docs(qa): re-point five 18.0 sweep red-row clauses to the shipped contract

[objectstack-fleet]

Refs #24579 (§1)
Clause-②: no

Part of #24579: this PR lands §1 of that wave anchor, the five red-row re-points. §2 (wave-wide themes), §3 (checklist-accuracy findings), §4 (fixture gaps, partials, not-run handover), §6 and §7 stay on the card.

What

The 18.0 release sweep (subject 5b14b7f3) scored five checklist clauses fail. Each run record disposed its row as a stale spec or an assertion defect against a documented contract: the product is right and the clause is wrong. This PR re-points those five clauses. Each item bumps revision 1 → 2 and gains one history row that names its run record and has this PR as its ref.

Ledger only. No product code, test or pin changes. Diff: 5 files under docs/qa/platform-checklist/areas/, one item per file, and no other item or area-level key moves (checked by parse against the base).

item · clause	run record	disposition	edited fields	revision
cli.organization-ownership-ceremony acceptance[1]–[4]	#24551 (verdict word reconciled with #24556)	stale spec	title, fixtures.knownGaps (new), steps, acceptance[0]–[3] (old [4] removed), automated.ref, source	1 → 2
automation.flow-authoring-refusals-v18 acceptance[2]	#24545 (and #24558's "PUT 422 too broad")	stale spec	title, steps[1], acceptance[2]	1 → 2
api-backend.error-sentences-and-unique-violation-wire-code acceptance[2]	#24541	assertion defect	acceptance[2] (acceptance[1] untouched: product defect #24561)	1 → 2
access-security.share-link-combined-gates acceptance[3]	#24559	assertion defect	title, acceptance[3]	1 → 2
attachments-storage.chunked-upload-integrity acceptance[3]	#24560	stale spec	title, steps (renumbered from 0), acceptance[1] (index), acceptance[3]	1 → 2

Each re-point, against main 5a871e4e41

Every source cited below is byte-identical between the run subject 5b14b7f3 and main 5a871e4e41. The one file that moved, metadata-protocol/src/protocol.ts, changed by a perf commit whose hunks are nowhere near the two refusals cited from it.

