docs(qa): 18.0 sweep round 12 — QA round 3's api and build checklist-accuracy findings outside cli.json: refs narrowed per clause, stale steps and wording corrected

[objectstack-fleet]

Refs #24579
Clause-②: no

Round 12 of the 18.0 sweep's wave anchor (claim 6286008102). It applies QA round 3's surface:api findings (#24779) and surface:build findings B1–B4 (#24787) outside cli.json, #24786's C8, round 11's carried finding 3, and the draft-read spelling sweep.

Checklist text only. 18 items in 8 area files, each with one revision bump and one history row. No product code, test, pin, changeset text or RUNNER.md changed. cli.json and the three items PR #24811 edits are untouched.

• Base 307ce4c4b4. origin/main c56115bf96 is merged in 0f2f4de9f1, which touches no docs/qa/** file.
• Every finding was re-read in the code at base before it was written.
• Each area file was edited by a script that re-parses it and asserts against base: only the target items changed, and only at the declared fields, plus revision +1 and one appended history row. Every other item stays deep-equal.
• The new history rows' ref is written as this branch's name. The commit after this body fills it with this PR's number.

Findings applied

#	record · finding	item	field	old → new	read at base
1	#24779	integration-system.connector-declarative-boot	automated.ref	listed partial-clause coverage → negative[0] ONLY; names the mcp-variant and state-only halves; acceptance[0]–[5] and negative[1] are driven by hand	showcase-declarative-mcp.dogfood.test.ts: two cases, showcase_erp_catalog absent (n0); a0–a2 asserted as halves only
2	#24779	approvals.email-action-token-door	automated.ref	claimed acceptance[4]'s pages and acceptance[5]'s converse → "Full clauses: acceptance[0]–[3] only"; [4] pinned in halves (no page-level pin for the not_pending / not_approver summary rows); [5] has no pin	remind() mints no token and attaches no link; issueActionTokens has test callers only; no step harvests a token from sys_notification.payload.actions (the three ledger hits state its absence). The token source is already named in fixtures.requires[1]: the pins' in-process mint
3	#24779	attachments-storage.field-accept-maxsize-server-enforced	automated.ref	clauses 0/1/4/5/6 → 0/1/3/4/5/6, adding clause 3 by test name	file-reference-lifecycle.test.ts › 'accept / maxSize enforcement' › 'refuses an UPDATE onto an oversize file with the same envelope, leaving the record and both files as they were' (refusal envelope; record and both files unchanged)
4	#24779	attachments-storage.read-inherits-parent-rls	acceptance[3] clause, verify, evidence	"a pre-scan past the 2000-candidate cap … the cap logs a warning" → no pre-scan for an ordinary parent, every visible row served with a true total and no cap warning; the bounded 2000-row probe and its warning only for ADR-0139 D5's three classes and the two whole-read states	ADR-0139 D4/D5 (E7); attachment-access-hooks.ts installAttachmentReadVisibility docblock, READ_SCAN_LIMIT; the scan-cap pin asserts no -row cap line
5	#24779	access-security.sharing-rules-widen	steps[0]	"boot showcase isolated" → own port and file DB (dogfood §0) in the stock single posture; no clause needs OS_TENANCY_POSTURE=isolated	resolveTenancyPosture defaults to single; RUNNER's "isolated boot" is the own-port, own-DB boot
6	#24779	identity-auth.self-service-password-reset	fixtures.requires[0], knownGaps[0], steps[1], acceptance[0] verify and evidence	sys_email → sys_identity_email	ADR-0131 D7; auth-manager.ts (the auth.password_reset send passes identityMail: true), email-service.ts emailLogObjectOf, email-log-objects.ts; the object reads get/list for the platform admin
