the verify names — the hook's 'web' stamp is engine-side so it scores, but the /data door itself is undriven
   • records-forms.object-hook-lifecycle a6/n0: hook-error-format.dogfood.test.ts proves a throwing beforeDelete (hef_ref_guard, default onError) leaves the row; no pin drives a throwing beforeInsert POST
   • records-forms.object-hook-lifecycle ref says the four objectql units ran '83 tests'; this tree has 79 it() cases across them (25+12+22+20) — count drift, not a missing file
   • records-forms.predicate-relationship-traversal a3 is scored from an engine pin by the item's own knownGaps (no restricted persona on stock showcase) — a deliberate layer exception, not a rule-6 pass for an HTTP oracle
   • records-forms.record-clone-contract ref says packages/rest/src/search-clone-route-schema-conformance.test.ts 'drives the live mount' — it calls the registered handler on RestServer(mockServer) with a mocked protocol whose cloneData returns a constant body; no HTTP adapter, no engine
   • records-forms.record-clone-contract a3: the verify names 'the Check whether sys_session.token — a live session credential — serializes over the data API (ADR-0100 channel 3 has no read protection) #7823 strip suite' but the ref names no such file; packages/metadata-protocol/src/protocol.write-response-internal-fields.tripwire.test.ts (enumerates cloneData) exists and is not in the ref
   • records-forms.record-clone-contract ref spells files as 'packages/metadata-protocol — search-clone-schema-conformance.test.ts' (package + em dash + basename, no src/ path) — a strict path parser would miss both; the parent resolved them
   • records-forms.record-discussion-mentions a5: comments-permission-matrix '(f) enable.feeds:false still answers FEEDS_DISABLED' asserts 403 + code on its cmt_nofeeds fixture; it does not read the thread's zero rows after the refusal
   • records-forms.record-discussion-mentions a6/n3: capability-gate-update-verb.test.ts is engine-level (ObjectQL + installAuditWriters), as the clause itself says
   • records-forms.record-discussion-mentions a8: the clause names objectui recordActivityFeed.test.ts as a fallback oracle, but it is not in automated.ref (objectui), so a ref-driven run never executes it
   • records-forms.record-discussion-mentions a9: mention-recipient-gate.integration.test.ts is engine-level; the ref itself says partial at most
   • records-forms.record-edit-undo UndoManager.test.ts tests only the in-memory undo/redo stack; it scores no clause of this item (none of the clauses is a stack-semantics clause) — the ref should say so explicitly
   • records-forms.view-type-gallery a5: the pin is a Playwright spec (pnpm -C examples/app-showcase test:smoke) that needs a built console and a live stack — it scores only if the parent actually runs it; a vitest-only pin run leaves a5 not-run.
   • records-forms.write-answer-advisories-rollback-and-tree-delete a1: advisory-write-answer.test.ts calls ObjectStackProtocolImplementation createData/updateData in-process — the REST PATCH body is not observed
   • records-forms.write-answer-advisories-rollback-and-tree-delete a2/n0: engine-after-hook-abort-unit.test.ts drives ObjectQL directly; no HTTP pin for the aborting afterInsert
   • records-forms.write-answer-advisories-rollback-and-tree-delete a3: scored on the referenceless tree fixture (rtl_*), not a showcase object — acceptable since the clause names no carrier

   search

   • search.cross-field-object-search a1: the pin proves the name-hit control only as 'some returned name contains retail' (names.some(...includes('retail'))), not by naming Acme Retail; it satisfies the verify's 'a name-containing-retail account'
   • search.field-scoped-narrowing a1/n0/n1: the bare ref claims the item; the pin has no $searchFields refusal case. packages/rest/src/rest-server-closed-query-params.test.ts and list-view-grouping-query-door.test.ts mention INVALID_FIELD + searchFields (route-handler level) and are not in the ref
   • search.field-scoped-narrowing a3: pin drives only POST /data/showcase_account/query with bare search/searchFields; the GET $search spelling is unpinned
   • search.global-search-skips-unreadable a0–a2: the dogfood pin runs on its own skipsearch_open / skipsearch_walled fixtures, not the showcase objects (W, showcase_invoice) the steps name; a0's unscoped case does not assert totalObjects (the mixed case does)