1. cli.organization-ownership-ceremony. By ruling, 18.0 is fresh installs only. The registered os migrate organization-ownership (MigrateOrganizationOwnership) refuses plan and apply alike, with NOT_IMPLEMENTED / upgrade-unavailable, before it opens anything. The changes:
   • acceptance[1] scores the bare-run refusal: no plan file, DB checksum unchanged.
   • acceptance[2] scores every --apply arm refusing the same way.
   • acceptance[3] keeps the drop-gate half (refused_organization_ownership_unmigrated with tables). The sys_migration checkpoint half is dropped.
   • Revision 1's acceptance[4] (the migrated copy boots) is removed.
   • automated.ref gains organization-ownership.release-refusal.test.ts, the pin of the registered command. The other seven pins drive the ceremony class beneath it.
   • The mechanism (PM hypothesis 1, falsified): the ledger has no clause-level skip. 1788 clauses across 16 areas carry only clause/oracle/verify/evidence (one $comment). check-platform-checklist.mjs reads no such key, and RUNNER's skipped is a run verdict, not an item field. The nearest legal shape is the one the ledger already uses for a half an item does not score: a fixtures.knownGaps line saying the half is deliberately not scored here. Precedents are cli.plugin-manifest-build-contract knownGaps[1] and platform-core.manifest-install-contract knownGaps[0].
   • The knownGaps line: knownGaps[0] lists the ceremony's withdrawn arms with the ruling quoted from QA run · cli (18/22) · 5b14b7f3 · 2026-10-19 · 17 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 4 NOT-RUN #24551 ("ruling records 6259608309 (item 1) and 6259698357 then cut 18.0 to fresh installs on the single posture…"). It tells a runner to score those arms neither fail (QA run · cli (18/22) · 5b14b7f3 · 2026-10-19 · 17 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 4 NOT-RUN #24551's reading of revision 1) nor skipped (QA run · priority:P0 (23/23) · 5b14b7f3 · 2026-10-19 · 17 PASS / 5 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #24556's, c1/c2/c4), because they are not on the item. That is the single reading for both runs: each run captured the refusal that each re-pointed clause now asserts.
   • knownGaps[1] says acceptance[3] scores the drop gate's exit, message and tables, not its prose. That prose still prescribes the withdrawn command, which is row 3 of platform-checklist + cli: three findings from the 18.0 QA sweep at 5b14b7f3 — two clauses mis-asserted against documented contracts, and a refusal that prescribes a withdrawn command (family card) #24567.
2. automation.flow-authoring-refusals-v18.
   • Root-scope arms: packages/lint/src/flow-cel-root-scope.ts#perWriteSnapshotEntrance stands the CEL root-scope judgment down at the runtime publish gate. This is by design, under rulings 5791822697 (item 3) and 6104584601 (letter B), and the item's own pin validate-expressions.flow-cel-root.test.ts asserts it. So the record.x and user.id arms expect 200 and a stored row at PUT, and os validate (acceptance[1]) still refuses them.
   • Job and endpoint arms: these are not PUT /meta/flow bodies. job and api are code-only types (allowRuntimeCreate: false, so PUT answers 403 NOT_CREATABLE). The clause names the flow-side twins the door does refuse: a try_catch node's retry.maxRetry, and the runAs: "system" flow that a code-declared authRequired: false endpoint names (anonymousElevatedFlowRefusal, 422 at runAs).
3. api-backend.error-sentences-and-unique-violation-wire-code. On a tenant-scoped object, driver-sql builds a field's unique: true as the (organization, field) composite, so the driver names no single column. dispatcher-unique-violation-wire-code.test.ts pins details keys as exactly developerMessage and object, and adds field only when DuplicateRecordError states a column. The clause now asserts that composite shape.
4. access-security.share-link-combined-gates. In share-link-routes.ts#registerShareLinkRoutes, /messages passes resolveToken the same audience inputs /resolve does. It answers every refusal with one 404 NOT_FOUND, and a resolved non-ai_conversations link with 400 UNSUPPORTED. runtime/src/domains/share-links-messages-audience.test.ts holds both mounts to one open/refused verdict per audience. The clause becomes "/messages is open iff /resolve is open", where open means the call passed the link's gates. A malformed password header is refused 400 VALIDATION_FAILED by both routes, before either reads the link.
5. attachments-storage.chunked-upload-integrity.
   • Progress: registerStorageRoutes asks the starting-organization gate on progress only when expiryStampDue holds. So after an org switch, progress answers 200 unless the session's expires_at has passed, and 409 after that. Chunk PUT and complete answer 409 either way.
   • Numbering: the steps numbered chunks from 1 while the API numbers them from 0 (the server answered missingChunks: [1] for the step's "chunk 2"). Steps now number from 0, acceptance[1] expects [1], and the org-switch step names all three calls.

Titles that contradicted a re-pointed clause follow it: cli, automation, access-security and attachments. No file:line citation is written. The new #symbol anchors are MigrateOrganizationOwnership, ORGANIZATION_OWNERSHIP_UPGRADE_UNAVAILABLE, perWriteSnapshotEntrance, registerShareLinkRoutes and registerStorageRoutes, and all five resolve.

Verification (at 1f7239d717)

• pnpm check:platform-checklist exits 0. This gate runs in no per-PR CI, so this local reading is its evidence:

  check-platform-checklist: OK — 16 areas, 327 items (322 active, 1 planned); coverage: 39 kinds mapped, 2 waived; traps: 19 documented, 19 in use; … line citations: 0 survive across 21 swept documents …; symbol anchors: 860/870 resolved … across 21 swept documents against 406 cited sources, 10 on the named residual, 18 file floors held
  

  The symbol-anchor count was 855/865 against 404 cited sources at base 5a871e4e41. This diff adds +5 resolved anchors and loses none, and the residual is unchanged at 10.
• node scripts/pm/dispatch-gates.mjs --commands derives 13 commands on this diff (5 paths vs merge base 5a871e4e4, +73 / −45). All 13 exit 0:
  • check-ci-filter-parity
  • check-closing-keyword-parity and its --self-test
  • check-comment-mask-corpus
  • check:doc-formula-expressions (lint). This one first exited 3 (PREREQUISITE: formula and lint unbuilt, nothing measured). It exits 0 after turbo run build --filter=@objectstack/formula --filter=@objectstack/lint.
  • check:cross-package-test-inputs
  • check:doc-authoring
  • check:driver-memory-census
  • check:gitlink-declared
  • check:nul-bytes
  • check:platform-checklist
  • check:refd-timer-probe
  • check:watch-hint-literal
• --ran reconciliation: "13 derived famil(ies) accounted for — 13 run, 0 NOT-MEASURED (a DERIVED zero — all 13 recorded an exit code and none of them is 3)".
• No package is touched, so there is no dependency-closure build, package test or typecheck. The rest of the farm is CI's.
• skip-changeset, re-measured: the only package.json whose directory contains docs/qa/ is the private repo root (@objectstack/spec-monorepo, private: true), so this diff ships nothing.
• The PR opens with each new history row's ref set to a placeholder, because the PR number does not exist until the PR does. The next commit replaces those five strings with this PR's number and changes nothing else. The gate re-run on that final head is recorded in the os-dev-report comment on qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.

