[sweep] v18.4.0 release test sweep #32908

Activity

1. objectstack-fleet

   added

   documentationImprovements or additions to documentationImprovements or additions to documentation

   priority:p1High: required for production / M2High: required for production / M2

   domain:devxDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   on Nov 12, 2026
2. objectstack-fleet commented on Nov 12, 2026

   

   objectstack-fleetBot

   on Nov 12, 2026

   ContributorAuthor

   More actions

   triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

   Path: none

   Triage: first touch → domain:devx · p1 · pm:queue · 2026-11-12T23:47Z

   ⛔ Not a claim.

   • State: the wave anchor was filed with grade and lane but no pm state, and no claim is recorded. pm:queue lets the seat that runs Round 1 record its Claim:.
   • Grade: p1, as filed. It is the release's acceptance evidence under the maintainer's 18.4.0 plan.

   ---

   Generated by Claude Code
3. objectstack-fleet

   added

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   on Nov 12, 2026
4. objectstack-fleet commented on Nov 13, 2026

   

   objectstack-fleetBot

   on Nov 13, 2026

   ContributorAuthor

   More actions

   qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W

   Round 2 taken by qa#3 (2026-11-13T04:08Z). The maintainer, in this seat's session, picked 「qa#3 跑增量 + 复测」 for the question 「18.4.0 第 2 轮验收由谁跑?」. domain:devx#1: please don't run these slices, so nothing runs twice. Seat post #33014, mailbox #33015.

   Round 2, on the frozen release-candidate subject (taken once the five open priority:p0 cards #32955, #32754, #32929, #33003, #32986 have landed):

   slice	selector	why
   R2-P0	priority:P0 (24)	round 1's subject 5fb79bc0 is 56+ commits old, with a dozen breaking (!) fixes since
   R2-FIX	the items behind #32955, #32754, #32929 (HotCRM CRM Overview against 18.3.0), #33003, #32986	re-judge each p0 fix
   R2-UPG	release-18.4.0-w1-upgrade (3)	stored-row, package-less-row and overlay reads changed after round 1
   R2-TOUCH	touched:5fb79bc0 (147 at main ee9ad834: 4 P0, 95 P1, 48 P2; 69 api)	the increment round 2's original plan did not cover

   Round 1's since:v18.4 FAILs behind #32941–#32946 (all p2) are re-judged only where their fix has landed by the freeze; the rest read as known issues. smoke:npm-18.4.0 after publish stays with the lane's post-release rule.
5. objectstack-fleet commented on Nov 13, 2026

   

   objectstack-fleetBot

   on Nov 13, 2026

   ContributorAuthor

   More actions

   qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W

   Parked from #33025 (qa#3 · R2-TOUCH api slice · main ee9ad83, 2026-11-13T05:08Z): checklist-accuracy notes and fixture gaps, not extracted. The record body carries the evidence.

   The clause-level detail is in each group comment.

   Stale or wrong item text, no verdict moved:

   • api-backend.api-methods-verb-gate A1 and N1 say restore/purge never appear in the allowed list. Since ADR-0148 / engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237 they derive from delete, so ['get','delete'] answers allowed ["get","delete","restore","purge"]. The clause's real check, that the list equals the computed closure, passed.
   • api-backend.retired-def-refusal rev 2 quotes the manifest.loading tombstone. It was removed under the ADR-0087 2026-10-26 addendum (spec: retire tombstones, conversions and migration entries older than one protocol major; a strict unknown-key refusal with an upgrade-guide link takes over (maintainer ruling D2 = A) #25767 D2=A). A 17-prefix carrier now gets the generic unknown-key refusal plus the upgrade-guide sentence. The registry holds 249 entries (53 at 17, 196 at 18), not 224.
   • api-backend.aggregate-contract-matrix: since spec + rest: retired-key, aggregation and filter-comparand refusals answer 300-1300 character messages; split each into a short head and a rationale the door answers as a hint #32279 the array_agg/string_agg prescription sits in fields[].hint, not in message.
   • automation.trigger-status-contract A5: the "edit the paused node away" arm now resumes on the run's pinned body with 200. Only the deregistered-flow arm still answers 404 RUN_NOT_FOUND.
   • studio-authoring.save-door-runs-authoring-rules: the title's "details and tabs slots" case is outdated. slots.tabs has been retired whole since 18.3.0.
   • studio-authoring.removed-key-save-door-refusal: view and form refusals also carry a second issue at path '' that says only "Invalid input". The suggester proposes aria → areas, and a key named "" renders as empty backticks.
   • integration-system.external-schema-introspection A2: draft fields carry {type, label}, not {type} only.
   • integration-system.connector-degraded-recovery A3: the first retry is immediate (boot-end reconcile, about 3 s), then 10 → 20 → 40 s. A metadata reload retries at once. Neither is a hot loop.
   • cli.dev-automigrate-policy knownGaps[1] and N3: a sqlite-wasm autoMigrate is now refused at build, not accepted and ignored. The os serve step also needs OS_AUTH_SECRET.
   • cli.migrate-plan-apply-json: the plan lists eight lifecycle create_tables. migrate meta refuses --database-url without --stored (exit 1), which is not a os migrate 成功时退出码是随机非零值(208/171/176/163/62…),--version / --help 却干净退出 0 #4873 violation.
   • cli.migrate-meta-codemod: the stock showcase has two mode-less decision nodes, not three. negative[6] clashes with step 8's output. Step 3 should plant keys retired at 18, because a 17-retired key's conversion left with its tombstone.
   • identity-auth.two-factor-enrollment-reveal: the "pre-verify bearer answers 401" note does not hold on a cookie session (200/400).
   • identity-auth.two-factor-disable-lifecycle: mfa_required has three levels (off / administrators / everyone). A gated user cannot restore the setting (403 MFA_REQUIRED) until they enroll again.
   • platform-core.manifest-install-contract: GET /api/v1/meta has no protocol field. Read the major from GET /api/v1 version.
   • access-security.ai-service-account-agent-ceiling A0 and A3 name GET /auth/me/permissions with the agent's key. That door is session-only by design, so it answers any key {authenticated:false} and A0 can never be consulted there. The steps should also use an owner-private object, because showcase_task is public-read and hides the clamp.
   • access-security.activation-write-operator-gate steps[4] says ledger reads are open, but a member gets 403 on sys_metadata_activation.
   • access-security.no-active-org-session-semantics steps[8] has a member create a showcase_account. The object's create permission refuses that first, and the resulting generic 403 can be mistaken for the org refusal.
   • ai.mcp-coded-refusals-and-runtime-exposure A1 names no door. The coded refusal holds on HTTP only (card-api-5).
   • ai.mcp-namespace-faces: the action ai.description must be at least 40 characters. N2's only pin, packages/mcp/src/mcp-action-tools.test.ts:313, is missing from automated.ref.
   • ai.mcp-tool-call-interceptor: steps[4] should wait for health 200 before the stdio calls. knownGaps[0] can close: the inline-plugin fixture booted and all five legs held.

   Fixture gaps (blocked rows above) and recipes:

   • The walled-leg grant for activation-write-operator-gate A4 needs a grant placed outside HTTP.
   • No door mints a raw approval token (approvals.email-action-token-door, five rows).
   • The SLA recipe was not driven (approvals.status-mirror-field A2b).
   • The abort-failure and 'failed'-producer seams exist only in unit tests (attachments-storage.upload-session-abort).
   • The metadata-plane 503 arm has no door (api-backend.action-activation-door-contract A4b).
   • No colliding-face pair is staged (ai.mcp-namespace-faces N2).
   • platform-core.metadata-registry-serving A6 needs the form screenshot from a Console build.
   • Stock personas need a sys_attachment permission grant before the attachment hooks can be reached.
   • identity-auth.import-invitation-and-sso-domain-answers fixtures should name OS_SSO_ENABLED.
   • cli.meta-package-flags-and-explain: the writable package must declare a dependency on com.example.showcase, or the view save is refused 422.
   • platform-core.marketplace-install-local-lifecycle: a member created by the admin has mustChangePassword, so every door answers 403 PASSWORD_RESET_REQUIRED until the password changes.
   • The scratch qa_b package needs strict:false or a dependency on qa_a to build.
   • showcase_batch_reminders needs a tasks input when triggered.

   Environment facts for RUNNER (shared-tree traps met this round):

   • --no-compile boots serve whatever dist/objectstack.json another runner compiled last, so exporting OS_PORT is not enough. One connector boot self-pinged another runner's port; the runner caught it and discarded the boot. Items that self-ping were re-run from scratch copies compiled under their own OS_PORT.
   • qa-fixture.mjs walled-boot compiles into the shared dist.
   • os package install writes manifests into the shared examples/app-showcase/.objectstack/installed-packages/, which every later boot re-registers, and no API door undoes it. One runner's scratch pair sat there for about a minute (04:46–04:47Z). The only tree boot in that window read no package listing, and the folder is empty again.
6. objectstack-fleet commented on Nov 13, 2026

   

   objectstack-fleetBot

   on Nov 13, 2026

   ContributorAuthor

   More actions

   qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W

   Parked from #33048 (qa#3 · R2-TOUCH browser slice · main ee9ad83, 2026-11-13T06:33Z): checklist-accuracy notes and fixture gaps, not extracted. The record body carries the evidence.

   Fixture gaps (no card): home-amount-preview-states has no editable stock carrier (see BLOCKED row: either re-point the item at an object with an editable currency field, or decide the preview should also render on a computed amount); delete-toast-undo-restore — the only Project grid (All Projects) declares its own bulk actions, which removes the built-in bulk Delete by design (ObjectGrid.tsx ~L1299; on Tasks the same path toasts "Deleted 2 Task records" with no Undo); settings-hub-roundtrip — no stock user-scope secret; activation-ledger — the ambiguous-row leg needs a second holding package; self-signup-gate ran its invite_only variant only (email_domain / open need a declared audience); the showcase contributor persona reads zero showcase_task rows (its task_own_rows compares assignee == current_user.email; the run had set assignee to a user id, so treat as a fixture note until someone confirms what assignee should store) — package-customize-restore-display's end-user render used an admin context.

   Environment-fact corrections for RUNNER.md:

   • a plain cp -a examples/app-showcase scratch copy does not boot (relative pnpm links: Cannot find module …/@objectstack/cli/bin/run.js); working recipe: copy into WS/examples/app-X and symlink WS/packages and WS/node_modules to the tree's, or replace the copy's node_modules with an absolute symlink;
   • on a --no-compile boot with OS_PORT exported, showcase_declarative_connector_ping still failed fetch failed and the connector's metadata baseUrl read 127.0.0.1:3000 (RUNNER says the live dispatch follows OS_PORT); not scored, connector_action passed on two other flows;
   • a reboot within 1 h on the same DB skips the first lifecycle sweep (watermark in sys_lifecycle_state, objectql: the lifecycle sweep runs 60 s after every kernel boot, even on a database created seconds earlier, so a fresh tenant kernel pays 130 statements in its first minute #29918) — lifecycle-retention-sweep steps S4/S5 are stale on that point;
   • doors acting on an approval request answer 404 REQUEST_NOT_FOUND (not 403) to a caller who cannot read it (refuseUnreadableRequest, by design) — affects request-page A1, quorum S4, decision-matrix A6/N2;
   • the studio-customize-journey live spec needs more than the default 30 s on a loaded 4-CPU box with a vite dev console.

   Per-item checklist-accuracy notes follow.

   access-security.share-link-landing-page

   • The item writes the route as /s/:token; on a CLI-served boot the page is /_console/s/:token (bare /s/<token> answers the server's 404 JSON ENDPOINT_NOT_FOUND). The Sign-in link's redirect is basename-relative (/s/…) and round-trips correctly.
   • Cosmetic (not scored): the header prints the object API name ("Shared showcase_client_brief") and the hidden-fields notice prints field API names (internal_notes, deal_value), not labels; the card also lists system fields (Owning Business Unit, Queue, Id, Organization). The clause's expected string matches what renders.
   • An anonymous load logs two 401s on GET /api/v1/auth/get-session in the browser console (expected for a no-session visitor).

   access-security.security-catalog-one-holder-and-boot-report

   • The data API refuses planting the A4 grant: POST /api/v1/data/sys_user_permission_set {permission_set:'qa_no_such_set'} → 400 VALIDATION_FAILED reference_not_found, so S3's "plant a row" is a SQL write on a stopped server's file (as done).
   • A4's clean-boot INFO line is invisible on a default os dev boot (its banner shows WARN and above only); pass --log-level info to read it.
   • The ≤50 names cap was not driven live (2 grants); the pin covers 51.

   approvals.request-page-reply-and-reader-visibility

   • A1 member leg: the clause expects 403 FORBIDDEN; the product answers a non-reader 404 {"code":"REQUEST_NOT_FOUND","error":""} by design (ApprovalService.refuseUnreadableRequest, packages/plugins/plugin-approvals/src/approval-service.ts: "Every door that ACTS on a request … answers a caller who may not READ the request exactly what it answers an id that names no request"); no row lands, so the clause's substance holds. Reproduced twice. FORBIDDEN 'actor … is not on this request' is rea…
   • Related, scored on approvals.inbox-metadata-actions (ALERT filed): on this sha the request page itself renders 'Object Not Found' for every NON-admin participant (GET /meta/object/sys_approval_request → 404 for them); A4 here is the admin's view only, as the clause asks.
   • A2's 404 leg is reachable on stock with a runtime grant: PUT /api/v1/meta/permission/ {objects:{sys_approval_request:{allowRead:true}}} (200) + POST /data/sys_user_permission_set {user_id, permission_set, organization_id} (201) — no seed change needed; the item could carry this as its fixture instead of "blocked(fixture)".
   • S3/A3 scratch object needs sharingModel declared (PUT without it → 400 INVALID_METADATA security-owd-unset) and the reader needs an object read grant; a stock member holds none on a runtime object.

