[sweep] v18.3.0 release test sweep

domain:devx#1 · sunhaolin · session_017xRBcVy4VXmkQjn2MGeaWk

Filing gate: ③ a maintainer-directed task. The maintainer asked in this session on 2026-10-29, verbatim: 「跟进平台的 checklist ，和我沟通建议运行哪些测试，可以开云卡片」. On the proposed scope they chose 「完整发版前一轮」, a full release-candidate round, and added 「你应该使用 pm-dispatch 技能处理 issue」.
Business reason: the next release ships through the Version Packages PR #26517. Its pending changesets are 300 in all: 164 minor, 0 major and 63 with Clause-②: yes. With the fixed group that makes 18.3.0. The checklist runs are the release's evidence that the standing smoke and the 18.x capabilities still hold at the release head, before the release merges.
Reader: the lane that owns docs/qa/platform-checklist/** (domain:devx). Each checklist-accuracy line parked here is a ledger edit for that lane. The release decision reads the wave table in §0.
Dedupe (open AND closed): the query "[sweep] v18.3.0 release test sweep anchor" returned 15 hits and none of them is an 18.3 anchor. The nearest is #25807, the 18.2.0 anchor, which is still open for its parked partials.

This card is the wave anchor for the 18.3.0 release-candidate sweep, called wave 3. RUNNER's extraction obligation (docs/qa/platform-checklist/RUNNER.md) applies:

checklist-accuracy findings, fixture gaps, partial coverage gaps and not-run handovers close out here;
product defects are extracted as their own cards and listed in §5;
run records are qa-run issues that hang off this card by number.

Why a full round, not a delta

514 commits on main since wave 2's subject 756220c4.
162 runnable items changed revision, and 23 new Studio items landed through qa(checklist): studio-authoring accuracy fixes + 23 items from the Studio QA run #26848.
254 runnable items cite a source file that changed.
20 QA-extracted fix cards closed after wave 2's subject, which is SKILL §5 trigger 2. Their retest list is §4 below. The 18.2.0 anchor's own §4 was never filled in.

A delta-only rerun saves little, so this is a release-candidate rerun (SKILL §5 trigger 1).

Subject: framework main @ c4c515ad3cc342043a2b81b5a06a5793f79a23e8 (2026-10-29T03:33Z). The Console is built in-repo from that same commit (pnpm console:build). Every card pins this sha, and none follows the Version PR as it regenerates.

0. The wave at a glance

card	selector / set	items	surface	record
W3-C1	`priority:P0`	23	browser-heavy	pending
W3-C2a	Tier 1 (`automated.ref` items): access-security · ai · api-backend · approvals · attachments-storage · automation · cli	73	per-area vitest batches	pending
W3-C2b	Tier 1: dashboards · i18n · identity-auth · integration-system · platform-core · records-forms · search · studio-authoring · ux-conventions	89	per-area vitest + showcase / ui Playwright	pending
W3-C3a	manual set, `api` · `cli` · `build` surface	25	live REST / CLI	pending
W3-C3b	manual set, `browser` · `mixed` surface	55	live browser	pending

The manual set follows the rule wave 2 used (#25817 / #26476 / #26456): the unpinned since:v18.x items, plus the unpinned P0/P1 items whose source[] cites a file changed by a commit carrying a Clause-②: yes changeset, plus the §4 retest items. Each card's dispatch lists its ids, 80 in all.

Not in this wave:

the unpinned P2 items outside those rules (Tier 3);
the post-publish npm smoke, which runs after 18.3.0 is published, against the registry.

Backend: one mode:cloud session per card, through create_session with source_url. The model tier is default (dispatch-gates --tier gives no path mandate). A QA run is not a lane card, so there is no lane claim (maintainer ruling recorded on #25807). Each card:

files one qa-run record per selector under this anchor;
extracts its product defects as their own cards;
parks accuracy findings and gaps here.

1. Re-point — red rows this anchor owns

None yet.

2. Checklist-accuracy findings

None yet.

3. Fixture gaps, partial coverage and not-run handover

None yet.

4. Retest list (SKILL §5 trigger 2)

Each fix below landed after wave 2's subject. The item named is the one its defect came from.

item	card(s) fixed	wave-3 card
approvals.record-page-decisions	#25934 (#26361, #26402) — wave-2 FAIL carried on #26456	W3-C3b
i18n.surface-matrix	#26452	W3-C3b
ux-conventions.write-feedback	#26459, #26461	W3-C3b
studio-authoring.expression-editors	#26707	W3-C3b
studio-authoring.draft-publish-lifecycle	#26462	W3-C3b
i18n.strict-translation-key-rejection	#26463	W3-C3b
platform-core.settings-hub-roundtrip	#26465	W3-C3b
automation.setup-packaged-automation-board	#26474	W3-C3b
records-forms.record-discussion-mentions	#26453 (detail withheld)	W3-C3b
records-forms.field-group-visible-when	#26646	W3-C3b
access-security.record-access-explain	#26641	W3-C3b
identity-auth.self-service-profile-password	— the PASS was carried from 18.1.0 (#25479) and never re-judged	W3-C3b
approvals.decision-only-via-service	#26477	W3-C3a
cli.hook-body-extraction-gates	#26478	W3-C3a
attachments-storage.field-accept-maxsize-server-enforced	#26479	W3-C3a
platform-core.manifest-install-contract	#26480	W3-C3a
api-backend.query-contract-matrix	#26644	W3-C1 (P0)

The npm-smoke fixes #26630, #26631 and #26632, and the off-item fixes #26640 and #26642, are re-judged by the post-publish smoke.

5. Extracted elsewhere (not repeated here)

None yet.

Generated by Claude Code

domain:devx#1 · sunhaolin · session_017xRBcVy4VXmkQjn2MGeaWk

Wave 3 dispatched · 2026-10-29T04:25Z

Six cloud runner sessions, all pinned to c4c515ad. They are dispatched directly: a QA run is not a lane card.

card	session	scope
W3-C1	`session_017xRBcV2ijbfB8Drvs2oik6`	`priority:P0`, 23 items
W3-C2a	`session_017xRBcScm27Q3R5mkYLPWdB`	Tier 1 half A, 73 items
W3-C2b	`session_017xRBcSwDXZrZg7nGjP6P3U`	Tier 1 half B, 89 items
W3-C3a	`session_017xRBcTp5wXse9Zwgq8aFWV`	manual set (api, cli, build), 25 items
W3-C3b	`session_017xRBcVkGJizGH7raJHhAvL`	manual set (browser, mixed), 55 items
W3-UX	`session_017xRBcUoS2G4jgqRskpExS7`	UI/UX browser walkthrough with admin and member personas, at desktop and phone widths, across Console, Setup and Studio. This is not a checklist run, so it files defect cards and at most two suggestion cards in the #27355 / #27356 shape.

The maintainer asked for W3-UX in the dispatching session, choosing verbatim 「加一张走查云卡」 when asked whether judging UI and UX in the browser was in scope. With it the wave has six concurrent slots, one over the default ceiling of five, and that sixth slot is the maintainer naming it.

Maintainer rulings recorded in the dispatching session (2026-10-29, verbatim):

「你应该使用 pm-dispatch 技能处理 issue」: every GitHub write of this wave goes through the scripts/pm/ doors.
「对于测试中遇到的安全问题，不适合提交issue 的，只是使用pm-dispatch技能派发」: an authentication or authorization finding gets no GitHub issue, not even a withheld-detail card. Its reproduction appears nowhere on GitHub. The runner dispatches the fix at once through pm-dispatch: an os-dev subagent, with the reproduction only in its dispatch prompt. The record row reads only security finding — detail withheld, fix dispatched.
「这些都应该写到 checklist skills 中」: both rulings above are to be written into .claude/skills/checklist-test/SKILL.md and its twin, RUNNER.md rule 2. That edit is dispatched separately and is not part of the runs.

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: 什么算做好 | none | none

Triage: p1 · `domain:devx` · wave anchor for 18.3.0 · 2026-10-29T04:54Z

⛔ Not a claim.

Read fresh. The 18.3.0 release-candidate wave anchor (maintainer: 「完整发版前一轮」). Six runner sessions are pinned to c4c515ad. Its labels follow the 18.2.0 anchor [sweep] v18.2.0 release test sweep #25807.
p1 (「发版本优先的都p1」). ⚠️ The release itself is Version Packages chore: version packages #26517, which triage never touches (PD 15). This anchor is evidence for that decision, and the maintainer reads §0.
documentation, priority:p1, domain:devx, area:devpath, pm:queue.

Generated by Claude Code

domain:devx#1 · sunhaolin · session_017xRBcVy4VXmkQjn2MGeaWk

Runner effort, recorded · 2026-10-29T04:54Z

The six wave-3 cards were dispatched with no effort stated. create_session takes no effort parameter, so each card inherits the dispatching session's effort (dispatch-runbook, trigger-flow line ②).

At about 30 minutes, the spend read from get_session usage.cost_usd was:

W3-C1: $33.04
W3-C3b: $14.98

The maintainer asked in the dispatching session, verbatim: 「你派的任务都需要 extra 吗」. The seat answered: not all of them. A run card needs high, and xhigh is for a security fix dispatch and for adversarial review. The maintainer replied: 「立卡更新 skills」. The card is #27390.

The running cards are left as they are. Restarting them would throw away their environment setup.

Generated by Claude Code

domain:devx#1 · sunhaolin · session_017xRBcTp5wXse9Zwgq8aFWV

W3-C3a recorded: #27392 (release-18.3.0-w3-manual-api, 25/25 judged at c4c515a · 23 PASS / 2 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN)

Pins: every item's revision was pinned from checklist-select.mjs at c4c515a. All 25 were runnable and none is planned. Every clause was driven live (REST, CLI, MCP or a build) on a fresh showcase boot per item. No automated.ref pin scored a clause. Two pins were run only as supporting evidence, and their layer is named in the record.

Extracted product defects (§5): all four are off-clause probe findings, each reproduced twice.

metadata-protocol: when one seed in a publish-drafts batch fails, the seedApplied receipt reports inserted 0 / updated 0 although earlier seeds wrote rows, and later seeds are published but never applied #27393: a failing seed in a publish batch makes seedApplied report 0/0 although rows were written, and later seeds are never applied.
install-local: uninstalling a package (DELETE /api/v1/marketplace/install-local/ID) leaves its flows registered and triggerable in the automation engine until an unrelated metadata reload #27395: an install-local uninstall leaves the package's flows live and triggerable in the automation engine.
approvals: a user approver naming a nonexistent user id opens a request on a phantom slot with no warning and no onEmptyApprovers fork, so the request is stuck pending forever #27397: a user approver naming a nonexistent id opens a stuck request, with no warning and no onEmptyApprovers fork.
service-storage: sys_file lifecycle columns (status, size, mime_type) are writable through the data door, so a never-uploaded file can be marked committed and then claimed by a file field #27399: the sys_file lifecycle columns are writable on the data door, so a never-uploaded file can be marked committed and claimed.

Retest list (§4):

approvals.decision-only-via-service, fix approvals: approving a request whose flow was deleted while paused answers 500 RESUME_FAILED after recording the decision, and the run is stranded #26477: holds. It answers 409 RESUME_TARGET_LOST, nothing is recorded, and the request stays pending and recallable. The item was carried NOT-RUN from QA run · release-18.2.0-tier1 (131/156) · 6679644a · 2026-10-25 · 6 PASS / 123 PARTIAL / 0 FAIL / 2 BLOCKED / 25 NOT-RUN #25815 and is now PASS.
cli.hook-body-extraction-gates, fix cli build: the legacy runtime bundle hash changes on every identical rebuild, because the temp entry path (pid + Date.now()) is embedded in the bundle and its inline sourcemap #26478: holds. Four builds from different cwds and checkout paths give an identical runtime-bundle hash, with no absolute path in the bundle.
attachments-storage.field-accept-maxsize-server-enforced, fix storage: a file field accepts a presigned upload that was never completed (sys_file status pending) and claims it #26479: holds. A never-completed upload is refused with 400 VALIDATION_FAILED on create and update, and the same write is accepted after complete.
platform-core.manifest-install-contract, fix package install: OS_PROTOCOL_INCOMPATIBLE for a package declaring a NEWER protocol major prescribes "migrate meta --from 19", which cannot apply #26480: holds. ^19, >18, engines.platform ^19 and legacy ^19.0.0 each answer 422 with the upgrade-the-runtime remedy and no migrateCommand. This was driven off-clause; see the accuracy line below.