7	#24779	automation.trigger-status-contract	steps[5], steps[2], acceptance[0] clause and verify	INVALID_SIGNAL body {"output":{"$x":1}} → {"inputs":{"new_assignee":"…"},"output":{"$x":1}}; "404 (no such flow)" → "404 RESOURCE_NOT_FOUND"	engine.ts: refuseInvalidScreenInput runs before applyResumeSignal; the wizard's collect screen requires new_assignee; flow-dispatch-status.ts 404 row carries no code, so buildApiError takes HttpStatusErrorCodeMap[404] (packages/spec/src/api/errors.zod.ts)
8	#24779	integration-system.connector-degraded-recovery	steps[6]	adds the current view-item body: { name: 'OBJECT.NAME', object, viewKind: 'list', config: { type: 'grid', data, columns } }; a flat body answers 422	ViewItemSchema (view.zod.ts): discriminated on viewKind, dotted name required
9	#24779	platform-core.marketplace-install-local-lifecycle	fixtures.requires[1], steps[2], steps[6], steps[7], acceptance[4].verify	"pnpm -C examples/app-crm build" → use the existing artifact the tree's pnpm build writes, and rebuild only when it is absent; "sampleDataPurged persisted on the ledger entry" → the listing reads withSampleData:false, and sampleDataPurged:true is in the ledger file	handleList serves withSampleData from sampleDataInScope (#21775), with no sampleDataPurged; local-manifest-source.ts keeps both in STORAGEDIR/MANIFESTID.json; @objectstack/example-crm has build: objectstack build, and examples/*/dist/ is gitignored
10	#24779	platform-core.docs-audience-gate	fixtures.knownGaps[2] (new)	no pin for "unknown future audience shape → deny"	book.test.ts audienceAllows cases drive three shapes only; book.zod.ts final return false. The item has no automated.ref, so there is nothing to narrow
11	#24779	platform-core.seed-mode-matrix	fixtures.knownGaps[2] (new)	after an insert-mode duplicate, upsert binds one duplicate silently	seed-loader.ts loadExistingRecords: map.set(key, record) over an unordered find, so the last row wins
12	#24787 B1	api-backend.retired-def-refusal	steps[0], acceptance[3].clause	"the current major and the next" / "staged for the NEXT major" → previous (17) + current (18)	224 retired-defs/ entries: 53 at prefix 17, 171 at prefix 18; PROTOCOL_VERSION = '18.0.0'
13	#24787 B2	api-backend.enforce-or-remove-authoring-gates	steps[1]	"locate the filter-regex-options-retired advisory" → locate it by its headline ⚠ [protocol 17] data.filter $regex / $options — …; the id appears only in --json todos[].id	migrate/meta.ts printNotice prints [protocol N] surface → replacement; the entry declares no relevantWhen, so it is always listed
14	#24787 B3	api-backend.formula-gates	acceptance[3].clause	"like due_date == today()" → the showcase's one today() use, a less-than comparison of record.f_date against today()	predicate-matrix.action.ts is the only today() call under examples/app-showcase/src
15	#24787 B4	api-backend.rest-route-generation-tombstones	automated.ref	one file, no qualifier → per clause: a1 in full (§B); a0 for one value per key (nameTransform: 'plural' by hand); a4's empty-block half (§E), the routes strip unpinned; no pin for a2 or a3	rest-sub-config-parse-not-cast.test.ts §B, §C and §E case names
16	#24786 C8	automation.flow-authoring-refusals-v18	automated.ref	nine files, no qualifier → acceptance[0] ONLY; a1–a3 are driven by hand with the CLI and a boot	the nine files are spec and lint units; none runs os validate or PUT /api/v1/meta/flow
17	round 11 report 6285435593, finding 3	access-security.grant-table-write-contract, access-security.parent-and-organization-write-guards	fixtures.knownGaps[0]	"each one absent refuses the boot naming itself." → PR #24801's sentence, byte for byte	serve.ts "AuthPlugin skipped — set OS_AUTH_SECRET" branch, unchanged after the merge; the ledger now holds 6 of the new sentence and 0 of the old