   attachments-storage.download-authz-both-sides

   • S0's field-owned receipt is reachable over REST: upload with scope 'user', then PATCH the invoice line's receipt with the fileId — the claim stamps ref_object/ref_id/ref_field.
   • The acl flip in S5 works as a plain admin PATCH on /api/v1/data/sys_file (200); members get 403 PERMISSION_DENIED for the same write, on their own file or another's. The knownGap's "system write" wording could name the admin door.
   • An admin attaching a MEMBER's uncommitted-to-any-record file to an admin-owned parent is refused 400 "File cannot reference this file: it is not a file you can open" — so the uploader-bypass leg needs the temp-grant-then-revoke shape used above.

   attachments-storage.inline-grid-receipt-cells

   • S8 says "re-open the created invoice": the invoice record page (a custom page layout: Invoice / Amounts sections) does not draw the line items in its first screen; the chip is read in the Edit Invoice dialog's Line Items grid.

   automation.setup-packaged-automation-board

   • The served Setup entry carries icon: 'zap', a harmless extra key A0's list doesn't name. The rail/_status count is 33 on this sha (the item cites 32 from QA run · release-18.3.0-w4-l1 (40/40) · 7fa9873f · 2026-11-02 · 37 PASS / 2 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #29124); per the item, reconcile names, not counts.

   automation.package-flow-override

   • The topology edit was API-written into the Studio-created pair draft. Studio has canvas affordances (Add node / edge +), but this run did not drive a node removal through them. The label edit and every other step went through Studio.

   automation.flow-reference-package-resolution

   • The item doesn't say what status the scratch flows declare. They were authored without status and installed as draft (_status status "draft", enabled true), and the door trigger ran them, so this didn't matter.
   • The environment-holder refusal's remedy, "Declare a dependency on the package that holds it (ADR-0141)", reads oddly when the holder is "the environment", which no package can depend on. The other half of the sentence (move the flow into the package) is the usable fix. This is copy nuance, not scored.

   cli.package-upgrade-plan-override-advice

   • The fixture says "customized in Studio … and published"; this run used the RUNNER pair recipe over the API (ensure-customization + PUT ?package=…custom), which writes the overlay active in one step. The hidesChange entry is the same either way.
   • The view the build registers is qa_up_ticket.default (from a list: view key), worth naming in the fixture.

   identity-auth.implicit-account-linking-ownership

   • unlink-account accepted the sys_account ROW id as accountId (as S4 says); better-auth's own parameter name reads like the provider account id, so a runner reading the library docs may send the sub instead — the row id is what worked here.
   • The fixture recipe in identity-auth.linked-accounts-social held: an inline plugin object in the scratch config's plugins array, calling applyConfigPatch in start(), registers the provider before better-auth builds.

   integration-system.job-package-key

   • sys_job carries no package column, so "which package holds the bare key" is read only from the INFO attribution line above (printed at info/debug level; os dev defaults to warn) — the item's verify could name it.
   • The packages need a body job: install-local carries no runtime module, so a handler job in such a package could never run.

   platform-core.lifecycle-retention-sweep

   • S4's 'boot fresh on the same file DB … and wait ≥90s' is stale since objectql: the lifecycle sweep runs 60 s after every kernel boot, even on a database created seconds earlier, so a fresh tenant kernel pays 130 statements in its first minute #29918 (sweep watermark): the control sweep writes sys_lifecycle_state.last_swept_at (row id 'lifecycle', in the PRIMARY file life.db), and a reboot inside one interval (1 h) skips the first sweep (runFirstScheduledSweep → watermarkIsYoung, packages/objectql/src/lifecycle/lifecycle-service.ts; the only trace is a DEBUG line). Measured: a re-boot at 05:05:03 on the same DB logged no sweep line after 3.5 min. The run…
   • Also from objectql: the lifecycle sweep runs 60 s after every kernel boot, even on a database created seconds earlier, so a fresh tenant kernel pays 130 statements in its first minute #29918: a store a boot created from empty defers its first sweep one interval — S0's schema boot must be stopped before 60 s or it seeds a watermark that suppresses S2's control sweep (this run stopped it in time).

   platform-core.package-export-round-trip

   • On the target every package lands with source 'marketplace' (exa, exc, exd) or 'authored' (the pair) and exd is ENABLED (a fresh runtime has no disable) — so the source's disabled exd serves 404 on /meta/object/qaexd_item while the target serves it 200. Expected by the design (the export carries items, not the disable); worth one line in A5 so "serves every item the source served" is not read as a mismatch.
   • Every target install logs WARN … declares no engines.protocol range; loading under protocol 18.0.0 without a compatibility check because the export carries no engines range for packages authored at runtime — noise a runner should not count as the A5 WARN.

   platform-core.activation-ledger-package-key-upgrade

   • On route (a) 18.3.0's position door also writes package_id (com.objectstack.plugin-security), so the "position row stays null" check needs the row nulled by SQL as the flow row is; the item only says this for the flow row.
   • The conflict-boot ERROR sentence says the duplicates are "two activation rows for one item the environment authored (no package)" while the item (qa183_sync_flow) is package-held — the wording reads the NULL package_id as an environment item. Cosmetic; the ObjectQLPlugin line beside it names the holder correctly.
   • Every boot of this tree logs ERROR [security] upgrade impact: 1 activation ledger row(s) … name an item no package ships … qa183_env_flow for the planted environment row: expected for a switch row on an environment item (18.3.0's door refuses one), noted so the next runner does not chase it.

   platform-core.bare-name-one-holder-refusal

   • Rev 2's A0/A3 and N0 are stale at ee9ad83 for flow (and agent, email_template, action, picklist, mapping, dataset, api, function — all namespace-scoped now); only tool, connector, webhook keep one holder per deployment. The variants line "a run drives flow and agent" cannot exercise the one-holder refusal at this sha.
   • A2's "qa_a takes auth.password_reset over the platform's copy" is not visible on a package-less read: the platform copy still answers it. Whether the email service resolves qa_a's copy for password-reset mail was not driven.
   • Types not driven: picklist, mapping, dataset, api, object-less action, function, webhook, connector, skill (tool driven as the control).

   records-forms.related-list-server-pagination

   • S0's route: clicking Northwind in the list opens a ~720px record drawer (tabbed tier: Overview/Activity/Contacts 26/… strip), not the column-tier page S1 describes; the column-tier page is the row's ↗ "Open as full page" or /record/<id> directly. Worth saying in S0.
   • The page-1/page-2 child requests carry no sort param (paging over an unspecified order). Pages were disjoint on this SQLite boot; noted only as a fragility, not scored.

   records-forms.adhoc-filter-sort-builder

   • The console's own Log out removes the list-state:* / list-filters:* keys from localStorage (LS keys after logout: none), so S5's "the cache this step tests" is gone by the time B signs in; B's cleanliness is then guaranteed by both the logout wipe and the user-keyed row. Worth a sentence in S5 so a runner does not expect to see A's keys still present beside B's.
   • The sidebar's "In-Progress Tasks" (Data Slices) link opens /showcase_task/data?filter[status]=in_progress, a different surface from the in_progress saved view; S3's "navigate back to showcase_task in_progress" must go through Tasks + the view switcher (which lands on /view/showcase_task.in_progress?uf__filter=…&uf__search=…&uf__sort=…).
   • The FilterBuilder/SortBuilder toolbar buttons are icon buttons (aria-label "Filter"/"Sort", testid toolbar-filter-trigger) whose accessible name gains the badge count once active.

   records-forms.concurrent-edit-conflict

   • Inline dialog buttons read "Reload latest" / "Overwrite anyway" / "Cancel" (item text says Reload / Overwrite) — product labels, not a defect.
   • UX nit (not scored): for a multi-field inline conflict the dialog renders YOUR EDIT / CURRENT VALUE as raw JSON ({"annual_revenue":3333,"website":"…"}) rather than labelled field values; single-field conflicts render the plain value.

   records-forms.record-discussion-mentions

   • fixtures.requires[2] / steps[13] say no showcase permission set grants sys_comment read and a minted member's GET /api/v1/data/sys_comment answers 403 (qa(checklist): records-forms — provisioning recipes for a walled two-organization mention leg, a packaged action specimen, and the app-crm import specs #26625, QA run · release-18.3.0-w3-manual-browser (54/55) · c4c515ad · 2026-10-29 · 44 PASS / 2 PARTIAL / 8 FAIL / 0 BLOCKED / 1 NOT-RUN #27441). Measured at ee9ad83: a fresh member holds member_default with sys_comment allowRead true and the GET answers 200 on both the single and the group boot — the qamention_comment_reader grant is no longer needed (skipped here; reads proved directly).
   • A7/S11 assert four FeedFilterMode options with changes_only = "rows of feed type field_change". Since objectstack#30074 ruling C the panel offers changes_only only for an object with field history and fills it only with sys_audit_log entries; showcase_project has no trackHistory, so the panel offers 3. Stale spec — the four-mode leg needs a record:discussion panel on a trackHistory object (none in the stock showcase).
   • S6/A3: the console bell does not read GET /api/v1/notifications; it reads sys_inbox_message + sys_notification_receipt (useInboxBell.ts) and its badge counts unread TOPICS (two mentions → "1 unread topic", ×2). GET /api/v1/notifications still carries the per-row unreadCount the clause cites, and mark-read goes to POST /api/v1/notifications/read[/all].
   • sys_comment.mentions is a JSON-STRING textarea: an array body answers 400 "expected a string, received an array" — steps[13]'s "mentions naming the member" should show the "[\"id\"]" shape.
   • The walled fixture node scripts/qa/qa-fixture.mjs walled-boot boots from the shared tree without --no-compile/--no-watch, so a shared-tree run must hand-roll the boot (done here from the scratch copy).

   records-forms.object-hook-lifecycle

   • S2: showcase_task requires project; a bare padded-title POST answers 400 VALIDATION_FAILED (required) — the step's "valid required fields" should name it.
   • Scratch hooks need no scratch package: a package-less PUT /api/v1/meta/hook/ saves env-wide (200) on a stock boot.

   records-forms.field-type-constraints

   • Every zoo POST needs f_master_detail (required master-detail → showcase_project); the steps' bodies omit it — a first 201-char probe answers two field errors (max_length + required). Add it to S1–S8.

   records-forms.cascading-multilevel-and-clear

   • A1's "message key option_unavailable" is not in the HTTP body: the 400 carries code invalid_option and the rendered message "Province / State: option 'ca' is not available"; the key lives server-side (packages/objectql/src/validation/rule-validator.ts:3149 messageKey: 'option_unavailable'). Score on the code; the verify text could say "message rendered from option_unavailable".
   • knownGaps[0] (no 3-level cascade fixture) unchanged: still 2-level only; no clause depends on it.

   records-forms.field-history-tracking

   • N2 probe on showcase_task: a direct backlog → in_progress PATCH answers 400 invalid_transition (state machine); step through 'todo' first.

   records-forms.delete-toast-undo-restore

   • S4 cannot be driven on Project in the stock showcase: the only project grid (All Projects) declares bulkActionDefs, which by design suppresses the implicit bulk Delete; no other project surface offers row selection with Delete. Suggest pointing S4 at showcase_task's All Tasks (which keeps the implicit Delete; toast "Deleted 2 Task records", verified here) or seeding a project grid view without defs.
   • A0's dialog now carries a second sentence naming cascaded children ("This also deletes their related records in: Field Zoo, Membership, Task.") — still no permanence promise; the verify could quote the full body. ("their" reads oddly for a single record — copy nit.)

   records-forms.home-amount-preview-states

   • The item's oracle surface does not exist on the stock showcase: "the line under Amount" on the invoice edit form is never drawn, because amount is a formula field (read face), and the preview only mounts on an editable record-mode currency. Needs triage between (a) assertion/fixture defect — point the item at an object with an editable record-mode amount (none ships in the showcase; a fixture is needed), or (b) product gap — ADR-0144 D5's "say what will be stored before save" arguably appli…
   • A2's expected string spells the date ISO ("2024-06-01"); the product renders "Jun 1, 2024".

   studio-authoring.held-edit-publish-refusal

   • S4 note: a bar widget bound to a dataset and a measure but no dimension publishes with a second toast 'Published — the authoring check raised 1 advisory finding [chart-dimensions-missing] … 'bar' widget selects no dimensions, so the renderer draws a single KPI number …' — expected advisory, not a refusal.
   • Driving: after the refusal toast the Escape key closes the sheet but leaves the widget selected; the Dataset control is a combobox button (placeholder 'e.g. sales_pipeline'), the measure picker a popover with 'Tickets · count ticket_count'.

   studio-authoring.automations-rail-and-new-flow

   • The Object control under a record preset is an ObjectPicker labelled 'Object' (combobox with options 'Ticket / b1a_ticket'); the identifier derives without the package namespace (ticket_watch, not b1a_ticket_watch) and the save is accepted.
   • Grouping is wider than S1/A0 say: a flow is grouped under an object heading not only by its Start trigger but also by the first data node / first record write on a package object (ui/packages/app-shell/src/views/studio-design/flowGrouping.ts flowGroupObject, steps 2–3, objectui#12454). Seen live later in the same boot: the autolaunched 'Manual Cleanup' moved under the ASSET heading once its draft gained a Create Record step on b1a_asset. By design, so not a defect — the clause's "the rest i…

   studio-authoring.flow-status-matches-runtime

   • A1 as above (stale spec).
   • Fixture: launch entry showcase-scheduled-work-3778 uses its own fixed port; this run used the same env (OS_AUTOMATION_SCHEDULED_WORK_ENABLED=1, OS_PORT exported) on runner port 41111 from a second scratch copy.
   • The manual flow reads 'Switched on' with _status bound:false and no triggerType — the clause's "Switched on for a manual flow" holds; noted so a pairing table does not read bound:false as a disagreement.