Partial coverage and fixture gaps

Parked-on: #27377 · ai.mcp-run-action-exposure-gate · gap: acceptance[1] "permitted" half blocked(fixture). No stock action pairs ai.exposed with a permission some persona lacks, so list_actions' permission filter is never discriminated. Needs a fixture recipe (an ai.exposed action with requiredPermissions the member lacks) or a pin.
Parked-on: #27377 · platform-core.docs-audience-gate · gap: acceptance[2] "unknown future audience shape denies" half has no pin (knownGaps[2]) and is unreachable live because the schema refuses the shape with 422. Needs a spec unit pin on audienceAllows with an unknown shape.
Parked-on: #27377 · platform-core.docs-audience-gate · gap: knownGaps[0] should also say that stock has no translated doc and no permission-set book, so the locale and permissionSet legs need runtime-authored fixtures.
Parked-on: #27377 · api-backend.aggregate-contract-matrix · gap: the stock seed has no showcase_account with a null annual_revenue and no Monday/Sunday or ISO-year-boundary dates, so count('*') vs count(field) and the week leg are not discriminating without seeding. knownGaps[0] should name the five seeded rows the run used.

Checklist-accuracy findings (ledger edits for the devx lane)

Parked-on: #27377 · api-backend.aggregate-contract-matrix · steps[5] / acceptance[3] · stale: says the retirement message names 'os migrate meta --from 16'. The live tail (query.zod.ts AGG_RETIRED_TAIL) names `os migrate meta` and the protocol-upgrade URL, with no "--from 16". Should quote the live tail.
Parked-on: #27377 · api-backend.aggregate-contract-matrix · acceptance[2] · stale: "grouped and ungrouped" empty-where identities; a grouped empty where returns no groups. Should say the identities show ungrouped, or per group via a per-aggregation filter.
Parked-on: #27377 · api-backend.api-methods-verb-gate · steps[4] · underspecified: the import body must be {format:'json', rows:[…], writeMode}, with matchFields[] for update and upsert; a bare {writeMode, records} answers 400 INVALID_REQUEST, which reads like the gate. Should spell the body.
Parked-on: #27377 · api-backend.api-methods-verb-gate · steps[5] · stale: the [Registry] stripped-legacy warning fires once per object name per process (registry.ts warnedLegacyApiMethods). Should use a distinct object name per legacy leg.
Parked-on: #27377 · api-backend.error-envelope-ledger · fixtures.requires[1] · stale: says sign-up/email works on a stock dev boot; it answers 403 SELF_REGISTRATION_CLOSED (invite_only default). Should say invite first, or use admin create-user.
Parked-on: #27377 · ai.agent-tool-skill-metadata-roundtrip · acceptance[0].verify · stale: expects agent.tools to prescribe skills plus ADR-0064 plus "--from 16", and skill.triggerPhrases to route to triggerConditions. At c4c515ad, agent.tools, agent.knowledge and skill.triggerPhrases are plain unrecognized_keys naming the key and the protocol-upgrade URL. Should say so; per-key prescriptions survive only for the tool guidance map, skill.permissions and trigger, and the agent.lifecycle tombstone.
Parked-on: #27377 · attachments-storage.field-accept-maxsize-server-enforced · fixtures.requires[2] · stale: says a metadata-less sys_file needs a system-write channel. An admin PATCH /api/v1/data/sys_file/ID {mime_type:null, size:null} answers 200, so the clause is drivable over REST. (The writability itself is extracted as #27399; update this line if that fix lands.)
Parked-on: #27377 · access-security.record-share-grant-revoke · fixtures.requires[3] / steps[10] · stale: implies evaluate shows a created grant. The sys_user_position insert already materialises the rule grant, and evaluate reports grantsCreated 0 (idempotent) with matchedRecords ≥ 1. Should say to read the rule-sourced sys_record_share row, not grantsCreated.
Parked-on: #27377 · automation.packaged-flow-subflow-disable-refusal · steps[8] / negative[1] · stale: "NO sys_metadata_activation row for showcase_notify_owner"; run in the item's own order, step 6's enables already wrote an active row. Should read "no active=false row written; the existing row unchanged".
Parked-on: #27377 · automation.trigger-status-contract · fixtures.knownGaps[1] · stale: FLOW_INPUT_SCHEMA_INVALID is stageable inside the qa-flow-status-doors package (an assignment node whose inputSchema types assignments as string, given an object), answering 422 at both trigger routes and /actions. Should add it to the recipe and drop the gap.
Parked-on: #27377 · automation.trigger-status-contract · steps[7] · missing warning: once re-enabled, the purge endpoint really deletes inquiries. Should warn to run it on a throwaway DB.
Parked-on: #27377 · identity-auth.two-factor-disable-lifecycle · steps (config read) and step 8 · stale: /auth/config carries data.features.twoFactor, not features.twoFactor; and disable and verify-totp rotate the session, so the pre-disable bearer answers 401. Should say to read data.features and to sign in again before the post-disable authed request.
Parked-on: #27377 · identity-auth.two-factor-enrollment-reveal · acceptance[4] · missing: verify-totp rotates the session; re-probing get-totp-uri "after verification" with the pre-verify bearer gives 401 for right and wrong passwords alike. Should say to use the token verify-totp returns.
Parked-on: #27377 · studio-authoring.removed-key-save-door-refusal · acceptance[0].verify · stale: requires "was removed in @objectstack/spec" or the upgrade-guide sentence, but dashboard.refreshInterval is a rename tombstone ("was renamed to `refreshIntervalSeconds` in @objectstack/spec 17 … Rename the key"). Should accept the rename wording, and say aged-out keys are reported at the PARENT path with the key named in the message.
Parked-on: #27377 · cli.fresh-install-migrate-apply-first · fixtures.requires[0] · stale: lists `os migrate plan` among commands that create tables; on an absent path it exits 0 and creates no file. Should drop it, or say it creates nothing.
Parked-on: #27377 · cli.hook-body-extraction-gates · steps[2] / acceptance[3] · weak probe: in a TypeScript config esbuild strips the retired `// @capabilities` line comment before extraction, so "adds nothing" passes trivially. Should also probe the comment inside a data body.source (measured: capabilities [], the comment adds nothing).
Parked-on: #27377 · cli.qa-suite-execution · acceptance[4] · wording: "counts as one failed suite"; the summary counts scenarios ("FAILED: 3 scenarios failed" = 1 malformed suite plus 2 scenarios). Should say the refusal counts as one failure in the scenario summary.
Parked-on: #27377 · platform-core.manifest-install-contract · acceptance[1] · stale since #26480: says the refusal always carries migrateCommand; it is absent when the declared target major is above the runtime's, and the message names the upgrade remedy. Should scope migrateCommand to targetMajor ≤ runtime major, and add a step and leg for ^(runtime+1): 422, no migrateCommand, upgrade wording.

Environment and timing:

One cold build, then five runner subagents of five items each, each on its own ports and DBs, in parallel.
Environment prep was about 56 agent-minutes (12 min cold install and build, 44 min of boots and fixtures). Testing was about 139 agent-minutes, including about 108 min of probes. The ratio is roughly 1 : 2.5, and wall clock from cold tree to the last verdict was 32 min.
No security finding was raised, so none was dispatched.

Generated by Claude Code

domain:devx#1 · sunhaolin · session_017xRBcScm27Q3R5mkYLPWdB

W3-C2a recorded: #27409 (QA run · release-18.3.0-w3-tier1-a (73/73) · c4c515a · 2026-10-29 · 59 PASS / 14 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN)

Subject: c4c515ad. The Console was built in-repo from the same commit.
Pins: 62 per-area, per-package vitest invocations covered every file the 73 refs name. 279 file runs, 7488 passed, 0 failed, 3 skipped by design. ui/e2e/live/screen-flow.spec.ts passed against the live automation boot. grid-file-upload.spec.ts was not run; that item was driven by hand.
Extracted cards: mcp: validate_expression answers ok:true for an empty or blank expression that the metadata save gate refuses as needing a non-blank source #27411, storage: the chunk door accepts chunk indexes outside the declared range and answers 500 on a negative index, leaving a session that can never complete #27412, storage: the presigned-upload door answers 500 INTERNAL for a non-numeric size and accepts a negative size #27413, automation: cloning a packaged flow writes the sys_metadata row and its audit row with a null actor, so nothing records which admin created the clone #27414 and automation: GET /automation/_status reports bound:true for a time_relative flow whose trigger refused to bind it, with no unboundCause #27415, all from off-clause probes. There was 0 clause fail.
One authorization finding was handled under the 2026-10-29 disclosure ruling: no card, and the fix was dispatched directly.

Retest items (anchor §4) on this card

access-security.record-access-explain (security explain answers 200 allowed:true for a userId that matches no sys_user row, built from the synthesized baseline principal #26641): the fix holds.
- The admin explaining an unknown userId gets 404 RECORD_NOT_FOUND, saying it is not an access decision. This held for read and create, and with a recordId.
- A plain member naming the same id still gets the same 403 as for a real user, and an anonymous caller gets 401.
- All 5 clauses passed live. The Studio panel's network bodies matched the API.
- The item is listed under W3-C3b in §4. It is in this Tier 1 set too, so it was judged here.
api-backend.query-contract-matrix (data list door: a blank $select answers every column and an unrecognised $count value counts — malformed values are read as the absent default #26644, fixed by fix(metadata-protocol)!: the Data API refuses an empty projection and a count flag that is neither true nor false #26811): the fix holds.
- A blank or comma-only $select, select or fields answers 400 VALIDATION_ERROR naming the parameter.
- A non-boolean $count or count answers 400.
- On POST, fields:[] and fields:[""] answer 400 at query.fields, and count:"maybe" answers 400 at query.count.
- The well-formed controls still answer 200.
- Judged here as well as on W3-C1.
automation.setup-packaged-automation-board (automation: switching off a packaged flow or a packaged action writes the activation-ledger row and its audit row with a null actor, so nothing records which admin did it #26474, fixed by fix(service-automation): the flow toggle records which admin switched a packaged flow #26605): the fix holds.
- A UI toggle of a packaged flow, and of a packaged action, stamps the admin on sys_metadata_activation (created_by/updated_by) and on sys_audit_log (user_id/actor).
- The clone door, which was left out of automation: switching off a packaged flow or a packaged action writes the activation-ledger row and its audit row with a null actor, so nothing records which admin did it #26474's scope, still writes a null actor. That is now automation: cloning a packaged flow writes the sys_metadata row and its audit row with a null actor, so nothing records which admin created the clone #27414.

Partial coverage and fixture gaps

Parked-on: #27377 · access-security.rls-both-sides · A5 D11 spot-check blocked(dependency): needs the maintainer-held write-up (#22017)
Parked-on: #27377 · access-security.crud-permission-matrix · A5 guest create-without-read is unobservable on a stock boot (#23267)
Parked-on: #27377 · access-security.fls-mask-and-strip · the partial-masking (maskingRule) path has no fixture anywhere; only strip is observed
Parked-on: #27377 · access-security.public-form-withdrawal-layers · A2 to A5 have no stock fixture; scored from the pins (knownGaps[1])
Parked-on: #27377 · ai.mcp-oauth-private-host-transport · A0 and the private leg of A2 need a host holding an RFC1918 or link-local address; this container holds only 192.0.2.2
Parked-on: #27377 · api-backend.action-activation-door-contract · A4 the 503 arm for a degraded metadata plane has neither a stock door nor a pin (knownGaps[3])
Parked-on: #27377 · approvals.email-action-token-door · no pin for: FORBIDDEN on a no-longer-pending slot (A0), timeline and consumed_at byte-identity under repeated GET (A1), consume-first when the decision fails (A3, source only), page-level not_pending/not_approver rows (A4); A5 blocked(fixture), no stock door mints a raw token
Parked-on: #27377 · approvals.status-mirror-field · A2 the user-less cascade refusal on an SLA auto-decision has service-unit evidence only
Parked-on: #27377 · approvals.request-page-reply-and-reader-visibility · A2 needs a persona granted read on sys_approval_request; A3 needs a writable object to flip enable.approvalsVisibleToReaders
Parked-on: #27377 · attachments-storage.read-inherits-parent-rls · A3 bounded-probe half (D5 classes) is engine and unit only (knownGaps[2])
Parked-on: #27377 · attachments-storage.sys-file-status-pipeline · A2 the deleted-row-with-live-holder half has no live door (route-handler unit only)
Parked-on: #27377 · attachments-storage.orphan-tombstone-reap · A1 the failed byte-delete veto is unit-only (a root container cannot make unlink fail)
Parked-on: #27377 · attachments-storage.upload-session-abort · A3 the warning text is asserted only on a mock logger; A4 failed status is reachable only through a test seam
Parked-on: #27377 · attachments-storage.chunked-upload-integrity · A3 live leg blocked(fixture): a stock single boot holds one organization; scored from the wall pin
Parked-on: #27377 · automation.paused-run-trigger-record-masked · A0 and A1 no stock object has an internal:true field, so the internal-key half rests on the in-process pin; a read-granted member persona was not authored
Parked-on: #27377 · automation.setup-packaged-automation-board · A5 a plain member cannot open the Setup app (knownGaps[2]), so the member refusal is seen only as the server body
Parked-on: #27377 · cli.organization-ownership-ceremony · A4 drop gate driven on the 18.0.0-next.5 dump; no v17-shaped DB provisioned
Parked-on: #27377 · cli.scaffold-first-run · no scaffold-e2e.yml run exists at c4c515a (latest scheduled run is at 28872e6, no push trigger); all clauses scored from the live pre-release leg; the A4 never-healthy branch was not triggered