Acceptance notes

Noted, not filed. Each item is already parked on #24579 by its run record unless another carrier is named.

• access-security.share-link-combined-gates automated.ref does not name packages/runtime/src/domains/share-links-messages-audience.test.ts, the pin of the parity acceptance[3] now asserts. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §3. Not added here, because §1 changes automated.ref for the cli row only.
• attachments-storage.chunked-upload-integrity acceptance[3] still needs a second organization, and stock 18.0 refuses one with 403 ORGANIZATION_CREATION_DISABLED. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §2, the "no second organization" theme. Separately, none of its three pins asserts the door-level org-switch 409. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §3, from QA run · attachments-storage (11/11) · 5b14b7f3 · 2026-10-19 · 10 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #24560.
• automation.flow-authoring-refusals-v18 has three steps-level accuracy findings. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §3, from QA run · automation (18/22) · 5b14b7f3 · 2026-10-19 · 15 PASS / 2 PARTIAL / 1 FAIL / 0 BLOCKED / 4 NOT-RUN #24545 and QA run · since:v18 (48/48) · 5b14b7f3 · 2026-10-19 · 38 PASS / 7 PARTIAL / 3 FAIL / 0 BLOCKED / 0 NOT-RUN #24558.
  • The anonymous-endpoint arm needs an armed rateLimit.
  • "A REST-triggered flow reading record.x" is ambiguous.
  • acceptance[1]'s schema-layer arms surface as STACK_SCHEMA_INVALID with a contract sentence, not as a rule id.
• api-backend.error-sentences-and-unique-violation-wire-code: a package cannot author a hook on sys_sharing_rule, so the fixture line and step 1 are unrunnable as written. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §3, from QA run · api-backend (22/27) · 5b14b7f3 · 2026-10-19 · 20 PASS / 1 PARTIAL / 1 FAIL / 0 BLOCKED / 5 NOT-RUN #24541 and QA run · since:v18 (48/48) · 5b14b7f3 · 2026-10-19 · 38 PASS / 7 PARTIAL / 3 FAIL / 0 BLOCKED / 0 NOT-RUN #24558. acceptance[1] is the product defect rest/metadata-protocol: POST /api/v1/data/:object/batch withholds a hook's business refusal as a per-row INTERNAL_ERROR, while /data, /createMany and /import return the hook's sentence #24561.
• cli.organization-ownership-ceremony: there is no v17-shaped SQLite fixture in the tree. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §4. The drop-gate prose naming the withdrawn command is row 3 of platform-checklist + cli: three findings from the 18.0 QA sweep at 5b14b7f3 — two clauses mis-asserted against documented contracts, and a refusal that prescribes a withdrawn command (family card) #24567.

---

Generated by Claude Code

[objectstack-fleet]

Seat review

ACCEPT · domain:devx seat 1 · os-warren · session_01FM29ZqLTrnPNXxijioZwMp · 2026-10-19T16:49Z · head d3ea1a46fd · card #24579 §1 (claim 6271209099)