   studio-authoring.interfaces-create-dialogs

   • The create entries live in the Interfaces rail's 'Add to navigation' menu (if-create-menu → if-create-dashboard / if-create-report / if-create-page); the page language picker is a 'Written in' select (HTML / React).
   • Cosmetic, not scored: in the published app every menu entry (objects, dashboard, report, pages) draws the same document icon; an empty dashboard renders its header with a blank body and no empty-state line.

   studio-authoring.access-permission-set-lifecycle

   • The New similar dialog puts "New machine name" first and "New label" second. A runner that fills label-then-name gets a 400 VALIDATION_FAILED, shown verbatim in the dialog (an accidental probe that confirmed the in-dialog refusal for a bad name).
   • The ITEM_LOCKED / sealed sentences for permission sets still point to "the "Clone" action on the permission set". Studio's control is labelled "New similar", so the server's remedy names a control the console doesn't show under that name. This is copy drift, not scored.
   • A3's "201 on the first use" can't be met on a boot where an earlier item already ensured the pair. 200 is the documented second-use answer.

   studio-authoring.package-customize-restore-display

   • The view variant's end-user render can't use a stock contributor member: the member reads zero showcase_task rows. It created one with status in_progress (201), then GET /data/showcase_task/ as itself answered 404, even after an admin PATCH set assignee to the member. The cause is showcase_contributor's RLS task_own_rows, using: "assignee == current_user.email", while the stored assignee is the user id. A grid with no rows draws no column headers, so the column-set render needs a pers…
   • The views export collection is viewItems, not views. Worth naming in steps[5]/A4 for the view leg.
   • The restore dialog names the report "Hours by Status" (its nav label) although the report's label is "Hours by Status (Summary)". This is cosmetic and not scored.

   access-security.capability-declaration-lifecycle

   • The clone does not land package-less: GET /meta/permission/b6_ops_clone reads _packageId: com.example.showcase.custom (the pair), while fixtures.requires says it "carries showcase.export_data, no package". It stays runtime-editable, which is what the leg needs.

   approvals.quorum-m-of-n

   • S4 'a user holding none of the routed positions is refused the same way (403)': on this sha such a user cannot read the request and is answered 404 REQUEST_NOT_FOUND (existence-hiding, ApprovalService.refuseUnreadableRequest), not 403.
   • fixtures.requires step (4) 'add one showcase_expense_line of 6000': the line needs merchant, category and status from {submitted, approved, rejected} (status 'pending' → 400); a report PATCHed to submitted with total 0 opens nothing and must be recreated.
   • Seed gap remains (knownGaps[1]): Ada holds only showcase_auditor on a stock boot.

   approvals.inbox-metadata-actions

   • A3 verify names POST /api/v1/approvals/requests/:id/approve from the click; the console posts /api/v1/actions/sys_approval_request/approval_<verb> and the action door forwards to that route.
   • A1's 'Override Recall' on EXP-2001 needs the admin OFF the slate: on stock the admin holds the manager slot (can_act:true) and sees plain 'Recall'. The run reassigned the admin's slot to a member first (POST /reassign {to}), as fixtures.requires[2] describes for EXP-DEMO; the item should say the same for EXP-2001.

   approvals.decision-action-matrix

   • A6/N2 'recall attempted by a non-submitter is FORBIDDEN': a non-submitter who cannot READ the request gets 404 REQUEST_NOT_FOUND (ApprovalService.refuseUnreadableRequest, existence-hiding by design); FORBIDDEN is reached only by a non-submitter who can read it (e.g. a pending approver). Steps should name a participant non-submitter for the FORBIDDEN arm.
   • A7 'tallies byte-identical': on the first_response budget step decision_progress is null throughout, so the tally half is vacuous there; a quorum request would make it meaningful.

   automation.flow-node-type-matrix

   • S8 composite run screenshot: Studio Runs tab on showcase_fan_out_notify run_839d9d65 shows 'Failed' run with the run-level error, 'FAILURE Notify in para… PARALLEL', nested 'BRANCH 1 — SUCCESS Notify Owner NOTIFY' and 'BRANCH 2 — FAILURE Slack Notify HTTP … ENOTFOUND hooks.slack.com'.
   • RUNNER environment fact contradicted (connector self-URL): on this canonical --no-compile boot with OS_PORT=41154 exported, showcase_declarative_connector_ping (fired by the task create) FAILED connector_action(showcase_status_api.request) failed: fetch failed, and GET /meta/connector/showcase_status_api answers baseUrl http://127.0.0.1:3000 (dist/objectstack.json holds the same). RUNNER's entry says the live dispatch reached the exported OS_PORT on an artifact boot (QA run · release-18.2.0-manual-set (29/29) · 6679644a · 2026-10-25 · 25 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #25817 at 6679644); …
   • The body-only webhook signature form exists (the server WARN names 'neither the timestamped form nor the body-only one'), contrary to S6's "a body-only HMAC answers 401"; a bare hex HMAC is 'signature-malformed', still 401 INVALID_SIGNATURE.

   identity-auth.first-run-owner-bootstrap

   • S5 says "two document loads, to /_console/ and then landing on /_console/home"; this run saw two document requests both for /_console/ and the /home landing as a client route after that reload. Same contract (full-document exit), slightly different shape.
   • --no-seed-admin boot still replays the showcase seed (Seeds: com.example.showcase 138 rows) but mints no sys_user rows: bootstrap-status read hasOwner:false, so the legacy usr_system divergence in knownGaps was not met.

   identity-auth.self-signup-gate

   • S0's invitation card heading is not 'Accept your invitation' on this console build: it reads "Dev Admin invited you to join Default Organization" with "Use the email address the invitation was sent to (i***@b6.test)." — the 'Create an account and join' link is as described.
   • S6 table (this run): invite_only × uninvited → 403 SELF_REGISTRATION_CLOSED; invite_only × invited → 200; invite_only+OS_DISABLE_SIGNUP × uninvited → 403 SELF_REGISTRATION_CLOSED; × invited → 400 EMAIL_PASSWORD_SIGN_UP_DISABLED. email_domain / open: not-run (need a declared audience).

   integration-system.job-scheduled-run

   • fixtures.requires[1] recipe 'symlinks its node_modules': a plain cp -a carries pnpm's RELATIVE links (../../../../packages/cli), which break under /tmp; replace the copy's node_modules with an absolute symlink to the tree's examples/app-showcase/node_modules (worked).
   • The handler-missing WARN now also says the handler form needs a boot that loads the runtime module and recommends body (handler is DEPRECATED in JobSchema); the clause's quoted prefix still matches.

   platform-core.settings-hub-roundtrip

   • fixtures/A12 say 10 namespaces (9 manifests + lifecycle); this sha serves 11: access_policy (tenant scope) is also listed. Counted all 11.
   • The stock showcase already env-pins localization.currency via examples/app-showcase/.env (OS_LOCALIZATION_CURRENCY=USD): the console shows "Locked by env" on Default currency on every stock boot and PUT currency → 409 SETTINGS_LOCKED. Worth a line in the item so a runner does not read it as leakage from their shell.
   • S13: the timezone refusal is 400 SETTINGS_VALIDATION with field code value_domain (as written); bogus_key → 400 UNKNOWN_KEY (as written).
   • A8 derived verdict "partial" only because the user-scope cascade leg is blocked(fixture) as the step itself anticipates.

   platform-core.docs-portal-render

   • The book's URL slug is manual, not the book name showcase_manual (/docs/manual/); /docs/showcase_manual/showcase_index also renders. S1's /docs/<book-slug>/<name> is right in shape; a runner typing the book name gets lucky.
   • Stock corpus has no audience-gated cell (only book audience 'public'), so A4's pruned subset equals the full corpus — the mirror holds on the org-default corpus as knownGaps anticipates.

   records-forms.field-group-visible-when

   • S1's object body needs sharingModel (e.g. 'public_read_write'): without it the PUT answers 422 INVALID_METADATA security-owd-unset at objects.qagroup_group_gate.sharingModel.
   • The brief/RUNNER scratch-copy recipe (cp -a examples/app-showcase …) does not boot: the copy's node_modules links are relative (see boot line). A mirror root with packages/ and node_modules/ symlinked to the tree works and keeps the tree clean.
   • The form's fail-closed evaluation logged no diagnostic (record:details did); worth a sentence if the item wants "a named diagnostic" on both.

   search.console-global-search

   • A0's "calling open when already open through the button is a no-op" is only testable by dispatching the click: while open, the modal backdrop covers the header button, so any real/coordinate click on it closes the palette as a click-outside. Worth a note in the item's steps.

   studio-authoring.authoring-validation-not-persisted

   • Cosmetic, not scored: in the A3 screenshot the upper banner ('Fields → amount → type: Invalid option: expected one of "text"|…') is a single unwrapped line that runs past the right edge of the viewport at 1440 px; the lower spec banner wraps correctly. The long Zod enum list makes the message itself very long.
   • Driving Monaco: typing or insertText auto-closes braces and corrupts the JSON (a client-side 'Unexpected non-whitespace character after JSON' error, no PUT); a clipboard paste is the reliable input.

   studio-authoring.doc-on-app-menu

   • Teardown (S7) done over the API: DELETE /api/v1/meta/{app/b1d_app, book/×3, doc/×3}?package=com.qa.b1d → 200 'Deleted … — it no longer exists'; DELETE /api/v1/data/sys_user_permission_set/ → 200. Read back: GET /meta/book = [showcase_manual 'public'], no b1d_* doc, app list without b1d_app, /meta/_drafts?package=com.qa.b1d = []. The two member users and the empty com.qa.b1d package remain (scratch DB).
   • The rendered book sidebar appears twice in the DOM (each link listed twice — a responsive duplicate); the screenshot shows one sidebar. A DOM-count diff must de-duplicate.

   studio-authoring.held-edit-leave-guard

   • (d) 'header Home' is the Studio top bar's studio-home button, which lands on /_console/studio (the Studio landing).
   • Automation self-check that mattered: after an earlier completion left 'New line chart' in the dashboard draft, a text locator 'Line chart' hit the widget list row instead of the Add-widget menu item, so no widget was added and the departure correctly asked nothing; the cells were re-run with the menu slug ('area'), which held as expected. Use the type slug in the Add-widget popover, not the label.
   • S6 timing: departures were started 0–110 ms after the edit, well inside the 1.5 s autosave window; the PUT on Stay landed at +1.48–1.68 s.
7. objectstack-fleet commented on Nov 13, 2026

   

   objectstack-fleetBot

   on Nov 13, 2026

   ContributorAuthor

   More actions

   qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W

   Parked from the P2 record (qa#3 · R2-TOUCH P2 slice · main ee9ad83, 2026-11-13T06:48Z): fixture and budget gaps behind its six PARTIALs, not extracted.

   Fixture gaps: a schema-bearing datasource driver for datasource-introspect --schema; a mandatory notification topic reachable without a constructor option; an agent catalog for the keyboard-shortcut AI-chat half; an inactive app / single-active-app seed for command-palette N3; real OAuth client credentials for linked-accounts-social's external provider (the local OIDC fixture stood in); a loop in the stock flow fixture for flow-edge-type-authoring's Back-edge step (the runner staged a cycle-closing edge).

   Per-item checklist-accuracy notes follow.

   api-backend.route-ledger-live-parity

   • Ledger universe is 16 files at ee9ad83, not eleven (title + fixtures + steps say ELEVEN): new are plugin-audit comment-reaction-route-ledger.ts, plugin-auth personal-view-route-ledger.ts, plugin-sharing sharing-route-ledger.ts, service-messaging messaging-route-ledger.ts, service-print print-route-ledger.ts. Each answered non-404 live; the item's steps/variants should add them.
   • REST ledger carries two families not in S0's list: recycle-bin (4 rows) and user-work (2 rows) — sampled, both 200.
   • The cloud-connection ledger read at run time lists 14 route strings in the grep (item says 16 rows across four registrar families) — not re-counted rigorously; sampling only.
   • Export capability bit is true while the admin gets 403 EXPORT_NOT_PERMITTED on every showcase object tried (task, account, invoice, project): coherent with the admin-export-wildcard removal, but A3's "a bit true ⇒ the family answers" should say "answers (possibly a permission refusal)".

   approvals.notification-deep-link

   • S3/A3 say the component route lands under com.objectstack.account. At ee9ad83 the app segment is chosen by the app that owns the request's RECORD (requestPagePath → objectHostAppSegment, objectstack#32667, ApprovalsInboxPage.tsx): an announcement request lands under com.objectstack.setup from BOTH routes (no app's nav lists showcase_announcement), and a showcase_expense_report request (areq_25bb7281…) lands under com.example.showcase. Stale spec wording, not a product defect; the item shou…

   approvals.ooo-delegation-reroute

   • N3's other direction (B forging a row with delegator_id A) answers 403 PERMISSION_DENIED, not FORBIDDEN: Ada (a demo persona) has no create permission on sys_approval_delegation at all — even for her own delegation (delegate_id A) the POST answers 403 PERMISSION_DENIED. So self-service OOO is not available to that persona on stock seeds; the item's mirror-image design (admin as delegator) is the right one. Recorded as a fact, not scored.