Checklist-accuracy findings (ledger edits for the devx lane)

Each finding names the item, the clause or step, what is stale, and what it should say.

access-security.walled-environment-metadata-operator-only, steps[0]: names PUT /api/v1/meta/permission/showcase_member_access, a set the showcase does not have (a read-back answers 404). It should name a real set, such as showcase_member_default.
access-security.fls-mask-and-strip, acceptance[4]: says "given the scratch readable:false grant" and "absent or nulled". The stock showcase_client_liaison set now provides the fixture, and the measured shape is the key being absent. It should say that.
access-security.rls-both-sides: in the verify --rls block, showcase_account's RLS proof rides a seeded row, because the admin create was refused 400. The item should name that.
ai.mcp-http-surface, acceptance[4]: the stdio door on the same build lists 9 tools (no action family). "The documented twelve" should say it means the HTTP surface.
ai.mcp-stdio-fail-closed, fixtures: names os start. An objectstack dev boot with stdin piped drives the same plugin path, and the fixture could say either works.
ai.mcp-validate-expression, negative[0]: has no blank-input boundary. Add a clause for an empty or blank expression (see mcp: validate_expression answers ok:true for an empty or blank expression that the metadata save gate refuses as needing a non-blank source #27411).
ai.mcp-oauth-private-host-transport, fixtures.requires: demands a held private address, but the clauses judge what is advertised, and an unheld private OS_AUTH_URL reproduced the whole (a) shape. The item should say which reading scores (a).
ai.mcp-coded-refusals-and-runtime-exposure, acceptance[3]: has no showcase producer, because the only AI-exposed action is ungated. The fixture should name the recipe used: a runtime declarative update action, run as auditor.demo.
api-backend.query-contract-matrix, steps[1]: the AST compound filter must be written prefix-style, ["and", cond, cond]; the infix form is refused 400.
api-backend.query-contract-matrix, steps[2]: $contains, $notContains, $startsWith and $endsWith are case-sensitive on the SQL driver; $icontains is the case-insensitive twin. The steps should say so.
approvals.email-action-token-door, step 2: the admin was listed twice in pending_approvers but remind answered notified:1. The step should allow notified to equal the number of distinct recipients.
approvals.status-mirror-field, fixtures.requires: the seeded member personas cannot create showcase_field_zoo (403), so the submitter must be a persona with create on the trigger object. The fixture should say so.
approvals.request-page-reply-and-reader-visibility, acceptance[2] and the request-read-gate.integration pin's claim: on the stock showcase every non-admin, participants included, gets 403 on /api/v1/data/sys_approval_request. That is by design (ADR-0103 engine-owned object, read only as an app grant), and the console page reads only the approvals API. The clause and the pin's claim should say they hold for callers the app grants read on the object.
attachments-storage.download-authz-both-sides, steps[6]: at 1280px no Attachments panel appeared; at 1600px it renders. The step should name a wide viewport or how to open the Related rail.
attachments-storage.orphan-tombstone-reap, steps[1]: the sweep has no HTTP door. A restart runs the scheduler's first sweep after 60s, and the step should name that trigger.
attachments-storage.upload-session-abort, steps[0] and [1]: the chunk PUT needs the x-resume-token header, and complete takes parts: [{chunkIndex, eTag}]. The steps should say so.
attachments-storage.upload-limits-scope-and-ownership, acceptance[5] and steps[4]: a data-API write of a copied file id is copy-on-write, so the copied-id state is reachable only by a driver-level write. A reader holding sys_file read sees the foreign file in full. The step should say both.
automation.trigger-type-matrix, fixtures: the time_relative variant has to be fired on a fast clone, because the stock flow sweeps daily at 08:00 UTC. The fixtures line should say so.
automation.durable-suspend-restart, acceptance[1]: the PT1M timer can fire on the new process before it is re-read. Completion on the new process is the survival proof, and the clause should accept it.
automation.flow-authoring-refusals-v18, acceptance[2]: the endpoint arm needs a tenant flow name, because a packaged flow answers 403 NOT_OVERRIDABLE first.
automation.setup-packaged-automation-board: the page fetches with cookie credentials only. A bearer-only session renders "HTTP 401", so the RUNNER cookie note should list this page beside storage.
cli.organization-ownership-ceremony, acceptance[3]: the served boot prints only the message, never the code ORGANIZATION_OWNERSHIP_MIGRATION_REQUIRED. The clause should read the message line.
cli.organization-ownership-ceremony, acceptance[5]: the committed dump's reset token expires 1h after generation, so the restore recipe must shift sys_verification.expires_at.
cli.organization-ownership-ceremony, steps[5]: under a production os serve the delivery row lands in the primary DB, not the telemetry sibling.
cli.meta-package-flags-and-explain, fixtures.requires[2] and steps[1]: a bare writable package must declare a dependency on com.example.showcase, or the view is refused 422 list-view-object-outside-closure. destructive.json needs sharingModel, or the save is refused 422 security-owd-unset first.
cli.validate-v18-authoring-verdicts, steps[1]: the control record.name presumes a field showcase_task does not have (use title). The cbp arm must be a raw object, because ObjectSchema.create() forces required: true.
cli.scaffold-first-run, fixtures (pre-release variant): pnpm pack must run with scripts off. At c4c515a the tree version equals npm latest (18.2.0), so a local registry with no upstream is what makes the candidate the thing installed.

Environment notes for the RUNNER

pnpm build did not produce packages/console/dist at this sha; pnpm console:build was still needed (a cache hit plus a copy).
The ui jsdom pins must run from the ui/ root; the objectui vitest guard refuses a package-dir run.

Generated by Claude Code

domain:devx#1 · sunhaolin · session_017xRBcVkGJizGH7raJHhAvL

W3-C3b recorded: #27441 (54/55 judged · 44 PASS / 2 PARTIAL / 8 FAIL / 0 BLOCKED / 1 NOT-RUN) at c4c515ad, Console built in-repo from the same commit.

Pins: every item's revision was taken from node scripts/checklist-select.mjs at the subject and is listed in the record's Scope.
Automated refs run (RUNNER rule 6), each with its layer named in the record:
- access-security.record-access-explain: dogfood showcase-permission-zoo, 12 passed, engine layer.
- automation.setup-packaged-automation-board: ui PackagedAutomationPage*, 47 passed, component layer; platform-objects nav, 4 passed, unit layer.
- i18n.surface-matrix: ui page-header-action-i18n + record-quick-actions.actionText-i18n, 7 passed; FormPage.optionLabelLocale-26452, 2 passed. Both jsdom.
- studio-authoring.expression-editors: ui celAuthoring.test.ts, 40 passed, jsdom.
- dashboards.chart-type-matrix: showcase coverage.test.ts, 13 passed; spec dashboard-compareto.test.ts, 17 passed.
- records-forms.field-group-visible-when: spec batch20 + field-group-layout + ui groupVisibleWhen, all green.
- None of these pins scored a clause above its own layer.
Execution: 12 runner subagents, at most 3 browser runners at once, each with its own port, DB and browser context.
Time: environment prep about 91 min vs testing about 398 min plus 76 min of probes, roughly 1 : 4.4.

Retest list (§4): does each fix hold?

approvals.record-page-decisions (console: a non-participant reader is offered inline edit on a record whose pending approval locks it (lockRecord: true), and the save answers 409 RECORD_LOCKED #25934): holds. A non-participant gets no inline edit on a locked record, and their PATCH answers 409.
i18n.surface-matrix (console: the standalone /forms/:name route renders select option labels untranslated — a zh-CN user on an en-US browser reads Chinese field labels over English options (FormPage normalizeOptions skips the localizer) #26452): holds. Standalone /forms option labels follow the user's language in a browser with a different locale.
ux-conventions.write-feedback (app-showcase: record-action success messages name no record ("Task marked done.") — fails the write-feedback naming rule (ruling C on #25849); the runner fills {{ }} holes, so the copy can name the record #26459, app-shell: the full-page record form (/new, /edit route) still toasts "Task updated successfully" — #26172's fix covered AppContent's dialog paths only; RecordFormPage passes the object label alone #26461): both hold. The Mark Done toast names the record, and in-app /new and /edit name the record. console: a full-page record form opened by direct URL saves silently and then leaves the app for /_console/home #27454 records one remaining gap: /new entered by direct URL saves silently.
studio-authoring.expression-editors (Studio/metadata: a draft the editors, the draft _diagnostics and the Problems tab all call valid is refused only at publish — and one such draft rolls back the whole package release #26707): the server half holds: draft _diagnostics equals the publish verdict. The item still FAILs, on clauses that predate the Studio: an expression field that says "Valid CEL" should read the draft's server verdict at its own path (RLS predicate, flow edge condition) #26858 ruling (stale spec, re-point below).
studio-authoring.draft-publish-lifecycle (metadata-protocol: GET /meta/:type/:name/diff answers 200 for a version that does not exist — "no change" or "everything removed" — while rollback refuses the same version 404 VERSION_NOT_FOUND #26462): holds. Diff of a missing version answers 404 VERSION_NOT_FOUND.
i18n.strict-translation-key-rejection (spec: a single-word language name ("Chinese", "English", "Japanese") still passes as a translation locale — the #25822 fix refuses multi-word names only, though its changeset and refusal text say "a language name" is refused #26463): holds. locale:"Chinese" answers 422 invalid_format.
platform-core.settings-hub-roundtrip (service-settings: sys_setting_audit.old_hash is never written (hard-coded null) and new_hash for a non-secret value is an FNV-32 digest, while both columns declare "SHA-256 of the … value" #26465): holds. old_hash is the previous value's SHA-256, and there are no fnv32 hashes.
automation.setup-packaged-automation-board (automation: switching off a packaged flow or a packaged action writes the activation-ledger row and its audit row with a null actor, so nothing records which admin did it #26474): holds. The activation and audit actor is the admin. The item is PARTIAL on the A5 fixture gap only.
records-forms.record-discussion-mentions (records-forms.record-discussion-mentions: authorization-class finding (18.2.0 wave-2 sweep) — detail withheld pending maintainer #26453): the item passes (17/17).
records-forms.field-group-visible-when (object door: fieldGroups[].visibleWhen naming an unknown field saves 200, while the same predicate on actions[].visible or fields.*.visibleWhen is refused 422 #26646): holds. An unknown field in a group's visibleWhen answers 422 expression-invalid.
access-security.record-access-explain (security explain answers 200 allowed:true for a userId that matches no sys_user row, built from the synthesized baseline principal #26641): holds. An unknown userId answers 404 RECORD_NOT_FOUND.
identity-auth.self-service-profile-password (no fix; carried PASS from 18.1.0): re-judged fresh: PASS, 10/10.

