docs(qa): 18.0 sweep round 7 — integration-system checklist-accuracy findings and four carried notes

[objectstack-fleet]

Refs #24579
Clause-②: no

Round 7 of the 18.0 release sweep's wave anchor (#24579), one PR in two parts. Part (a) takes integration-system, the last area §3 had not worked, from its run records #24575 (round 1, 5b14b7f3) and #24615 (round 2, ba4afcc2), plus the rows #24556 and #24558 left for this file. Part (b) takes four notes carried from rounds 5 and 6. These are checklist and runner-doc defects only: no product code, test or pin changes.

Every finding was re-derived from origin/main's source before it was edited. Each edited item takes one revision bump and one history row naming its run record(s). The rows' ref is a placeholder in this head; a fill commit replaces exactly those 16 strings with this PR's number.

Part (a) — docs/qa/platform-checklist/areas/integration-system.json

13 items (cap 20).

item	fields edited	revision	run record
datasource-credential-refusal-matrix	fixtures.knownGaps[2], fixtures.knownGaps[4] (new), steps[0], steps[8], acceptance[6].clause, source[2]	4 → 5	#24575, #24556
datasource-admin-lifecycle	steps[2], steps[3], steps[4], steps[5], steps[8], acceptance[0].clause, acceptance[2].clause, acceptance[4].clause, acceptance[4].verify	3 → 4	#24615
external-schema-introspection	fixtures.knownGaps[0]	3 → 4	#24615
external-schema-browser-ui	steps[1], steps[7], acceptance[0].clause / .verify / .evidence, acceptance[3].verify, fixtures.knownGaps[3], fixtures.knownGaps[4] (new)	3 → 4	#24615
connector-degraded-recovery	fixtures.requires[0], steps[4], steps[6], acceptance[3].verify	2 → 3	#24575
notify-inbox-delivery	fixtures.requires[0], fixtures.knownGaps[2], steps[5], acceptance[3].verify, acceptance[4].verify	4 → 5	#24575, #24615
job-scheduled-run	fixtures.requires[1], steps[4], steps[6], acceptance[3].verify / .evidence	4 → 5	#24575
connector-declarative-boot	automated.ref	2 → 3	#24598 (round 2 part 1), #24575
inbound-mailbox-association	fixtures.requires[1], fixtures.knownGaps[0]	1 → 2	#24558
notification-org-and-redeliver-eligibility	fixtures.requires[2], steps[2], steps[3]	1 → 2	#24558
external-datasource-federated-read	fixtures.requires[0], steps[4], acceptance[2].oracle / .evidence	3 → 4	#24575
external-schema-drift-gate	fixtures.knownGaps[0], steps[0]	2 → 3	#24615
connector-auth-kind-application	steps[1], fixtures.knownGaps[0], source[5]	1 → 2	#24615

What each one says now, and the source it was checked against:

