docs(qa): re-point the half-A platform-checklist items that described an older product

docs/qa/platform-checklist/areas/search.json

@@ -309,7 +309,7 @@
       "title": "Pinyin recall is gated end-to-end by OS_SEARCH_PINYIN_ENABLED: on, latin pinyin (full + initials) hits CJK names; off, it does not — while CJK terms keep matching",
       "since": "v15.1",
       "status": "active",
-      "revision": 3,
+      "revision": 4,
       "priority": "P1",
       "surface": "mixed",
       "personas": ["seeded admin (admin@objectos.ai)"],
@@ -322,7 +322,7 @@
           "a readable boot log for BOTH boots (debug level) — the OFF-side oracle is the loaded-plugin roster, so the run needs the plugin count / `requires` list from each boot, not just the ON-side output"
         ],
         "knownGaps": [
-          "the plugin's own inert line ('OS_SEARCH_PINYIN_ENABLED is off — inert') is UNOBTAINABLE in a CLI-served deployment and must not be used as the OFF-side oracle: the CLI gates one layer upstream and omits `pinyin-search` from `requires` when the flag is off, so the plugin is never loaded and never reaches its own inert branch. Run #7629 measured 47 loaded plugins with the flag off vs 48 with it on, and found ZERO occurrences of 'pinyin' in a 1.2 MB debug boot log. The clause below therefore reads the roster difference; the inert line is kept only as the alternative oracle for a host that loads the plugin unconditionally"
+          "the plugin's own inert line ('OS_SEARCH_PINYIN_ENABLED is off — inert') is UNOBTAINABLE in a CLI-served deployment and must not be used as the OFF-side oracle: the CLI gates one layer upstream and omits `pinyin-search` from `requires` when the flag is off, so the plugin is never loaded and never reaches its own inert branch. Run #7629 measured 47 loaded plugins with the flag off vs 48 with it on (51 vs 52 on main c91af8ed6 under #24036), and found ZERO occurrences of 'pinyin' in a 1.2 MB debug boot log. The clause below therefore reads the roster difference; the inert line is kept only as the alternative oracle for a host that loads the plugin unconditionally"
         ]
       },
       "steps": [
@@ -348,15 +348,15 @@
           "evidence": "the contrast query"
         },
         {
-          "clause": "flag OFF (explicit false, restart): the INITIALS forms ('zw' for 张伟, 'hnkj'/'wf' for the account) go to zero — the companion is gone from the schema view and the filter never ORs it — while '张' still matches via the source column. ⛔ Do NOT expect full-pinyin 'zhangwei' to go to zero on the stock fixture: showcase_contact.email is searchable:true and the seeded row carries email zhangwei@huaning.example, so that term still matches through the SOURCE column with pinyin off (likewise 'huaning' on the account via website / billing_email). The initials are the real discriminator because no source column spells them",
+          "clause": "flag OFF (explicit false, restart): the INITIALS forms ('zw' for 张伟 and 'wf' for 王芳 on showcase_contact, 'hnkj' for 华宁科技 on showcase_account) go to zero — the companion is gone from the schema view and the filter never ORs it — while '张' still matches via the source column. ⛔ Do NOT expect full-pinyin 'zhangwei' to go to zero on the stock fixture: showcase_contact.email is searchable:true and the seeded row carries email zhangwei@huaning.example, so that term still matches through the SOURCE column with pinyin off (likewise 'wangfang' for 王芳 through her email, and 'huaning' on the account via website / billing_email). The initials are the real discriminator because no source column spells them",
           "oracle": "api",
           "verify": "the same three queries after the flagged restart split exactly that way, with no errors",
           "evidence": "post-restart response bodies"
         },
         {
           "clause": "OFF is inert end-to-end, not half-disabled — and under CLI serving the gate sits one layer UPSTREAM of the plugin: with the flag off the CLI does not add `pinyin-search` to `requires`, so the plugin is never loaded (no hooks, no backfill, pinyin-pro never imported, and its own 'is off — inert' line never printed). A host that loads the plugin unconditionally takes the in-plugin inert branch instead. Either route satisfies the ADR-0049 no-half-state design: column provisioning and population share the SINGLE decision point resolveSearchPinyinEnabled",
           "oracle": "log",