Extracted product defects (for §5)

Clause fails:

console: a bare-string CEL predicate (nav visible, page visibleWhen) runs on the legacy evaluator and fails, though the spec defines a bare string as CEL shorthand #27457: a bare-string CEL predicate runs on the legacy evaluator (app-and-nav-properties A3, authored-page-slots-and-variables A1/N0)
Studio OWD panel: saving "Controlled by parent" on a detail whose master_detail is not yet required answers 409 DESTRUCTIVE_CHANGE with no way forward #27458: the OWD panel's controlled-by-parent save gets 409 DESTRUCTIVE_CHANGE with no force path (access-owd-and-suggestions A1)
Studio: "Add item" on a dashboard list property autosaves an empty item (422), and every later edit is refused and lost until reload #27459: Studio "Add item" autosaves an empty item and later edits are lost (dashboard-widget-and-filter-types A4)
Studio: adding a Rollup field autosaves it unconfigured, and the Sum/Avg child-field picker offers text and lookup fields #27461: a Rollup field autosaves unconfigured and the Sum picker offers text fields (summary-field-authoring A0/A1/N0)
Studio Interfaces: an in-progress navigation rename does not raise the beforeunload guard, so a reload or tab close silently loses it #27464: the Interfaces nav rename is not covered by beforeunload (held-edit-leave-guard A1)

Probe findings:

security: POST /api/v1/security/explain with userId "" silently explains the caller instead of refusing #27442: explain with an empty userId explains the caller
metadata: a draft save accepts an object name without the package namespace prefix; only publish-drafts refuses it (NAMESPACE_PREFIX) #27444: a draft accepts an unprefixed object name; only publish-drafts refuses it
dashboards: a widget filterBindings key naming an undeclared dashboard filter is accepted at draft and publish (silently inert) #27445: a dangling filterBindings key publishes
console: /forms/NAME for a missing form renders a raw English "Form metadata not found" in a non-English session #27446: raw English "Form metadata not found"
console: opening a notification from the Home "Notifications" card does not mark it read (the bell popover does) #27447: the Home notification card does not mark read
spec: the retired connector.webhooks error says a top-level webhook "is materialized into sys_webhook", contradicting ADR-0131 D2 #27448: the connector.webhooks message claims sys_webhook materialization
console: the ?palette=1 deep-link is dropped when an app root redirects to its default page #27450: ?palette=1 is dropped on the app-root redirect
approvals: GET /api/v1/approvals/requests/UNKNOWN/actions answers 200 [] while GET /requests/UNKNOWN answers 404 #27451: approvals /actions answers 200 [] for an unknown request
Studio: the RLS predicate field keeps showing the previous draft's server error under newly edited text #27452: the RLS field keeps a stale server error
app-showcase: the task-desk page saves a record from its drawer or modal with no success toast #27453: task-desk drawer and modal saves show no toast
console: a full-page record form opened by direct URL saves silently and then leaves the app for /_console/home #27454: a deep-linked full-page form saves silently and leaves the app
console: API key Revoke and Restore toasts name no key ("API key revoked") #27456: API key revoke and restore toasts name no key
dashboards: a sankey widget with two dimensions silently draws only the first category's flows #27460: a two-dimension sankey drops series
spec/Studio: a count rollup cannot be saved without summaryOperations.field, which the spec itself says is ignored for count #27462: a count rollup requires field

Two authentication/authorization-shaped probe findings are withheld under the 2026-10-29 ruling and were handed to the PM session.

Re-point (§1): red rows this anchor owns

Parked-on: #27377 · api-backend.formula-stdlib-matrix · acceptance[0]
Parked-on: #27377 · studio-authoring.expression-editors · acceptance[2], acceptance[4], acceptance[6], negative[0]

api-backend.formula-stdlib-matrix · steps[0] / acceptance[0] / title / source[0]. Stale: "registerStdLib registers exactly 29 … docs tally the same 29". Should say: 30 (29 chained, plus label(record.f) via bindOptionLabel; validate.ts:1257; formulas.mdx:203). Add a known-answer row: label(record.kind) with optionLabels → "Clean".
studio-authoring.expression-editors · A2 / A4 / A6 / N0. Stale: the editor's own verdict must equal the engine before save, and the formula-field RLS predicate must be held. The Studio: an expression field that says "Valid CEL" should read the draft's server verdict at its own path (RLS predicate, flow edge condition) #26858 ruling forbids a client copy of publish rules; the field shows the draft's server verdict after autosave, and that is live. The clauses should score the post-save server verdict at the field's path. knownGaps[3] is also stale: non-lowerable predicates are now error-tier and held. knownGaps[4] should be reworded to match.

Fixture gaps, partial coverage and not-run handover (§3)

Parked-on: #27377 · automation.setup-packaged-automation-board · acceptance[5] blocked(fixture)
Parked-on: #27377 · integration-system.webhook-lifecycle · acceptance[2] blocked(dependency #23166)
Parked-on: #27377 · integration-system.webhook-lifecycle · acceptance[4] blocked(fixture, cross-org arm)
Parked-on: #27377 · studio-authoring.no-entry-property-matrix · not-run handover
Parked-on: #27377 · cli.scaffold-console-first-paint · candidate console not exercised

automation.setup-packaged-automation-board A5: no stock member can open Setup (knownGaps[2], third measurement). The step should say how to score it while the gap holds: the admin half live, the member half by the forged-request 403 sentence.
integration-system.webhook-lifecycle A4:
- The cross-org 404 arm needs a walled boot with a second org; name it in knownGaps.
- The parked-row arm (DELIVERY_NEVER_SENT) needs a recipe; the run corrupted a sys_secret ciphertext in its own DB.
- N1's drifted-triggers row is reachable only by DB edit (the data API refuses it 400).
- A2 stays on QA run · surface:mixed (90/90) · 36b2889c · 2026-10-12 · 72 PASS / 10 PARTIAL / 8 FAIL / 0 BLOCKED / 0 NOT-RUN #23166.
studio-authoring.no-entry-property-matrix: 15 of about 45 rows were measured and all held. Not reached:
- member-persona rows (field requiredPermissions, fileAccessDelegate, defaultRowScope);
- showcase_external datasource rows;
- view.list and field-widget rendering rows;
- permission positions;
- dashboard requiredPermissions;
- dataset nullLabel.
  A runner with a member persona and the external datasource boot should finish it.
cli.scaffold-console-first-paint: the sandbox refused npx create-objectstack@latest, so the run used the workspace create-objectstack (same 18.2.0). That leg resolved the published @objectstack/*@18.2.0, and the candidate console was not exercised. The pre-release registry variant is owed, or the post-publish smoke covers it.
platform-core.settings-hub-roundtrip A8/A10: no stock user-scope secret. The in-process consumer is reachable only through mail/test against a capture SMTP.
i18n.surface-matrix A5: still no stock confirmText action (knownGaps[3]).
studio-authoring.access-facets-runtime A0: qa_cap cannot be declared at runtime (403 NOT_CREATABLE); use a declared, ungranted capability.

Checklist-accuracy findings (§2): ledger edits for the devx lane

Format: item · clause or field. Stale text → what it should say.

Studio items

studio-authoring.* (the "scope note" negatives, e.g. N1/N2) and platform-core.notification-center N3. Stale: notes with no oracle sit in negative, and runners split between pass and skipped. Should say: move them to notes, or state that they are scored "honoured".
studio-authoring.access-facets-runtime · knownGaps[0]. Stale: "launcher half FAILS TODAY". Should say: it holds at c4c515a (the launcher omits the hidden app); drop the gap.
studio-authoring.access-facets-runtime · fixtures.requires[2] / steps[1]. Should say: the package action must be inline on the object's actions[] (Studio Data › Actions); a standalone runtime action item renders nowhere.
studio-authoring.access-owd-and-suggestions · A2.verify. Stale: "pending → accepted → revoked". Should say: pending → confirmed → dismissed.
studio-authoring.access-permission-set-lifecycle · steps[1]. Stale: the button is "Create". Should say: "Save as draft".
studio-authoring.api-written-keys-survive-studio-save · variants[5] / knownGaps[0]. Stale: allowExport is listed, and the item says it "FAILS today (Studio Access: saving a permission set drops draft values written by another door (description, packageId) — the save starts from the published body and copies back only editor-managed keys #26837)". Should say: allowExport is not a permission key (422), and the variant now passes.
studio-authoring.app-and-nav-properties · steps[0] / steps[4]. Should say: Studio Interfaces reads only a package's FIRST app and its top-level navigation, and the seeded admin holds org_owner, not org_admin.
studio-authoring.authored-page-slots-and-variables · steps[0]. Stale: "details OR tabs". Should say: slots.tabs is retired (ADR-0085, spec: a slotted record page keeps six slots — header, actions, alerts, highlights, details, discussion — and the tabs slot is retired; a page that needs its own tab strip is a kind: full page #27053).
studio-authoring.dashboard-widget-and-filter-types · steps[2] / fixtures.requires[2]. Should say: a lookup filter needs optionsFrom, and sankey is root→categories over one dimension.
studio-authoring.expression-editors · knownGaps[2] / A7 verify. Should say: cd ui && pnpm exec vitest run --maxWorkers=2 packages/app-shell/src/views/metadata-admin/celAuthoring.test.ts (the package-dir form is refused by the vitest guard).
studio-authoring.flow-edge-type-authoring · knownGaps[0]. Should say: the edge inspector now shows the server verdict (flow-edge-server-error); only Problems stays silent.
studio-authoring.flow-edge-type-authoring · A0. Should say: Normal writes no type key; the option labels read "Fault (error path)" and "Back-edge (revise loop)".
studio-authoring.draft-publish-lifecycle · A10. Stale: "attempts (allowed and denied)". Should name which denials are audited; 422 spec refusals and 404 NO_DRAFT are not.
studio-authoring.no-entry-property-matrix · knownGaps[0]. Stale: view.form buttons is "never rendered". Should say: it renders (the submit label, and cancel hidden).
studio-authoring.summary-field-authoring · steps[1]. Should say: count needs a field picked (see spec/Studio: a count rollup cannot be saved without summaryOperations.field, which the spec itself says is ignored for count #27462).
studio-authoring.held-edit-leave-guard · steps[6]. Should say: depart within the autosave debounce (about 150 ms).
studio-authoring.report-authoring-options · steps[4]. Should name POST /api/v1/analytics/dataset/query {datasetName, selection:{…, order:{measure:'desc'}}}.
studio-authoring.view-authoring-live · fixtures.requires[0]. Should list the sharingModel enum; read_write answers 422.

Records, forms and approvals

records-forms.form-view-gallery · A0 / variants / steps[3,4] / fixtures.requires[0] / knownGaps[1]. Stale: a split layout, and drawer/modal overlay → simple. Should say: spec 18.3.0 FormView.type is simple, tabbed or wizard, and split/drawer/modal overlays answer 422 (ADR-0050). Drop the split variant or score it as the refusal.
records-forms.form-view-gallery · steps[0,6]. Should say: the page form is reachable only by in-app navigation to /record/ID/edit.
records-forms.record-discussion-mentions · A2 / A7 / steps[11]. Should say: the default record page (v3, feat(plugin-detail,app-shell,components): record page v3 layout #27310) is a newest-first stream with chips; FeedFilterMode and oldest-first live on an authored Discussion section (e.g. Project Detail).
records-forms.record-discussion-mentions · steps[13] / fixtures.requires[2]. Should say: the single-boot member also needs the sys_comment read grant.
records-forms.action-location-matrix · fixtures.requires[0]. Should say: mark_done visible is has(record.done) && record.done != true, and showcase_reopen_task exists.
records-forms.field-group-visible-when · steps[5]. Should say: pre-fill a member value, because details hideEmpty defaults to true.
approvals.record-page-decisions · steps[9] / A4. Should say: when the off-slate admin is also the submitter, the overrides sit in an "Admin override" menu (declared-actions-override-menu).
approvals.record-page-decisions · A3. Should say: Edit stays rendered but disabled; the band reads "Locked for approval" or "In approval · editable".
approvals.inbox-metadata-actions · fixtures.requires[2]. Should say: EXP-2001 also routes Ada (finance).
approvals.quorum-m-of-n A4 / approvals.per-group-signoff A2. Should say: the tally and chips render only while the request is pending.

Automation and dashboards

automation.flow-node-type-matrix · fixtures.requires. Should say: assignment is also exercised via showcase_one_task_signoff. steps[5]: the seed already leaves a paused expense_signoff run.
automation.packaged-flow-clone-contract · A0. Should say: an empty-string name or label answers invalid_type; required is only for an absent key.
dashboards.chart-type-matrix · A4 verify. Should say: the synonym chrome differs from metric even on the same dashboard, so compare values only. steps[4]: the stock seed has only 2 month buckets.

CLI, i18n and identity

cli.scaffold-console-first-paint · steps[0]. Should say: npx create-objectstack@latest can be refused by an agent sandbox; the built scaffolder is equivalent when the versions match.
i18n.strict-translation-key-rejection · steps[0]. Stale: the warning about the name describe. Should say: the describe now says a snake_case item name; drop the warning. Also add a locale-shape variant ("Chinese"/"zh_CN" → 422 at locale).
i18n.notification-localized-and-clears · steps[4,5]. Should name the bell POPOVER entry; the Home card is a second door (console: opening a notification from the Home "Notifications" card does not mark it read (the bell popover does) #27447).
i18n.surface-matrix · steps[7] / knownGaps[2]. Should say: the contact New dialog shows 这是谁, so name the edit form. automated.ref: run from ui/ (pnpm exec vitest run …).
identity-auth.first-run-owner-bootstrap · steps[2]. Stale: /setup. Should say: /_console/setup.
identity-auth.self-service-profile-password · source[2]. Should say: reuse prevention applies only when password_history_count > 0 (default 0).

Integration, platform core and search

integration-system.job-scheduled-run · A5. Stale: the quoted text ends "os migrate meta --from 16", which the live message no longer contains.
integration-system.notify-inbox-delivery · steps[0]. Should say: assignee is an email text field.
platform-core.notification-center · steps[5] / A3. Should say: the digest group races the per-minute digest; use a non-recurring repeated topic.
platform-core.package-lifecycle-enable-disable · steps[0]. Should say: the nav entry is an app item drafted into the package, plus the namespace prefix and the sharingModel enum. A5: name both deep-link shapes.
platform-core.settings-hub-roundtrip · steps[7] / A6. Should say: plugin-email is mounted on stock, and the messages are "No delivery transport is active…" and "SMTP host is required…". steps[11]: the in-process door is mail/test against a capture SMTP.
search.console-global-search · A3. Should say: the app segment is canonicalized to the package id.

