qa(checklist): clauses for three round-3 defects outside the ledger, plus two RUNNER rules — a pin scores only the layer it drives, and an off-clause probe budget

[objectstack-fleet]

Fixes #24802
Clause-②: no — the internal QA ledger and its runner protocol; nothing published

Summary

Three ledger clauses for the defects round 3 of the 18.0 sweep found outside the ledger, and two RUNNER rules. Each new clause carries a QA-source: citation, a revision bump, a history row, and a knownGaps line naming its card. Each stays red until that card's fix lands.

• api-backend.batch-transactional-discovery rev 6 (rest: POST /api/v1/batch answers 500 for an update or delete op whose id is the empty string, where a missing id answers 400 VALIDATION_FAILED #24781). New acceptance[5]: an update or delete op on POST /api/v1/batch whose id is the empty string answers 400 VALIDATION_FAILED, the same as a missing id, and never a 5xx. Adds steps[6] (the empty-id pair plus their no-id controls) and negative[1]. Source: QA run QA run · surface:api (116/130) · 580fd4ed · 2026-10-20 · 62 PASS / 54 PARTIAL / 0 FAIL / 0 BLOCKED / 14 NOT-RUN #24779, observed beside the clauses.
• records-forms.validation-rule-type-matrix rev 5 (objectql(validation): an unevaluable severity:'warning' rule logs "write rejected: … fails closed" twice while the write is accepted 201 and persists #24782). New acceptance[5] (log oracle): an unevaluable severity: 'warning' rule lets the write land, and no log entry naming the rule says the write was rejected or failed closed. fixtures.requires[2] carries round 3's recipe: two scratch objects authored through PUT /api/v1/meta/object, each with a script rule int(record.title) > 1, one at warning and one at error. That closes round 2's fixture gap (QA run QA run · records-forms (38/44) · ba4afcc2 · 2026-10-19 · 34 PASS / 2 PARTIAL / 2 FAIL / 0 BLOCKED / 6 NOT-RUN #24616: negative[0] blocked(fixture), "an unevaluable CEL validation cannot be authored through any door"). negative[0] now names its scratch object. Adds steps[6] and negative[3].
• access-security.no-active-org-session-semantics rev 6 (group posture: a member whose session has no active organization gets 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on a tenant-scoped create, where isolated answers 403 naming the missing organization #24784). New acceptance[7], the walled group leg: a member whose membership set is non-empty and whose session has no active organization never gets a 5xx on a tenant-scoped create, and nothing is stamped with a NULL organization_id. Whether group lands that write or refuses it 4xx is left to group posture: a member whose session has no active organization gets 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on a tenant-scoped create, where isolated answers 403 naming the missing organization #24784. Adds steps[8] (the set-active-null producer) and knownGaps[3]. automated.ref now names the layer its pin drives. no-active-organization-write-refusal.test.ts runs SecurityPlugin's middleware over a stub terminal that stands in for the engine, so its group CONTROL "lands" at the plugin-security layer only. The pin therefore cannot score acceptance[7].
• RUNNER rule 6, new paragraph: a pin scores only the layer it drives. Before a pin scores a clause whose oracle is a public door's answer, the runner names the layer the pin reaches (plugin unit, engine, or HTTP), read off the pin's harness. A pin that stops above the oracle's layer scores the clause partial and names the missing layer. group posture: a member whose session has no active organization gets 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on a tenant-scoped create, where isolated answers 403 naming the missing organization #24784 is the worked instance. The paragraph sits beside rule 6, not inside the walled-boot entry.
• RUNNER rule 8: keep an off-clause probe budget. Each run keeps time after its clauses for probing the selector's doors past them: boundary values, the opposite severity or posture, and recipients outside the asserted scope. A probe scores nothing. A finding that passes the filing gate is extracted with QA-source: … · observed beside the clauses. The run-record body contract gains the probe line: how long the probes took, what they covered, and what they found.

Not in this PR: the records-forms.record-discussion-mentions clause for #24785. Its fix PR #24794 is still an open draft (checked just before this PR was opened). Under RUNNER rule 2 that clause would publish the reproduction before the fix ships, so it waits until #24794 merges.

Out of scope, and not touched here: the round-3 re-points and accuracy findings in #24579 comment 6284472874. These include F3, the group wording of this item's acceptance[0] and [1] and its knownGaps[0] and [1] producers. They belong to the anchor lane.

Verification

The clauses were run on a stock showcase at a43405d596, this branch's base and current origin/main. The build was pnpm build --concurrency=2 (76/76). The boot was objectstack dev --seed-admin, posture single, on a fresh DB. Server stopped by process group afterwards.

clause	expected now (card open)	measured
batch acceptance[5], update with id empty string	red	500 DATABASE_ERROR "Internal data error"; no-id control 400 VALIDATION_FAILED "Operation 'update' on 'showcase_task' requires an id"
batch acceptance[5], delete with id empty string	red	500 INTERNAL_ERROR; no-id control 400 VALIDATION_FAILED. Log: [REST] Unhandled error: Error: Update requires an ID or options.multi=true (and the Delete twin)
validation acceptance[5], warning rule	red	201, row persisted (re-read 1 row). The log prints two entries naming qa_unevaluable_warn, and both say "write rejected". The first ends "a rule that cannot be evaluated fails closed, it is never skipped" after a multi-line CEL caret excerpt, so the verify text now says to read each entry to its end
validation negative[0], error twin	green	400 VALIDATION_FAILED, fields[0] {field: _record, code: rule_violation}, re-read 0 rows
no-active-org acceptance[7], walled group	red	not measured here: it needs a walled boot (scratch app declaring @objectstack/organizations, owner email, membership policy). Its red rests on QA run #24783 and the RUNNER rule 7 re-derivation in #24784. Per the dispatch, written from knownGaps, not hand-tested

The red and green states match the cards: #24781, #24782 and #24784 are open.