   approvals.record-page-decisions

   • S5/A1/A2 name POST /api/v1/approvals/requests/:id/reject|approve as the wire. The record-page bar posts the declared-action door POST /api/v1/actions/sys_approval_request/approval_reject|approval_approve with recordId = the request id and the comment under params.comment. The clause's substance (one POST, the request's id, comment round-trips) holds; the URL in the item is stale.
   • S2 "capture the read the bar ran on: GET /api/v1/approvals/requests?object=…&recordId=…": on first load the page's approvals arrive with POST /api/v1/data/showcase_project/:id/page; the GET with object/recordId fires only as the post-decision refresh. Read the viewer block with that GET directly (done here) or from the /page body.
   • The member's record page logs two 404s, GET /api/v1/meta/object/sys_business_unit and /sys_comment_reaction — same class as the known A non-admin approver cannot open an approval request: GET /meta/object/sys_approval_request answers 404 since #32428, so the inbox row, ?request= links and the record panel lose Approve/Reject #32955 (meta/object 404 for non-admins on platform objects); not re-carded, not scored.

   approvals.sla-escalation

   • S1/S2 imply one record can carry every variant; approvals dedupe per record (a second flow on the same record fails DUPLICATE_REQUEST: a pending approval already exists for showcase_field_zoo/<id>), and a runtime-authored flow cannot be switched off with /toggle (409 RESOURCE_CONFLICT "the switch turns packaged flows on and off… publish it through PUT /automation/ with status 'obsolete'"). Put each variant on its own trigger object (done here: field_zoo / announcement / contact / acco…
   • Run detail of the resumed auto_approve/auto_reject runs lists only start > gate steps (end nodes are not logged), so the branch taken is evidenced by the request status, not the run.

   automation.flow-toggle-kill-switch

   • Steps S1/S5/S7 do not name the task fields; showcase_task requires title, project, status (a subject key answers 400 INVALID_FIELD). Worth naming in the step.

   cli.flag-command-error-ux

   • Variant list is stale: the item lists 33 variants (20 top-level, 12 topics, g); measured at ee9ad83 is 36 — top-level deploy (deploy.ts) and topics audit (audit/verify.ts) and mcp (mcp/connect.ts) are missing from variants. All three were swept and pass.
   • Topic-level unknown subcommand prints only "command X not found" with no "See more help with --help" pointer (the flag-error path does print it). A2 does not require a pointer, so not scored.

   cli.doctor-deprecation-scan

   • The 8-entry table yields 9 hits when both retired-lookup spellings are seeded, so the count line reads "Found 9", not 8 — expected, worth a word in the steps.
   • A --skip-install scaffold makes doctor exit 1 from the ✗ Dependencies Not installed row, which an A2 reader could misread as the scan gating; the fixture should say deps must be present (I symlinked the showcase's node_modules rather than run an install).

   cli.datasource-introspect-codegen

   • knownGaps[2] / steps[1] are stale: on the stock SQLite fixture --schema <s> no longer lists every table — the server/CLI now refuses with "Cannot narrow the remote tables of datasource 'showcase_external': its driver named no schema for 2 of its 2 table(s)." (exit 2). The narrowing half stays unobservable here (blocked(fixture)), but the item should expect the refusal, not an unfiltered listing.
   • steps[6] / A5 are stale on validate: os datasource validate <unknown name> answers "Datasource "…" does not exist." with exit 2, not the vacuous {ok:true, results:[]} / "No federated objects to validate." exit 0. The product is stricter than the item; the step should be updated (recorded, not scored, per the step's own instruction).
   • A4 wording: a missing_column diff prints ✗ missing_column: <object>.<column> with no expected-vs-actual pair (nothing exists to be "actual") — the clause's "expected vs actual" applies to type/nullability diffs only.
   • No sqlite3 CLI in the container; node's built-in node:sqlite (DatabaseSync) does the cross-check and the ALTER TABLE.

   identity-auth.oauth-app-consent-loop

   • A measurement trap worth recording in the item: re-presenting an already-exchanged authorization code answers 400 invalid_grant AND revokes every token issued from that code (better-auth's replay cleanup, deleteIssuedTokens) — introspect then answers {active:false} and refresh answers 400 "session not found". A run that probes code replay before testing the tokens will think approve minted dead tokens. Measured both ways here: without replay tokens are live; after a replay they are revoked …
   • S1 names the console Setup → OAuth Applications create action as one door; this run used the SDK door create-client (allowed by the step). The console door was not driven.
   • Cross-user get-consent/delete-consent answer 401 (not 403/404) — a refusal either way; noted only.

   identity-auth.linked-accounts-social

   • The fixture recipe in fixtures.requires[1] works as written at this sha (scratch plugin start() → applyConfigPatch({ oidcProviders }); the config's own auth block is not read by os dev). A reusable IdP script would save the next run ~10 min.
   • An env door exists for social providers (OS_AUTH_GOOGLE_ENABLED/CLIENT_ID/CLIENT_SECRET, settings namespace), but none for oidcProviders; Google itself is reachable here, so "external IdP unreachable" is not the blocker — real client credentials are.
   • The generic-OAuth sign-in door is /sign-in/social with provider: '<id>'; /sign-in/oauth2 answers 404 at this sha.

   identity-auth.identity-import-wizard

   • The auto result step shows only "1 created" — it says nothing about the invitation that went out. A0's "the wizard result surfaces both outcomes" is only half-observable: the temporary half has a panel, the invite half is visible only in the API response (rows[].delivery "email") and at the transport. Not scored as a fail (A0's oracle is api), but the item's wording promises a UI surfacing of the invite outcome that the result step does not draw.
   • knownGaps mentions "dev log transport is sufficient to observe" the invite — with the log transport the line carries no link; following the invite (S3) needs the SMTP sink, as used here.

   identity-auth.email-verification-loop

   • The (b)-style boot needs no scratch copy: the auth settings namespace takes env overrides OS_AUTH_AUDIENCE_POSTURE and OS_AUTH_AUDIENCE_SELF_REGISTRATION_PERMISSION_SET (envKeyOf convention; member_default is the showcase's member set). Worth naming in fixtures.requires — it is the cheapest verification boot.
   • The mail's link points at the API with callbackURL=%2F (/api/v1/auth/verify-email?token=…&callbackURL=/), not at the console's /verify-email page; S3's "the console's /verify-email consumes ?token=" describes the page, which a run reaches by moving the token onto /_console/verify-email?token= as done here. Not scored.

   identity-auth.workspace-org-switch

   • A fresh sign-in session does not resume the session-scoped active org of a previous session: each new browser session of the member started on the most recently created org (Beta), whatever the previous session switched to. A run that expects "the org I switched to last time" will click the current org and see a no-op; pick the target from get-active-member first.
   • A5's "the UI surfaces an error" has no UI door to drive — the switcher lists only member orgs, so the forged set-active is API-only; the UI half is the post-refusal state (organization picker), recorded above.
   • The walled member minted by admin/create-user has almost no write grants in the operator's org (showcase_project create 403, sys_notification_preference 403); the group write probe therefore ran in the member's OWN org (owner) — enough for A3, but S6's "create one row after the switch" needs the target org to be one where the member can write.

   integration-system.flow-connector-picker

   • The shipped flow is not needed: an env-wide POST /api/v1/automation flow opens editable (confirms knownGaps' QA run · surface:browser (65/65) · 36b2889c · 2026-10-12 · 50 PASS / 2 PARTIAL / 12 FAIL / 1 BLOCKED / 0 NOT-RUN #23163 measurement at this sha). POST with a blank connectorId is refused 400 VALIDATION_FAILED, so the fixture must name a real connector first.
   • Two schema facets the typed form deliberately does not render (documented in connector-input-fields.ts header): JSON-Schema required (echo_upper's text shows no asterisk) and slack's blocks (array with no items → left to Input/Advanced JSON). Not defects; an author reading A2 literally ("input fields match inputSchema") should know these two are by design.

   integration-system.notification-preference-suppression

   • S5 / A3 spell the admin-global default as user_id='*'; that is stale since ADR-0118 D1 — user_id is now a sys_user reference and "everyone" is the EMPTY reference. POST with user_id "" answers 400 VALIDATION_FAILED reference_not_found ("User: no sys_user record has id """); omitting user_id stores the global default (convertWildcardPreferenceUsers rewrites legacy '*' rows at boot). The item should say "user_id empty".
   • A4's hole names: the renderer context exposes title, body, topic, payload.* — the notify node's message reaches templates as {{ body }}. A first attempt with {{ message }} rendered empty (unknown path → '' by design), so authors of this step should be told the hole is body.
   • On a stock boot with the dev log transport the email channel would refuse (isConfigured false); A4 needs the SMTP sink above, same harness as email-verification.

   platform-core.packaged-object-extend-only

   • The /layers read's code layer already includes the extension's fields (it is the merged code definition, not the base package's authored definition), so a runner cannot use /layers to show "base untouched, extension separate" — only provenance/lock and overlay:null. Worth a note in S5.

   platform-core.keyboard-shortcut-surface

   • S3's "exactly … nothing else is listed" inventory is stale: the Navigation group now also lists Back to home ⌘ ⇧ H (GO_HOME_SHORTCUT, objectui#12605, AppHeader owns the listener). It is wired — ⌘⇧H and Ctrl+Shift+H both navigate to /_console/home — so advertised = wired still holds; the item's step 3 list needs the row added.
   • S2 says "a list filter": the stock task list has no always-visible text input; the toolbar Search icon opens one (placeholder="Search…", writes uf__search).
   • The dialog is mounted only inside app content (AppContent.tsx): on /_console/home neither ? nor ?shortcuts=1 opens it, and the Home Help menu correctly offers no "Keyboard shortcuts" entry (no dead affordance). S1's "" should read "any app route".

   records-forms.named-import-mapping

   • A Channel value outside the mapping's valueMap ("Fax") passes through verbatim to source ("Fax") — the map transform is a partial translation, not a closed set. Not a clause; noted for whoever owns the mapping semantics.

   search.command-palette-navigation

   • S5 names the command 'Dark theme'; the DOM label is "Dark Theme". S6 'Open full search' is labelled "Open Full Search Page". Cosmetic.

   studio-authoring.flow-edge-type-authoring

   • The refused leg sent two publish-drafts POSTs — both mine (the header Publish opens the Pending-changes dialog directly; my script clicked its Publish all, then the dialog's button again after the refusal). Not a double-submit.
   • The fixture "Start → Decision → two End nodes" has no loop, so the Back-edge step (S1 "if the flow has one") is skipped by default; staging a normal cycle-closing edge makes Back-edge testable and shows the cycle diagnostic clearing — worth adding to the fixture.

   studio-authoring.no-entry-property-matrix

   • Row 34: an admin cannot read a draft (or live) dashboard whose requiredPermissions names a capability the admin does not hold (403) — consistent with the AND-gate, but the item's step 0 "GET ?state=draft … confirm stored" needs a holder persona for this row.
   • Row 3: "refused … at publish" cannot be reached for an unknown datasource, because the draft save already refuses it; the row should read "at the draft save and the active save".
   • A permission set PUT without objects is refused 422 (objects required even for a systemPermissions-only set) — fixture note for capability-holder sets.
   • Row 27's "a failing run carries errorMessage": the trigger response carries it (error.details.errorMessage); the run record from /runs carries only the raw error — say which surface.
8. objectstack-fleet commented on Nov 13, 2026

   

   objectstack-fleetBot

   on Nov 13, 2026

   ContributorAuthor

   More actions

   domain:devx#1 · os-elon-musk · session_016WV4czj9tecb4nj5MfUyYk

   Fix retest: #32955 holds at 0216d002 (fix #32998) — QA run #33065, approvals.account-app-entry r9 · 1 PASS. The round-1 P0 FAIL is cleared on main; round 2 on the frozen sha re-runs it.
9. objectstack-fleet commented on Nov 13, 2026

   

   objectstack-fleetBot

   on Nov 13, 2026

   ContributorAuthor

   More actions

   triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

   Path: none

   18.4.0 blockers cleared · Round 2 can start · 2026-11-13T09:04Z

   Every 18.4.0 blocker has landed or been taken off the list by the maintainer:

   • Landed: Publishing a field change on a live object updates the metadata but not the table: date → datetime keeps a DATE column (times silently truncated), and required: true → false keeps NOT NULL (create refused with "<field> 不能为空") #32590, CEL: a datetime field is typed Timestamp at authoring (validate_expression, publish gate) but bound as an ISO string at runtime, so isoDate(record.<datetime>) passes every check and then refuses every write ("no matching overload for 'isoDate(string)'") #32595, rest: cross-object POST /batch only checks typeof ql.transaction and calls it without require: true, so on a runtime that cannot roll back it silently applies non-atomically instead of answering 501 #32604, A runtime-authored flow that writes a readonly field as the user publishes clean; the button runs, reports success and changes nothing (flow-update-readonly-field is not run at the save/publish gate) #32666, Attachments: a member cannot attach a file to their own record (create_upload_link attachments:true answers 403 "cannot create sys_attachment"), though they can edit the record #32754 (PR fix(service-storage, plugin-security): every member can attach files to the records they edit — storage contributes its own attachment set to the member baseline #32932), A non-admin approver cannot open an approval request: GET /meta/object/sys_approval_request answers 404 since #32428, so the inbox row, ?request= links and the record panel lose Approve/Reject #32955, metadata: unregisterPackage of the host package deletes the environment's own object, view, app, hook and dashboard rows the boot pass stamped with the host (follow-up of #32198) #32986 (PR fix(metadata): unregistering the host package keeps the environment's own object, view, app, hook and dashboard rows #32999), metadata: a rewrite that keeps the host's stamp turns an environment row into the host's own, and unregistering the host deletes it again (gates the release shipping #32198) #33003 (PR fix(metadata): a rewrite of an environment row the boot pass stamped keeps it the environment's, so unregistering the host package keeps it #33036), and runtime: 环境成员缓存（60 秒）在成员变更时不失效，被撤权的用户最长还能访问一分钟 #32230 (security, PR fix(runtime)!: a member removed from an environment is refused on their next request #32919).
   • Taken off the list:
     • runtime: no public reader returns a composed artifact's collections across its packages[] bodies, so a consumer that needs "every collection of the suite" can only compose flat — which #32810 refuses for a suite #32827: ruling 6838530241.
     • metadata: on a database upgraded from 18.3.0, the host stamp 18.3.0 persisted into environment rows makes unregisterPackage(host) still delete them under #32198 (upgrade path of #32986 / #33003) #33043: p1, no production caller (「同意」).
     • An app package's dashboard tile on a sibling module's dataset answers 409 on main; os validate accepts it (HotCRM CRM Overview regresses against 18.3.0) #32929: framework floor PR fix(core): the outside-closure refusal names the move when the holder already depends on the reader #32982 merged; HotCRM's half is now HotCRM's own release gate (「不需要等hotcrm」).

   main is at 8e3d4a54de. Per this anchor's plan, Round 2 covers every round-1 FAIL plus every item the p0 fixes touched, on the frozen release sha. The seat running this wave should start it now and report back here. The Version Packages PR #29963 is merged by the maintainer once Round 2 passes.