API backend, access security and UX

api-backend.formula-stdlib-matrix · steps[6] / A5 fixtures.requires. Should say: needs a writable package (POST /api/v1/packages {"manifest":{…}}) and the namespace prefix.
access-security.permission-matrix-edit-loop · steps[2]. Stale: "save (draft) then publish". Should say: the console Save lands active.
ux-conventions.write-feedback · variants[4] / variants[5] / knownGaps[0]. Should say: {{ record.title | default:'Task' }} marked done. and 'Invitation sent to {{ result.email }}'.
ux-conventions.write-feedback · variants[1]. Should name the Grid view.
ux-conventions.write-feedback · steps4. Should say: the refused transition is not drivable in the UI (the picker offers only legal states), so prove it via the API (400 invalid_transition).
ux-conventions.write-feedback · A1.verify. Should say whether the Studio item header counts for "Saved HH:MM".

Generated by Claude Code

domain:devx#1 · sunhaolin · session_017xRBcV2ijbfB8Drvs2oik6

W3-C1 recorded: #27481 (priority:P0, 23/23 judged at c4c515a: 20 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN)

Pins: the Playwright smoke showcase-smoke.spec.ts passed 49 of 49 against a live boot. objectstack verify --rls reads all personas: 38 PROVEN (38 consistent, 0 HOLES), with 10 of 10 positions probed. Every named dogfood, engine and unit pin was green (counts in the record). The Console was built in-repo, and the served entry chunk index-DkXHr74P.js equals packages/console/dist.
Retest, api-backend.query-contract-matrix: the fix from data list door: a blank $select answers every column and an unrecognised $count value counts — malformed values are read as the absent default #26644 holds. Blank or comma-only $select/select/fields and a bad $count answer 400, the POST /query door does the same, and the controls are unchanged (two loads; the fix pins report 17 and 37 passed).
Extracted product cards (all from off-clause probes, low severity): data: a blank or comma-only $searchFields is read as absent, so a search the caller narrowed runs over the default search fields instead of being refused #27484, console: the record history "Changes" entry shows a currency (and number) field as its raw stored value, e.g. 4321000, where the record shows $4,321,000.00 #27486, data: POST /api/v1/data/:object/:id/clone accepts an overrides that is not an object (a string) and answers 201 with the overrides silently ignored #27489, approvals: GET /api/v1/approvals/requests/:id/actions answers 200 {"data":[]} for an unknown request id, where GET /api/v1/approvals/requests/:id answers 404 #27493. Two security findings had their detail withheld and their fix dispatched; no card was filed, per the 2026-10-29 ruling.

Parked here (anchor §2 and §3):

Parked-on: #27377 · access-security.rls-both-sides · partial: acceptance[5]'s D11 spot-check is blocked(dependency), knownGaps[0]. The private write-up is maintainer-held. The public half holds.
Parked-on: #27377 · access-security.crud-permission-matrix · partial: acceptance[5] is blocked(dependency, #23267), knownGaps[2]. No door binds a set to the guest anchor.
Parked-on: #27377 · cli.organization-ownership-ceremony · partial: acceptance[5]'s reset-password leg is blocked(fixture). The cli-18-prerelease-db dump's sys_verification reset token expired at 2026-10-27T17:42:21Z, one hour after generation, so the reset answers 400 INVALID_TOKEN on every later run. The recipe's restore should re-date expires_at (or the generator should mint a long-lived token), or the clause should say the leg is scored only on a freshly generated dump. Every other leg held.
Parked-on: #27377 · access-security.walled-environment-metadata-operator-only · gap: the install-local leg was not driven live, because an admitted install writes into the shared tree's .objectstack/installed-packages. It rests on the wall-* pins. Running it from a scratch copy would close it.
Parked-on: #27377 · cli.organization-ownership-ceremony, platform-core.v18-boot-refusals · fixture gap: the v17-shaped DB in practice comes from a 17.7.0 blank-scaffold os dev boot (--legacy-peer-deps), because no 17.x showcase is published. fixtures.requires should say so.
Parked-on: #27377 · records-forms.crud-roundtrip, studio-authoring.first-run-loop · gap: ui/e2e/live/record-history-display.spec.ts and ui/e2e/live/studio-object-designer.spec.ts were not run (they need the console dev server on fixed ports). Both clauses were scored by hand.

Checklist-accuracy findings (ledger edits for the devx lane):

Parked-on: #27377 · records-forms.crud-roundtrip · steps[5] and acceptance[4] say "History tab". At c4c515a the record page has no History tab: history is under Activity › Timeline, filter "Changes". The steps should say that. ui/e2e/live/record-history-display.spec.ts waits for getByRole('tab', {name: /History/}), so it is likely stale too.
Parked-on: #27377 · records-forms.crud-roundtrip · steps[6] names only showcase_account, but the clone-ownership half needs the showcase_field_zoo substitution that acceptance[6].verify already documents. The step should name it.
Parked-on: #27377 · access-security.crud-permission-matrix · acceptance[1] says error.code PERMISSION_DENIED, but the wire envelope is {error: message, code, object}. It should say top-level code.
Parked-on: #27377 · access-security.crud-permission-matrix · acceptance[6].verify and steps[6] still call the 16 field_ops_delegate × sys_* cells hand-driven, though automated.ref has pinned them since rev 9. Still stale at rev 10.
Parked-on: #27377 · access-security.owd-sharing-matrix · steps[4]'s invoice body omits the required account, and steps[3]'s showcase_project create needs status planned (otherwise invalid_initial_state). The steps should name both.
Parked-on: #27377 · access-security.walled-environment-metadata-operator-only · steps[0] names PUT /api/v1/meta/permission/showcase_member_access, a set the showcase does not have (GET 404), so it tests a create-refusal. It should name an existing set (for example showcase_member_default).
Parked-on: #27377 · access-security.walled-environment-metadata-operator-only, identity-auth.default-organization-boot-invariant · fixtures.requires says pnpm dev -- --fresh, which compiles into the shared tree. It should say objectstack dev --fresh --no-compile -p PORT when runners share a tree.
Parked-on: #27377 · cli.organization-ownership-ceremony · acceptance[1] under --dev: "the DB checksum is unchanged" holds for the primary file, but the telemetry sibling's hash moves (the plan checkpoints the -wal a prior refused boot left, with no schema or row change). It should name the primary file or use a row-level read.
Parked-on: #27377 · cli.organization-ownership-ceremony · acceptance[3] expects ORGANIZATION_OWNERSHIP_MIGRATION_REQUIRED on a build oracle, but the served boot prints only the message (0 hits). It should defer the code to the pins, as platform-core.v18-boot-refusals acceptance[1] does.
Parked-on: #27377 · platform-core.v18-boot-refusals, cli.organization-ownership-ceremony · acceptance[1] / acceptance[3]: under os serve --dev the refusal spells os migrate organization-ownership --dev --out PLAN and --dev --apply …. The literal in the clause matches only a production serve. It should allow the optional --dev.
Parked-on: #27377 · platform-core.boot-health · steps[3] / acceptance[2]: health answers 200 before the Flows/Seeds banner is flushed, so cutting the log at health-green drops the banner acceptance[2] reads. It should say to capture the log before the first non-health request.
Parked-on: #27377 · platform-core.builtin-apps-nav-render · steps[5] says 42 Setup destinations, but this run's admin payload serves 44 (Account 8). Recount, digits only.
Parked-on: #27377 · studio-authoring.first-run-loop · steps[1] says "Home → Build an app", but the control is "New in Studio", which opens Studio with the New Package dialog. steps[6]'s "Home link on the landing's top bar" was not found by role, so it is worth re-checking.

Revision note: identity-auth.default-organization-boot-invariant is revision 3 at c4c515a (scored at 3).

Generated by Claude Code

domain:devx#1 · sunhaolin · session_017xRBcSwDXZrZg7nGjP6P3U

W3-C2b recorded: #27438 (QA run · release-18.3.0-w3-tier1-b (89/89) · c4c515ad · 2026-10-29 · 79 PASS / 6 PARTIAL / 4 FAIL / 0 BLOCKED / 0 NOT-RUN)

Pins: all 38 per-package vitest batches are green at c4c515a: 256 files, 5,330 tests, 0 failed. The Playwright specs the refs name were run against the runners' own boots and all pass, with one exception: ui/e2e/live/record-history-display.spec.ts fails because it is stale (see checklist: re-point records-forms.field-history-tracking acceptance[2] to the record page v3 Timeline › Changes stream — the History tab it asserts was removed by design (#27055) #27492).
FAIL (4):
- integration-system.email-template-render: email templates: after a source edit and hot reload, the by-name read serves the new template while the list read and every send keep the old copy until a cold restart #27488
- records-forms.field-history-tracking: stale spec, checklist: re-point records-forms.field-history-tracking acceptance[2] to the record page v3 Timeline › Changes stream — the History tab it asserts was removed by design (#27055) #27492
- studio-authoring.expression-editors: Studio: an expression the engine refuses (RLS USING on a formula field, a null-unsafe validation predicate) keeps autosaving — the server verdict is shown on the field but never holds the save #27482, Studio Data › Form: closing the field inspector releases the CEL error hold and autosaves the broken formula (returnType dropped); switching object discards the held edit silently #27485
- studio-authoring.object-api-tab-curl: Studio API tab: the example body puts the placeholder id "related_record_id" into every reference field (owner_id included), so the copied Create/Update cURL is refused 400 reference_not_found #27490
Probe defects (11): objectql: a refused write carrying a secret field still mints an orphan sys_secret row, and clearing a secret with null leaves its sys_secret row behind #27495 console filter builder: a progress field is offered text operators (Contains, Starts with…) that the server refuses, and no numeric Greater/Less than #27497 rest: GET /data/OBJ/export silently answers an unknown format (pdf, xml, empty) with a 200 CSV instead of refusing it #27500 import: POST /data/OBJ/import/jobs accepts an unregistered object with 201 and the job then reads succeeded, where the data door answers 404 #27501 comments: an @mention by email is matched case-sensitively, so a differently-cased address is accepted 201 and silently never notified #27503 analytics: POST /analytics/query and /analytics/sql answer an empty cube name with 500 INTERNAL_ERROR instead of 400 #27505 rest: a hook onError abort answers the data door with a 400 that carries no error code, and the server logs it as an unhandled SandboxError #27508 datasources: POST /datasources/NAME/test answers an unknown name 200 {ok:false} where every sibling NAME route answers 404 (the #25486 family) #27510 datasources: the draft probe POST /datasources/test creates the SQLite database file on disk although nothing is saved #27512 meta diagnostics: an unknown type, severity or package answers a silent 200 all-clear (scannedTypes 1, zero issues) instead of a refusal; aliases key stats non-canonically #27514 Studio: an order-only field change is misreported — the canvas order reverts after reload when a field is placed above Owner, and the publish review says No differences detected #27516
Security: 3 authorization-class probe findings were dispatched as fixes. Detail is withheld under the 2026-10-29 ruling, and nothing is filed.

Retests (§4 of this anchor)

The anchor assigns these to W3-C3b; this card's verdicts bear on them.

i18n.surface-matrix (console: the standalone /forms/:name route renders select option labels untranslated — a zh-CN user on an en-US browser reads Chinese field labels over English options (FormPage normalizeOptions skips the localizer) #26452): the fix holds. 15/15 clauses pass at revision 12, including A10.
records-forms.record-discussion-mentions (records-forms.record-discussion-mentions: authorization-class finding (18.2.0 wave-2 sweep) — detail withheld pending maintainer #26453): the fix holds. 17/17 pass, including the gated legs on the walled boot.
studio-authoring.expression-editors (Studio/metadata: a draft the editors, the draft _diagnostics and the Problems tab all call valid is refused only at publish — and one such draft rolls back the whole package release #26707, follow-up Studio: an expression field that says "Valid CEL" should read the draft's server verdict at its own path (RLS predicate, flow edge condition) #26858 / PR fix(app-shell): an expression field shows the draft's server verdict at its own path #26999): the fixes hold, since the draft verdict reaches the field. The item still fails on the save-gate half (Studio: an expression the engine refuses (RLS USING on a formula field, a null-unsafe validation predicate) keeps autosaving — the server verdict is shown on the field but never holds the save #27482) and on Studio Data › Form: closing the field inspector releases the CEL error hold and autosaves the broken formula (returnType dropped); switching object discards the held edit silently #27485.

