docs(qa): re-point the half-A platform-checklist items that described an older product

[objectstack-fleet]

Part of #24036
Clause-②: no

Half A of the ledger card: the stale items in eight area files under docs/qa/platform-checklist/areas/. Those files are access-security, ai, search, api-backend, approvals, attachments-storage, automation and cli. Half B owns the other eight files and is a separate PR. This PR does not close the card, which stays open for half B.

Each revised item gets the following:

• a bumped revision;
• a history row naming platform-checklist: revise the items the #23878 full run and the #23879 since:v18 run found stale (knownGaps, steps, fixtures, oracles, source anchors across 15 areas; no clause red) — ledger follow-up #24036 that carries the reading;
• a green node scripts/check-platform-checklist.mjs.

Where a revision changed a fixture, a step's request or an oracle, the item was re-run once against a real app built from this tree (checklist-test §3). That means framework c91af8ed6 with the console at objectui f8267df93aba. The re-runs are recorded in one qa-run record per area:

area	record	judged	verdicts
access-security	#24104	12/35	1 pass, 11 partial
ai	#24105	5/10	1 pass, 4 partial
search	#24106	1/8	1 partial
api-backend	#24107	11/27	11 partial
approvals	#24108	8/20	1 pass, 7 partial
attachments-storage	#24109	5/11	5 partial
automation	#24111	10/22	10 partial
cli	#24114	9/22	9 partial

partial here is the derived verdict of a scoped re-run. The clauses a revision touched were driven and passed, and the item's other clauses were skipped as outside the run. No clause failed in any record. Product code is untouched, and the only changed paths are the eight area files: +659 / -316.

What changed, per item

access-security (15 items)

• write-path-guards r5:
  • the steps now give the wire shapes (bare-array createMany, {records:[{id,data}]} updateMany);
  • the mixed-outcome step sends continueOnError, because the default run stops at the first failure.
  • Re-run in QA run · access-security (12/35) · c91af8ed · 2026-10-17 · 1 PASS / 11 PARTIAL / 0 FAIL / 0 BLOCKED / 23 NOT-RUN #24104.
• readonly-package-locks-studio r5: step 5 says the package manifest needs type and the scratch object needs sharingModel. Re-run.
• crud-permission-matrix r6:
  • 45 rows, 4 of them delegate rows;
  • the [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057 known-fail gap is removed, because [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057 closed and the in-subtree create answers 201.
  • Re-run.
• fls-mask-and-strip r4: clause 4 scores the two budget controls the form renders. budget_remaining is a formula field and is not on the form. Re-run in the browser.
• sharing-rules-widen r2:
  • the position variant is confounded by manager depth, so it is recorded but not scored, and the clauses run on the unit rule;
  • A13 edits the sys_sharing_rule row, because sys_record_share PATCH answers 405;
  • a manual share needs object-level read.
  • Re-run.
• record-share-grant-revoke r5: source[1] names sharing-routes.ts#registerSharingEndpoints. Anchor only, no re-run owed.
• audit-log-browser r5: a fresh member gets 403 at the object gate, so the parent-record gate rests on the plugin-audit visibility pins. Re-run.
• public-form-intake r3:
  • the anonymous row's owner_id is null;
  • /forms/:name answers 302 to /_console/f/:name.
  • Re-run.
• share-link-capability-tokens r7:
  • Vary includes the two share-password headers, because CORS appends Origin;
  • an email audience gives a uniform 404 INVALID_OR_EXPIRED;
  • emailAllowlist is required.
  • Re-run.
• sharing-rule-authoring-ui r3: two rules are seeded, one on showcase_contact, and the Setup nav source is corrected. Wording only.
• capability-declaration-lifecycle r4:
  • sys_capability is retired;
  • the dispatcher /actions domain is the surface;
  • the regrant leg runs on a clone, because showcase_ops is sealed;
  • step 6 now says a platform-name shadow is refused at boot, while validate and build pass it.
  • Re-run, build legs included.
• activation-write-operator-gate r3: the posture oracle is the Tenancy: single banner line. Re-run.
• platform-owner-email-anchor r3: the entitled leg now precedes the malformed list, so the sibling check discriminates. Re-run on one scratch DB across five restarts.
• record-view-read-audit r2:
  • the stock leg boots at OS_LOG_LEVEL=info with a positive control;
  • the stock leg reads showcase_account, because a baseline member is refused showcase_contact;
  • a scripted scratch-copy recipe covers the configured half.
  • Re-run on both halves.
• share-link-landing-page r3: the objectui pin text is updated to f8267df93aba. Wording only.

ai (6 items)