• Form. Draft, base main, first lines Refs #24579 (§1) / Clause-②: no, plus a Part of #24579 line. Assignee os-warren, labels size/m and skip-changeset (docs only). node scripts/pm/check-governed-merges.mjs --pr 24622 → NOT governed, 118 changed lines. git merge-tree against main 5e8000906e (which now carries PR docs(qa): re-word three v18 checklist clauses the 18.0 QA sweep found mis-asserted #24592) is clean.
• Scope. Five files under docs/qa/platform-checklist/areas/, +73 / −45, one item in each. No package, test, pin or gate is touched. Each item goes revision 1 → 2 with one history row that names its run record and ref docs(qa): re-point five 18.0 sweep red-row clauses to the shipped contract #24622.
• The five re-points, checked against the head's source.
  • cli.organization-ownership-ceremony: acceptance[1] and [2] now score the release refusal. organization-ownership.ts exports ORGANIZATION_OWNERSHIP_UPGRADE_UNAVAILABLE with code NOT_IMPLEMENTED, and answers plan_refused / apply_refused. acceptance[3] keeps the drop gate: apply.ts:581 answers refused_organization_ownership_unmigrated with tables. organization-ownership.release-refusal.test.ts exists and joins automated.ref.
  • The withdrawn ceremony arms move to fixtures.knownGaps[0] as "deliberately not scored". The ledger has no clause-level skip (PM hypothesis 1 falsified), and this is the shape cli.plugin-manifest-build-contract and platform-core.manifest-install-contract already use. It tells a runner to score those arms as neither fail (QA run · cli (18/22) · 5b14b7f3 · 2026-10-19 · 17 PASS / 0 PARTIAL / 1 FAIL / 0 BLOCKED / 4 NOT-RUN #24551) nor skipped (QA run · priority:P0 (23/23) · 5b14b7f3 · 2026-10-19 · 17 PASS / 5 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #24556), the one reading both runs agree on.
  • automation.flow-authoring-refusals-v18: the two CEL root-scope arms expect 200 and are stored. perWriteSnapshotEntrance in packages/lint/src/flow-cel-root-scope.ts records the stand-down. The try_catch retry.maxRetry twin is refused by contract, and config-unknown-keys.test.ts:191 pins nodes.1.config.retry.maxRetry.
  • api-backend.error-sentences-and-unique-violation-wire-code acceptance[2]: the details keys are exactly developerMessage and object. The pin is packages/runtime/src/dispatcher-unique-violation-wire-code.test.ts. acceptance[1] (rest/metadata-protocol: POST /api/v1/data/:object/batch withholds a hook's business refusal as a per-row INTERNAL_ERROR, while /data, /createMany and /import return the hook's sentence #24561) is untouched.
  • access-security.share-link-combined-gates acceptance[3]: "/messages is open iff /resolve is open". registerShareLinkRoutes is in share-link-routes.ts, and share-links-messages-audience.test.ts exists.
  • attachments-storage.chunked-upload-integrity acceptance[3]: progress answers 200 unless the expiry stamp is due. registerStorageRoutes is in storage-routes.ts. The steps now number chunks from 0, and acceptance[1] expects [1].
• Gates. The dev's dispatch-gates union is 13 derived, 13 run, all exit 0 at d3ea1a46fd. check:platform-checklist goes from 855/865 to 860/870 anchors (+5, none lost), and reads the same on the joint tree with main. Check-runs at d3ea1a46fd: 39, all completed, 31 success, 8 skipped. node scripts/pm/check-expected-skips.mjs --pr 24622 → OK — 8 skipped check-run(s), every one in the roster (exit 0). There are no reviews and no comments.
• Accepted deviations. Titles of rows 1, 2, 4 and 5, and the steps of rows 1, 2 and 5, follow their re-pointed clauses. Row 1's old acceptance[4] (the migrated copy boots) is removed; its arm is recorded in knownGaps[0]. The PR body cites gates at 1f7239d717, and the final head's union is in the dev report 6272202933.
• Carried to the next round, not a blocker (probe). Row 1's source gains the path .changeset/pre/15212-180-guards-fresh-single-only.md. The GA version render consumes .changeset/pre/*.md, so that pointer dangles once 18.0.0 is versioned. A throwaway-worktree probe deleted the file and ran node scripts/check-platform-checklist.mjs: exit 0 both ways, because the gate does not resolve plain source paths, so nothing goes red. The same item already lists consumed changesets in prose ("v18 changesets (.changeset/pre/, consumed into 18.0.0-next.*): …"). The next qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 round folds 15212-180-guards-fresh-single-only into that prose entry.
• Out-of-scope findings. The dev's eight notes go to qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §2–§4 and platform-checklist + cli: three findings from the 18.0 QA sweep at 5b14b7f3 — two clauses mis-asserted against documented contracts, and a refusal that prescribes a withdrawn command (family card) #24567 row 3. qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 round 2 (6272314386) adds two §1 red rows, studio-authoring.expression-editors and approvals.email-action-token-door. Both are left for the next round.

This seat readies the PR and queues it with auto-merge.

---

Generated by Claude Code