docs(qa): re-point six stale platform-checklist clauses across five items to the shapes their rulings shipped

[objectstack-fleet]

Fixes #23950
Clause-②: no

Six platform-checklist clauses across five items pinned shapes that rulings and PRs have since moved. Each was red in a QA run against a product that is right. This PR re-points each clause to the shape that shipped. Each item's revision is bumped and a history row names #23950 and the ruling or PR that moved the shape. No clause is loosened past its ruling: each one still fails if the product broke the ruled behaviour. The diff is docs/qa/platform-checklist/areas/{ai,cli,approvals,platform-core}.json only (+110 / −64, four files). No product code changes.

All five items were re-run against a real showcase boot built from this tree's product sources (fb82f9b1, whose product tree is origin/main 022c6e799). One record per item: #23995, #23996, #23997, #23998, #23999. The six re-pointed clauses all pass. One item, platform-core.shell-nav-personalization, fails on a different clause (0, icon-mode navigation) because of a console defect this run found. That clause is not one this card touches (see Acceptance notes).

Per clause

1. ai.mcp-stdio-fail-closed clause 6 (r4 → r5; from record #23915)

• Old pin: the generic error text MCP stdio identity is no longer valid (key revoked or expired), scored from a log line.
• New clause: revocation is honored on the next call and fails closed. The post-revoke call serves no row and is a tool error whose envelope carries code API_KEY_REVOKED and status 403. A pre-revoke read on the same session is the control. The oracle is the tool result (api). The message's wording is not pinned: the code is what a client branches on, and API key refusal API_KEY_REVOKED says "a revoked key never works again", but the declared restore_api_key action brings the same key back to 200 #23944 is rewording that text.
• Cites: packages/mcp/src/plugin.ts resolvePrincipal ([Decision] API key 的生命周期与存放：到期上限与不活动失效取多长，key 继续放自有 sys_api_key 还是迁到 @better-auth/api-key（#23287 裁决 C′ 的留项） #23367; it raises ApiKeyLifecycleRefusalError), packages/core/src/security/api-key.ts#lifecycleRefusalOf, and packages/mcp/src/mcp-http-tools.ts#errorResultWithCode.
• Re-run (QA run · ai.mcp-stdio-fail-closed (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23995): pass. Before the revoke, 1 row. After PATCH /api/v1/data/sys_api_key/KEY_ID {"revoked": true} (200), the next query_records returns isError with {"error": {"code": "API_KEY_REVOKED", "status": 403, …}} and no records key.

2. cli.migrate-meta-codemod clause 7 (r4 → r5; from record #23921)

• Old pin: a restart condition, "--help lists exactly from/to/step/out/stored/database-url/apply/yes/force/type/json, with no in-place rewrite flag".
• New clause: the item's own restart trigger fired (feat(cli): os migrate meta --write — the AST codemod that rewrites authored sources for the mechanical applied set (v18) #9591 is done: --write landed in PR feat(cli): os migrate meta --write — write the chain's mechanical edits into the authored sources #22108, and PR fix(spec): the retirement sentence names --write: it applies the edits it can prove, you apply the rest #22142 named it in the house sentence). As revision 3 prescribed, the rewrite assertions come back rather than the clause being deleted. --write rewrites in place exactly the mechanical edits it can trace to one literal in one project file. It lists every other edit with a closed-set refusal kind and writes no semantic advisory. Every byte outside a written site is unchanged. The write is held to a re-run of the chain (restored, exit 1, on disagreement). A second --write writes nothing.
• Cites: packages/cli/src/commands/migrate/meta.ts#printWriteOutcome and MigrateMeta.writeSources, packages/cli/src/utils/authored-source-codemod.ts#CodemodRefusalKind, and the packages/cli/test/migrate-meta-write.test.ts pin.
• Re-run (QA run · cli.migrate-meta-codemod (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23996): pass. Wrote 7 of 7 mechanical change(s) into 4 file(s). Re-ran the chain over the written sources: no mechanical change remains. diff -r touches only the 7 listed sites. The second --write prints the no-change line. --write --json: write.status written. A helper-built plant was refused as [helper], which the item's knownGap names as the contract working.