• mcp-validate-expression r3: the field is estimate_hours, not est_hours. Re-run in QA run · ai (5/10) · c91af8ed · 2026-10-17 · 1 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 5 NOT-RUN #24105.
• mcp-run-action-exposure-gate r3: list_actions takes no arguments; objectName answers -32602. Re-run.
• mcp-http-surface r3: resume_run is in the tool list. Re-run.
• agent-tool-skill-metadata-roundtrip r5: ?mode=draft answers 400 VALIDATION_ERROR. Re-run.
• mcp-stdio-fail-closed r6, residual:
  • a fixture note: on os start, a sign-in that carries a Cookie header and no Origin answers 403 MISSING_OR_NULL_ORIGIN, while os dev accepts it;
  • cookie-less sign-in and key minting are unaffected.
  • Runner note only.
• skill-instructions-mcp-prompts r2:
  • step 5 names what makes a source edit live (the watcher's rebuild and restart, objectstack build or --compile) and the runtime PUT route;
  • a bare restart serves the stale dist at /meta while the MCP projection follows the source (measured).
  • Re-run, pass.

search (2 items)

• pinyin-flag-both-sides r4:
  • wf is the contact 王芳, not an account;
  • the roster reads 51 vs 52, and the one-plugin difference is the oracle.
  • Re-run on both boots in QA run · search (1/8) · c91af8ed · 2026-10-17 · 0 PASS / 1 PARTIAL / 0 FAIL / 0 BLOCKED / 7 NOT-RUN #24106.
• global-search-skips-unreadable r2: the flag defaults ON through zh-CN, so a run must set it false. Wording only.

api-backend (11 items, re-runs in #24107)

• error-envelope-ledger r4: BATCH_NOT_ATOMIC needs a top-level atomic:false.
• bulk-write-contract r2: the doors are id-based, and the member has no allowDelete.
• package-rest-lifecycle r3: scope project, and clause 4 scores 400 VALIDATION_ERROR instead of message text.
• route-ledger-live-parity r4: 18 families; the reports family was retired.
• server-timing-admin-gated r4: the spans are parse, db, serialize, handler and total.
• rest-metadata-config-contract r4: the masking fixture is showcase_project with client_liaison.
• aggregate-contract-matrix r2: it now uses search:qa-contributor-bound-member.
• batch-transactional-discovery r5: project is required.
• enforce-or-remove-authoring-gates r4: the strip-by-design control is an unknown key on RestServerConfig.routes.
• declarative-endpoint-execution r3: three endpoints; os build reports "3 APIs".
• retired-def-refusal r2:
  • steps sample defs by carrier. A def is either reached through a retired-key tombstone (manifest.loading, agent.lifecycle) or is a zero-consumer schema export, driven through its import.
  • the control is an invented stack key and an invented type.
  • No clause changed.

approvals (8 items, re-runs in #24108)

• approver-resolution-matrix r4 (residual): the bindings flow ships obsolete, and there is a runtime flow door.
• ooo-delegation-reroute r6: runtime flow registration on stock. Full re-run, pass.
• status-mirror-field r2: runtime flows; scoped re-run.
• per-group-signoff r7: a mismatched actorId is refused 403 "cannot act as".
• decision-action-matrix r5: request-info is approver-only.
• email-action-token-door r3: the dead-slot leg reassigns with from.
• record-page-decisions r2: the served route is /record/:id, and a non-override persona now covers the both-sides clause.
• pending-count-surfaces r2: the The Account app's Notifications entry 403s for every non-admin — no permission set grants sys_inbox_message #7344 gap is stale; member surfaces were measured with ten pending approvals.

attachments-storage (5 items, re-runs in #24109)

• attach-requires-parent-edit r7: a non-reader outsider gets 404, a reader outsider gets 403.
• sys-file-status-pipeline r3: the hooked re-attach un-tombstones, and the tombstone-download pin is named.
• upload-session-abort r4: a bogus eTag gives 409 before the backend, so failed is reachable only through the test seam.
• field-accept-maxsize-server-enforced r2: 400 ERR_FILE_CONSTRAINT; the oracle moves from log to api.
• download-authz-both-sides r5:
  • step 7 drives the reachable shape: persona A's open panel, A's grant revoked, then Download;
  • persona B never reaches the panel.
  • Re-run in the browser.
• The qa-scratch-authz recipe mints three invited members and pins the three permission-set payloads.

automation (10 items, re-runs in #24111)

