checklist: re-point the ledger lines the 18.3.0 wave-5 re-check measured as stale, and add an item for the whole-deployment export #29906

domain:devx#1 · os-warren · session_01JQwxbaZ6rLm2Spz4jKu1xe

Filing gate: ③ the maintainer's direct order. Warren, 2026-11-03 10:28Z, in the thread that dispatched the wave-5 re-check, answering that the 18.3.0 anchor #27377 is closed so these lines had nowhere to land: 「你需要可以重新开一个卡」.
Business reason (③, the order stands for it): the next checklist run on 18.3.0 or later reads these items as written; every line below is a step, verify or fixture a runner followed at 589049b0 and found false, so left as is each one costs the next run a misread FAIL, a wasted 422 or a stalled step.
Reader who acts: the domain:devx checklist ledger lane (docs/qa/platform-checklist/areas/*.json plus RUNNER.md), in one re-point PR as #29679 / PR #29815 did for the run before; and the next authoring pass for the new item in part D.
Dedupe: repo:objectstack-ai/objectstack is:issue "re-point" checklist created:>=2026-11-01 → 22 hits incl. closed. Nearest: #29679 (closed, re-point from run #29672, earlier lines), #29892 (open, ai.mcp-run-action-exposure-gate A4 and step 6 — left out here), #29819 (open, Studio boot fixtures incl. the showcase picklist — the picklist-bound-select fixture line below overlaps it; land it there if that card is first). No open card collects the rest.

Source runs (subject 589049b023d82c94508bf9fce752ea19069279e5): #29877 (W5-P0), #29890 (W5-FAIL), #29893 (W5-STUDIO), #29870 (W5-EXPORT). Brief: the 18.3.0 wave-5 brief (anchor #27377, closed).

A. From the W5-FAIL run (#29890)

• records-forms.list-view-capabilities A8 / steps[8] (and records-forms.bulk-select-all-matching steps[5]): still name POST /api/v1/apps/showcase/recalc with top-level _selectedIds; the console posts to the action door {params:{_selectedIds}} since Console: send a same-origin type: 'api' action click through POST /actions/:object/:action instead of fetching its target directly (ruling on #27506, step 3 of 3) #27611 (the door forwards flat). The re-point parked in wave 4 "once action door: a record-less aggregate api action that declares recordIdParam is refused 400 ("identifies its record by id"), so bulk "Recalculate Selection" never runs #29173 lands" is now owed.
• RUNNER environment fact "view is overlay-allowed, a view PUT answers 2xx on stock showcase with no ?package=" no longer holds (ADR-0146 D11): a bare view/email_template PUT answers 403 NOT_OVERRIDABLE; the working recipe is POST /packages/com.example.showcase/ensure-customization, then PUT ?package=com.example.showcase.custom with overrides:{package,basedOn}. Affects list-view N0/N1 staging and email-template-render's admin-edit steps.
• api-backend.error-sentences-and-unique-violation-wire-code step 0 offers /data/:object/batch as an equivalent door; it cannot answer the 400 the clause asserts.
• integration-system.connector-auth-kind-application step 1: outputVariable is retired, bind with a flow variable; a reflecting echo writes secrets into flow run output, so runners should not grep run records.
• integration-system.email-template-render: steps 9(c) should add a non-string display-name probe; each rejected send writes a sys_email row failed; the "no locale" branch is unreachable from the HTTP door (notify gives the deployment default en); the by-name read ignores ?locale=.
• automation.packaged-flow-clone-contract: the dropped-key list is 11 (overrides added); the "In com.example.showcase.custom" text is on the designer header, the list row carries an "Added" mark (Studio: an item header keeps the item name readable; chips and tools collapse first #29693).
• automation.setup-packaged-automation-board: switch text is "Switched on/off for this deployment"; a copy opens on the base pillar's URL.
• studio-authoring.packaged-automation-studio-lock step 3: the New dialog names no target, so it is provable only by creating a flow.
• platform-core.home-admin-cluster-links: an extra app-id canonicalisation hop from /apps/setup; "Keyboard shortcuts" is in the Help menu only inside an app.
• i18n.notification-localized-and-clears steps[4]: a member's popover has no Activity tab. i18n.surface-matrix: automated.ref still says --maxWorkers=2; no field-help variant (N1 reached only incidentally); knownGaps[3] (live confirm specimen) is stale.
• records-forms.adhoc-filter-sort-builder: steps[5], A3 and N2 should name the account-menu sign-out path; A2's verify reads filter and sort but not search.
• studio-authoring.dashboard-widget-and-filter-types A4 / steps[5]: add the wave-4 shape (Field filled, Options From begun) as its own case; sankey with two dimensions draws no root node.
• studio-authoring.draft-publish-lifecycle A3: GET ?mode=draft answers 400; the no-overwrite proof is the next publish serving REV2.
• studio-authoring.no-entry-property-matrix: knownGaps[0] still says lockedBy "is never shown" (stale since fix(plugin-list): a list view locked by lockedBy alone shows its lock indicator #29312); the sortable variant line should name its observable (header and Sort picker); compactToolbar/showRecordCount/resizable probe only at a non-default value; modalSize acts only on the isDefault form; conditionalFormatting is stored as a CEL envelope, so A0's byte-equal compare must accept it.
• studio-authoring.expression-editors fixture: a new object needs sharingModel or publish refuses security-owd-unset.
• ux-conventions.disabled-control-reason: knownGaps[0] stale (Archive declares its own reason, record_header placement only); the automation Enabled toggle is enabled on read-only packages; variants 4 and 5 have no stock instance; variants[2] should name the ~all item page.
• ux-conventions.write-feedback: the Invite text is the outcomeMessages.link_only copy; the per-group approval stays pending after one approval (read sys_approval_action).
• studio-authoring.access-permission-set-lifecycle: the same manage_metadata refusal answers PERMISSION_DENIED on clone and FORBIDDEN on the metadata PUT.
• Environment: a fresh DB shows a "Set the default currency" / timezone prompt over the admin's first page (workspace-timezone-prompt-decline).