3. approvals.approver-resolution-matrix clauses 4 and 5 (r2 → r3; from record #23926)

• Old pin: under the default admin_rescue, the request opened on the literal type:value slot (position:qa_nobody, queue:support) and waited for the Approval routed to an empty position permanently locks the record (no admin override, no recovery) #3424 override.
• New clauses: since the approvals: an empty slate under onEmptyApprovers: 'admin_rescue' opens on the tenant's administrators as named approvers, not as a nameless rescue request (retires the #22725 unstaffed arm) #22824 ruling (PR feat(plugin-approvals): an empty admin_rescue slate opens on the organization's administrators; retire the unstaffed arm #22850), an empty slate opens on the request organization's administrators as ordinary approvers. The abandoned literal and its reason are recorded in node_config_json.__resolvedFrom (admin_rescue:abandoned, admin_rescue:reason). A routed-to-administrators system comment lands on the request, a WARN names the routing, and the request stays pending. The queue clause keeps its 审批节点「处理人 Value」应改为记录 lookup(现查 metadata 端点→只能手填);附 approver value 语义核实 + queue 未实现 #3508 warn and its never-a-fake-approval property. The fail, auto_approve and fallback legs are unchanged. A new negative fails the retired nameless request.
• Cites: packages/plugins/plugin-approvals/src/approval-service.ts#organizationAdministrators and emptySlateReason, and the admin-rescue-named-slate.integration.test.ts pin (11/11 green on this tree).
• Re-run (QA run · approvals.approver-resolution-matrix (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23997): pass. The administrators are the members whose resolved sets hold organization_admin(_no_bypass): here, only the org owner. admin_rescue and queue requests open on [the owner], with the abandoned literal in __resolvedFrom and the comment Routed to this organization's administrators because the approver slate named no one: …. auto_approve's review.autoApproved reads true on the approve edge.

4. platform-core.shell-nav-personalization clause 5 (r2 → r3; from record #23939)

• Old pin: app/section/record breadcrumbs on a record route, each crumb navigable.
• New clause: the header's crumbs follow the route. A report draws one crumb, its label, with no 「Reports」 type crumb. A system/* route draws System then its section. An object route (list, view, record) draws no crumb after the PREVIEW chip. Crumbs are plain text and rebuild on reload. "Each crumb navigates" is withdrawn by that contract, not relaxed. The clause still fails if a crumb returns on an object route, if a report or system route loses its crumb, or if a type crumb comes back.
• Cites: objectui packages/app-shell/src/layout/AppHeader.tsx (objectui#12461, objectui#12526, objectui#12273). It was read at the run's pin daeb77fc and again at f8267df9, the pin main moved to during this work (chore(objectui): move the console pin to f8267df93aba, past the spec deletion of checkPageComponentViewData #23973). objectui#12605 there only adds the product mark before the pill.
• Re-run (QA run · platform-core.shell-nav-personalization (1/1) · fb82f9b1 · 2026-10-16 · 0 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #23998): pass. Report: one crumb, Hours by Status (Summary). system/settings: System, Settings. Record: none, with the page heading Fabrikam. 0 links after the chip. Identical after reload.

5. platform-core.activation-ledger-row-contract clause 4 (r2 → r3; from record #23939)

• Old pin: the scope wall {flow, action}, and "a permission/position row is a FAIL" on the 2026-08-26 Ledger convergence: registration home + one store implementation + permission-set convergence (ADR-0126 §4/§8, maintainer-ruled bundle) #12159 ruling.
• New clause: the wall is the four values the shipped doors write: flow, action, position, permission. ADR-0131 D3 moved the position and permission-set switch into this ledger (regime C as ADR-0131 D6 amends ADR-0126 §3), superseding Ledger convergence: registration home + one store implementation + permission-set convergence (ADR-0126 §4/§8, maintainer-ruled bundle) #12159. The clause gains a door-side leg: a :type outside the two (capability) and an audience anchor (everyone) answer 400 and leave no row. It still fails on a fifth type or an anchor row. The item's own knownGap asked for exactly this revision when a third writer shipped.
• Cites: packages/runtime/src/domains/catalog-activation.ts#handleCatalogActivationWrite and packages/core/src/security/resolve-authz-context.ts#readDisabledCatalogNames.
• Re-run (QA run · platform-core.activation-ledger-row-contract (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23999): pass. Four OFF switches return 200 and leave distinct metadata_type {action, flow, permission, position}. The capability probe answers 400 (:type one of position, permission) and the everyone probe answers 400 (audience anchor); the row count is unchanged after both.