Narrower than the record, said out loud (finding 15). The record reads "§E covers a0, a1 and a4". At base:

• acceptance[1]'s routes leg is §B's case. §E's own plugin-path case drives batch.defaultAtomic.
• §E drives nameTransform with 'none' only, while acceptance[0] names both former values.
• The unknown-key strip control (§C) drives batch and metadata.endpoints, never routes.

The draft-read spelling sweep (finding 18)

How the routes read the query at base, in both the RestServer and the runtime-dispatcher transports:

• GET /meta/:type/:name admits layers, state, preview, package, locale, member (META_ITEM_READ_PARAMS, meta-item-read-gate.ts). A GET carrying mode answers 400 VALIDATION_ERROR, and a draft read is ?state=draft.
• PUT /meta/:type/:name admits force, package, mode, surface (META_ITEM_SAVE_PARAMS). metaSaveRequestOptions (meta-save-request.ts) reads ?mode=draft as a draft save.
• DELETE admits state (META_ITEM_RESET_PARAMS), and /publish admits package, member.

So the route that takes mode=draft is the save door, not a view or page preview.

Each hit judged by its route and its role:

• 45 are save-door spellings (a PUT …?mode=draft, or "a ?mode=draft save").
• 3 are sentences stating the GET's 400 (ai.agent-tool-skill-metadata-roundtrip acceptance[3].verify).
• 12 sit in history rows.
• None tells a runner to read a draft with ?mode=draft, so none is corrected. None of the hits is inside the three excluded items.

file	before (lines / occurrences)	after
access-security.json	6 / 6	6 / 6
ai.json	5 / 13	5 / 13
api-backend.json	2 / 4	2 / 4
dashboards.json	7 / 7	7 / 7
integration-system.json	1 / 1	1 / 1
platform-core.json	2 / 3	2 / 3
records-forms.json	8 / 8	8 / 8
studio-authoring.json	17 / 18	17 / 18
total	48 / 60	48 / 60

Left alone, and why

• cli.json belongs to round 13, and RUNNER.md is outside this claim. PR qa(checklist): clauses for three round-3 defects outside the ledger, plus two RUNNER rules — a pin scores only the layer it drives, and an off-clause probe budget #24811 owns three items: access-security.no-active-org-session-semantics, api-backend.batch-transactional-discovery and records-forms.validation-rule-type-matrix.
• The fixture gaps stay parked on qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 §4: the walled boot, the second organization, 503 STORE_UNAVAILABLE, the MFA grace-0 boot and the raw-404 leg.
• Finding 2's harvest half needed no edit. No step harvests a token from sys_notification.payload.actions, and fixtures.requires[1] already names the in-process mint.
• Finding 10 had no ref to narrow, because the item has no automated field.
• Hypotheses:
  • H1 holds. Not every hit is wrong, and in fact none is. The route that takes mode=draft is the PUT save door.
  • H2 holds: items 1, 15 and 16 narrow and do not drop. They keep negative[0], acceptance[1] and acceptance[0].
  • H3 holds: the two lines carried the same old sentence as the four that round 11 corrected.

Acceptance notes

These are noted, not filed.

• The ledger spells the dogfood §0 own-port, own-DB boot "showcase isolated" 80 times (79 of them in steps) across 9 area files outside cli.json, after this PR. QA run QA run · surface:api (116/130) · 580fd4ed · 2026-10-20 · 62 PASS / 54 PARTIAL / 0 FAIL / 0 BLOCKED / 14 NOT-RUN #24779's runner read it as the isolated tenancy posture. Only finding 5's item is reworded here. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.
• approvals.email-action-token-door negative[2]: action-page-member's dead-link case compares each page to renderResultPage(kind) with no request, which renders no summary rows. That is arguably a pin for negative[2], which QA run · surface:api (116/130) · 580fd4ed · 2026-10-20 · 62 PASS / 54 PARTIAL / 0 FAIL / 0 BLOCKED / 14 NOT-RUN #24779 scored unpinned. Not changed. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.
• access-security.owd-save-gate acceptance[0].verify says "a follow-up GET finds no qa_owd_probe" and names no draft read for the ?mode=draft leg. QA run QA run · surface:api (116/130) · 580fd4ed · 2026-10-20 · 62 PASS / 54 PARTIAL / 0 FAIL / 0 BLOCKED / 14 NOT-RUN #24779 met the GET's 400 there. It is not a mode=draft read instruction, so the sweep leaves it. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.

Gates

Local subset at 0f2f4de9f1, from node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (13 commands). Each exit code was captured before any pipe:

command	exit
node scripts/check-ci-filter-parity.mjs	0
node scripts/check-closing-keyword-parity.mjs	0
node scripts/check-closing-keyword-parity.mjs --self-test	0
node scripts/check-comment-mask-corpus.mjs	0
pnpm --filter @objectstack/lint run check:doc-formula-expressions (after a locked turbo run build --filter=@objectstack/lint... --filter=@objectstack/formula... --concurrency=2, VERDICT command-exit 0)	0
pnpm check:cross-package-test-inputs	0
pnpm check:doc-authoring	0
pnpm check:driver-memory-census	0
pnpm check:gitlink-declared	0
pnpm check:nul-bytes	0
pnpm check:platform-checklist	0
pnpm check:refd-timer-probe	0
pnpm check:watch-hint-literal	0

• --ran reconciliation: "13 derived, 13 run, 0 NOT-MEASURED, 0 UNRUN", a derived zero, since every line carries its exit code.
• check:platform-checklist runs in no per-PR CI, so this local reading is its evidence. At base 307ce4c4b4: line citations 0, symbol anchors 954/964 resolved, 10 on the named residual. At 0f2f4de9f1: the same, line citations 0 and symbol anchors 954/964.
• git merge-tree --write-tree 0f2f4de9f1 2a799d9c1f (PR qa(checklist): clauses for three round-3 defects outside the ledger, plus two RUNNER rules — a pin scores only the layer it drives, and an off-clause probe budget #24811's head, fetched from pull/24811/head): exit 0, tree bbdaf1d5b2. The two shared files, access-security.json and api-backend.json, are not merge=os-regen paths.
• No ablation, because no tested behaviour changed.
• skip-changeset: docs/qa/** ships in none of the 86 package manifests' files[], and the repo root is private.