• trigger-type-matrix r4 and time-relative-trigger r3: the scheduled legs need OS_AUTOMATION_SCHEDULED_WORK_ENABLED=1.
• These five walk a task to done through in_review with its required project:
  • flow-node-type-matrix r6;
  • flow-error-handling r4;
  • packaged-flow-subflow-disable-refusal r3;
  • connector-dispatch-matrix r3;
  • flow-toggle-kill-switch r3.
• flow-node-type-matrix also names the self-pinging http recipe.
• connector-dispatch-matrix's premise guard reads the exported OS_PORT and a completed run, because /connectors carries no baseUrl.
• trigger-status-contract r2: the qa_always_fails recipe authors an errorMessage.
• packaged-flow-disable-durable r3: the log corroboration needs --log-level info.
• packaged-flow-clone-contract r3:
  • the automation: a cloned packaged flow reaches no Studio surface — the clone is stored with no package, and every Studio Automations rail lists only package-scoped flows #21332 reachability expected-fail is stale (objectui#11553), because Studio's org scope lists and opens the package-less clone;
  • the clone survives a cold restart and still dispatches.

cli (9 items, re-runs in #24114)

• hook-body-extraction-gates r3: the expected-fail flipped. The default build prints "N handlers could not be lowered…", --json carries bodyExtractionWarnings, and the clause now fails if that goes silent.
• build-own-contract r5: the advisory key sits at a strip-mode site (a field's object-form visibleWhen) under strict:false; a key on a field is a hard refusal.
• dev-automigrate-policy r2:
  • the datasource is named and mapped as default, because a datasource named default is refused;
  • drift is staged with storage.notNull;
  • relax_not_null is needs_confirm;
  • the safe specimen is a planted legacy unique index;
  • the schema dump replaces os migrate plan as the pending oracle (see below).
• dev-boot-contract r5: the config-declared default is a named datasource plus datasourceMapping {default:true, datasource}.
• migrate-duplicates-inventory r7: the overlay index is (type, name, package_id, bundle_member), and sys_metadata has no organization_id.
• doctor-health-report r3: the staged config must load. A malformed view body makes doctor skip config analysis, while a well-formed orphan container loads.
• datasource-introspect-codegen r5: the scratch namespace must match the draft's prefix.
• scaffold-console-first-paint r4:
  • the port lever is OS_PORT / -p;
  • the scaffold serves its own installed @objectstack/console, not .objectui-sha.
• scaffold-first-run r5: on the 18 line, skills sync from @objectstack/skills in node_modules and are compared against that package's catalog.

Findings disproved or routed (no ledger edit)

• api-backend.date-range-preset-matrix: disproved. No item text claims where a rolling window ends, and last_7_days ends today as the item already implies.
• cli.doctor-health-report ("orphan-view staging needs strict:false"): only half held. A malformed body is refused by the default load, but a well-formed orphan container loads under the default defineStack. The step now says which.
• approvals.quorum-m-of-n duplicate-slot count is product-side (approvals: the decision-progress line's "N eligible approvers" counts pending_approvers slots, so one person holding two slots is counted twice (5 eligible shown for 3 people) objectui#12781).
• automation.flow-runs-page-test-trigger picker labels are product-side (console Flow Runs page: the flow picker shows only machine names — it reads the label from it.spec.label, but meta.getItems('flow') serves flattened items whose label is top-level objectui#12783).
• The public-form heading pointer was withdrawn by comment 6225030762.

Left, with reason

• automation.time-relative-trigger: only the binding leg was re-run. The due-date sweep was not driven.
• approvals.status-mirror-field: the returned / maxRevisions / cascade legs were not re-run.
• access-security.platform-owner-email-anchor clause 6: the posture-split unit pins were not run in this pass.
• The two scaffold items were measured from create-objectstack@next (18.0.0-next.2). @latest is 17.7.0 and depends on no @objectstack/skills.
• docs/qa/platform-checklist/RUNNER.md is outside this card's file surface but still says two stale things:
  • its connector self-URL fact reads a baseUrl that /automation/connectors does not carry;
  • its scheduled-work notes predate the opt-in.
    These are reported for the seat; this PR does not touch RUNNER.md.

Acceptance notes

• Open PR refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054's anchor line in access-security.json (public-form-withdrawal-layers) is untouched.
• Observed outside any clause: os migrate plan on a project whose primary store is a config-declared datasource "Examined 0 managed table(s)" and printed a PARTIAL plan, while the dev boot of the same config reported three drifts in that file. The report carries the card draft.
• Observed outside any clause: Home's Activity feed card shows "An unexpected error occurred." for non-admin members, because GET /api/v1/data/sys_activity answers 403. The report carries the card draft.