B. From the W5-STUDIO run (#29893), one line per finding: item · clause · reading

• studio-authoring.picklist-bound-select · steps[3] / steps[4] / steps[8] · 'Setup -> Metadata -> Object -> OBJ_A' and 'Setup -> Metadata -> Picklist -> NAME' now redirect into Studio's All metadata area: /_console/apps/setup/metadata/object/OBJ -> /_console/studio/~all/metadata/object/OBJ (the package-scoped /studio/PKG/metadata/object/OBJ redirects to the Data pillar instead), and /apps/setup/metadata/picklist -> /studio/~all/metadata/picklist, detail /studio/com.example.showcase/metadata/picklist/NAME. Steps should name the Studio route (ADR-0146 D1 / feat(setup): Setup's metadata pages open Studio's All metadata area; the catalog's Active switch moves to each item's page #28818) as studio-authoring.object-designer-roundtrip r12 already does.
• studio-authoring.picklist-bound-select · steps[7] / acceptance[6] · 'open the new-record form of each' has no app-nav route for runtime objects in a fresh package; the drivable new-record form is the Studio Records tab 'Add record' dialog - say so.
• studio-authoring.picklist-bound-select · fixtures.requires[0] · 'Boot with --compile' is stale: since cli/dev: on an os dev boot with OS_PORT set, served connector metadata reads the build-time baseUrl (http://127.0.0.1:3000) while dispatch reaches the live port, so /meta disagrees with what runs #26130 a default os dev compiles; on a scratch copy the default boot carried the edit. Also the shared-tree edit it prescribes should be made in a scratch copy (RUNNER --no-compile / shared-checkout rule) - this run did that.
• studio-authoring.picklist-bound-select · acceptance[4] · the bound-field inspector lists only the list's OWN values (Bronze/Silver/Gold) with the note 'Values other packages add to it are offered too' - the extension's Platinum is not shown there; the clause ('the list's values shown read-only') holds, but a runner may expect the merged four.
• studio-authoring.api-written-keys-survive-studio-save · variants[0] · indexes needs a scoped unique ('organization'); a bare unique:true is refused 422 (ADR-0120 D1). variants[3] contextSelectors needs {id,label,optionsSource:{endpoint,...}} - worth spelling a valid value in the variant to save the next run two 422s.
• studio-authoring.object-designer-roundtrip · steps[4] · the 'Saved HH:MM' status line was not found in the Data pillar page text on this build; the autosave is observable as the PUT ?mode=draft 200 and the 'Draft · 1 unpublished' header chip. Wording drift only.
• studio-authoring.object-api-tab-curl · steps[1] · with the inspector panel open the flat tabs (incl. API) collapse into 'Advanced' below ~1000 px container width; return to API via Advanced or close the panel. Wording/fixture note only.
• studio-authoring.validation-rules-authoring · acceptance[1] · 'the fix sends one' holds only for a fix that differs from the last saved condition: deleting the typed error back to the saved text sends no PUT (nothing to save). The verify should say fix to a different valid condition
• studio-authoring.validation-rules-authoring · steps[2] · a state_machine rule is written once it has field + message, with transitions {}; the transition row comes after it via 'Add transition' — the step reads as if the transition is part of the first save
• studio-authoring.actions-tab-presets · steps[5] · Advanced 'New action' is written at once as {type:script,operation:update,patch:{}}; choosing 'What it does: Run a script' then holds it ('Script body ... needs a value') until a body is given. The editor now offers Capabilities checkboxes for a sandboxed-JS body, so acceptance[4] could require a body that writes (api.write) rather than one that only returns
• studio-authoring.authoring-validation-not-persisted · history r6 'not yet driven live at this URL' · now driven live: /_console/apps/setup/metadata/object/NAME redirects to /_console/studio/~all/metadata/object/NAME, Source tab autosave PUTs and the 422 banner renders
• studio-authoring.hooks-tab-authoring · fixtures.requires[2] · OS_LOG_LEVEL=info is not needed: the retry lines are WARN and print at the default warn level
• studio-authoring.validation-rules-authoring · acceptance[1] · 'an invalid condition' should name both shapes it covers: a parse error (client lint) and an engine-refused expression (the server verdict, e.g. a nullable comparison); this run's first leg drove only the first