   studio-authoring

   • studio-authoring.expression-editors a0-a6: every pin in the ref is a jsdom component/unit test; it holds evidence for the editor's lint, inference, completion and test-run logic but scores none of the screenshot/dom/api clauses
   • studio-authoring.meta-save-preconditions-and-draft-rows a1-a3: every pin stops above HTTP (RestServer with createMockServer, HttpDispatcher.dispatch called directly, objectql repository/protocol units) — the api-oracle clauses stay the run's live leg
   • studio-authoring.metadata-diagnostics-sweep a3/n0: the ref says the pin covers the outage clause ONLY, but its '[[finding] getMetaDiagnostics scannedTypes still overstates the swept set when a type is benignly skipped — no payload field lets a caller detect partial coverage #8924] a caller error the producer classified is refused loudly' describe asserts the ?type= misspelling refusal at the protocol layer — unclaimed protocol-layer evidence; the api-oracle clauses still need the REST door.
   • studio-authoring.object-designer-roundtrip a3: F4 seeds one real option, not the three the clause judges with, and never publishes — the ref says so; the banner half is pinned under a different fixture than the clause states.
   • studio-authoring.org-override-registry-gate all clauses are api-oracle but the only pin (overlay-precedence.test.ts) is a unit test of the overlay whitelist (describe 'overlay whitelist enforcement (shared-DB invariant)'), stopping above the HTTP door; it corroborates a0/a2/a3/n0 and scores none; no pin touches a4's DELETE reset
   • studio-authoring.permission-matrix-editor-ux fieldBulk.test.tsx asserts filter narrowing, the '2 / 8' counter and bulk scope as jsdom checkbox states — evidence for a0/a1 at the component layer, but never the SAVED fields map that a2/a3/n0 make the authority
   • studio-authoring.permission-matrix-editor-ux a5: readonly.test.tsx covers the package and type gates and a capability gate; the artifact gate ('provided by a code package') sits in PermissionMatrixEditor.artifactTier.test.tsx, not in the ref
   • studio-authoring.record-page-roundtrip ref cites console pin cf153eb for the reading; the run's objectui pin is b41ed7f (both specs present and asserting as described)
   • studio-authoring.save-door-runs-authoring-rules a1-a3/n0: none of the eight pins boots HTTP (metadata-protocol saveMetaItem, objectql, spec, lint units and a RestServer unit) — the api clauses stay the run's

   ---

   Generated by Claude Code
4. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   From #25815 (release-18.2.0-tier1) — §3 fixture gaps, partial coverage and not-run handover.

   • Result: 156 items, 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN; 1178 clauses, 315 pass · 0 fail. No pin red (framework 374 files, 10,009 passed; objectui 29 unit files, 378 passed; objectui e2e/live 31/31; showcase Playwright 53/53; verify --rls 0 FAILED · 0 HOLES). Nothing for §5.
   • Partial coverage, parked here: one Parked-on: #25807 line per PARTIAL / NOT-RUN / BLOCKED item in QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815's close-out comment (150 lines; clause-level reasons in its three detail comments). Of the 861 unscored clauses, 254 are layer-limited (a pin asserts them below the oracle's layer — RUNNER rule 6), 132 half-asserted, 50 procedural, the rest unpinned.
   • Not-run handover (25) — each needs a live run, or a pin at the oracle's layer: access-security.me-permissions-aggregation-parity, access-security.record-access-explain, access-security.share-link-landing-page, ai.mcp-oauth-private-host-transport, ai.mcp-validate-expression, api-backend.bulk-write-contract, api-backend.query-contract-matrix, approvals.decision-only-via-service, automation.setup-packaged-automation-board, cli.scaffold-first-run, i18n.surface-matrix, integration-system.connector-descriptor-audit, platform-core.url-overlay-contract, records-forms.bulk-select-all-matching, records-forms.concurrent-edit-conflict, records-forms.conditional-rules-grid, records-forms.delete-behavior-matrix, records-forms.field-type-constraints, records-forms.gantt-interactions, records-forms.import-job-undo-cancel, records-forms.list-view-capabilities, records-forms.record-clone-contract, records-forms.record-discussion-mentions, studio-authoring.org-override-registry-gate, studio-authoring.permission-matrix-editor-ux.
   • New fixture gap: records-forms.import-job-undo-cancel — e2e/import-console/import-console-undo.spec.ts needs IMPORT_CONSOLE_LIVE=1 and an app-crm boot (crm_app/crm_lead); its twin e2e/import-harness/import-undo.spec.ts needs the plugin-grid demo harness on :5200 over app-crm on :3002. Neither runs on the stock showcase.
   • cli.scaffold-first-run: its only evidence is the nightly scaffold-e2e.yml, last green at 4cc17db3c0 (run 40158961882), not this subject.
   • BLOCKED, unchanged: access-security.no-active-org-session-semantics (QA run · priority:P0 · e4e5c6e3 · 2026-08-17 · 7 PASS / 7 PARTIAL / 2 FAIL / 2 BLOCKED #9334), records-forms.record-edit-undo (no packaged undoable update action).