• Postgres recipe (§3's bullet). The credential matrix's knownGap said no recipe is proven and the QA container has no database. The container has PostgreSQL 16 at /usr/lib/postgresql/16/bin (re-read in this container), and QA run · integration-system (16/20) · 5b14b7f3 · 2026-10-19 · 11 PASS / 5 PARTIAL / 0 FAIL / 0 BLOCKED / 4 NOT-RUN #24575's recipe scored acceptance[1] and [6] pass. The gap now carries the recipe.
• mongodb, not mongo. DRIVER_CATALOG serves mongodb (driver-catalog.ts), and an authored mongo is refused by name since 18 (datasource.zod.ts). Fixed in both datasource items.
• sqlite filename. SqliteConfigSchema declares filename; file is an alias that authoring refuses with a rename hint.
• POST /test order (hypothesis 2). The item relied on the order: steps[3] and acceptance[2].clause both stated it. server.post(root + '/test') is registered after every :name route in admin-routes.ts. "test" stays uncaptured only because no POST route takes a bare :name. So the ledger text is corrected. The code comment is reported in the acceptance notes below and is not edited.
• ?schema= on Postgres (hypothesis 1). 18.0 round-2 sweep framework findings: a paid invoice line's amount/total stays writable while its inputs are locked; an unevaluable hook condition answers 500 INTERNAL_ERROR; remote-tables?schema= never narrows on the SQL drivers #24619 row (c) is now service-datasource: remote-tables?schema= never narrows on the in-tree SQL drivers, so a named schema answers 200 with the wrong tables (#24619 row c) #24664, which is open. The knownGap's claim that a Postgres fixture would make narrowing live-scoreable is false: introspectSchema lists current_schemas(false) tables with bare names. It is corrected. acceptance[1] states the finding: the two listRemoteTables route twins diverge on ?schema= — the admin spelling drops it #7955 contract and stays as written, because the defect makes it false live, not the clause.
• Browser UI (round 2's §3 additions).
  • The objectui pin is 12dc7b47c340, and QA run · integration-system (17/20) · ba4afcc2 · 2026-10-19 · 17 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 3 NOT-RUN #24615 ran at 4016370a. Both were read.
  • DatasourceResourcePage rows never open the item, so steps[1] names the engine edit route.
  • The save-first guidance is unreachable: CREATE_MODE_CANVAS_TYPES is object / report / dataset / doc. acceptance[0] now scores the observable half (no name-less call) and records the guidance half as not-run.
  • The quoted refusal belonged to POST /meta/_migrate-stored. The item save door answers metaWriteCapabilityVerdict's "Saving a metadata item requires…" with 403 FORBIDDEN.
  • A repeated import answers 201 and overwrites: importObject makes no existence check. This is recorded as a knownGap that no clause scores.
• Reload backoff (rounds 3 and 4). degradeConnectorInstance restarts attempts at 1 only on a signature change. A metadata:reloaded reconcile retries at once and keeps counting. steps[6] now names a restart-free reload: os dev restarts on a source save, because its --restart defaults to true.
• Messaging 501 recipe. resolveServedCapabilities skips the always-on slate under --preset minimal. The knownGap carries QA run · integration-system (17/20) · ba4afcc2 · 2026-10-19 · 17 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 3 NOT-RUN #24615's scratch app-todo recipe.
• Timeout probe. runWithPolicy retries timeouts. A second probe with a retryPolicy is what can show it.
• connector-declarative-boot ref. It is narrowed clause by clause against the two cases of showcase-declarative-mcp.dogfood.test.ts, in the shape round 2 used for scope-depth-asymmetry.
• QA run · since:v18 (48/48) · 5b14b7f3 · 2026-10-19 · 38 PASS / 7 PARTIAL / 3 FAIL / 0 BLOCKED / 0 NOT-RUN #24558's rows.
  • The showcase composes MailboxServicePlugin, because requires lists mailbox. What is missing is the IMAP sync composition, a mailAssociation field and an IMAP double.
  • An inactive webhook never gets a delivery: the redeliver guard reads the dispatcher's active === true predicate. The item carries the active-then-switch-off recipe. It warns off a pending row, which answers DELIVERY_NOT_ELIGIBLE from assertHttpRedeliverable for another reason.

Part (b) — carried notes

item or section	fields edited	revision	source
platform-core.metadata-authoring-roundtrip	automated.stale.observedIn (#7695 → #24598), .partial, .why, .ownedBy	3 → 4	Tier 1 run #24598; round 6's note
access-security.activation-write-operator-gate	acceptance[3].clause, acceptance[4].clause, acceptance[4].verify, acceptance[5].verify, negative[3], source[0]	4 → 5	round 5's note
access-security.platform-owner-email-anchor	steps[0]	3 → 4	round 5's note
RUNNER.md · "Environment facts the runner should not re-derive", the objectui-only automated.ref entry	lines 434–439 rewritten (the paragraph runs 434–449)	—	round 6's note