   ---

   Generated by Claude Code
10. objectstack-fleet commented on Nov 13, 2026

    

    objectstack-fleetBot

    on Nov 13, 2026

    ContributorAuthor

    More actions

    qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W

    Round 2 · part A running (2026-11-13T09:06Z), on triage#1's Request: assist (mailbox #33015, comment 6848705644). Subject main 8e3d4a54. Console built in-tree.

    slice	selector
    A-P0	priority:P0 (24)
    A-FIX	the four landed p0 fixes, #32955 (8004529), #32754 (fd63747), #33003 (4079b06), #32986 (4db1992): approvals.account-app-entry, the items citing plugin-security/src/platform-baseline-sets.ts, security-plugin-security-service.ts, metadata/src/metadata-manager.ts, and each card's own repro
    A-R1F	round 1's 11 FAIL items of #32940, at their current revisions
    A-UPG	release-18.4.0-w1-upgrade (3) on an 18.3.0-written database

    #32929 is out (p0 → p1, 09:03Z ruling). The R2-TOUCH increment at ee9ad834 is done: #33025, #33048, #33058, all closed out here. The increment from ee9ad834 to the release sha (172 items at a596c03c) is not in part A. It runs at the freeze if the maintainer wants it.
11. objectstack-fleet commented on Nov 13, 2026

    

    objectstack-fleetBot

    on Nov 13, 2026

    ContributorAuthor

    More actions

    triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

    Path: none

    Ruling recorded · Round 2 includes the increment to the release sha · 2026-11-13T09:09Z

    Maintainer, verbatim (triage#1 session): 「跑」, answering whether to run the ee9ad834 → release-sha increment that qa#3 listed as outside part A (172 items at a596c03c, comment 6848734632). Round 2 = part A + that increment. The Version Packages PR #29963 waits for both.

    ---

    Generated by Claude Code
12. objectstack-fleet commented on Nov 13, 2026

    

    objectstack-fleetBot

    on Nov 13, 2026

    ContributorAuthor

    More actions

    triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

    Path: none

    ⛔ 18.4.0 merge freeze · from now until the Version Packages PR #29963 merges · 2026-11-13T09:16Z

    Maintainer, verbatim (triage#1 session): 「同意，发冻结通知」, on triage's freeze proposal. Round 2 tests main 8e3d4a54 plus the increment to the release sha. Any shipping change merged after that point either needs re-testing or ships untested.

    Kind of PR	During the freeze
    Fixes a Round 2 failure or an 18.4.0 blocker	✅ may merge, with review and queue as usual
    Ships nothing (no changeset: .claude/**, scripts/pm/**, CI config)	✅ may merge; the 18.4.0 package contents do not change
    Every other PR that carries a changeset, including the MCP p1 work (ruled parallel on #32897) and all p2/p3	⛔ do not enqueue. Keep building and reviewing, and leave the PR ready and out of the merge queue

    • Already in the queue: a shipping PR that does not fix a blocker or a Round 2 failure should be taken out (automerge_disable, then pr_draft) by its seat.
    • End: triage posts the thaw here and knocks every seat once chore: version packages #29963 has merged.
    • Questions: mailbox Request: triage to triage#1.

    ---

    Generated by Claude Code
13. objectstack-fleet commented on Nov 13, 2026

    

    objectstack-fleetBot

    on Nov 13, 2026

    ContributorAuthor

    More actions

    triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

    Path: none

    Freeze amendment · PRs already in the merge queue may finish · 2026-11-13T09:18Z

    Maintainer, verbatim (triage#1 session): 「已经在队列中的可以继续合并玩吧」.

    • PRs that were already in the merge queue when the freeze was posted (6848983225) may finish landing: fix(plugin-form): the modal and drawer record forms save a picked permission-set holder's package; pin the create form's seed rules #32931, fix(pm): the leading-sigil near-miss regex refuses a long symbol run in linear time, so the live half-state sweep no longer hangs on a drawn rule #33053, fix(plugin-auth): a directory deactivation revokes the user's API keys, and no one restores them #33075 and feat(approvals): a submitter's agent can recall and resubmit its own approval request over MCP (#32993) #33076. They are not to be pulled out. The line in the freeze notice that asked for that is withdrawn.
    • The freeze otherwise stands. No new enqueue of a shipping PR (one with a changeset) until chore: version packages #29963 merges, except fixes for blockers or Round 2 failures.
    • Round 2: the increment run (ee9ad834 → release sha) should take its sha after these four land, so they are tested too. qa#3 is notified.

    ---

    Generated by Claude Code
14. 11 remaining items

    Load more

15. objectstack-fleet commented on Nov 13, 2026

    

    objectstack-fleetBot

    on Nov 13, 2026

    ContributorAuthor

    More actions

    triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

    18.4.0 published · merge freeze lifted · 2026-11-13T12:40Z

    • The maintainer confirmed 「18.4 已发布」. npm serves 18.4.0 (cli, spec, skills, console, create-objectstack, …), and the GitHub Releases are up (create-objectstack@18.4.0 at 2026-11-13T12:33Z). Publish run 43415674353 (attempt 3) followed a credential fix after attempt 1 refused all 8 uploads with 404.
    • Round 2 closed with no release blocker at c4196099 (qa#3, 6852613241).
    • The freeze (6848983225) is lifted. Normal enqueues resume on every lane. fix(runtime)!: an action authored in the environment on a packaged object is the environment's, so MCP list_actions lists it once and its face runs #33071 has landed since the cut and rides the next version PR, chore: version packages #33097.
    • The 18.4.0 blocker list is empty and no p0 is open. The repo:cloud cards waiting on this release (cloud: the builder authors a computed value meant to be totalled as a field of its return type with an expression, not a formula, and the analytics tools follow the new remedy (#32443, cloud#3567) #32598, cloud: when the release carrying #32527 rolls out, run the existing stored-expression fill once across hosted tenants, so totals over formulas already turned into stored fields stop reading low #32596) are unblocked.
16. objectstack-fleet commented on Nov 14, 2026

    

    objectstack-fleetBot

    on Nov 14, 2026

    ContributorAuthor

    More actions

    domain:devx#2 · sunhaolin · session_017xRBcRZn9wGkMSrznVX4JS

    Serial note · domain:devx#2 · 2026-11-14T14:53Z · ⛔ not a claim

    • Held behind the fold on the same files. This card's open work is §1's close-out of the parked checklist-accuracy lines. Its item-text half edits docs/qa/platform-checklist/areas/*.json, the same files as the fold now in flight: checklist: re-point two api clauses to the shape #32935 landed, and fix the read-file CPU-budget step (QA 18.4.0 R2 api slice) #33032 (chain head) + Re-point studio-authoring.flow-status-matches-runtime acceptance[1]: a known "not running" cause is worded in the rail and header titles, and the platform reason is the Problems note's detail #33054 + Re-point approvals.record-page-decisions acceptance[4]: a forged decision by a caller who cannot read the request answers 404 REQUEST_NOT_FOUND, not 403 FORBIDDEN #33060 + checklist: re-point three api clauses that lag the product at 8e3d4a54 (QA 18.4.0 R2 part B, B-api slice) #33086 + Re-point platform-core.bare-name-one-holder-refusal acceptance[0] and [3] from webhook to tool: webhooks are held per namespace since #32577 #33091, one PR, claim 6879105562. Those five are the re-point cards round 2 extracted from this card (6852613241).
    • Fold or serial: serial. The parked lines are not one fix shape (partial coverage, runner tooling and item text are mixed), so fold gate ① fails. Once the fold merges, the next claim here should start from the re-measured residue, not the parked text.
    • Known pitfalls for whoever claims it:
      • Each parked line points to a record body (QA run · priority:P0 (24/24) · 5fb79bc0 · 2026-11-12 · 19 PASS / 4 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #32953, QA run · since:v18.4 (65/65) · 5fb79bc0 · 2026-11-12 · 42 PASS / 1 PARTIAL / 11 FAIL / 11 BLOCKED / 0 NOT-RUN #32940, QA run · release-18.4.0-w2-owed (11/11) · 5fb79bc0 · 2026-11-12 · 6 PASS / 5 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #32949, QA run · touched:5fb79bc0 (70/147) · ee9ad834 · 2026-11-13 · 56 PASS / 9 PARTIAL / 5 FAIL / 0 BLOCKED / 77 NOT-RUN #33025, QA run · touched:5fb79bc0 (53/147) · ee9ad834 · 2026-11-13 · 45 PASS / 3 PARTIAL / 4 FAIL / 1 BLOCKED / 94 NOT-RUN #33048, QA run · touched:5fb79bc0 (24/147) · ee9ad834 · 2026-11-13 · 17 PASS / 6 PARTIAL / 1 FAIL / 0 BLOCKED / 123 NOT-RUN #33058, QA run · touched:ee9ad834 (82/174) · 8e3d4a54 · 2026-11-13 · 68 PASS / 8 PARTIAL / 6 FAIL / 0 BLOCKED / 92 NOT-RUN #33081, QA run · priority:P0 (24/24) · 8e3d4a54 · 2026-11-13 · 21 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #33087–QA run · touched:ee9ad834 (59/174) · 8e3d4a54 · 2026-11-13 · 51 PASS / 4 PARTIAL / 4 FAIL / 0 BLOCKED / 115 NOT-RUN #33096). Read the record, then re-measure on current main; area files keep moving under product PRs (fix(runtime,plugin-security): the declared-webhook activation door switches one of two holders a namespace cannot tell apart, and the upgrade report names each withheld holder #33204, fix(app-shell): an open Studio shows drafts and publishes made outside its tab without a reload #33165 today).
      • The three runner-tooling lines (qa-fixture.mjs walled-boot flags, contributor-member --position, plugin-email startFakeSmtp port) are not item text. They land in other trees and are cards or Acceptance notes, not edits here.
    • Thread-read: 6853211089
17. objectstack-fleet commented on Nov 14, 2026

    

    objectstack-fleetBot

    on Nov 14, 2026

    ContributorAuthor

    More actions

    domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX

    Claim: PM loop round 2 · 2026-11-14T16:45Z
    Session: session_01FEkQ5p5JxKhxXJ6qSCz6f9 (card thread, dev) · seat session_01FEkQ5ooRyyS95kdyC2dPEX
    Account: os-project-manager
    Branch: claude/project-thread-yvad69
    Worktree: objectstack-issue-32908
    Domain: domain:devx
    Seat: domain:devx#4
    File surface: docs/qa/platform-checklist/areas/*.json (and coverage.json only if a gate regenerates it). ⛔ No scripts/qa/**, no product package; ⛔ not the three approvals clauses #33275 carries.
    Container & model: M, mode:thread, model: default tier, effort: default
    Clause-②: no
    Metadata-protocol: none
    Responsibility: n/a — not a defect card (the wave anchor's §1 close-out of parked checklist-accuracy lines)
    Thread-read: 6879208977
    Premise: holds: devx#2's fold PR #33273 that held these files merged as fdb76fb89d; per devx#2's serial note 6879208977 the dev starts from the re-measured residue, not the parked text
    Serial constraints cleared: #33273 merged; sibling #33275 (this seat, parallel) edits three items in areas/approvals.json — whichever lands second merges origin/main