-          "verify": "diff the two boots' loaded-plugin roster — the OFF boot is one plugin short and `pinyin-search` is absent from `requires` (#7629 measured 47 vs 48) — and confirm a full-text grep of the OFF debug boot log yields ZERO 'pinyin' occurrences. Do NOT wait for the plugin's inert line: it cannot appear when the plugin was never loaded, and treating its absence as a failure is the trap this clause was rewritten to remove. If the roster shows the plugin WAS loaded, then the inert line is required instead. No backfill activity on either route",
+          "verify": "diff the two boots' loaded-plugin roster — the OFF boot is exactly one plugin short and `pinyin-search` is absent from `requires` (#7629 measured 47 vs 48; main c91af8ed6 measured 51 vs 52 — the absolute count moves with the plugin set, the one-plugin difference with PinyinSearchPlugin as the missing entry is the oracle) — and confirm a full-text grep of the OFF debug boot log yields ZERO 'pinyin' occurrences. Do NOT wait for the plugin's inert line: it cannot appear when the plugin was never loaded, and treating its absence as a failure is the trap this clause was rewritten to remove. If the roster shows the plugin WAS loaded, then the inert line is required instead. No backfill activity on either route",
           "evidence": "both boots' plugin count / `requires` lines + the zero-hit grep over the OFF boot log (or, plugin-loaded hosts only, the inert line)"
         },
         {
@@ -390,7 +390,8 @@
       "history": [
         { "revision": 1, "date": "2026-08-07", "change": "new item: both sides of the pinyin flag with toggle semantics read from resolveSearchPinyinEnabled's source (explicit-wins + zh-locale default), recall variants pinned to the seeded CJK rows, backfill contract from the plugin source", "ref": "claude/platform-test-checklist-ocwugl" },
         { "revision": 2, "date": "2026-08-11", "change": "the OFF-inertness clause now names an oracle that exists. It demanded a specific plugin log line ('OS_SEARCH_PINYIN_ENABLED is off — inert') which run #7629 proved unobtainable under CLI serving: the flag gates one layer upstream, the CLI omits pinyin-search from `requires`, the plugin is never loaded, and a 1.2 MB debug boot log contained zero occurrences of 'pinyin' (47 loaded plugins off vs 48 on). That is a STRONGER proof of inertness than the log line would have been, so the clause now reads the plugin roster / `requires` difference plus the zero-hit grep, and keeps the inert line only as the alternative oracle for a host that loads the plugin unconditionally — the run is told which route it is on by the roster itself. Step 7, the fixtures requirement and the plugin source citation follow; knownGaps records the unobtainability so the next author does not restore the log-line oracle. This was the item's ONLY partial in #7629 — the substance (both flag sides, per-variant recall, backfill) is unchanged", "ref": "#7647" },
-        { "revision": 3, "date": "2026-08-18", "change": "re-targeted clause 3's OFF-side expectation at the initials forms. It demanded that 'zhangwei' stop returning 张伟 with the flag off, but the seeded contact carries email zhangwei@huaning.example and email is searchable:true, so the term still matches through the source column — correct behaviour that the clause scores as the flag failing to disable. The initials (zw / hnkj / wf) have no source-column spelling and are the honest discriminator (#9467 CF-4)", "ref": "#9386" }
+        { "revision": 3, "date": "2026-08-18", "change": "re-targeted clause 3's OFF-side expectation at the initials forms. It demanded that 'zhangwei' stop returning 张伟 with the flag off, but the seeded contact carries email zhangwei@huaning.example and email is searchable:true, so the term still matches through the source column — correct behaviour that the clause scores as the flag failing to disable. The initials (zw / hnkj / wf) have no source-column spelling and are the honest discriminator (#9467 CF-4)", "ref": "#9386" },