• studio-authoring.interfaces-create-dialogs · fixtures.requires[2] · 'Studio has no dataset editor' is stale: the New report dialog now carries a 'New dataset' button (ui/packages/app-shell/src/views/studio-design/datasetCreate.tsx, engine.studio.interfaces.newDataset.*); the fixture can stay API-written but the parenthetical should say Studio can create one
• studio-authoring.report-authoring-options · fixtures.requires[2] · same stale 'Studio has no dataset editor' parenthetical
• studio-authoring.record-page-roundtrip · steps[4] · 'Save draft' is an autosave on this surface: the block pick and each property edit PUT the draft and the toolbar Save stays disabled; the step could say 'the draft autosaves, then Publish'
• studio-authoring.record-page-roundtrip · personas[1] · 'No run has yet driven the member leg on this object' is now outdated: W5-STUDIO G3 drove it as phone.demo@example.com and the authored page rendered
• studio-authoring.report-authoring-options · steps[0]/[2] · switching Report type to Joined is held (no save) until a block is added; a runner that switches type and reloads sees Summary again; worth one line in the step
• studio-authoring.custom-page-render-and-blocks · A4 / steps[7] · 'exposes the grid/kanban switch': the visualization switch is no longer a toolbar control; since objectui#12423 it is the Layout row (Grid / Kanban) inside the list toolbar's Display popover. Intent holds; the step should say Display › Layout.
• studio-authoring.custom-page-render-and-blocks · A1 / steps[4] · 'object-grid rows equal GET /api/v1/data/showcase_task': the work queue is filtered status = in_review (IN_REVIEW in command-center.page.ts), so it equals that filtered read (2 rows), not the bare list. Name the filter.
• studio-authoring.custom-page-render-and-blocks · A3 · the stock seed has every showcase_task owned by the admin, so 'a task owned by another user is ABSENT' needs a planted foreign-owned task (POST /data/showcase_task with owner_id usr_showcase_auditor_demo). Add to fixtures.requires.
• studio-authoring.custom-page-render-and-blocks · steps[8] · the env-wide draft is published with POST /api/v1/meta/page/qa_page_probe/publish (200); naming the door saves a lookup.
• studio-authoring (all page items) · fixture · a fresh org opens a 'Set the default currency' modal over the first page visited; a runner must dismiss it ('Not now') before screenshots.
• studio-authoring.multi-package-item-rows · A3 · 'the ONE ruled text every write over a sealed name reads' overclaims. Packaged object and hook names read managedItemSealedSentence. A package-less write over a packaged view or dashboard reads the ADR-0146 D11 pair remedy ('ships in … save it into ….custom'). A flow reads the Regime C sentence ('sealed against in-place edits. Declare an override … or switch it off'), pinned by protocol.sealed-remedy-kind.test.ts. Scope the clause to the kinds the ruled sentence covers (object, hook, …). The step already says 'any showcase object', so the verdict stands
• studio-authoring.org-override-registry-gate · A0 · the 403 NOT_OVERRIDABLE on object/showcase_task now carries the managed-item sealed sentence, not the registry-flag text that the source rows describe. The clause scores the code, so it is not a fail; source[0]'s 'runtime returns HTTP 403 not_overridable' framing could name the sealed-sentence regime
• studio-authoring.held-edit-publish-refusal · A2 / steps[4] · 'bind it' is not one step: after a Dataset is chosen, a KPI widget is held again on 'Values (measures) … needs a value' until a measure is picked. The step could say 'bind a dataset and a measure'
• studio-authoring.held-edit-leave-guard · steps[2] · the picklist label 'Priority' collides with any earlier run that published a Priority field on the same object (Create is then disabled with no error). Suggest 'a fresh label' or a dedicated object
• studio-authoring.held-edit-leave-guard · acceptance[1] negative half · a clean-pillar reload proves 'no prompt' only if the page has user activation (Chrome withholds beforeunload otherwise). The step should say to click inside the clean page before reloading. This run did, with navigator.userActivation.hasBeenActive=true