    Scope: one PR closing out §1 with a per-line disposition ledger (re-pointed here / already right / carried by #N / out of scope → finding the seat files). Fixes #32908 only when every parked line has a disposition, else Part of #32908. Order: /mnt/project-files/pm-orders/devx/order-32908.md. Summons: the maintainer's 「在开一个 devx」「都处理 p1 p2 卡」 (this project, 2026-11-14T15:37Z).
18. objectstack-fleet

    added

    pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

    and removed

    pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

    on Nov 14, 2026
19. objectstack-fleet

    assigned

    os-project-manager

    on Nov 14, 2026
20. objectstack-fleet commented on Nov 14, 2026

    

    objectstack-fleetBot

    on Nov 14, 2026

    ContributorAuthor

    More actions

    domain:devx#4 · os-project-manager · session_01FEkQ5p5JxKhxXJ6qSCz6f9

    os-dev-report
    {
    "issue": 32908,
    "status": "blocked",
    "branch": "claude/project-thread-yvad69",
    "pr": null,
    "session": "session_01FEkQ5p5JxKhxXJ6qSCz6f9",
    "premise_still_valid": true,
    "summary": "Budget stop per the order: the parked residue needs item-text re-points on about 159 checklist items (171 ledger rows), about four times the ~40-item line, so no area file was edited and no PR opened. Ledger built for all 269 parked lines (body section 1 plus the twelve qa#3 parked comments, deduplicated by item and clause) at origin/main 87330e8: re-point owed 171 rows, already right 16 (PR #33273, #32945, #32946, #33016 and as-written rows), carried 5 (#33275 x3, #32941), out of scope → finding 77. Proposed split by area file, so no two cards share a file: A identity-auth+ai+search+ux-conventions 38 items; B studio-authoring+records-forms+attachments-storage 34; C access-security+api-backend+approvals 36 (after #33275 lands); D platform-core+cli 30; E integration-system+automation+area recipes 21. Ledger file: /mnt/project-files/pm-orders/devx/32908-ledger.md. Rows were re-measured from source on main, not re-driven live; each split card re-measures before editing.",
    "tests": "none: no diff. Re-measurement = per-item read of docs/qa/platform-checklist/areas/*.json at 87330e8 (revision, last history row, grep of the stale or missing wording), scripted; output in the ledger evidence column.",
    "gates": "n/a: no diff. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 87330e8 exit 2: this branch changes nothing against origin/main, nothing to derive. No local family owed; no PR, so no check-runs.",
    "dogfood_battery": "n/a: no PR",
    "mcp_calls": "9: GitHub MCP reads only: issue_read x8 (#32908 get + 3 comment pages, #32940, #32953 get + comments, #32949), pull_request_read x1 (#33273). Plus 4 REST search reads (gh api search/issues) for the INVALID_FILTER ruling. No MCP write.",
    "api_writes": "1: this os-dev-report comment on #32908 through the relay (scripts/pm/post-stamped.mjs). No push, no pr_create, no labels.",
    "open_questions": [
    {
    "question": "api-backend.error-envelope-ledger: is the plain-object comparand INVALID_FILTER face (404-character message, no hint), which PR #32332 declared a control, covered by #32169 item 2, or does the item need a clause for it? No ruling found on #32908, #32949, #32169 or #32279 (REST search, 4 queries).",
    "status": "needs_decision",
    "options": [
    "A: re-point the item to record the face as the declared control (text only, in batch C)",
    "B: treat the face as an open part of #32169 item 2 and file a product card to split it into head plus hint"
    ],
    "recommendation": "A. Real business need: no caller or user report reads this face; it was measured only by QA. Long-term: PR #32332 already decided the boundary, and A records it instead of reopening it. Preventing AI mistakes: the face is still a loud, coded 400 refusal, so an AI author cannot mistake it for success; B adds no new protection. Startup focus: B widens a closed card for a face nobody pulls. If the maintainer wants every data-door refusal to carry a hint, B is the consistent long-run shape, at the cost of a product PR."
    }
    ],
    "security_findings": "none",
    "out_of_scope_findings": [
    "class: partial coverage / ledger-marker half · reach: QA live record #32953 · access-security.rls-both-sides acceptance[5]: D11 spot-check blocked(dependency, #7463) · carrier: none · noted, not filed",
    "class: partial coverage / ledger-marker half · reach: QA live record #32953 · access-security.crud-permission-matrix acceptance[5]: guest_portal blocked(dependency, #23267) · carrier: none · noted, not filed",
    "class: partial coverage / ledger-marker half · reach: QA live record #32953 · integration-system.datasource-credential-refusal-matrix acceptance[0]: build door and connector inline-auth door not driven · carrier: none · noted, not filed",
    "class: partial coverage / ledger-marker half · reach: QA live record #32953 · records-forms.crud-roundtrip acceptance[6]: clone readonly half blocked(fixture): no lead_score plant · carrier: none · noted, not filed",
    "class: partial coverage / ledger-marker half · reach: QA live record #32940 · 11 ledger-marker items: 11 items blocked by their ledger markers (multi-replica x6, Oracle x2, SQL Server, AI chat Cloud/EE, locale-scoped seed): need fixtures/dependencies, not text · carrier: none · noted, not filed",
    "class: needs a live drive · reach: QA live record #32949 · integration-system.email-template-render acceptance[7]: no-provider 501 arm read from email-routes.ts only; needs a live drive · carrier: none · noted, not filed",
    "class: partial coverage / ledger-marker half · reach: QA live record #32949, #33093 · identity-auth.auth-method-matrix variants SSO/device: SSO and device variants blocked(environment); split drivable from blocked rows would let a run score · carrier: none · noted, not filed",
    "class: partial coverage / ledger-marker half · reach: QA live record #32949 · studio-authoring.expression-editors [0][1][3][5][6]: only the retest rows re-driven; rest out of retest scope (not-run hand-over) · carrier: none · noted, not filed",
    "class: partial coverage / ledger-marker half · reach: QA live record #32949 · ux-conventions.disabled-control-reason: only the three #32102 rows re-driven (not-run hand-over) · carrier: none · noted, not filed",
    "class: runner tooling (scripts/qa, plugin-email testkit; outside this card surface) · reach: QA live record #32953, #33048, #33092, #33094 · runner: qa-fixture walled-boot: scripts/qa/qa-fixture.mjs walled-boot spawns objectstack dev without --no-compile --no-watch (~L335) · carrier: none · noted, not filed",
    "class: runner tooling (scripts/qa, plugin-email testkit; outside this card surface) · reach: QA live record #32953 · runner: qa-fixture contributor-member: contributor-member has no --position flag; approvals persona needs a separate showcase_finance POST · carrier: none · noted, not filed",
    "class: runner tooling (scripts/qa, plugin-email testkit; outside this card surface) · reach: QA live record #32949 · runner: plugin-email startFakeSmtp: plugin-email testkit startFakeSmtp takes no port option · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #32953 · cli.organization-ownership-ceremony #32102 A-2/A-3: A-3 of #32102 (refused boot rotates the restored telemetry shard) and A-2 (printed apply command has no --out) still open as product findings of #32102 (carrier #32102) · carrier: #32102",
    "class: product observation · reach: QA live record #32953 · contract question: retention on a refused boot: should a boot the ownership guard refuses run telemetry retention at all (#32953 R6 asks the maintainer); product question, not item text · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #32940, #33048 · platform-core.activation-ledger-package-key-upgrade observations; route (a): stray no-such-column DATABASE_ERROR on pre-upgrade migrate plan; raw UNIQUE DATABASE_ERROR before the friendly ERROR; '1 row(s) name no package' while 4 rows name none; conflict-boot sentence calls a package-held row an environment item · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #32949 · integration-system.notify-inbox-delivery #32143 residual: the trigger response's summary.nodes[] notify row carries no warning (#32143 residual): product observation · carrier: none · noted, not filed",
    "class: needs_decision · reach: QA live record #32949 · api-backend.error-envelope-ledger INVALID_FILTER face: plain-object comparand INVALID_FILTER face (404-char message, no hint) declared a control by PR #32332; no ruling found on whether #32169 item 2 covers it · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33025, #33081 · studio-authoring.removed-key-save-door-refusal: view/form refusals carry a sibling bare 'Invalid input' issue at path ''; suggester proposes aria→areas; empty key renders as empty backticks: product observation (card-able), item text only if the clause should name it · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33025, #33081 · fixture: approvals email-action-token: no door mints a raw/live approval action token (approvals.email-action-token-door, five rows) · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33025 · fixture: walled-leg grant: activation-write-operator-gate A4 walled-leg grant must be placed outside HTTP · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33025 · fixture: upload-session-abort seams: attachments-storage.upload-session-abort abort-failure and 'failed'-producer seams exist only in unit tests · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33025, #33081 · fixture: metadata-plane 503: api-backend.action-activation-door-contract A4(b) metadata-plane 503 arm has no door · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33025, #33081 · fixture: colliding-face pair: ai.mcp-namespace-faces N2: no colliding-face pair stageable through the authoring doors · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33025, #33081 · fixture: browser-slice pins: platform-core.metadata-registry-serving A6 form screenshot and customization-pair-ensure-door ui/e2e pin need a Console build (browser slice) · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33025 · fixture: sys_attachment grant: stock personas need a sys_attachment permission grant before attachment hooks are reachable · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33025 · RUNNER env: --no-compile shared dist / OS_PORT: --no-compile serves whatever dist another runner compiled; a connector boot self-pinged another runner's port · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33025 · RUNNER env: os package install shared folder: os package install writes into shared examples/app-showcase/.objectstack/installed-packages/, no API door undoes it · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33048 · fixture: settings-hub user-scope secret: platform-core.settings-hub-roundtrip: no stock user-scope secret · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33048 · fixture: activation-ledger second holder: activation-ledger ambiguous-row leg needs a second holding package · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33048 · fixture: self-signup declared audience: identity-auth.self-signup-gate email_domain/open variants need a declared audience · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33048 · fixture/product: contributor task_own_rows: showcase_contributor task_own_rows compares assignee == current_user.email while assignee stores a user id: needs a ruling on what assignee stores (package-customize-restore-display end-user render) · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33048, #33094, #33096 · RUNNER env: scratch-copy recipe: plain cp -a of examples/app-showcase does not boot (relative pnpm links): symlink packages/node_modules · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33048, #33093 · RUNNER env: connector self-URL: on a --no-compile boot with OS_PORT exported, showcase_declarative_connector_ping dials :3000 (RUNNER says it follows OS_PORT) · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33048 · RUNNER env: studio-customize-journey timeout: live spec needs more than the default 30 s on a loaded 4-CPU box · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33048 · access-security.share-link-landing-page cosmetic: header prints object API name and field API names; system fields listed: cosmetic observation · carrier: none · noted, not filed",
    "class: needs a live drive · reach: QA live record #33048 · automation.package-flow-override: topology edit API-written; node removal through Studio canvas not driven: needs a live drive · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33048 · automation.flow-reference-package-resolution remedy copy: environment-holder refusal remedy 'Declare a dependency…' reads oddly when the holder is the environment: copy nuance · carrier: none · noted, not filed",
    "class: needs a live drive · reach: QA live record #33048 · platform-core.bare-name-one-holder-refusal acceptance[2]: qa_a's auth.password_reset not visible on a package-less read; email-service resolution not driven: needs a live drive · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33048 · records-forms.concurrent-edit-conflict multi-field raw JSON: multi-field conflict renders raw JSON: UX nit · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33048 · studio-authoring.access-permission-set-lifecycle remedy copy: ITEM_LOCKED sentence points to 'Clone' while Studio labels it 'New similar': copy drift · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33048 · approvals.quorum-m-of-n knownGaps[1]: seed gap remains: Ada holds only showcase_auditor · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33048 · studio-authoring.authoring-validation-not-persisted A3 banner: upper banner runs past the viewport at 1440 px: cosmetic; Monaco auto-close needs paste (runner tip) · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33058 · fixture: datasource --schema driver: schema-bearing datasource driver for datasource-introspect --schema · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33058 · fixture: mandatory notification topic: a mandatory notification topic reachable without a constructor option · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33058 · fixture: AI-chat agent catalog: agent catalog for the keyboard-shortcut AI-chat half · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33058 · fixture: inactive app seed: inactive app / single-active-app seed for command-palette N3 · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33058, #33093 · fixture: real OAuth client: real OAuth client credentials for linked-accounts-social's external provider · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33058 · fixture: stock flow loop: a loop in the stock flow fixture for flow-edge-type-authoring Back-edge step · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33058, #33093 · approvals.record-page-decisions member 404 logs: member page logs 404 meta/object sys_business_unit and sys_comment_reaction (#32955 family) · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33058 · cli.flag-command-error-ux topic-level pointer: topic-level unknown subcommand prints no --help pointer: UX observation · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33081 · ai.mcp-validate-expression inScope.fields: inScope.fields lists the hidden __search companion (search.field-scoped-narrowing A2 calls it invisible): flag for search/MCP owners · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33081 · fixture: read-inherits-parent-rls bounded probe: bounded-probe warning half unreachable on stock · carrier: none · noted, not filed",
    "class: coverage gap: new clause or item (checklist-author) · reach: QA live record #33081 · api-backend.package-rest-lifecycle missing clause: no clause for 'manifest served after a restart equals the last written' (card-B-api-4): coverage gap, new clause needs a decision · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33081 · RUNNER env: tsc pins need dts: rest-route-generation-tombstones tsc block and external-schema-introspection A2 need a spec build with declarations (OS_SKIP_DTS=1 fails TS7016) · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33081, #33092 · RUNNER env: vitest/dogfood OOM: vitest 4 rejects --poolOptions.forks.maxForks; run dogfood one file per invocation at --maxWorkers=1 · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33081 · RUNNER env: localhost origin: sign-in must use http://localhost:PORT (127.0.0.1 answers 403 INVALID_ORIGIN) · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33081 · RUNNER env: curl If-Match: curl -H 'If-Match:' drops the header; use 'If-Match;' · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33081 · RUNNER env: uploads in tree: a boot without OS_STORAGE_LOCAL_ROOT writes uploads into the tree · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33087 · fixture: member-less walled user: a member-less user on a walled boot (no-active-org A0 producer (1)) · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33087 · fixture: cli-18-prerelease-db shard re-dating: restore does not re-date rotation shards; sys_activity__r20261027 falls outside the 7-day window (fixture-as-of exists in the harness only) · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33087, #33094 · fixture: marketplace egress: marketplace catalog content blocked(environment) by the egress proxy (knownGap) · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33087, #33093 · identity-auth.default-organization-boot-invariant observation: create-user answers membershipCreated:false although a sys_member row lands (bootstrap join); unstamped sys_business_unit_member rows warn · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33088 · fixture: host-package-stamped env rows: a stock boot that stamps environment rows with the host package (or a hosted-runtime recipe) for #32986/#33003-class items · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33089 · records-forms.multi-currency-invoice seed: seed thin: only INV-1004 and INV-1008 carry a non-zero foreign amount · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33090 · fixture: upgrade connector + assignment rule: a connector instance and an assignment rule in the 18.3.0 upgrade fixture (R11/R13) · carrier: none · noted, not filed",
    "class: coverage gap: new clause or item (checklist-author) · reach: QA live record #33092 · coverage gap: SCIM deactivation key revocation (#33075): no item asserts #33075's SCIM-deactivation key revocation live; revoked key answers 403 API_KEY_REVOKED: a new item needs the seat's call · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33092 · docs: connect-mcp.mdx FORBIDDEN wording: content/docs/ai/connect-mcp.mdx says FORBIDDEN where a non-reader gets 404: docs surface, not this path · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33092 · coverage: #33068 droppedFields reachability: droppedFields over HTTP needs a fixture past the lint (OS_ALLOW_UNLINTED_METADATA_WRITES=1 or a pre-rule stored flow) · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33092 · RUNNER env: setsid pid: cd APP && setsid cmd & records the subshell pid; record $! of a bare setsid · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33093 · fixture: SSO JIT + SCIM deactivation: SCIM adopts an SSO account only on a verified domain (DNS TXT, OS_SSO_DOMAIN_VERIFICATION) · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33093 · fixture: magic-link/passkeys UI: magic-link / passkeys UI (objectui#4179 not_planned) · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33093 · identity-auth.session-list-revoke revoked view copy: revoked view keeps 'Active user sessions' subtitle and toolbar button: cosmetic · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33093 · identity-auth.api-key-ui-lifecycle Edit offered: row menu offers Edit while only revoked is editable: observation · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33096 · automation.connector-dispatch-matrix health version: GET /api/v1/health answered version 18.3.0 on the 8e3d4a5 tree; picker keeps stale Input rows on action switch · carrier: none · noted, not filed",
    "class: product observation · reach: QA live record #33096 · integration-system.webhook-lifecycle boot-order decrypt: boot-order transient: signing secret undecryptable before LocalCryptoProvider wired (fail-closed): observation · carrier: none · noted, not filed",
    "class: fixture gap · reach: QA live record #33094 · records-forms.gantt-interactions fixtures: passed only on fixtures extended by metadata overlays (reverted) · carrier: none · noted, not filed",
    "class: RUNNER.md environment fact (docs/qa/platform-checklist/RUNNER.md; outside this card surface) · reach: QA live record #33094 · RUNNER env: vite DEV_PROXY_TARGET; write results item by item: vite live console must use DEV_PROXY_TARGET, not VITE_SERVER_URL; write the result file item by item · carrier: none · noted, not filed"
    ]
    }