Other edits inside the same revisions, each re-measured on the re-run

• ai.mcp-stdio-fail-closed clause 1: same ruling, same item. The up-front admission refuses a lifecycle-refused key with [MCP] OS_MCP_STDIO_API_KEY is refused (API_KEY_REVOKED): …, not the did-not-resolve text. The clause now names both refusals, and a new step restarts with the just-revoked key. Measured: exit 1 with that line. Neither clause pins the lifecycle message's wording.
• cli.migrate-meta-codemod: the title, fixtures, third knownGap, step 2 (the current house sentence), clause 1 (scoped to runs without --write) and the mutation negative follow feat(cli): os migrate meta --write — the AST codemod that rewrites authored sources for the mechanical applied set (v18) #9591. Measured on the re-run and corrected in the same revision:
  • Step 8 called the stock tree canonical for --from 17, but it lists 3 flow-decision-mode-inclusive-explicit edits. The canonical source is now the tree the write leg wrote, and the identical-run diff normalizes the (Nms) stamp.
  • Step 8's parenthetical said the runtime was at PROTOCOL_MAJOR 17. It is 18 since feat(spec)!: PROTOCOL_VERSION 17 → 18 in an ordinary PR — regenerated spec-changes.json and upgrade guide, ^18 handshakes, pre-mode lockstep exception (#22085 Q1 → B) #22215, which the run's Chain: line prints.
• approvals.approver-resolution-matrix fixtures: the data API refuses sys_team writes (measured 405) and sys_user.manager_id (measured 403). The fixtures name the doors that work instead: POST /api/v1/auth/organization/create-team and add-team-member, and POST /api/v1/auth/admin/set-user-manager.
• platform-core.activation-ledger-row-contract: steps 1 and 5 flip and re-enable all four switches (clause 3 follows). The variants, the knownGap's writer list, the title, a negative and the sources follow, and the Ledger convergence: registration home + one store implementation + permission-set convergence (ADR-0126 §4/§8, maintainer-ruled bundle) #12159 citation is marked superseded.

Verification (final head c4bf2ba4e)

Gate list derived with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. It reports 13 commands, and each exited 0 with its exit captured before any pipe:

• check-ci-filter-parity
• check-closing-keyword-parity and its --self-test
• check-comment-mask-corpus
• @objectstack/lint check:doc-formula-expressions
• check:cross-package-test-inputs
• check:doc-authoring
• check:driver-memory-census
• check:gitlink-declared
• check:nul-bytes
• check:platform-checklist
• check:refd-timer-probe
• check:watch-hint-literal

--ran with exit codes: 13 derived, 13 run, 0 NOT-MEASURED, 0 UNRUN. check-governed-merges --branch: NOT governed, 174 changed lines. Tier 1 pins on the run tree: mcp plugin.test.ts 17/17, objectql action-activation.test.ts 18/18, service-automation flow-activation-ledger.test.ts 47/47, dogfood packaged-activation-ledger-reach 11/11. Supporting suites: cli migrate-meta-write.test.ts 23/23 and plugin-approvals admin-rescue-named-slate 11/11.

docs/qa/** ships in no package, so no changeset.

Acceptance notes

• The re-run found three product defects outside this card. They are handed to the dispatching seat for their own cards (the runner files none):
  • objectui sidebar, icon mode: the invisible group label (SidebarGroupLabel: -mt-8 and opacity-0, with pointer events still on) covers the lower half of the item above it. On stock showcase the Page Authoring icon does not route on a centre click. This is platform-core.shell-nav-personalization clause 0's fail in QA run · platform-core.shell-nav-personalization (1/1) · fb82f9b1 · 2026-10-16 · 0 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #23998, with a full reproduction there.
  • os start used as an MCP stdio host: a client that writes initialize at spawn has that line read as serve's positional config argument. The boot falls back to the artifact on the default host, and the initialize goes unanswered.
  • The showcase flow showcase_approver_bindings is status: 'draft' and its docblock says that keeps it out of the runtime, but draft flows fire their triggers. Every showcase_field_zoo update opens an admin_rescue approval request.
• Harness observation, not filed: the nav scripts restore a saved browser state per script. Replaying a stale objectui-favorites cache brought an unpinned entry back. That is this harness replaying old state, noted in QA run · platform-core.shell-nav-personalization (1/1) · fb82f9b1 · 2026-10-16 · 0 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #23998.
• The interrupted first run of this dispatch left examples/app-showcase/objectstack.config.bundled_*.mjs (gitignored) in the worktree. It was removed before the re-run.
• The console bundle the browser item ran on was a vite build of an objectui checkout at the pin. It carries no sdui.manifest.json, which only the boot's page-source warning reads.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · ACCEPT · PR #24000 (draft, head c4bf2ba4e, Fixes #23950) · domain:devx seat 2 · session_016PVjjuVPte5XEJvaQx1E4t · 2026-10-16T17:24Z

Checked on GitHub and against the sources, not on the report's say-so. The dispatch's first run was lost to a container restart. Its commits survived, and the resumed run verified them, finished them and opened this PR.