• studio-authoring.automations-rail-and-new-flow · A1/steps[2]/steps[5] · the dots now read 'Switched on' / 'Switched off' (refactor(studio)!: one word per item state on the All metadata tiles, headers and marks #29784/feat(i18n, app-shell): one word per state in Studio and Setup, and the permission matrix columns in Chinese #29841), not 'On' / 'Off'; the header switch reads 'Switched off' under 'Off by default · review before enabling'. Respell the quoted words
• studio-authoring.flow-status-matches-runtime · A0/A3/title · 'On' / 'Off' are now 'Switched on' / 'Switched off' in rail sr-text and header Status; toasts read 'Switched on — publish to apply' / 'Switched off — publish to apply'
• studio-authoring.org-scope-flows · fixtures.requires[1] · confirmed current at 589049b: raw package-less PUT of a fresh name answers 200, clone lands in com.example.showcase.custom, D11 shipped-name control 403. If D11's scheduled closure of package-less writes lands, this fixture loses its only door (no New in ~org) — the item then needs a new fixture recipe
• studio-authoring.flow-edge-type-authoring · steps[3] · the Condition control has no accessible label (VariableTextInput; reachable only by placeholder 'CEL expression — taken when it evaluates true'), and it is disabled while Default branch is ticked — the step should say untick Default branch first
• studio-authoring.app-and-nav-properties · steps[1] · a first visit to the app shows a 'Set the default currency' modal over the chrome (org has no default currency) — runners must dismiss it ('Not now') before reading branding
• studio-authoring.app-and-nav-properties · A5 · the Studio View picker writes the qualified 'OBJECT.view' name (gsixn_project.closed_projects) while the item's steps[0] example and the runtime accept the bare list-view name; the item should say which spelling the inspector writes; the qualified form's runtime landing was not driven this run
• studio-authoring.package-customization-counts-and-marks · A0 · 'the pair link opens com.example.showcase.custom': the link's href is the pair, but Studio redirects a pair URL to its base (customizationPairBaseOf, ADR-0146 D3), landing on /_console/studio/com.example.showcase/data; the clause should say it lands on the base's Studio (and the link title 'Open the customization package … in Studio' over-promises)
• studio-authoring.package-customization-counts-and-marks · fixtures · 'one item the pair adds (Studio's New on the read-only base, e.g. a permission set from access-permission-set-lifecycle step 6)' — this run wrote it by API; the 'Added' mark lands on it either way
• studio-authoring.access-facets-runtime · steps · 'operation read' — the picker's vocabulary is all/select/insert/update/delete; read is 'select'
• studio-authoring.permission-matrix-editor-ux · A3/steps · 'fall back to the read-only default (readable, not editable)' — after Clear a field falls back to the OBJECT grant (data-field-rule=inherited; readable+editable when the object grants edit). The verify (keys absent from the saved map) is right; the parenthetical is not
• studio-authoring.permission-matrix-editor-ux · A5 · the metadata-admin door draws no object expander on a read-only set (968 object checkboxes, no field panel), so 'field bulk absent' is only observable on the Studio Access door; say so
• studio-authoring.package-customize-restore-display · A0 · 'one ensure POST (201 on the run's first customization, 200 after)' held; note a fresh page load of the same item asks ensure again (200) on its first edit — 'once' is per editing session
• offclause.zh-cn-studio-save-29790 · Z1/step 2 · 'capture the autosave PUT body (does it carry the zh labels?)' depends on state: the first Studio save of an object with no pending draft sends the untranslated body; the zh echo only appears once a draft exists and Studio is reloaded — a check that edits once from a clean published state never exercises the restore path.
• offclause.zh-cn-studio-save-29790 · step 1 · a field translation has no description key (422 unrecognized_keys); translatable field slots are label/help/placeholder/options/inlineTitle — the check should not ask for a field description translation.
• offclause.zh-cn-studio-save-29790 · step 2 · the Studio Settings tab (object label/description form) edits the untranslated document; the translated echo comes from the 表单 field inspector — name that surface.
• offclause.zh-cn-studio-save-29790 · Z1/Z3 · the zh read of an object description is always the catalog's (支持工单) whatever the source says, so the non-label edit must be read on an en read or the stored row, never on the zh read.