• (b)1. studio-record-page.spec.ts has the same blob at 4016370af3c9 and 12dc7b47c340 (read in objectui), and QA run · tier1:automated-pins (149/166) · ba4afcc2 · 2026-10-19 · 60 PASS / 89 PARTIAL / 0 FAIL / 0 BLOCKED / 17 NOT-RUN #24598 ran it 0 passed / 1 failed. ownedBy names e2e(live): eleven live specs are stale or red at the console pin against the shipped showcase — the 18.0 sweep's Tier 1 run (#24598) read them as non-defects, and no card holds their repair objectui#13104. The marker also said studio-object-designer.spec.ts was unaffected. QA run · tier1:automated-pins (149/166) · ba4afcc2 · 2026-10-19 · 60 PASS / 89 PARTIAL / 0 FAIL / 0 BLOCKED / 17 NOT-RUN #24598 ran its F1 and F4 red, so partial and why now say so.
• (b)2. Each comma-range citation, re-pointed. The cited lines now hold other code.
  • acceptance[3].clause ,141-147 → activation-gate.ts#refuseUngrantedActivationWrite, plus the header's "What it enforces" single bullet (prose).
  • acceptance[4].verify ,155-163 → #refuseUngrantedActivationWrite (the sentence) and #FLOW_ACTIVATION_SUBJECT / #ACTION_ACTIVATION_SUBJECT (the remedies).
  • acceptance[5].verify ,190 → #refuseUngrantedActivationWrite and #refuseUngrantedActivationAuthoring (both isSystem arms).
  • negative[3] ,141-147 → #readEffectiveTenancyPosture, plus the header's "Fail-open on an ABSENT posture is deliberate" section (prose).
  • source[0] (#posture, which resolved only to a local const posture, plus five line ranges) → the four symbols above, plus the same header section in prose.
• (b)3. serve.ts#walledPostureRefusal refuses a walled posture before any config is read, and it reads no OS_PLATFORM_OWNER_EMAIL. The walled-theme text itself (RUNNER.md's entry and the seven knownGaps) is untouched, waiting for feat(objectql,cli,plugin-webhooks)!: 18.x step 4: the walled lift (8b walled half, the os serve lift, the declared-webhook name guard, declared webhooks deployment-wide) #24667.
• (b)4: my call is to reword, not to count. The merged tree is abb111cb4c: this branch plus origin/main 73d4cc7391, which includes PR docs(qa): 18.0 sweep anchor round 6 — mark the objectui live specs stale at the console pin, and narrow or drop the pins that cover no full clause, in the UI-facing areas #24697. On it, the rule "an automated.ref names an objectui path and no path in this checkout" counts 23 objectui-only items, plus 7 mixed. On the pre-docs(qa): 18.0 sweep anchor round 6 — mark the objectui live specs stale at the console pin, and narrow or drop the pins that cover no full clause, in the UI-facing areas #24697 base d1173825b7 the same rule counts 27. Round 6 counted 28 before and 24 after by its own rule. The old sentence's "23" therefore matches this tree only by coincidence: it was four short a commit earlier, and a second careful reader counts 24 here. The number moves with every pin edit, and no gate reads it. The entry now states the rule, and keeps every other sentence in it.

Bounded in-place fixes (same defect class, mechanical, same file, same gate):

• activation-write-operator-gate acceptance[4].clause: it said flows recommend the clone path and that the platform_admin POSITION admits. Both remedies name the operator and neither names a clone: automation-activation-posture-gate.test.ts asserts ask your platform operator with no clone, and the action pin asserts no clone. The gate reads the PLATFORM_ADMIN posture rung (ec?.posture === 'PLATFORM_ADMIN', Four server-side readers derive platform authority from the NAME in ExecutionContext.positions — same species as #15948's blocked escalation, and already reachable on main #15981). The walled lead of the clause is unchanged.
• external-schema-browser-ui acceptance[3].verify cited ExternalDatasourcePanel.tsx,108-123, and connector-auth-kind-application fixtures.knownGaps[0] and source[5] cited index.ts,103,142 / ,66,103,142. These are the (b)2 rot class, re-pointed to a symbol or to prose for objectui.
• notify-inbox-delivery fixtures.requires[0] spelled recipients ['{record.assignee}']. The flow declares one CEL value envelope.