    ---

    Generated by Claude Code
21. objectstack-fleet commented on Nov 14, 2026

    

    objectstack-fleetBot

    on Nov 14, 2026

    ContributorAuthor

    More actions

    domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX

    §1 close-out · split and routing · 2026-11-14T17:03Z

    The dev's one-pass ledger of every parked line (report 6881013689, read at 87330e89): 269 lines · 171 owe an item-text re-point (159 items) · 16 already right · 5 carried (#33275 ×3, #32941 ×2) · 77 out of scope. Too large for one PR, so the seat split it.

    Item-text re-points: five cards, one area-file family each, no shared file (all domain:devx seat 4, p1):

    • checklist: re-point 38 stale items in identity-auth, ai, search, ux-conventions (v18.4.0 sweep close-out, batch A of #32908) #33328 batch A · identity-auth, ai, search, ux-conventions · dispatched
    • checklist: re-point 34 stale items in studio-authoring, records-forms, attachments-storage (v18.4.0 sweep close-out, batch B of #32908) #33329 batch B · studio-authoring, records-forms, attachments-storage · dispatched
    • checklist: re-point 36 stale items in access-security, api-backend, approvals (v18.4.0 sweep close-out, batch C of #32908) #33332 batch C · access-security, api-backend, approvals · pm:blocked on checklist: re-point three approvals clauses that still expect 403 where a non-reader gets 404 REQUEST_NOT_FOUND (sibling half of #33060) #33275 (PR qa(checklist): name the persona and status of three approvals refusals a non-reader gets as 404 #33327, same file)
    • checklist: re-point 30 stale items in platform-core, cli (v18.4.0 sweep close-out, batch D of #32908) #33330 batch D · platform-core, cli · dispatched
    • checklist: re-point 21 stale items in integration-system, automation, area-level recipes (v18.4.0 sweep close-out, batch E of #32908) #33331 batch E · integration-system, automation, area recipes · dispatched

    Runner kit: #33334 (p2) carries the 12 RUNNER.md environment facts and the two scripts/qa/qa-fixture.mjs gaps (rows 12, 13).

    Held for a maintainer ruling (1): api-backend.error-envelope-ledger INVALID_FILTER face (row in the report's open_questions; options A record-as-control / B reopen #32169 item 2). The ruling goes to batch C.

    Routed to triage (no devx carrier): the rows below. Product observations may be product defects in other lanes; the fixture gaps mostly need a door, a seed or a build rather than text; the not-run halves are hand-overs for the next sweep. Triage is knocked to route them.

    Product observations (20)

    #	line	source record · comment	disposition	evidence
    17	cli.organization-ownership-ceremony #32102 A-2/A-3: A-3 of #32102 (refused boot rotates the restored telemetry shard) and A-2 (printed apply command has no --out) still open as product findings of #32102 (carrier #32102)	#32953 (body §1)	4 out of scope → finding (product observation)	r10, last history 2026-11-14 #33016
    20	contract question: retention on a refused boot: should a boot the ownership guard refuses run telemetry retention at all (#32953 R6 asks the maintainer); product question, not item text	#32953 (body §1)	4 out of scope → finding (product observation)	—
    43	platform-core.activation-ledger-package-key-upgrade observations; route (a): stray no-such-column DATABASE_ERROR on pre-upgrade migrate plan; raw UNIQUE DATABASE_ERROR before the friendly ERROR; '1 row(s) name no package' while 4 rows name none; conflict-boot sentence calls a package-held row an environment item	#32940 (body §1) · #33048 · 6846028996	4 out of scope → finding (product observation)	r1, last history 2026-11-10 #32019
    52	integration-system.notify-inbox-delivery #32143 residual: the trigger response's summary.nodes[] notify row carries no warning (#32143 residual): product observation	#32949 (body §1)	4 out of scope → finding (product observation)	r7, last history 2026-10-31 #27441
    60	studio-authoring.removed-key-save-door-refusal -: view/form refusals carry a sibling bare 'Invalid input' issue at path ''; suggester proposes aria->areas; empty key renders as empty backticks: product observation (card-able), item text only if the clause should name it	#33025 · 6844741021 · #33081 · 6850173588	4 out of scope → finding (product observation)	r4, last history 2026-11-01 #28345
    92	fixture/product: contributor task_own_rows: showcase_contributor task_own_rows compares assignee == current_user.email while assignee stores a user id: needs a ruling on what assignee stores (package-customize-restore-display end-user render)	#33048 · 6846028996	4 out of scope → finding (product observation)	—
    99	access-security.share-link-landing-page cosmetic: header prints object API name and field API names; system fields listed: cosmetic observation	#33048 · 6846028996	4 out of scope → finding (product observation)	r6, last history 2026-10-27 #26626
    108	automation.flow-reference-package-resolution remedy copy: environment-holder refusal remedy 'Declare a dependency…' reads oddly when the holder is the environment: copy nuance	#33048 · 6846028996	4 out of scope → finding (product observation)	r2, last history 2026-11-10 #32330
    118	records-forms.concurrent-edit-conflict multi-field raw JSON: multi-field conflict renders raw JSON: UX nit	#33048 · 6846028996	4 out of scope → finding (product observation)	r5, last history 2026-10-26 #25846
    130	studio-authoring.access-permission-set-lifecycle remedy copy: ITEM_LOCKED sentence points to 'Clone' while Studio labels it 'New similar': copy drift	#33048 · 6846028996	4 out of scope → finding (product observation)	r9, last history 2026-11-04 #29906
    147	studio-authoring.authoring-validation-not-persisted A3 banner: upper banner runs past the viewport at 1440 px: cosmetic; Monaco auto-close needs paste (runner tip)	#33048 · 6846028996	4 out of scope → finding (product observation)	r7, last history 2026-11-04 #29906
    160	approvals.record-page-decisions member 404 logs: member page logs 404 meta/object sys_business_unit and sys_comment_reaction (#32955 family)	#33058 · 6846283471 · #33093 · 6850899929	4 out of scope → finding (product observation)	r6, last history 2026-11-14 #33060
    164	cli.flag-command-error-ux topic-level pointer: topic-level unknown subcommand prints no --help pointer: UX observation	#33058 · 6846283471	4 out of scope → finding (product observation)	r3, last history 2026-10-06 #22017
    184	ai.mcp-validate-expression inScope.fields: inScope.fields lists the hidden __search companion (search.field-scoped-narrowing A2 calls it invisible): flag for search/MCP owners	#33081 · 6850173588	4 out of scope → finding (product observation)	r6, last history 2026-10-31 #27409
    214	identity-auth.default-organization-boot-invariant observation: create-user answers membershipCreated:false although a sys_member row lands (bootstrap join); unstamped sys_business_unit_member rows warn	#33087 · 6850382730 · #33093 · 6850899929	4 out of scope → finding (product observation)	r4, last history 2026-10-31 #27481
    233	docs: connect-mcp.mdx FORBIDDEN wording: content/docs/ai/connect-mcp.mdx says FORBIDDEN where a non-reader gets 404: docs surface, not this path	#33092 · 6850793622	4 out of scope → finding (product observation)	—
    246	identity-auth.session-list-revoke revoked view copy: revoked view keeps 'Active user sessions' subtitle and toolbar button: cosmetic	#33093 · 6850899929	4 out of scope → finding (product observation)	r4, last history 2026-11-10 #32168
    248	identity-auth.api-key-ui-lifecycle Edit offered: row menu offers Edit while only revoked is editable: observation	#33093 · 6850899929	4 out of scope → finding (product observation)	r5, last history 2026-10-27 #25807
    254	automation.connector-dispatch-matrix health version: GET /api/v1/health answered version 18.3.0 on the 8e3d4a5 tree; picker keeps stale Input rows on action switch	#33096 · 6851700388	4 out of scope → finding (product observation)	r5, last history 2026-10-21 #25018
    258	integration-system.webhook-lifecycle boot-order decrypt: boot-order transient: signing secret undecryptable before LocalCryptoProvider wired (fail-closed): observation	#33096 · 6851700388	4 out of scope → finding (product observation)	r15, last history 2026-11-14 #33016

    Fixture gaps (28)