C. From the W5-P0 run (#29877)

Posted on #27377 as comment 6600018008 before the anchor's state was known; it is the list of record. Two lines to carry here: studio-authoring.first-run-loop knownGaps[3] is stale since #29790; RUNNER's "Packaged Automation" entry is stale after ADR-0146 D11.

D. New item: the whole-deployment export (from #29870)

No ledger item covers GET /api/v1/packages/export (#29755), withheldMaps (#29746) or os package export. Proposed, for the authoring pass:

• id: platform-core.package-export-round-trip, surface api + cli, priority P1, since 18.3.0.
• Acceptance:
  1. As a holder of studio.access or setup.access, GET /api/v1/packages/export answers every package whose registry row is not source: code exactly once, a disabled one included, dependencies first (a pair after its base when both are listed; a pair of a code base exported alone).
  2. Each entry equals GET /api/v1/packages/:id/export for that package, byte for byte; client.packages.exportAll() returns the same bundle.
  3. A connector header/env map is absent from the entry and named in withheldMaps (positions only, no header name or value in the bundle text).
  4. A disabled package's entry carries its own items (currently fails: runtime: a disabled package exports as an empty shell (GET /packages/:id/export and the whole-deployment bundle drop its items), so a re-install loses them #29871).
  5. os package export --out DIR writes one NN-ID/objectstack.json per entry in the read's order, each equal to its entry.
  6. On a fresh boot, installing each directory in order (os package install or POST /marketplace/install-local) answers 200, serves every object, field, flow, connector and pair extension, names each withheld map in the answer, and logs one WARN per package that has them.
  7. The target's GET /packages/export equals the source's apart from withheldMaps (currently fails: runtime: a package export omits the objectExtensions of a package installed through install-local, so an exported .custom pair loses its extension fields on the second export hop #29872).
• Negative: any query parameter → 400 VALIDATION_ERROR naming it; a member without either capability → 403 PERMISSION_DENIED; anonymous → 401; --out holding files → exit 1, nothing written; installing an entry before its dependency → 422 DEPENDENCY_MISSING.
• Source anchors: packages/runtime/src/domains/packages.ts#assemblePackageExportBundle, #assemblePackageManifest, #withheldConnectorMaps; packages/spec/src/api/package-lifecycle.zod.ts#PackageExportBundleSchema, #PackageExportManifestSchema; packages/cli/src/commands/package/export.ts; packages/cloud-connection/src/marketplace-install-local-plugin.ts#judgeWithheldMaps; packages/client/src/index.ts (packages.exportAll).
• Automated (existing, partial): packages/runtime/src/domains/packages-export-bundle.test.ts (dispatcher over a stub protocol), packages/qa/dogfood/test/package-export-bundle-round-trip.dogfood.test.ts, export-withheld-connector-maps.dogfood.test.ts, package-export-reinstall-custom-pair.dogfood.test.ts, packages/cli/test/package-export.test.ts.
• Fixture recipe: the ontology table in QA run · release-18.3.0-w5-export (1/1) · 589049b0 · 2026-11-03 · 0 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #29870 (authored package with object/flow/header-map connector via POST /packages + ?package= drafts + publish-drafts; ensure-customization + object_extension with a __c field; one install-local package; one authored package depending on the first, published then disabled). Two boots from scratch copies (install-local writes .objectstack/installed-packages/ under the cwd).

Acceptance notes

• Each line is re-read at the PR's base before it is applied; a line the ledger already fixed is skipped and named in the PR body.
• Part D lands as a new item with status and pins per the ledger rules; its two failing clauses cite runtime: a disabled package exports as an empty shell (GET /packages/:id/export and the whole-deployment bundle drop its items), so a re-install loses them #29871 and runtime: a package export omits the objectExtensions of a package installed through install-local, so an exported .custom pair loses its extension fields on the second export hop #29872.