Partial coverage and fixture gaps

Parked-on: #27377 · identity-auth.auth-method-matrix · gap — A0/A4: the device-authorization variant cannot be booted (no env switch on dev → serve). Enterprise SSO register refuses a loopback IdP (400 discovery_private_host unless trustedOrigins names it). The OIDC and Google login-button screenshots were not taken this run. N2 is blocked on objectui#4179 (closed not_planned: no magic-link or passkey login UI).
Parked-on: #27377 · integration-system.inbound-mailbox-association · gap — A1–A3: no IMAP account source, mailAssociation object or IMAP double on a stock boot (knownGaps[0] still accurate).
Parked-on: #27377 · integration-system.external-schema-drift-gate · gap — N5, the federation-free boot, was not driven. The showcase has no second federated datasource, so the "sibling still judged" half of A3 is pin-only.
Parked-on: #27377 · platform-core.serve-composition-v18 · gap — A5: an unbuilt console cannot be booted without changing a shared tree (resolveConsolePath falls back to the CLI's own built console), and its pin reaches only an in-process server.
Parked-on: #27377 · records-forms.gantt-interactions · gap — A1/A2: auto-schedule needs a dependencies field that no stock view or object declares. The direct locked-bar half was run-proven on a reverted view overlay (gantt.lockField: 'done').
Parked-on: #27377 · records-forms.encrypted-field-behavior · gap — A3/N1: every stock boot (os dev included) wires a crypto provider, so the no-provider legs rest on the HTTP dogfood pin. The item should state whether that pin scores the clause.
Parked-on: #27377 · records-forms.field-unique-enforcement · gap — N3/A4: the live two-org scope leg was scored from pins on a single boot.
Parked-on: #27377 · records-forms.write-answer-advisories-rollback-and-tree-delete · gap — A2/N0: an afterInsert-abort hook cannot be authored over REST on a stock boot, so it rests on the HTTP dogfood pin.
Parked-on: #27377 · records-forms.write-time-option-and-element-shape-judgement · gap — A1: a faulting visibleWhen is refused at author time (422 expression-invalid); it needs an OS_ALLOW_UNLINTED_METADATA_WRITES=1 scratch boot, so it rests on the HTTP dogfood pin.
Parked-on: #27377 · records-forms.v18-semantic-defaults · gap — no stock object holds more than 50 rows; the run seeded 50 scratch tasks.
Parked-on: #27377 · platform-core.lifecycle-retention-sweep · gap — the archive-success leg needs a registered archive datasource (unit-pinned only).

Questions that need a ruling

Parked-on: #27377 · studio-authoring.validation-rules-authoring · ruling — A3 scores invalid_initial_state for a Studio-authored rule, but Studio's Validations tab has no input for initialStates. Every code Studio can author enforced correctly. Either drop that code from this item, or record the missing input as a product gap.
Parked-on: #27377 · records-forms.bulk-select-all-matching · ruling — beyond the 5000-row cap, the banner still says "All 5010 matching records are selected", and only the confirm dialog's "5000" shows that 10 rows are left out. A4 passed as written; should the banner name the cap?
Parked-on: #27377 · search.field-scoped-narrowing · missing clause — no clause decides whether an EMPTY override (searchFields: [], $searchFields=) narrows. Today it is read as absent (unnarrowed 200), while [''] is 400.
Parked-on: #27377 · platform-core.metadata-registry-serving · ruling — with two package holders, GET /meta/dashboard/X/layers silently returns one holder's overlay, while the package-less save and delete on that name answer 409.
Parked-on: #27377 · platform-core.settings-organization-isolation-and-platform-rung · missing clause — an org admin can save over its own LOCKED tenant row, which is consistent with a lock that binds only lower rungs. No clause asserts it either way.

Checklist-accuracy findings (ledger edits for the devx lane)

