[objectstack-fleet]

Requested by 田騏 · project thread

Fixes #28641
Part of #27377

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：按 W3-C1R（QA run · priority:P0 (23/23) · eeec88d1 · 2026-11-01 · 20 PASS / 2 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #28545，eeec88d1）留下的 20 条清单准确性发现，逐条对照当前 main 源码复核后改了平台测试清单：9 个区文件、13 个条目，每个条目 revision +1 并追加一行 history。19 条落地修改；第 16 条（Studio 发布提示文字）main 上已由 docs(qa): studio-authoring quotes the publish toast as the console draws it #28526 改好，记为「已在上游修好」，不重复改。
• 为什么改：这些步骤里的计数、错误码、路由和入口已经过时（例如 Setup 现有 50 个入口、设置命名空间有 11 个、成员打开 Setup 设置页现在显示「无权访问」而不是嵌在别的应用里），每轮 P0 冒烟都要多走一遍手工核对或报出假问题。不改，[sweep] v18.3.0 release test sweep #27377 发版巡检锚点无法收口。
• 风险与回滚：只改 QA 清单 JSON，不动产品代码、不进任何发布包；没有任何判据被放宽，只补得更准或更严。回滚就是 revert 本 PR。
• 先看：docs/qa/platform-checklist/areas/platform-core.json（builtin-apps-nav-render 的 negative[3] 改写与 nav-surfaces-render 的常设手工项）；approvals.json 的 account-app-entry acceptance[0]（接受调度方构建，但新增「服务端入口包与 dist 一致」核对）；integration-system.json 的 knownGaps[5]（两条新凭据通道）。
• 两分钟验证：仓库根运行 pnpm check:platform-checklist，预期最后一行以 check-platform-checklist: OK — 16 areas, 352 items 开头。
• 需要你做的：无，席位落地。

What changes

Twenty checklist-accuracy findings that QA run #28545 (W3-C1R, at eeec88d1) parked on anchor comment 6554042054 were each re-verified against source at 6b9c1ca991 before editing. 19 rows are edited across 13 items in the nine area files the card names. One row (16) had already landed upstream. Every edited item gets revision +1 and one history row citing #28545 and #28641. Main's history stays an exact prefix. No file outside the nine is touched. No clause is weakened.