Gates

On head 1143504b:

• node scripts/check-platform-checklist.mjs → exit 0. Output: check-platform-checklist: OK — 16 areas, 328 items (323 active, 1 planned). It reports 0 line citations surviving and 943/953 symbol anchors resolved, the same counts as on base.
• node scripts/pm/dispatch-gates.mjs --commands derived 13 commands, each run and each exit 0:
  • node scripts/check-ci-filter-parity.mjs 0
  • node scripts/check-closing-keyword-parity.mjs 0
  • node scripts/check-closing-keyword-parity.mjs --self-test 0
  • node scripts/check-comment-mask-corpus.mjs 0
  • pnpm --filter @objectstack/lint run check:doc-formula-expressions 0 (ran: the log ends with the checker's own summary)
  • pnpm check:cross-package-test-inputs 0
  • pnpm check:doc-authoring 0
  • pnpm check:driver-memory-census 0
  • pnpm check:gitlink-declared 0
  • pnpm check:nul-bytes 0
  • pnpm check:platform-checklist 0
  • pnpm check:refd-timer-probe 0
  • pnpm check:watch-hint-literal 0
• node scripts/pm/dispatch-gates.mjs --ran → exit 0: 13 derived famil(ies) accounted for — 13 run, 0 NOT-MEASURED.
• coverage.json untouched: the checker required no change.

Acceptance notes

• Steps are referenced 1-based in verify text, as the existing api-backend clauses do ("step-7"). History rows use 0-based array indices ("steps[6]").
• The batch and validation knownGaps lines record the 580fd4ed measurement and this PR's re-measurement at a43405d596. Each tells the runner to re-run the clause and drop the line once its card's fix merges.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 — ACCEPT (#24802, head 2a799d9c1f)

Reviewed by the dispatch session session_01CfRDy7SuTfUqaTu2AEH2Hi against its own read of the diff (git diff origin/main... on the head), not against the report. The maintainer asked for this PR to be landed in that session.

1. Shape. 4 files, all in the claimed surface: RUNNER.md and the api-backend, records-forms and access-security area files (+107 / −17). coverage.json is untouched.
   • Three clauses each carry QA-source:, a revision bump, a history row and a knownGaps line naming its card (rest: POST /api/v1/batch answers 500 for an update or delete op whose id is the empty string, where a missing id answers 400 VALIDATION_FAILED #24781, objectql(validation): an unevaluable severity:'warning' rule logs "write rejected: … fails closed" twice while the write is accepted 201 and persists #24782, group posture: a member whose session has no active organization gets 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on a tenant-scoped create, where isolated answers 403 naming the missing organization #24784).
   • The rule 6 paragraph sits beside the pin-evidence rule, not inside the walled-boot entry. Rule 8 and the run-record probe line match the card's Scope.
2. Merge of main. Merge commit 2a799d9c brings in docs(qa): 18.0 sweep round 11 — the walled pass of QA round 3: RUNNER's walled boot under serve, and eight items' producers, recipes and refusals #24801 (round 11), without a rebase. The only conflict was in access-security.no-active-org-session-semantics, and both sides are kept:
   • docs(qa): 18.0 sweep round 11 — the walled pass of QA round 3: RUNNER's walled boot under serve, and eight items' producers, recipes and refusals #24801's knownGaps[0]–[4] and its revision 6 history row stand as main has them.
   • This PR's row is now revision 7, and its knownGaps entry is [5]. Read in the diff.
3. Premise measured. Clauses (a) and (b) were driven on a stock showcase at a43405d596. Both are red, as their open cards predict, and the error twin's 400 control is green. Clause (c) is written from QA run · walled:isolated+group (11/14) · 580fd4ed · 2026-10-20 · 8 PASS / 1 PARTIAL / 1 FAIL / 1 BLOCKED / 3 NOT-RUN #24783 and group posture: a member whose session has no active organization gets 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED on a tenant-scoped create, where isolated answers 403 naming the missing organization #24784, because it needs a walled boot.
4. Gates.
   • CI on 2a799d9c: 31 success, 9 skipped, 0 failing. Mergeable: clean.
   • On the merge commit, check-platform-checklist.mjs (16 areas, 328 items) and the same 13 derived commands all exit 0. The Gates section of the body still quotes the pre-merge head 1143504b.
   • check-governed-merges.mjs --pr 24811: NOT governed (0 of 4 paths hit the register), +107 / −17.
5. Accepted deviation. Clause (d), for records-forms.record-discussion-mentions, is held back until its fix PR fix(plugin-audit): @mention notifications reach only mentioned users who can read the record #24794 merges (RUNNER rule 2), as the card says. It follows in a separate PR.
6. Out-of-scope findings.
   • The guard-hook false positive is reproduced and filed as guard-main-checkout-bash.sh reads quotes inside a $(…) command substitution as closing the outer double quote, so a > inside a quoted curl body is taken for a redirect and a read-only command from the primary checkout is blocked #24812.
   • The setsid process-group correction went to the anchor qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 (comment 6285856955).
7. Landing. Clause-② no; not governed; ordinary queue landing: ready, then auto-merge.

---

Generated by Claude Code