+        { "revision": 4, "date": "2026-10-17", "change": "clause 2 named 'wf' as an account initials form, but 'wf' is the initials of the seeded CONTACT 王芳 (company 华宁科技); the clause now places 'wf' on showcase_contact and 'hnkj' on showcase_account, and its ⛔ note adds 'wangfang', which still matches 王芳 through her email with the flag off. The roster counts in clause 3 and the knownGap gain the current reading (51 vs 52) and clause 3 states that the one-plugin difference, not the absolute count, is the oracle. Re-run on main c91af8ed6: flag ON (stock, zh-CN default) contact zhangwei/zw/张 → 张伟, contact wf → 王芳, account huaning/hnkj/华 → 华宁科技; flag OFF (OS_SEARCH_PINYIN_ENABLED=false, fresh DB, debug log) contact zw → 0, wf → 0, 张 → 张伟, zhangwei → 张伟 and wangfang → 王芳 (email column), account hnkj → 0, huaning and 华 → 华宁科技; banner 'Plugins: 51 loaded' OFF vs 52 ON, the difference PinyinSearchPlugin, and zero 'pinyin' occurrences in the 589 KB OFF debug boot log", "ref": "#24036" }
       ]
     },
     {
@@ -682,7 +683,7 @@
       "title": "Global search (GET /api/v1/search) skips what the caller cannot read instead of failing: an unreadable object is never queried, named or counted; a readable object is searched only on fields the caller may query; row scope still narrows every searched object",
       "since": "v17",
       "status": "active",
-      "revision": 1,
+      "revision": 2,
       "priority": "P1",
       "surface": "api",
       "personas": [
@@ -701,7 +702,7 @@
           "why": "supplies the one persona every clause rests on: a non-admin whose read set excludes some objects (acceptance[0]-[2]), narrows showcase_invoice to its own rows (acceptance[3]) and excludes some sys_user search columns (acceptance[4]). Run as a seeded demo persona instead, the clauses fail the same way the recipe's own notes record: one is refused at the object gate and the other reads everything"
         },
         "knownGaps": [
-          "#21880 (open): a field-narrowed search is not fully governed by the narrowing when the optional pinyin search companion is on (OS_SEARCH_PINYIN_ENABLED). Run acceptance[4] with the flag OFF (the stock default). A hit seen with the flag ON is recorded against #21880, not filed as a new finding",
+          "#21880 (open): a field-narrowed search is not fully governed by the narrowing when the optional pinyin search companion is on (OS_SEARCH_PINYIN_ENABLED). Run acceptance[4] with the flag OFF, set EXPLICITLY: boot with OS_SEARCH_PINYIN_ENABLED=false. On the showcase the flag is NOT off by default — unset, it derives ON from the zh-CN entry in i18n.supportedLocales (packages/types/src/env.ts resolveSearchPinyinEnabled; the stock boot loads pinyin-search and backfills the companion). A hit seen with the flag ON is recorded against #21880, not filed as a new finding",
           "the two #21880 cases (acceptance[3] row scope on a searched object, acceptance[4] a term only in a hidden field) have no end-to-end pin yet; #21879's dogfood pins object-level skipping only, and the hidden-field narrowing is unit-pinned. A run of this item is their only end-to-end reading until #21880 adds them",
           "if no stock field satisfies acceptance[4]'s premise (the hidden column holds no value unique to it on this boot), record acceptance[4] blocked(fixture) and score the mechanism from the unit pin. Do not edit sys_user directly to plant one"
         ]
@@ -777,6 +778,12 @@
           "date": "2026-10-06",
           "change": "new: PR #21879 made global search skip the objects and fields a caller cannot read instead of failing the whole request with 403, and no item asserted it. search.console-global-search drives the same route but only for row-level parity. This item adds the object-level skip (never queried, named or counted; an explicit objects= naming the object answers like no such object; the object still refused at its own door), plus the two cases #21880 lists: row scope still narrows a searched object, and a term only in a field hidden from the caller yields no hit. #21880's open pinyin-companion finding is recorded as a knownGap with the flag-off instruction. The persona reuses the area recipe qa-contributor-bound-member",
           "ref": "#21932"
+        },
+        {
+          "revision": 2,
+          "date": "2026-10-16",
+          "change": "knownGaps[0] called pinyin OFF 'the stock default' (#23878 checklist-accuracy finding). On the showcase, OS_SEARCH_PINYIN_ENABLED unset derives ON from the zh-CN locale (resolveSearchPinyinEnabled; re-measured on main c91af8ed6: the stock boot loads com.objectstack.plugin.pinyin-search and logs the companion backfill), so the run must set the flag false explicitly for acceptance[4]. Wording only, no re-run owed",
+          "ref": "#24036"
         }
       ]
     }