• Shape:

  • 4 files, +110 / −64, all docs/qa/platform-checklist/areas/*.json. That is inside the claim's surface (6218158623).
  • Not governed: check-governed-merges --pr 24000, run by this seat, reads 0 of 4 paths.
  • The body opens Fixes #23950, then Clause-②: no.
  • The diff is ledger only, so the seat applied skip-changeset in this act.

• Clause 6 of ai.mcp-stdio-fail-closed, read by this seat on the diff:

  • The clause now fails closed by its code. A post-revoke query_records on the same session returns isError, its envelope parses to {error: {code: 'API_KEY_REVOKED', status: 403}}, and it carries no row. The verify line says "Score the code, the status and the absence of rows, never the message's wording".
  • Clause 1 pins the plugin's own is refused (API_KEY_REVOKED) wrapper.
  • Neither pins the lifecycle message that API key refusal API_KEY_REVOKED says "a revoked key never works again", but the declared restore_api_key action brings the same key back to 200 #23944 rewords. This follows the seat's mid-round message after the engine seat's declaration 6219272459.
  • The failure line keeps a post-revoke row as a P0 FAIL. No clause is loosened past its ruling.

• The other clauses, as the report states and the diff shows:

  • cli.migrate-meta-codemod covers the shipped --write / --all;
  • approvals.approver-resolution-matrix covers the administrators' slate (approvals: an empty slate under onEmptyApprovers: 'admin_rescue' opens on the tenant's administrators as named approvers, not as a nameless rescue request (retires the #22725 unstaffed arm) #22824);
  • platform-core.shell-nav-personalization covers the current header crumbs;
  • platform-core.activation-ledger-row-contract covers the position / permission writers (ADR-0131 D3/D6).

  Each item bumps revision and gains a history row.

• Re-runs, on fresh boots of this tree (fb82f9b1):

  record	item	result
  QA run · ai.mcp-stdio-fail-closed (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23995	ai	8/8
  QA run · cli.migrate-meta-codemod (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23996	cli	8/8
  QA run · approvals.approver-resolution-matrix (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23997	approvals	6/6
  QA run · platform-core.activation-ledger-row-contract (1/1) · fb82f9b1 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #23999	ledger	6/6
  QA run · platform-core.shell-nav-personalization (1/1) · fb82f9b1 · 2026-10-16 · 0 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #23998	shell-nav	6/7

  All six re-pointed clauses pass. Shell-nav's one fail is clause 0, which this card does not touch. It is a product defect in the console's icon-mode sidebar, routed below.

• Gates:

  • Local: 13 derived, 13 exit 0, --ran 0 NOT-MEASURED. This includes check:platform-checklist.
  • CI at report time: 1 red, Check Changeset, which clears with skip-changeset.

• Routed by this seat from the report:

  • three product defects, filed as their own cards in this act: the sidebar label overlap (objectui), os start reading MCP stdin as its config path, and the showcase's draft approver flow firing;
  • the close-out of source records QA run · area:ai (9/9) · 94114c1f · 2026-10-16 · 8 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #23915, QA run · area:cli (17/17) · 94114c1f · 2026-10-16 · 16 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #23921, QA run · area:approvals (18/18) · 94114c1f · 2026-10-16 · 17 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #23926 and QA run · area:platform-core (30/30) · 94114c1f · 2026-10-16 · 27 PASS / 1 PARTIAL / 2 FAIL / 0 BLOCKED / 0 NOT-RUN #23939, which stays with the wave anchor qa(checklist): run the whole platform checklist on main (selector all, 272 items) and extract every new failure into its own card #23878's seat.

• Landing: once every check on this head reads green, the seat readies the PR, arms auto-merge, and confirms the merge on origin/main.

---

Generated by Claude Code