Findings left alone

finding	refuting reading
notify-inbox-delivery: the notify assignee must be a user id (§3; #24575)	Does not hold. RecipientResolver.resolveOne sends an email-shaped recipient to resolveEmail, which looks up sys_user by email under the fan-out system context and returns its id. It keeps the email verbatim only when nothing matches (recipient-resolver.ts). A user id works, but it is not required.
external-schema-introspection acceptance[1] and the title's "?schema= honoured"	Product-defect territory (#24664, open). The clause states the #7955 contract.
credential matrix: turso is absent from GET /drivers though POST accepts it, and the turso edit form shows only Label	Deliberate curation (driver-catalog.ts header: turso needs an optional package, which a dropdown cannot arrange). No item text says otherwise.
credential matrix: the metadata door serves the credentialsRef handle and the admin door only hasSecret, "say whether intended"	A question for the contract, not an inaccuracy. acceptance[2] judges the two shapes consistent, and #24575 scored it pass. The new knownGaps[4] describes both doors.
credential matrix: schemaMode: "external" on POST needs an external block	No step or clause of this item authors schemaMode, so the finding has no target text.
credential matrix: the console route is /_console/apps/com.objectstack.setup/metadata/datasource	No step of this item names a console route. #24575 (federated-read) and #24615 (browser runner) both reached Setup at /_console/apps/setup/metadata/datasource, the spelling the edited steps use.
credential matrix: a PATCH writing the literal mask is accepted and overwrites	Held for the maintainer on #24579 §7 (no declared contract). Recorded in knownGaps[4] as scored under no clause; no clause changed.
connector-auth-kind-application: the oauth2 build refusal is a raw zod dump that names no connector	A UX nit. acceptance[3] claims a located message only for the inline-authentication refusal, which #24615 measured located.
#24615: a scratch copy booted from /tmp prints "Console dist not found"	A RUNNER environment fact, harmless for API items. RUNNER.md is in scope this round only for the count sentence.

Excluded files, named only: studio-authoring.draft-publish-lifecycle has clause-free pins. The green summary-rollup.spec.ts on records-forms.master-detail-atomic-save and grid-conditional-rules.spec.ts on records-forms.conditional-rules-grid over-claim a clause. records-forms.json, studio-authoring.json (PR #24697) and cli.json (PR #24681) are untouched.

Acceptance notes (not filed)

• packages/services/service-datasource/src/admin-routes.ts: the comment above POST /test says it is "Registered before the :name routes". It is registered after all of them. There is no runtime effect, because no POST route takes a bare :name. Noted for the service-datasource lane.

• The comma-range line-citation spelling survives in other area files. The line-citation limb refuses only file:NNN and a bare :NNN, so these do not trip it. Hits:

  • in scope for a later round: access-security.record-view-read-audit, access-security.share-link-landing-page, ai.console-ai-surface-gating, attachments-storage.field-accept-maxsize-server-enforced, three automation items, five identity-auth items, platform-core.docs-portal-render, search.command-palette-navigation (15 items);
  • in this round's excluded files: cli, records-forms, studio-authoring.

  Same carrier as (b)2: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.

Gates

On abb111cb4c (the branch merged with origin/main 73d4cc7391), node scripts/pm/dispatch-gates.mjs --commands (no paths) derived 13 families. All 13 exited 0, with exit codes captured before any pipe:

node scripts/check-ci-filter-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:platform-checklist :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:watch-hint-literal :: exit 0

• --ran: "13 derived famil(ies) accounted for — 13 run, 0 NOT-MEASURED (a DERIVED zero …)". The first pass of check:doc-formula-expressions exited 3 because @objectstack/lint was unbuilt. It was built under the verify lock and re-run.
• check:platform-checklist runs in no per-PR CI, so this reading is its evidence: "OK — 16 areas, 327 items". Symbol anchors went from 886/896 at base to 917/927 resolved, none refused (hypothesis 3); merging docs(qa): 18.0 sweep anchor round 6 — mark the objectui live specs stale at the console pin, and narrow or drop the pins that cover no full clause, in the UI-facing areas #24697 left both totals unchanged. The anchor census moved access-security 96 → 107, integration-system 63 → 83, and platform-core 96 → 96.
• Editing discipline: a span-recording textual editor re-parsed each area file. It asserted that only the declared fields of the declared items changed, each with one revision bump and one history row, and that every other item and top-level key is deep-equal.
• Changeset: docs/qa/** is in no package's files[], so this PR publishes nothing and takes skip-changeset.