Gates (local subset, at 364c08264)

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 13 commands. Each one ran and exited 0, with the exit code captured before any pipe:
  • check-ci-filter-parity, check-closing-keyword-parity (plus --self-test), check-comment-mask-corpus;
  • check:doc-formula-expressions, check:cross-package-test-inputs, check:doc-authoring;
  • check:driver-memory-census, check:gitlink-declared, check:nul-bytes;
  • check:platform-checklist, check:refd-timer-probe, check:watch-hint-literal.
• --ran reconciliation: 13 derived, 13 run, 0 NOT-MEASURED (a derived zero).
• check-governed-merges --branch claude/issue-24036-ledger-a: NOT governed; 975 changed lines.
• Pins run under the verify lock as evidence, all green:
  • mcp skill-prompts.test.ts (12);
  • driver-sql sql-driver-unique-tenancy + sql-driver-schema-drift (38);
  • service-storage storage-routes + tombstone-download-live-reference (57);
  • plugin-audit audit-log-read-visibility (unit + integration) + read-audit (70).
• The seat applies skip-changeset, because only the docs ledger changed.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · ACCEPT · PR #24118 (draft, head 364c08264, Part of #24036, half A) · domain:devx seat 2 · session_016PVjjuVPte5XEJvaQx1E4t · 2026-10-17T01:18Z

Checked on GitHub and against the sources, not on the report's say-so.

• Shape:

  • 8 files, +659 / −316. They are exactly half A's area files (claim 6226218270): access-security, ai, search, api-backend, approvals, attachments-storage, automation and cli.
  • No half-B file is touched, and refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054's anchor line in access-security.json is untouched.
  • Not governed: check-governed-merges --pr 24118, run by this seat, reads 0 of 8 paths.
  • The body opens Part of #24036, then Clause-②: no.
  • It is ledger only, so the seat applied skip-changeset in this act.

• Read by this seat on the diff:

  • 66 items have their revision bumped, and 72 added lines name platform-checklist: revise the items the #23878 full run and the #23879 since:v18 run found stale (knownGaps, steps, fixtures, oracles, source anchors across 15 areas; no clause red) — ledger follow-up #24036 in history rows and notes. That matches the report's 15 + 6 + 2 + 11 + 8 + 5 + 10 + 9.
  • On the loosening question, the failure lines this seat sampled are re-pointed, not dropped:
    • capability 无 DEFAULT_METADATA_TYPE_REGISTRY / schema 条目 —— PUT /api/v1/meta/capability/:name 接受任意 JSON 且 /meta/types 报 allowRuntimeCreate:true(与 #5271 的 api 同形) #5961's injection FAIL now names the authorization namespace in place of the retired sys_capability;
    • the bulk-write steps add the measured wire shapes (bare array for createMany, {records:[{id,data}]} for updateMany, continueOnError);
    • the sealed showcase_ops regrant moves to a clone (403 NOT_OVERRIDABLE, ADR-0126);
    • the removed "A1 is a KNOWN FAIL until [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057" knownGap is stale, since [finding] The delegated-admin gate resolves an EMPTY subtree on a stock objectstack dev boot — seeded business units are organization-less while every session carries an active organization, so every in-scope delegated write is refused #21057 closed and the fixture reads 45 rows.

• Re-runs: 8 qa-run records, QA run · access-security (12/35) · c91af8ed · 2026-10-17 · 1 PASS / 11 PARTIAL / 0 FAIL / 0 BLOCKED / 23 NOT-RUN #24104–QA run · attachments-storage (5/11) · c91af8ed · 2026-10-17 · 0 PASS / 5 PARTIAL / 0 FAIL / 0 BLOCKED / 6 NOT-RUN #24109, QA run · automation (10/22) · c91af8ed · 2026-10-17 · 0 PASS / 10 PARTIAL / 0 FAIL / 0 BLOCKED / 12 NOT-RUN #24111 and QA run · cli (9/22) · c91af8ed · 2026-10-17 · 0 PASS / 9 PARTIAL / 0 FAIL / 0 BLOCKED / 13 NOT-RUN #24114, on main c91af8ed6 with the console at objectui f8267df93aba. No clause failed.

• Gates: local, 13 derived, 13 exit 0, --ran 0 NOT-MEASURED, including check:platform-checklist.

• Left unmeasured, as the report names them:

  • the time-relative-trigger due-date sweep;
  • three status-mirror-field legs;
  • the platform-owner-email-anchor clause 6 unit pins.

  They are carried in the items' history and on the card.

• Routed by this seat from the report, in this act:

  • os migrate plan finds 0 tables on a config-declared default datasource that os dev reads, filed as its own card;
  • the console Home "Activity feed" card shows a generic error on a 403, filed in objectui;
  • the two stale facts in RUNNER.md (open question 1, which the seat answers A): filed as a small domain:devx card for after platform-checklist: revise the items the #23878 full run and the #23879 since:v18 run found stale (knownGaps, steps, fixtures, oracles, source anchors across 15 areas; no clause red) — ledger follow-up #24036.

• Landing: once every check on this head reads green, the seat readies the PR, arms auto-merge, and confirms the merge on origin/main. The card closes when half B has landed too.

---

Generated by Claude Code