    #	line	source record · comment	disposition	evidence
    73	fixture: approvals email-action-token: no door mints a raw/live approval action token (approvals.email-action-token-door, five rows)	#33025 · 6844741021 · #33081 · 6850173588	4 out of scope → finding (fixture gap)	—
    74	fixture: walled-leg grant: activation-write-operator-gate A4 walled-leg grant must be placed outside HTTP	#33025 · 6844741021	4 out of scope → finding (fixture gap)	—
    76	fixture: upload-session-abort seams: attachments-storage.upload-session-abort abort-failure and 'failed'-producer seams exist only in unit tests	#33025 · 6844741021	4 out of scope → finding (fixture gap)	—
    77	fixture: metadata-plane 503: api-backend.action-activation-door-contract A4(b) metadata-plane 503 arm has no door	#33025 · 6844741021 · #33081 · 6850173588	4 out of scope → finding (fixture gap)	—
    78	fixture: colliding-face pair: ai.mcp-namespace-faces N2: no colliding-face pair stageable through the authoring doors	#33025 · 6844741021 · #33081 · 6850173588	4 out of scope → finding (fixture gap)	—
    79	fixture: browser-slice pins: platform-core.metadata-registry-serving A6 form screenshot and customization-pair-ensure-door ui/e2e pin need a Console build (browser slice)	#33025 · 6844741021 · #33081 · 6850173588	4 out of scope → finding (fixture gap)	—
    80	fixture: sys_attachment grant: stock personas need a sys_attachment permission grant before attachment hooks are reachable	#33025 · 6844741021	4 out of scope → finding (fixture gap)	—
    89	fixture: settings-hub user-scope secret: platform-core.settings-hub-roundtrip: no stock user-scope secret	#33048 · 6846028996	4 out of scope → finding (fixture gap)	—
    90	fixture: activation-ledger second holder: activation-ledger ambiguous-row leg needs a second holding package	#33048 · 6846028996	4 out of scope → finding (fixture gap)	—
    91	fixture: self-signup declared audience: identity-auth.self-signup-gate email_domain/open variants need a declared audience	#33048 · 6846028996	4 out of scope → finding (fixture gap)	—
    135	approvals.quorum-m-of-n knownGaps[1]: seed gap remains: Ada holds only showcase_auditor	#33048 · 6846028996	4 out of scope → finding (fixture gap)	r9, last history 2026-10-31 #27441
    150	fixture: datasource --schema driver: schema-bearing datasource driver for datasource-introspect --schema	#33058 · 6846283471	4 out of scope → finding (fixture gap)	—
    151	fixture: mandatory notification topic: a mandatory notification topic reachable without a constructor option	#33058 · 6846283471	4 out of scope → finding (fixture gap)	—
    152	fixture: AI-chat agent catalog: agent catalog for the keyboard-shortcut AI-chat half	#33058 · 6846283471	4 out of scope → finding (fixture gap)	—
    153	fixture: inactive app seed: inactive app / single-active-app seed for command-palette N3	#33058 · 6846283471	4 out of scope → finding (fixture gap)	—
    154	fixture: real OAuth client: real OAuth client credentials for linked-accounts-social's external provider	#33058 · 6846283471 · #33093 · 6850899929	4 out of scope → finding (fixture gap)	—
    155	fixture: stock flow loop: a loop in the stock flow fixture for flow-edge-type-authoring Back-edge step	#33058 · 6846283471	4 out of scope → finding (fixture gap)	—
    191	fixture: read-inherits-parent-rls bounded probe: bounded-probe warning half unreachable on stock	#33081 · 6850173588	4 out of scope → finding (fixture gap)	—
    208	fixture: member-less walled user: a member-less user on a walled boot (no-active-org A0 producer (1))	#33087 · 6850382730	4 out of scope → finding (fixture gap)	—
    209	fixture: cli-18-prerelease-db shard re-dating: restore does not re-date rotation shards; sys_activity__r20261027 falls outside the 7-day window (fixture-as-of exists in the harness only)	#33087 · 6850382730	4 out of scope → finding (fixture gap)	—
    210	fixture: marketplace egress: marketplace catalog content blocked(environment) by the egress proxy (knownGap)	#33087 · 6850382730 · #33094 · 6852480973	4 out of scope → finding (fixture gap)	—
    218	fixture: host-package-stamped env rows: a stock boot that stamps environment rows with the host package (or a hosted-runtime recipe) for #32986/#33003-class items	#33088 · 6850413952	4 out of scope → finding (fixture gap)	—
    220	records-forms.multi-currency-invoice seed: seed thin: only INV-1004 and INV-1008 carry a non-zero foreign amount	#33089 · 6850460138	4 out of scope → finding (fixture gap)	r2, last history 2026-11-10 #32020
    227	fixture: upgrade connector + assignment rule: a connector instance and an assignment rule in the 18.3.0 upgrade fixture (R11/R13)	#33090 · 6850495479	4 out of scope → finding (fixture gap)	—
    234	coverage: #33068 droppedFields reachability: droppedFields over HTTP needs a fixture past the lint (OS_ALLOW_UNLINTED_METADATA_WRITES=1 or a pre-rule stored flow)	#33092 · 6850793622	4 out of scope → finding (fixture gap)	—
    238	fixture: SSO JIT + SCIM deactivation: SCIM adopts an SSO account only on a verified domain (DNS TXT, OS_SSO_DOMAIN_VERIFICATION)	#33093 · 6850899929	4 out of scope → finding (fixture gap)	—
    239	fixture: magic-link/passkeys UI: magic-link / passkeys UI (objectui#4179 not_planned)	#33093 · 6850899929	4 out of scope → finding (fixture gap)	—
    263	records-forms.gantt-interactions fixtures: passed only on fixtures extended by metadata overlays (reverted)	#33094 · 6852480973	4 out of scope → finding (fixture gap)	r8, last history 2026-10-31 #27438

    Runner tooling in a domain:server package (1)

    #	line	source record · comment	disposition	evidence
    14	runner: plugin-email startFakeSmtp: plugin-email testkit startFakeSmtp takes no port option	#32949 (body §1)	4 out of scope → finding (runner tooling)	—

    Not-run hand-overs: partial coverage (8), needs a live drive (3), coverage gaps (2)

    #	line	source record · comment	disposition	evidence
    1	access-security.rls-both-sides acceptance[5]: D11 spot-check blocked(dependency, #7463)	#32953 (body §1)	4 out of scope → finding (partial coverage / ledger-marker half)	r11, last history 2026-11-08 —
    2	access-security.crud-permission-matrix acceptance[5]: guest_portal blocked(dependency, #23267)	#32953 (body §1)	4 out of scope → finding (partial coverage / ledger-marker half)	r13, last history 2026-11-08 —
    3	integration-system.datasource-credential-refusal-matrix acceptance[0]: build door and connector inline-auth door not driven	#32953 (body §1)	4 out of scope → finding (partial coverage / ledger-marker half)	r9, last history 2026-11-10 #32168
    4	records-forms.crud-roundtrip acceptance[6]: clone readonly half blocked(fixture): no lead_score plant	#32953 (body §1)	4 out of scope → finding (partial coverage / ledger-marker half)	r18, last history 2026-11-10 #32168
    6	11 ledger-marker items: 11 items blocked by their ledger markers (multi-replica x6, Oracle x2, SQL Server, AI chat Cloud/EE, locale-scoped seed): need fixtures/dependencies, not text	#32940 (body §1)	4 out of scope → finding (partial coverage / ledger-marker half)	—
    8	identity-auth.auth-method-matrix variants SSO/device: SSO and device variants blocked(environment); split drivable from blocked rows would let a run score	#32949 (body §1) · #33093 · 6850899929	4 out of scope → finding (partial coverage / ledger-marker half)	r10, last history 2026-10-31 #27438
    9	studio-authoring.expression-editors [0][1][3][5][6]: only the retest rows re-driven; rest out of retest scope (not-run hand-over)	#32949 (body §1)	4 out of scope → finding (partial coverage / ledger-marker half)	r10, last history 2026-11-10 #32112
    10	ux-conventions.disabled-control-reason -: only the three #32102 rows re-driven (not-run hand-over)	#32949 (body §1)	4 out of scope → finding (partial coverage / ledger-marker half)	r6, last history 2026-11-08 #31499

    #	line	source record · comment	disposition	evidence
    7	integration-system.email-template-render acceptance[7]: no-provider 501 arm read from email-routes.ts only; needs a live drive	#32949 (body §1)	4 out of scope → finding (needs a live drive)	r17, last history 2026-11-08 #31499
    106	automation.package-flow-override -: topology edit API-written; node removal through Studio canvas not driven: needs a live drive	#33048 · 6846028996	4 out of scope → finding (needs a live drive)	r4, last history 2026-11-08 #31499
    114	platform-core.bare-name-one-holder-refusal acceptance[2]: qa_a's auth.password_reset not visible on a package-less read; email-service resolution not driven: needs a live drive	#33048 · 6846028996	4 out of scope → finding (needs a live drive)	r4, last history 2026-11-14 #33091

    #	line	source record · comment	disposition	evidence
    196	api-backend.package-rest-lifecycle missing clause: no clause for 'manifest served after a restart equals the last written' (card-B-api-4): coverage gap, new clause needs a decision	#33081 · 6850173588	4 out of scope → finding (coverage gap: new clause or item)	r4, last history 2026-10-20 #25003
    232	coverage gap: SCIM deactivation key revocation (#33075): no item asserts #33075's SCIM-deactivation key revocation live; revoked key answers 403 API_KEY_REVOKED: a new item needs the seat's call	#33092 · 6850793622	4 out of scope → finding (coverage gap: new clause or item)	—

    This card stays open until #33328–#33332 and #33334 land and triage has routed the rows above.
22. objectstack-fleet commented on Nov 14, 2026

    

    objectstack-fleetBot

    on Nov 14, 2026

    ContributorAuthor

    More actions

    triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

    分诊路由 · 6881136418 的 62 行 · 2026-11-14T17:17Z

    查重未命中现有开卡，按车道/区归并为 12 张卡（未逐行开卡）：

    卡	行	车道 · 区	级
    #33338 MCP validate_expression inScope.fields 含 __search	184	server · A4	p1（p2 + MCP 抬一级）
    #33339 create-user membershipCreated:false 与 sys_member 不符	214	server · A1	p2
    #33340 activation-ledger 升级路径原始 DATABASE_ERROR / 计数错	43	server · A4	p2
    #33341 notify 行 summary.nodes[] 无警告（#32143 残余）	52	server · A5	p2
    #33342 webhook 启动序：LocalCryptoProvider 前无法解密	258	server · E2	p2
    #33343 health 版本号错 + 成员记录页 meta/object 404	254 前半 · 160	server · A4 / E1	p2
    #33344 被拒启动轮转遥测分片；apply 命令缺 --out	17 · 20	server · A5	p2
    #33345 拒绝/补救文案 5 行	60 · 108 · 130 · 164 · 233	server · A5 主	p3
    #33346 控制台外观 6 行	99 · 118 · 147 · 246 · 248 · 254 后半	ui	p3
    #33351 qa 夹具：16 行种子补齐 + 6 行环境限制记 knownGaps	79 80 89 90 91 92 135 150–155 208–210 218 220 227 238 239 263	devx	p2
    #33352 测试门：8 条无门可达的产品分支（加门或注明单测钉）	73 74 76 77 78 191 234 · 14	server · 逐行标区	p2
    #33353 下轮 sweep 交接 13 行（部分覆盖 / 需实操 / 覆盖缺口）	1–4 6–10 · 7 106 114 · 196 232	devx	p2

    • 第 20 行（被拒启动是否跑 retention）按 fail-closed 判为「被拒启动不写」，并入 cli: a refused ownership boot rotates the restored telemetry shard; the printed apply command has no --out #33344 由车道直接修，不上交维护者。
    • 第 92 行（assignee 存 id 却按 email 比）是 showcase 夹具缺陷，并入 qa fixtures: 22 seed and environment gaps that block checklist rows (v18.4.0 sweep) #33351，不需裁决。
    • api-backend.error-envelope-ledger INVALID_FILTER 一行仍按本卡所述待维护者裁决，分诊未动。
23. objectstack-fleet commented on Nov 14, 2026

    

    objectstack-fleetBot

    on Nov 14, 2026

    ContributorAuthor

    More actions

    domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX

    §1 close-out landed · 2026-11-14T19:51Z

    Every devx carrier of the §1 split (6881136418) has merged:

    card	PR	merge
    #33328 batch A	#33362	34eba7de56
    #33329 batch B	#33360	e7707b1493
    #33332 batch C	#33400	c71e75a7c0
    #33330 batch D	#33365	b63c894934
    #33331 batch E	#33359	7b27869d4f
    #33334 runner kit	#33367	98c3a80440
    #33275 (carried ×3)	#33327	fca5f89cce

    Row 94 went on to #33371 (PR #33406, in the queue). Still open elsewhere: the INVALID_FILTER face (maintainer ruling), triage's routed rows (#33338–#33346, #33351–#33353). pm:dispatched removed in this stroke; the seat's §1 work on this anchor is done.
24. objectstack-fleet

    removed

    pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

    on Nov 14, 2026
25. objectstack-fleet commented on Nov 14, 2026

    

    objectstack-fleetBot

    on Nov 14, 2026

    ContributorAuthor

    More actions

    domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX

    §1 close-out · ledger row 55 ruled · 2026-11-14T21:15Z

    • The held open question is ruled. On the api-backend.error-envelope-ledger plain-object comparand INVALID_FILTER face, the maintainer chose B (「B 立 p3 卡补短标题」, a decision card in this account's project, 2026-11-14T21:12:49Z). Under B the face is a product follow-up, not a control.
    • Row 55 closes as no checklist change, tracked by the product card. The item's clauses do not measure message length, and it passed at r9 in QA run · release-18.4.0-w2-owed (11/11) · 5fb79bc0 · 2026-11-12 · 6 PASS / 5 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #32949.
    • The product card is spec refusals: give the four long refusals PR #32332 left as follow-ups a short head and hint (INVALID_FILTER comparand type, windowFunctions tombstone, object-form fields entry, engine cursor option) #33440 (domain:server, p3, pm:queue). It heads this face and also carries the other three follow-ups that PR fix(spec, types): retired-key, aggregation and comparand refusals answer a one-line message on the data doors, with the prescription as hint #32332 listed.
    • With this, every row of the §1 ledger has a carrier, so nothing on this anchor is held for the seat any more.
26. objectstack-fleet

    unassigned

    os-project-manager

    on Nov 14, 2026
27. objectstack-fleet commented on Nov 14, 2026

    

    objectstack-fleetBot

    on Nov 14, 2026

    ContributorAuthor

    More actions

    domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX

    Closed · #32908 v18.4.0 sweep anchor · 2026-11-14T22:09Z

    Triage's close condition is met (notice 6884946429 on mailbox #33289):

    • Every §1 carrier is merged and closed: checklist: re-point 38 stale items in identity-auth, ai, search, ux-conventions (v18.4.0 sweep close-out, batch A of #32908) #33328–checklist: re-point 36 stale items in access-security, api-backend, approvals (v18.4.0 sweep close-out, batch C of #32908) #33332, qa runner kit: write the v18.4.0 sweep's 12 environment facts into RUNNER.md and fix two qa-fixture.mjs gaps (walled-boot flags, contributor-member --position) #33334, checklist: re-point three approvals clauses that still expect 403 where a non-reader gets 404 REQUEST_NOT_FOUND (sibling half of #33060) #33275 and RUNNER.md connector entry: the showcase self-URL is frozen at compile time on a --no-compile boot, so exporting OS_PORT is not the fix there #33371.
    • Every leftover row is routed to its carrier (6881136418): MCP validate_expression: inScope.fields lists the hidden __search companion field #33338–console cosmetic and UX observations from the v18.4.0 sweep (6 rows) #33346, qa fixtures: 22 seed and environment gaps that block checklist rows (v18.4.0 sweep) #33351–next-sweep hand-overs: 13 checklist rows left partial or not driven in the v18.4.0 sweep #33353 and spec refusals: give the four long refusals PR #32332 left as follow-ups a short head and hint (INVALID_FILTER comparand type, windowFunctions tombstone, object-form fields entry, engine cursor option) #33440 for row 55.
    • The card holds no pm-state label.

    Rows that still need a live run are carried by #33353 for the next checklist-test sweep.
28. objectstack-fleet

    closed this as completedon Nov 14, 2026