---

Generated by Claude Code

[objectstack-fleet]

Seat review

ACCEPT · domain:devx seat 1 · os-warren · session_01FM29ZqLTrnPNXxijioZwMp · 2026-10-20T01:55Z · head 357f2ab08b · card #24579 round 7 (claim 6280591351)

• Form. Draft, base main, first lines Refs #24579 / Clause-②: no. Assignee os-warren, labels skip-changeset, documentation and size/m. node scripts/pm/check-governed-merges.mjs --pr 24717 → NOT governed, 258 changed lines. git merge-tree against main 54159fd742 is clean.
• Scope. Four claimed paths, +175 / −83: integration-system.json, platform-core.json, access-security.json and RUNNER.md. No package, test or pin.
• Ledger invariants, checked by parse against 73d4cc7391. 16 items differ: integration-system 13, platform-core 1, access-security 2. Each took one revision bump and one history row with ref docs(qa): 18.0 sweep round 7 — integration-system checklist-accuracy findings and four carried notes #24717. No item was added or removed, and no area-level key moved.
• Spot-checked at the head.
  • (b)2's re-pointed anchors resolve to real declarations in packages/runtime/src/domains/activation-gate.ts: refuseUngrantedActivationWrite (:324), refuseUngrantedActivationAuthoring (:408), readEffectiveTenancyPosture (:275), FLOW_ACTIVATION_SUBJECT (:132) and ACTION_ACTIVATION_SUBJECT (:148). The anchor count goes 886/896 → 917/927 with none refused.
  • The refuted §3 note "the notify assignee must be a user id" is rightly left alone. recipient-resolver.ts routes an email-shaped recipient through resolveEmail to the user id.
• Integration-system. §3's bullet, round 2's additions and the leftovers of rounds 3–4 are taken. 18.0 round-2 sweep framework findings: a paid invoice line's amount/total stays writable while its inputs are locked; an unevaluable hook condition answers 500 INTERNAL_ERROR; remote-tables?schema= never narrows on the SQL drivers #24619 rows (b) / (c) are read first. external-schema-introspection acceptance[1] states the finding: the two listRemoteTables route twins diverge on ?schema= — the admin spelling drops it #7955 contract that the open service-datasource: remote-tables?schema= never narrows on the in-tree SQL drivers, so a named schema answers 200 with the wrong tables (#24619 row c) #24664 makes false live, so it stays; only the knownGap's fixture claim is corrected. connector-declarative-boot's ref is narrowed per clause.
• Carried notes (b).
  • metadata-authoring-roundtrip's stale record now cites QA run · tier1:automated-pins (149/166) · ba4afcc2 · 2026-10-19 · 60 PASS / 89 PARTIAL / 0 FAIL / 0 BLOCKED / 17 NOT-RUN #24598 and e2e(live): eleven live specs are stale or red at the console pin against the shipped showcase — the 18.0 sweep's Tier 1 run (#24598) read them as non-defects, and no card holds their repair objectui#13104.
  • platform-owner-email-anchor steps[0] names serve.ts#walledPostureRefusal.
  • RUNNER.md's objectui-only count is replaced by its membership rule. On the tree with docs(qa): 18.0 sweep anchor round 6 — mark the objectui live specs stale at the console pin, and narrow or drop the pins that cover no full clause, in the UI-facing areas #24697 the rule counts 23; round 6's rule counts 24; the pre-docs(qa): 18.0 sweep anchor round 6 — mark the objectui live specs stale at the console pin, and narrow or drop the pins that cover no full clause, in the UI-facing areas #24697 base counts 27. A literal count drifts with no gate to catch it.
• Gates. The dev's dispatch-gates union: 13 derived, 13 run, all exit 0 at 357f2ab08b. check:platform-checklist OK. Check-runs at 357f2ab08b: 39, all completed: 31 success, 8 skipped. node scripts/pm/check-expected-skips.mjs --pr 24717 → OK — 8 skipped check-run(s), every one in the roster (exit 0). No review, no comment.
• Carried on the card, not filed.
  • The comma-range line-citation spelling survives in 21 more items, 15 outside this round's files.
  • admin-routes.ts's POST /test registration comment is misleading. It has no runtime effect and falls outside the three filing classes.
  • QA run · integration-system (17/20) · ba4afcc2 · 2026-10-19 · 17 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 3 NOT-RUN #24615's cwd-relative "Console dist not found" is a RUNNER environment fact.
  • The literal-mask PATCH stays on §7 for the maintainer.

This seat readies the PR and queues it with auto-merge.

---

Generated by Claude Code