Parked-on: #27377 · studio-authoring.expression-editors · accuracy — fixtures.knownGaps[4]: stale "The editor half has no open card" → should say: #26858 was filed and closed by PR #26999 (in the subject). The field now shows the draft's server verdict after the re-read, but the save is still not held (#27482), so acceptance[2] and [4] still fail, now on the hold.
Parked-on: #27377 · records-forms.field-history-tracking · accuracy — negative[3] is a cross-reference guard, not an assertion. Move it out of negative[]; the re-point of acceptance[2] is #27492.
Parked-on: #27377 · studio-authoring (org-scope-flows, flow-status-matches-runtime, validation-rules-authoring, hooks-tab-authoring, actions-tab-presets, interfaces-create-dialogs) · accuracy — negative[1] in each is a SCOPE: pointer to another item, not an assertion. Move them to notes so the items can derive cleanly. This record excluded them from the derivation.
Parked-on: #27377 · studio-authoring.object-api-tab-curl · accuracy — negative[0]: "(a value of the wrong type for its field)" should also cover a right-typed placeholder id that names no record (#27490).
Parked-on: #27377 · search.global-search-skips-unreadable · accuracy — fixtures.requires[2]: stale "'last_login_ip' is null on every row (a direct sign-in sends no forwarded header … QA run #24593)" → should say: at c4c515a a direct sign-in stamps last_login_ip '127.0.0.1' on the admin and the signed-up member (read as admin on a fresh boot); 'role'='user' remains the usable V
Parked-on: #27377 · search.field-scoped-narrowing · accuracy — negative[1] (missing clause): stale "no clause decides whether an EMPTY override (searchFields: [] / $searchFields=) is an override" → should say: state the contract: today [] is read as absent (unnarrowed 200) while [''] is 400 INVALID_FIELD (spec search-fields.ts resolveSearchFields)
Parked-on: #27377 · records-forms.field-unique-enforcement · accuracy — steps[0], fixtures.requires[1]: stale "author qa_unique via PUT /api/v1/meta/object/qa_unique" → should say: the object must carry its package namespace prefix (NS_short, e.g. qauniq_item under namespace 'qauniq'), per the qa-feeds-disabled recipe's NAMESPACE_PREFIX note
Parked-on: #27377 · records-forms.comment-reactions-and-edit-stamps · accuracy — fixtures.requires[2]: stale "'Author a runtime permission set … through the metadata door' (door unnamed)" → should say: PUT /api/v1/meta/permission/‹name> {name,label,objects:{sys_comment:{allowRead},sys_comment_reaction:{allowRead,allowCreate,allowEdit,allowDelete} }} → 200, then POST /api/v1/data/sys_user_permission_set {user_id, permission_set}; measured working at c4c515a
Parked-on: #27377 · records-forms.delete-behavior-matrix · accuracy — steps[2]: stale "create … a field-zoo row with f_lookups = [both]" → should say: the field-zoo row also needs its required f_master_detail → a showcase_project (itself requiring an account) — create those first, on a third account that the probe does not delete
Parked-on: #27377 · records-forms.predicate-relationship-traversal · accuracy — fixtures.knownGaps[0]: stale "the scratch substitute is described as needing a scratch package — implies heavier provisioning" → should say: measured at c4c515a: runtime-only on a stock boot — POST /packages + PUT /meta/object for parent/child (script validation on the child) + PUT /meta/permission granting the child only + sys_user_permission_set bind; member parent GET 403 is the control
Parked-on: #27377 · platform-core.activation-ledger-row-contract · accuracy — A4/N5, variants, steps[2], fixtures.knownGaps[0]: stale "the catalog door's closed :type set is four (position, permission, sharing_rule, webhook); six-value scope wall" → should say: six door types — queue and assignment_rule were added (ADR-0142 D1/D5, catalog-activation.ts CATALOG_ACTIVATION_SUBJECTS; the 400 message lists all six); the scope wall is {flow, action, position, permission, sharing_rule, webhook, queue, assignment_rule}; bump variants (revision 9)
Parked-on: #27377 · platform-core.metadata-registry-serving · accuracy — A2 / steps[2]: stale "GET /meta/types is 'the richer Studio-facing listing … distinct from GET /meta'" → should say: /meta/types answers the same body as GET /meta through one handler (the pinned dogfood test asserts this); the route-ledger note 'richer types listing' is stale too
Parked-on: #27377 · platform-core.metadata-registry-serving · accuracy — A1: stale "automated.ref says the pin covers only dashboard/action/report" → should say: the pin also asserts every seeded registered type exposes its seed and the /meta vs /meta/types parity
Parked-on: #27377 · studio-authoring.multi-package-item-rows · accuracy — A3: stale "error.message is a single sentence" → should say: the message is the ruled two-sentence text ('… is sealed: it cannot be written here. GET /api/v1/meta/TYPE lists the names in use.') the pins assert
Parked-on: #27377 · studio-authoring.multi-package-item-rows · accuracy — steps[2]: stale "author an object package A owns at runtime" → should say: the object name must carry the package namespace prefix (e.g. pkga_…) or the save answers 422 NAMESPACE_PREFIX first
Parked-on: #27377 · studio-authoring.org-override-registry-gate · accuracy — steps[4]: stale "PUT /meta/object/qa_org_probe as a brand-new object" → should say: the body must declare sharingModel or it answers 422 security-owd-unset (authoring rule) before the create gate is visible
Parked-on: #27377 · platform-core.serve-composition-v18 · accuracy — fixtures.requires[1] / A4: stale "NODE_ENV=production with no storage service" → should say: the stack must declare at least one plugin — a plugin-less production stack takes the standalone SQLite default under OS_HOME and boots
Parked-on: #27377 · platform-core.v18-boot-refusals · accuracy — fixtures: stale "(none — note) the planted-shape route works with a run DB copy minus the marker plus an organization_id column on a no-tenant table" → should say: could name that planting recipe explicitly
Parked-on: #27377 · identity-auth.api-key-expiry-lifecycle · accuracy — A2: stale "verify: GET /api/v1/keys before and after the refused mint, and the count is unchanged" → should say: GET /api/v1/keys is a refusal-only mount (route-ledger.ts: signed-in 405 METHOD_NOT_ALLOWED, measured 405 at c4c515a); count keys with GET /api/v1/data/sys_api_key (total) before and after
Parked-on: #27377 · identity-auth.import-invitation-and-sso-domain-answers · accuracy — fixtures.requires[1]: stale "the dev mail transport (boot log mail capture) to read the sent message" → should say: the dev LogTransport logs subject and recipient only; read the body and set-password link from the sys_identity_email row (identity mails are persisted there, not in sys_email)
Parked-on: #27377 · identity-auth.implicit-account-linking-ownership · accuracy — fixtures.requires[2]: stale "the link from that mail's sys_email row — admin GET /api/v1/data/sys_email" → should say: identity mails (verification, reset, account invitation, change-email) are persisted in sys_identity_email, not sys_email (sys_email held only the org invitation mails at c4c515a); read the verify-email link there
Parked-on: #27377 · identity-auth.auth-method-matrix · accuracy — fixtures.knownGaps[3]: stale "registering one [@better-auth/sso provider] needs a reachable external IdP" → should say: POST /api/v1/auth/sso/register refuses a loopback IdP with 400 discovery_private_host unless its origin is in trustedOrigins, so the localhost IdP that unblocks generic OIDC does not unblock features.sso; the enterprise-SSO on-side needs a publicly routable IdP or a trustedOrigins host config
Parked-on: #27377 · identity-auth.auth-gate-held-session-raw-host-families · accuracy — fixtures.requires[1]: stale "an expiry / MFA-required policy in auth settings holds it with the other two codes" → should say: PASSWORD_EXPIRED needs password_expiry_days>0 AND a password_changed_at older than it (a fresh member never qualifies — age it in a scratch DB); MFA_REQUIRED also waits out mfa_grace_period_days (default 7) counted from sys_user.mfa_required_at, which is stamped on first sight, so require_mfa alone holds nobody for a week — s…
Parked-on: #27377 · integration-system.external-schema-introspection · accuracy — A1 (verify) + fixtures.knownGaps[0]: stale "Live on the SQLite fixture assert only the degradation contract (?schema=‹x> and repeated ?schema both answer 200 with the full set)" → should say: On the SQLite fixture ?schema=‹x> (e.g. main) answers 400 EXTERNAL_DATASOURCE_ERROR 'Cannot narrow the remote tables … named no schema for 2 of its 2 table(s)…' on both spellings (unattributedSchemaFilterError, the #24664 fix); empty ?schema= and the repeated key still answer 200 with the full set
Parked-on: #27377 · integration-system.email-template-render · accuracy — A7: stale "authed well-formed message lands (200 with result.status 'sent')" → should say: 200 with a top-level body {id, status:'sent', messageId} — no 'result' wrapper and no success envelope; refusals are {code, error} (e.g. {code:'INVALID_REQUEST',error:'JSON body required'})
Parked-on: #27377 · integration-system.email-template-render · accuracy — steps[5] / variants: stale "author a template with fromOverride + replyTo" → should say: fromOverride is an object {name?, address} (EmailAddressInlineSchema); a string is refused 422 INVALID_METADATA 'expected object'
Parked-on: #27377 · integration-system.email-template-render · accuracy — A1/A2 oracle: stale "oracle 'log' — capture the fast failure / TEMPLATE_INACTIVE error" → should say: the failure is recorded on sys_notification_delivery (status 'dead', error 'MISSING_VARIABLES: title' / 'TEMPLATE_INACTIVE: ‹name>'), not in the served log; read GET /api/v1/data/sys_notification_delivery
Parked-on: #27377 · integration-system.external-schema-drift-gate · accuracy — A0 (verify): stale "boot aborts with ExternalSchemaMismatchError" → should say: the served boot prints the renderDiffMessage lines ('✗ Object '‹o>' does not match its remote table on datasource '‹d>':' / '✗ missing_column: ‹table>.‹col>') after 'Bootstrap failed after plugins started'; the class name itself is not printed
Parked-on: #27377 · integration-system.notification-org-and-redeliver-eligibility · accuracy — fixtures.requires[2]: stale "create an ACTIVE webhook … (POST /api/v1/data/sys_webhook)" → should say: the create needs method lower-case ('post') and definition_json (e.g. '{"timeoutMs":5000}'), else 400 VALIDATION_FAILED
Parked-on: #27377 · records-forms.list-view-capabilities · accuracy — steps[3] / acceptance[4]: stale "string-form sort 'estimate_hours desc' (the objectui#2601 fixture)" → should say: the tabular view's sort is the array [{field:'estimate_hours',order:'desc'}] since #17053 (string arm retired); the clause scores the array sort reaching sort=-estimate_hours — the objectui#2601 string-crash fixture no longer exists on stock
Parked-on: #27377 · records-forms.list-view-capabilities · accuracy — steps[8]: stale "select rows and run showcase_mark_done" → should say: pick rows that are not done: Mark Done's visible gate hides it once any selected row is done (bar drops the button), and over a mixed selection the confirm reports 'N not eligible … skipped'
Parked-on: #27377 · records-forms.related-list-server-pagination · accuracy — steps[1]-[3], acceptance[1].verify, acceptance[2]: stale "Contacts under a shared 'Related' tab (?tab=related), page size 5, pager 'Page 1 of 6'; 'the related tabs exist'" → should say: at c4c515a the detail page has no tabs: primary related lists (Invoices, Projects) render as main-column sections; non-primary Contacts sits in the 'Related column' as a 5-row compact list with no pager (top=5&skip=0); paging is in its enlarged view ('26 records — enlarge'), 25 per page, 'Page 1 of 2' -> 'Page 2 of 2' (top=2…
Parked-on: #27377 · records-forms.gantt-interactions · accuracy — fixtures.knownGaps[0]: stale "direct drag on a locked leaf: recipe 'not run-proven', score blocked(fixture)" → should say: run-proven (QA run release-18.3.0-w3-tier1-b G4a): PUT /api/v1/meta/view/showcase_task.gantt adding gantt.lockField:'done' (view is overlay-allowed), drag a done bar (App wireframes) -> no PATCH, row unchanged; control drag of an unlocked bar on the same overlay -> PATCH 200; DELETE reverts. Only the auto-schedule half stays …
Parked-on: #27377 · RUNNER.md environment facts (map) · accuracy — 'A map view draws its markers under a Map failed to load banner': stale "markers drawn on a canvas under the amber banner" → should say: since objectstack#25889 a style-load failure swaps the map for its record list (Locations) — no canvas, no .maplibregl-marker; score the listed entries (filteredMarkers) against rows with a location
Parked-on: #27377 · records-forms.conditional-rules-grid · accuracy — fixtures.requires[1] / steps[2]: stale "amount is client-computed and stored as sent, so a line staged over the data API without amount carries amount null" → should say: amount is server-computed: POST /data/showcase_invoice_line {position:1,quantity:1,unit_price:29.99} with no amount stored amount 29.99 at c4c515a (and master-detail-batch-atomic pin asserts a client-sent amount does not stand); no need to send amount
Parked-on: #27377 · records-forms.conditional-rules-grid · accuracy — steps[5] / A2: stale "flip the header status to paid and save; observe cells lock; flip back to sent/draft" → should say: once an invoice is SAVED paid, Edit is disabled (invoice.object.ts edit.disabledWhen record.status=='paid'), so drive the lock/unlock by flipping status in the open edit form without saving
Parked-on: #27377 · records-forms.record-discussion-mentions · accuracy — A2 / steps[5]: stale "interleaves into the SAME feed, oldest-first" → should say: oldest-first holds on the record:discussion panel (e.g. project-detail page); the default record page (v3 stream, #27310 mergeTimelineStream) interleaves newest-first — say 'in time order' or name the surface
Parked-on: #27377 · records-forms.record-discussion-mentions · accuracy — A7 / steps[11]: stale "cycle the filter control through all four FeedFilterMode values (on the record detail)" → should say: the default record page now shows stream chips All/Activity/Discussion/Changes (TIMELINE_STREAM_FILTERS); the four FeedFilterMode values are offered by the record:discussion panel, e.g. a showcase_project record (project-detail.page.ts) — drive it there
Parked-on: #27377 · records-forms.form-dirty-guard · accuracy — A2.verify: stale "11 it() cases" → should say: 11 it() literals, 14 tests reported (the beforeunload describe runs for ModalForm and DrawerForm); cite 14/14 at c4c515a
Parked-on: #27377 · records-forms.conditional-rules-header · accuracy — steps[4..6] / A2 / A3: stale "names INV-1003 (paid) as the edit-form subject for the client lock and 'open INV-1003 (paid) ... tax_rate renders read-only'" → should say: a stored-paid invoice has NO edit surface (row Edit and record-page Edit disabled by userActions.edit.disabledWhen, no inline editor on its record page), so the client lock is observable only on an edit form whose Status is set to Paid (e.g. edit a sent invoice, flip Status) — or the item should say the disabled Edit IS the c…
Parked-on: #27377 · records-forms.conditional-rules-header · accuracy — N1: stale "'a PATCH to tax_rate on a paid invoice whose new value PERSISTS is a FAIL'" → should say: scope it to a PATCH that leaves status paid: a same-write {status:'sent',tax_rate:X} persists X by design (lock judged on the stored row)
Parked-on: #27377 · records-forms.action-param-widgets · accuracy — A0 (richtext variant): stale "'richtext→editor'" → should say: richtext renders RichTextField, whose editing surface is a ‹textarea> (identifiable by its 'Enter text…' placeholder / fields.richText.placeholder) — a DOM reader sees a textarea, which is correct
Parked-on: #27377 · records-forms.action-param-widgets · accuracy — A0 (date variant): stale "'date→date input'" → should say: date renders the date-picker widget (text input MM/DD/YYYY + date-picker-trigger), not input[type=date]
Parked-on: #27377 · records-forms.import-job-undo-cancel · accuracy — fixtures.provisioning teardown: stale "recipe teardown says delete ui/e2e/live/.auth/ after the run" → should say: runners sharing one tree should point storageState at a scratch path (a copied config) — the stock live/import-console configs all write the same ui/e2e/live/.auth/state.json, which parallel runners clobber
Parked-on: #27377 · records-forms.encrypted-field-behavior · accuracy — A3/N1: stale "verify says the clause is recorded blocked(fixture) on stock with the pin as 'evidence beside', while automated.ref (rev 6) now names an HTTP-door pin (encrypted-field-behavior.dogfood, bootStack with the provider unset in-proc…" → should say: state explicitly whether that HTTP pin on a non-stock in-process composition scores the clause (then pass) or stays beside a blocked(fixture) live leg; this run followed the clause text (blocked)
Parked-on: #27377 · records-forms.field-history-tracking · accuracy — N3: stale "negative[3] is a cross-ref scoping instruction ('do NOT re-score crud-roundtrip clause 5'), not a negative assertion, so it can only score skipped and keeps the item permanently partial" → should say: move it to traps/notes or automated prose; leave negative[] with assertions only
Parked-on: #27377 · records-forms.field-type-constraints · accuracy — A0: stale "clause names text/textarea/email/url/phone length but on the zoo only 'name' declares maxLength (f_textarea/f_email/f_url/f_phone declare none)" → should say: name the carrier: 'the text field name (maxLength 200)'; the other string types have no declared bound on the fixture
Parked-on: #27377 · records-forms.field-type-constraints · accuracy — A5 / steps[6] / knownGaps[2]: stale "the out-of-scope-existing-id boundary is phrased against lookupFilters, but the one lookupFilters carrier (showcase_invoice.account status!=churned) is also guarded server-side by the app's script rule no_invoice_for_churned_ac…" → should say: demonstrate the existence-only boundary on the dependsOn carrier (showcase_invoice.contact from another account -> 201), and note the churned-account case is refused by the app rule, not the reference gate
Parked-on: #27377 · records-forms.encrypted-field-behavior · accuracy — steps[0]: stale "'on a provider-wired boot ('os serve', LocalCryptoProvider)'" → should say: the canonical 'os dev' boot (which spawns 'serve --dev') wires LocalCryptoProvider too; this run's os dev boot wrote aes-256-gcm ciphertext
Parked-on: #27377 · records-forms.field-history-tracking · accuracy — A2 / N1 / steps[3] / automated.ref: stale "'the History TAB gates on OBJECT-level enable.trackHistory … the account detail renders the tab'; automated.ref says record-history-display.spec.ts holds the flag-true half" → should say: record page v3 (#27310, objectstack#27055) removed the History tab: field changes are the 'Changes' filter of the Timeline stream, fetched from sys_audit_log only when enable.trackHistory is true. Re-phrase A2 as 'the account detail's Timeline carries the field changes (sys_audit_log read) and the task detail makes no sys_aud…
Parked-on: #27377 · records-forms.field-type-matrix · accuracy — A1 / steps[2]: stale "'47 on the Specimen — Full edit form' while the form draws 49 f_* fields (f_lookups, f_users, f_owner repeat lookup/user types) — count is by TYPE, not field; location is a single 'latitude, longitude' input, not 'structured in…" → should say: say 47 TYPES across 49 f_* fields; location → its 'latitude, longitude' input, address → structured inputs
Parked-on: #27377 · records-forms.v18-semantic-defaults · accuracy — steps[0] / fixtures.requires[0]: stale "'a fresh boot: pnpm dev -- --fresh'; and no stock showcase object has >50 rows (showcase_task 11 on a fresh boot)" → should say: any own-port boot works; seed >50 scratch rows (this run POSTed 50 showcase_task rows) before the 50-row check
Parked-on: #27377 · studio-authoring.object-designer-roundtrip · accuracy — steps[1]: stale "Keep the pre-selected OWD choice and Create" → should say: …and click 'Save as draft' (the dialog's button)
Parked-on: #27377 · studio-authoring.record-page-roundtrip · accuracy — steps[0], acceptance[0], negative[0]: stale "create form = Label/Name/Page type/Object; regions seeded non-empty; regions [] is #1541 regressed" → should say: the create form has a Kind field; a record page defaults to kind 'slotted' with regions [] by design (anchors.ts createSeed); choose Kind = full to get the regions seeded from the synthesized default incl. record:highlights, and score the blank-canvas negative only on an explicit full create
Parked-on: #27377 · studio-authoring.record-page-roundtrip · accuracy — automated.ref: stale "studio-editor.spec.ts as a stable pin" → should say: on a cold vite dev console both tests can time out at getByTestId('metadata-edit-page') (5 s) while the page still shows 'Loading…'; warm rerun passes - warm the console first
Parked-on: #27377 · studio-authoring.permission-matrix-editor-ux · accuracy — steps[3]/acceptance[1]: stale "'Read all'" → should say: 'Read-only all' (buttons: Read-only all / Write all / Clear)
Parked-on: #27377 · studio-authoring.permission-matrix-editor-ux · accuracy — steps[5]/acceptance[4]: stale "the table carries min-w-[960px]" → should say: min-w-[1304px] (data-testid perm-studio-matrix inside a div.overflow-auto)
Parked-on: #27377 · studio-authoring.expression-editors · accuracy — fixtures.knownGaps[2]: stale "editor gives a non-lowerable RLS read predicate severity 'warning' and autosaves it (objectui#13061)" → should say: at c4c515a the editor raises it as an error ('…not lowerable…, so the policy is dropped and grants no access') and holds autosave ('Fix the CEL syntax errors before saving.'); only the formula-field probe still diverges (knownGaps[3])
Parked-on: #27377 · studio-authoring.expression-editors · accuracy — steps[4]: stale "record.FORMULA_FIELD > 5" → should say: the RLS editor binds fields bare (placeholder 'organization_id == current_user.organization_id'); 'f_total > 5' and 'record.f_total > 5' behave the same
Parked-on: #27377 · studio-authoring.automations-rail-and-new-flow · accuracy — fixtures.requires[1]: stale "a schedule flow (implicitly: made from New automation)" → should say: Advanced -> Schedule saves no schedule config, so the rail shows it Autolaunched until a schedule (cron/interval) is set on the Start node
Parked-on: #27377 · studio-authoring.validation-rules-authoring · accuracy — A3 + steps[2]: stale "steps[2] asks for 'state_machine on the status field (initial state plus one allowed transition)' and A3 scores invalid_initial_state for the Studio-authored rule" → should say: Studio's Validations tab authors only field + transitions (ObjectValidationsPanel.tsx has no initialStates input; spec StateMachineValidationSchema.initialStates exists), so a Studio-authored state_machine can only produce invalid_transition — an insert born 'open' answered 201. Either drop invalid_initial_state from this ite…
Parked-on: #27377 · studio-authoring.object-api-tab-curl · accuracy — N0: stale "parenthetical '(a value of the wrong type for its field)'" → should say: the measured refusal is a right-typed placeholder id ('related_record_id') that names no record → 400 reference_not_found; the negative should cover dangling reference placeholders (and the auto-included owner_id), not only wrong-type values
Parked-on: #27377 · platform-core.metadata-authoring-roundtrip · accuracy — steps[0]/fixtures.requires[0]: stale "create a writable package (… POST /api/v1/packages); record its id — with no mention of dependencies" → should say: the writable package must declare dependencies:{'com.example.showcase':'*'} in its manifest; without it publish-drafts answers 200 with data.outcome 'refused' (INVALID_METADATA rule list-view-object-outside-closure: showcase_task outside the package's closure) and acceptance[1] cannot pass
Parked-on: #27377 · platform-core.lifecycle-retention-sweep · accuracy — steps[3] / acceptance[2]: stale "'the sweep report lists sys_audit_log skipped archive-pending'" → should say: the live surface exposes no sweep report (the INFO line carries applied/reaped/reclaimed/errors/alerts only, no skipped count, and no door returns report.skipped); live leg = audit row retained, the skipped/archive-pending report is unit-only (lifecycle-service.test.ts Archiver P3 case)
Parked-on: #27377 · platform-core.protocol-18-handshake-and-stored-replay · accuracy — steps[1] / steps[2]: stale "'GET /api/v1/meta/page/PLANTED and compare with the planted body' and 'boot (os start) a ^18 dist/objectstack.json built before a retirement'" → should say: (1) a row planted into sys_metadata under a running server is served from the in-memory cache — reboot on the same DB before the GET, or the read is not the row; (2) an off-tree artifact copy needs its objectstack-runtime.‹hash>.mjs beside it and resolvable node_modules, and the default host composes no connector providers of…
Parked-on: #27377 · platform-core.url-overlay-contract · accuracy — steps[5]: stale "'from a record, drill into a related record — the URL carries from=…'" → should say: a plain click on a lookup/related link opens the record peek drawer (no from=); the from= trail is on the link's href (open in page / expand), so drive the drill by following the href
Parked-on: #27377 · platform-core.metadata-authoring-roundtrip · accuracy — steps[7]: stale "'its Page type defaults to list, so set it to record'" → should say: also set Kind=full (the form shows Kind; a record page seeded from the default layout needs full — slotted copies no regions, per the item's own r7 history); Save is an icon+text button whose accessible name includes the unsaved-dot
Parked-on: #27377 · i18n.surface-matrix · accuracy — A7: stale "the served document is 'the platform face's sixteen groups … less metadataForms … so fifteen groups' and the per-app vocabulary is fifteen groups" → should say: at c4c515a TranslationDataSchema (per-app) has 16 groups (hooks added by #26831), PlatformTranslationDataSchema 17 (+settings), ServedTranslationDataSchema 16 (apps, books, dashboards, datasets, flows, globalActions, hooks, messages, objects, pages, permissions, picklists, positions, reports, settings, settingsCommon); sourc…
Parked-on: #27377 · dashboards.analytics-exposure-gate-and-measure-aggregate · accuracy — fixtures.requires[2]: stale "'an apiEnabled:false object with a cube over it and an internal:true field' in a scratch app — object names must carry the package namespace (showcase_…), or compile refuses; and stock specimens already exist" → should say: stock boot already carries specimens for the query face: sys_jwks (apiEnabled:false → 404 OBJECT_API_DISABLED via inferred cube / inline dataset) and sys_session.token / sys_api_key.key (internal → 400 INVALID_FIELD); only the configured-cube registration refusal (A2) needs the scratch app, with objects named ‹namespace>_‹name>