   ---

   Generated by Claude Code
5. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   Last edited by objectstack-fleet

   ContributorAuthor

   More actions

   T3 manual set recorded: #25817 (release-18.2.0-manual-set, 29/29 at 6679644a, pin b41ed7f68956: 25 PASS / 4 PARTIAL / 0 FAIL).

   Parked here (fixture gaps):

   • approvals.decision-action-matrix A9: there is no org-less request on stock. Both remaining candidates are refuted: a schedule-triggered approval, and an api-hook on an object with no organization column.
   • automation.trigger-status-contract A4: the 503 STORE_UNAVAILABLE arm.
   • automation.packaged-flow-subflow-disable-refusal N1: a second packaged caller needs a package-loader-installed package. A ?package=-authored flow counts as deployment-authored.
   • records-forms.action-location-matrix knownGaps[2]: A3 fail-closed and A4 (a).

   Checklist-accuracy findings: All of them are listed in #25817 under "Checklist-accuracy findings and fixture gaps". They include one RUNNER.md environment-fact correction: on os dev at 6679644a, the connector meta read shows the compiled baseUrl (3000) while live dispatch follows OS_PORT, so the prescribed Check misreports the fixture.

   Coverage gap: no ledger item asserts #25626's walled Create User join or 400 NO_ACTIVE_ORGANIZATION. This is pending confirmation by the addendum record on 17f8217b.

   Extracted product defects: #25818, #25819, #25820, #25821, #25822.

   Superseded: #25479. Its 7 un-rerun verdicts are carried forward on #25817.
6. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   T3 addendum: #25823 (identity-auth.admin-lifecycle-operations 1/1 PASS at 17f8217b, after #25626). Parked here:

   • Coverage gap. No item asserts feat(plugin-auth): multi-org Create User joins the administrator's current organization #25626's walled Create User join. The missing clauses are:

     • joins the caller's active organization as member, and a body organizationId chooses nothing;
     • 400 NO_ACTIVE_ORGANIZATION with no row;
     • invite-only still joins.

     The candidate pin is packages/qa/dogfood/test/create-user-organization-join.dogfood.test.ts.

   • Stale after feat(plugin-auth): multi-org Create User joins the administrator's current organization #25626:

     • access-security.no-active-org-session-semantics rev 8, its member-less operator create-user producer;
     • identity-auth.workspace-org-switch rev 5, personas[2];
     • RUNNER.md "Walled personas come from the admin door".

     Each recipe now needs the operator to create and set-active an organization first.

   • identity-auth.admin-lifecycle-operations's automated.ref overclaims. The A0 sign-ins, the A4 live-session half, the A6 stop half and the A9 state read-back beyond two routes are unpinned.
7. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   Triage: state — pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-25T16:00Z

   ⛔ Not a claim, ⛔ not a dispatch.

   • Grade stands as filed (p1 · domain:devx · target:v18). This is the 18.2.0 wave anchor: the checklist-accuracy ledger edits from QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815 and QA run · release-18.2.0-manual-set (29/29) · 6679644a · 2026-10-25 · 25 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #25817 close out here, in the lane owning docs/qa/platform-checklist/**.

   ---

   Generated by Claude Code
8. objectstack-fleet

   added

   pm:queue

   on Oct 25, 2026
9. objectstack-fleet commented on Oct 25, 2026

   

   objectstack-fleetBot

   on Oct 25, 2026

   ContributorAuthor

   More actions

   Checklist-accuracy findings carded — maintainer-directed (project thread, 2026-10-25 22:55Z, verbatim: 「写issue，不派发」). ⛔ Not dispatched; ⛔ not a claim.