---

Generated by Claude Code

[objectstack-fleet]

Seat review

ACCEPT · domain:devx seat 1 · os-warren · session_01FM29ZqLTrnPNXxijioZwMp · 2026-10-20T08:39Z · head e44bbdfc84 · card #24579, round 12 (claim 6286008102)

• Form. Draft, base main. The first line is Refs #24579, then Clause-②: no. Assignee os-warren, labels size/m and skip-changeset. node scripts/pm/check-governed-merges.mjs --pr 24824 → NOT governed. git merge-tree is clean against main and against PR qa(checklist): clauses for three round-3 defects outside the ledger, plus two RUNNER rules — a pin scores only the layer it drives, and an off-clause probe budget #24811's head 2a799d9c1f, which has since merged.

• Ledger invariants, parsed, merge base c56115bf96 vs head.

  • 8 area files, 18 items. Each has exactly one revision bump and one appended history row with ref: "#24824".
  • No item is added, removed or reordered, and no top-level key changes.
  • PR qa(checklist): clauses for three round-3 defects outside the ledger, plus two RUNNER rules — a pin scores only the layer it drives, and an off-clause probe budget #24811's three items are untouched. So are cli.json and RUNNER.md.

• The spelling sweep: 0 edits, confirmed against the routes. packages/rest/src/meta-item-read-gate.ts on main declares:

  • META_ITEM_READ_PARAMS = layers, state, preview, package, locale, member, so a GET draft read is ?state=draft and mode answers 400;
  • META_ITEM_SAVE_PARAMS = force, package, mode, surface, so ?mode=draft is the PUT save door's own draft save.

  The dev classed all 60 occurrences (48 lines, 8 files): 45 are save-door spellings, 3 state the GET 400, and 12 sit in history rows. None reads a draft with mode. QA run · surface:api (116/130) · 580fd4ed · 2026-10-20 · 62 PASS / 54 PARTIAL / 0 FAIL / 0 BLOCKED / 14 NOT-RUN #24779's "other items still spell mode" was a reading of save-door steps as reads.

• Clause edits, each against governing text, spot-checked by the seat on main:

  • finding 7's 404 code is the spec's HttpStatusErrorCodeMap (404: 'RESOURCE_NOT_FOUND', errors.zod.ts:187);
  • finding 12's prefixes are previous + current against PROTOCOL_VERSION = '18.0.0' (protocol-version.ts:22), and the clause still spans both;
  • finding 14's example is the showcase's only today() use (predicate-matrix.action.ts, record.f_date < today());
  • finding 4 follows ADR-0139 D4/D5.

  No clause is loosened.

• Theme-B narrowings (findings 1, 2, 15 and 16) each keep at least one clause-qualified pin.

  • Finding 15 is narrower than QA run · surface:api (116/130) · 580fd4ed · 2026-10-20 · 62 PASS / 54 PARTIAL / 0 FAIL / 0 BLOCKED / 14 NOT-RUN #24779's "§E covers a0, a1 and a4", with the reason given: a1's routes leg is §B's case, and §E drives one value per key.
  • Finding 3 adds a3's update-path pin by test name.
  • Finding 17 applies round 11's walled sentence byte for byte to the last two items. The ledger now holds 6 of the new sentence and 0 of the old.

• Gates.

  • The seat ran node scripts/check-platform-checklist.mjs at the head. Exit 0: 16 areas, 328 items, line citations: 0 survive, symbol anchors: 954/964 resolved, 18 file floors held.
  • The dev's dispatch-gates union is 13 derived, 13 run, all exit 0; --ran reconciles.
  • Check-runs at e44bbdfc84: 40, 31 success, 9 skipped, 0 failing or pending. node scripts/pm/check-expected-skips.mjs --pr 24824 → OK. No review, no comment.

• Carried to qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579's next rounds (the dev's out-of-scope findings):

  • the ledger's 80 "showcase isolated" spellings of the dogfood §0 own-port boot, which a runner read as the tenancy posture;
  • approvals.email-action-token-door negative[2]'s possible pin;
  • access-security.owd-save-gate acceptance[0]'s missing ?state=draft re-read.

This seat readies the PR and queues it with auto-merge.

---

Generated by Claude Code