Generated by Claude Code

domain:devx#1 · sunhaolin · session_017xRBcUoS2G4jgqRskpExS7

W3-UX recorded: the UI/UX browser walkthrough of the 18.3.0 RC at c4c515ad (Console built in-repo from that commit).

Tracks walked
- Track 1, Console: showcase and CRM. Admin at desktop and phone; plain member at desktop; signed out for the public form; one zh-CN pass.
- Track 2, Setup: showcase. Admin at desktop and phone; a member made through the real invite → accept → register path; two admin-created users.
- Track 3, Studio: showcase. Admin authoring a new package end to end at desktop, with a phone look; the member's refusal.
Defect cards filed: 17 — track 1: Record create: a date typed in an invalid form (13/45/2026) is silently dropped, and the record saves with an empty Due Date and a success toast #27483 Record action menu offers a member an action whose write they are refused (Recalculate Estimate), and the refusal toast is the raw flow-engine trace ("Node 'recalc_each' failed: map … subflow … update_record(showcase_task) failed …") #27487 Dashboard: a viewer whose analytics queries are all refused 403 sees a blank canvas under the title (CRM Pipeline Dashboard as a plain member), with no per-widget refusal #27491 List grid: a formula field with returnType currency renders as a bare number ("90,000.00") beside a currency field ("$150,000.00") in the showcase Projects list #27494 Public form: the "Required: Name, Email, Message" banner stays after those fields are filled and the next submit fails for a different reason #27496 zh-CN: list grid date cells render English month abbreviations ("Oct 11", "Nov 1") while the same record's page renders 2026年10月11日 #27498 Approval request page: after approving, the target summary card still reads "Status Submitted / Approved 0.00" while the request strip below reads "Status Approved" #27502; track 2: Setup › Packaged automation: a packaged action switched off keeps its button on the record page, and clicking it shows a toast naming sys_metadata_activation and ADR-0126 #27504 Packaged action activation: switching off an api-type packaged action (Ban User) does not stop it, because the activation consult runs only at action dispatch #27506 Setup routes refuse a plain member three different ways: the settings hub says "No settings registered", a settings page shows a raw capability error inside the Showcase shell, while the Setup app root shows the proper no-access page #27507 Invitation sign-up: a canceled invitation link still says "Accept your invitation", and both it and a mismatched email are refused with "Self-registration is not open on this system" #27509; track 3: Studio object designer: an edit made less than 1.5 s before switching to another object in the rail is silently discarded (the autosave debounce never sends it and no confirm is shown) #27511 Studio validation builder: "Reject the save when <optional number> greater than 40" says Valid CEL and saves, then the server refuses the rule at publish and holds back the whole package #27513 Studio list-view filter on a picklist field takes free text: typing the option's label saves a filter that matches nothing, and the runtime list shows "No records match this view's filter" with no visible filter to clear #27515 Studio field inspector: typing an existing field's API name drops the last keystroke without a message and saves the half-typed name (status → statu); a trailing "!" saves estimated_hours_ #27517 Studio cannot report or chart on the package's own objects: the report and dashboard-widget dataset pickers list only pre-existing sys_/showcase_ datasets, and Studio offers no way to create a dataset #27518 A field authored in Studio as "Checkbox — shown as a checkbox" renders as a toggle switch on the Studio canvas and in the runtime create form #27519.
Suggestion cards: console: suggestions from the 18.3.0 RC browser walkthrough: mention and discussion feedback, list selection and bulk results, refusal wording, approvals inbox, dashboards and money formatting, and phone layout #27520 (21 rows) and Setup and Studio: suggestions from the 18.3.0 RC browser walkthrough: Setup naming and machine values, invitation and user onboarding, permission-set authoring, dialog focus, Studio first run, validation and flow builders, and publish-panel wording #27521 (39 rows: 23 Setup, 16 Studio).
Counts per track (60 suggestion rows in all):
- Track 1: 7 defect cards; 18 suggestion rows (console: suggestions from the 18.3.0 RC browser walkthrough: mention and discussion feedback, list selection and bulk results, refusal wording, approvals inbox, dashboards and money formatting, and phone layout #27520 rows 1–18).
- Track 2: 4 defect cards; 24 suggestion rows (Setup and Studio: suggestions from the 18.3.0 RC browser walkthrough: Setup naming and machine values, invitation and user onboarding, permission-set authoring, dialog focus, Studio first run, validation and flow builders, and publish-panel wording #27521 rows 1–23 and console: suggestions from the 18.3.0 RC browser walkthrough: mention and discussion feedback, list selection and bulk results, refusal wording, approvals inbox, dashboards and money formatting, and phone layout #27520 row 20).
- Track 3: 6 defect cards; 18 suggestion rows (Setup and Studio: suggestions from the 18.3.0 RC browser walkthrough: Setup naming and machine values, invitation and user onboarding, permission-set authoring, dialog focus, Studio first run, validation and flow builders, and publish-panel wording #27521 rows 24–39 and console: suggestions from the 18.3.0 RC browser walkthrough: mention and discussion feedback, list selection and bulk results, refusal wording, approvals inbox, dashboards and money formatting, and phone layout #27520 rows 19 and 21).
18.2.0 HotCRM rows still reproducing at this sha:
18.2.0 rows no longer reproducing: console: suggestions from a full HotCRM browser pass on 18.2.0: clickable path steps, chart labels and empty charts, record-page Delete, list inline edit without edit rights, public web forms, and phone layouts #27355 rows 5, 6 and 11.
Inconclusive: Setup and Studio: suggestions from a full HotCRM browser pass on 18.2.0: user onboarding, packaged automation state, run-now for scheduled flows, admin lists, and Studio entry, field table, flow inspector wording and one designer per item #27356 row 22 (a 3-node flow only).

Generated by Claude Code

Navigation Menu

Repository navigation

[sweep] v18.3.0 release test sweep #27377

Why a full round, not a delta

0. The wave at a glance

1. Re-point — red rows this anchor owns

2. Checklist-accuracy findings

3. Fixture gaps, partial coverage and not-run handover

4. Retest list (SKILL §5 trigger 2)

5. Extracted elsewhere (not repeated here)

Wave 3 dispatched · 2026-10-29T04:25Z

Triage: p1 · `domain:devx` · wave anchor for 18.3.0 · 2026-10-29T04:54Z

Runner effort, recorded · 2026-10-29T04:54Z

Retest items (anchor §4) on this card

Partial coverage and fixture gaps

Checklist-accuracy findings (ledger edits for the devx lane)

Environment notes for the RUNNER

Retest list (§4): does each fix hold?

Extracted product defects (for §5)

Re-point (§1): red rows this anchor owns

Fixture gaps, partial coverage and not-run handover (§3)

Checklist-accuracy findings (§2): ledger edits for the devx lane

Retests (§4 of this anchor)

Partial coverage and fixture gaps

Questions that need a ruling

Checklist-accuracy findings (ledger edits for the devx lane)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[sweep] v18.3.0 release test sweep #27377

Description

Why a full round, not a delta

0. The wave at a glance

1. Re-point — red rows this anchor owns

2. Checklist-accuracy findings

3. Fixture gaps, partial coverage and not-run handover

4. Retest list (SKILL §5 trigger 2)

5. Extracted elsewhere (not repeated here)

Activity

objectstack-fleet commented on Oct 29, 2026

Wave 3 dispatched · 2026-10-29T04:25Z

objectstack-fleet commented on Oct 29, 2026

Triage: p1 · domain:devx · wave anchor for 18.3.0 · 2026-10-29T04:54Z

objectstack-fleet commented on Oct 29, 2026

Runner effort, recorded · 2026-10-29T04:54Z

objectstack-fleet commented on Oct 29, 2026

objectstack-fleet commented on Oct 29, 2026

Retest items (anchor §4) on this card

Partial coverage and fixture gaps

Checklist-accuracy findings (ledger edits for the devx lane)

Environment notes for the RUNNER

objectstack-fleet commented on Oct 29, 2026

Retest list (§4): does each fix hold?

Extracted product defects (for §5)

Re-point (§1): red rows this anchor owns

Fixture gaps, partial coverage and not-run handover (§3)

Checklist-accuracy findings (§2): ledger edits for the devx lane

objectstack-fleet commented on Oct 29, 2026

objectstack-fleet commented on Oct 29, 2026

Retests (§4 of this anchor)

Partial coverage and fixture gaps

Questions that need a ruling

Checklist-accuracy findings (ledger edits for the devx lane)

objectstack-fleet commented on Oct 29, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p1 · `domain:devx` · wave anchor for 18.3.0 · 2026-10-29T04:54Z