   The accuracy findings parked on this anchor from #25812, #25815, #25817 and #25823 are now one card per ledger file, each listing its lines verbatim with the record they come from. They carry documentation · priority:p2 · domain:devx · area:devpath and no target:v18 (not release blockers). This anchor's §2 and the part 1/2 + 2/2 comments stay as the evidence; close-out of each line happens on its card.

   card	ledger file	lines
   #25835	access-security	65
   #25836	ai	14
   #25837	api-backend	28
   #25838	approvals	19
   #25839	attachments-storage	18
   #25840	automation	24
   #25841	cli	12
   #25842	i18n	9
   #25843	identity-auth	23
   #25844	integration-system	26
   #25845	platform-core	19
   #25846	records-forms	60
   #25847	search	6
   #25848	studio-authoring	9
   #25849	ux-conventions	5
   #25850	RUNNER.md	3

   Not carded here (still parked on this anchor): the fixture gaps and PARTIAL coverage in §3, the 25 not-run items, and the #25626 coverage gap's fixture side (its missing clauses are on the identity-auth card).

   ---

   Generated by Claude Code
10. objectstack-fleet commented on Oct 25, 2026

    

    objectstack-fleetBot

    on Oct 25, 2026

    ContributorAuthor

    More actions

    Triage: the 16 ledger-edit cards are pm:on-hold · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-25T23:56Z

    ⛔ Not a claim, ⛔ not a dispatch.

    • Cards: qa(checklist): access-security — 65 ledger edits from the 18.2.0 release sweep (#25807) #25835, qa(checklist): ai — 14 ledger edits from the 18.2.0 release sweep (#25807) #25836, qa(checklist): api-backend — 28 ledger edits from the 18.2.0 release sweep (#25807) #25837, qa(checklist): approvals — 19 ledger edits from the 18.2.0 release sweep (#25807) #25838, qa(checklist): attachments-storage — 18 ledger edits from the 18.2.0 release sweep (#25807) #25839, qa(checklist): automation — 24 ledger edits from the 18.2.0 release sweep (#25807) #25840, qa(checklist): cli — 12 ledger edits from the 18.2.0 release sweep (#25807) #25841, qa(checklist): i18n — 9 ledger edits from the 18.2.0 release sweep (#25807) #25842, qa(checklist): identity-auth — 23 ledger edits from the 18.2.0 release sweep (#25807) #25843, qa(checklist): integration-system — 26 ledger edits from the 18.2.0 release sweep (#25807) #25844, qa(checklist): platform-core — 19 ledger edits from the 18.2.0 release sweep (#25807) #25845, qa(checklist): records-forms — 60 ledger edits from the 18.2.0 release sweep (#25807) #25846, qa(checklist): search — 6 ledger edits from the 18.2.0 release sweep (#25807) #25847, qa(checklist): studio-authoring — 9 ledger edits from the 18.2.0 release sweep (#25807) #25848, qa(checklist): ux-conventions — 5 ledger edits from the 18.2.0 release sweep (#25807) #25849, qa(checklist): RUNNER.md — 3 stale environment facts from the 18.2.0 release sweep (#25807) #25850. Each keeps its grade as filed (documentation · p2 · domain:devx · area:devpath).
    • On hold, not queued: the maintainer's words on filing were 「写issue，不派发」 (file the issues, do not dispatch). pm:queue would let any PM loop pick them up, so they wait for the maintainer's go. This comment is the hold record for all 16.

    Restart-when: the maintainer says to dispatch the 18.2.0 ledger-edit cards, on this card, on any of them, or in the project thread.

    ---

    Generated by Claude Code
11. objectstack-fleet commented on Oct 26, 2026

    

    objectstack-fleetBot

    on Oct 26, 2026

    ContributorAuthor

    More actions

    Released: the 16 ledger-edit cards → pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-26T10:41Z

    ⛔ Not a claim, ⛔ not a dispatch.

    • The maintainer's word, in the triage thread on 2026-10-26: 「16 张清单卡：应该可以回归队列吧」. This meets the Restart-when on the hold record above.
    • qa(checklist): access-security — 65 ledger edits from the 18.2.0 release sweep (#25807) #25835–qa(checklist): RUNNER.md — 3 stale environment facts from the 18.2.0 release sweep (#25807) #25850 go from pm:on-hold to pm:queue. Grades are unchanged (documentation · p2 · domain:devx · area:devpath). The domain:devx lane picks them up by its usual round. Each card's done-when stays a ledger edit: revise the item, bump revision, append history citing QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815 / QA run · release-18.2.0-manual-set (29/29) · 6679644a · 2026-10-25 · 25 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #25817, and keep pnpm check:platform-checklist green.
    • Paths under ui/ moved with the merge, so a checklist item that cites an objectui path is re-read against ui/ in the same edit.

    ---

    Generated by Claude Code