#	item · clause	outcome	source confirmation
1	access-security.crud-permission-matrix steps[0], [6]	edited: the live grant door (admin POST to sys_user_permission_set) and the delegate's sys_business_unit_member row into bu_field_ops	object apiMethods, the pin's inserts, seed. 201 and "effective" are #28545's reading
2	access-security.owd-sharing-matrix steps[3]	edited: the project body spelled with the required account	project.object.ts required: true. The 400 wording is #28545's
3	access-security.walled-environment-metadata-operator-only acceptance[0].verify	edited: --maxWorkers=1, one package at a time	RUNNER memory fact
4	same item, steps[1] / acceptance[1]	edited: _migrate-stored and POST /automation driven, 403 FORBIDDEN and 403 PERMISSION_DENIED named	both pins
5	api-backend.packaged-action-disabled-dispatch acceptance[6]	edited: 409 ACTION_DISABLED with the turned-off sentence on the bulk-reassign route. The sentence names no action, and the target flow is untouched	describeDisabled ignores the name; the live pin does too
6	api-backend.query-contract-matrix	edited: negative[1] for the #26644 contract	projectionFieldsValue / countFlagValue + both door pins
7	ai.mcp-stdio-fail-closed steps[7]	edited: revoke from a signed-in session or Setup's API Keys page	api-key-management-credential.ts
8	cli.organization-ownership-ceremony acceptance[1]	edited: plan-file-required is the --json reason; the text run prints the Refused line	organization-ownership.ts refuse helper
9	same item acceptance[5] + cli-18-prerelease-db recipe	edited: recipe knownGaps[3] + a pointer in acceptance[5].verify	the paused rows, timers and null assignees are read from the committed dump. The id replacement is #28545's
10	platform-core.builtin-apps-nav-render negative[3]	edited: Setup's access verdict, the shell-less denied screen, and the wire half driven directly	AppContent.tsx appSurfaceAwaitsVerdict
11	same item steps[4], [5]	edited: 11 namespaces (sms, lifecycle); 50 Setup / 8 Account	the namespaces are read from source. 50 is #28545's reading
12	platform-core.nav-surfaces-render steps[0], [2]	edited: nav_report_index named as the standing hand-walk; the id diff reads 51	50 leaves in apps/index.ts, 49 SURFACES
13	approvals.account-app-entry steps[3]	edited: entry through the avatar menu's Profile item, not the switcher	account.app.ts hidden: true, AppHeader.tsx
14	same item acceptance[0]	edited: the dispatcher's build is accepted, plus a required served-entry identity check	RUNNER one-build fact
15	records-forms.crud-roundtrip steps[5], acceptance[4]	edited: the Activity tab on the tab row; read after a fresh read	RecordPageColumns.tsx tab row. The panel lag is #28545's
16	studio-authoring.first-run-loop steps[3]	already upstream: revision 9 (#28526, commit 37184244b8, after eeec88d1) quotes the current toast	i18n keys publishedAllCountOne, publishedAccessHint, publishedOpenAccess
17	same item steps[2]	edited: opens on Records; Add field on the Form tab; option values derive from labels	StudioDesignSurface.tsx, OptionsEditor
18	integration-system.datasource-credential-refusal-matrix acceptance[6].verify	edited: item route GET/PATCH/DELETE; Allow DELETE, GET, HEAD, PATCH	admin-routes.ts
19	same item knownGaps / source	edited: the code-author env route and the external.connector channel, as the code and ADR-0015 state them	datasource-env-credential.ts, common.zod.ts, ADR-0015 D7
20	same item steps[0]	edited: which door names both refusals for a mongo probe	assertValidConfig runs before assertValidRecord; resolveDriverId

Tests

Docs only: no package source changes, so no build closure and no package test suite is owed (os-dev local-verification scope ①/②). skip-changeset: the diff touches only docs/qa/platform-checklist/areas/*.json, which no package ships.

Acceptance notes

• Row 12 offers two remedies. Adding a Reports entry to SURFACES edits examples/app-showcase/e2e/showcase-smoke.spec.ts, which is outside this card's file surface. So the item names /reports as the standing hand-walk, and the SURFACES entry is left to the seat as an out-of-scope note.
• Row 17: the Records grid's add-column header also carries "Add field" (StudioDesignSurface.tsx). The step names the Form tab, where QA run · priority:P0 (23/23) · eeec88d1 · 2026-11-01 · 20 PASS / 2 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #28545 found it, and mentions the grid header too.
• Row 19 describes only what datasource-env-credential.ts, common.zod.ts, datasource.zod.ts and ADR-0015 D7 already state. It adds no repro detail.

Verification

Gates (head 6d1cadb)

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 16 families at 6d1cadb865 (9 paths, +116 / -44, under the 3000 human-merge line). Each ran with stdin from /dev/null; exit codes were written to disk before any output was read:

• node scripts/check-adr-links.mjs :: exit 0
• node scripts/check-adr-links.mjs --self-test :: exit 0
• node scripts/check-closing-keyword-parity.mjs :: exit 0
• node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
• node scripts/check-comment-mask-corpus.mjs :: exit 0
• node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
• pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 3 on the first run, a prerequisite refusal that measured nothing (formula and lint dist absent). Exit 0 after turbo run build --filter=@objectstack/formula --filter=@objectstack/lint (lock VERDICT command-exit 0)
• pnpm check:ci-filter-parity :: exit 0
• pnpm check:cross-package-test-inputs :: exit 0
• pnpm check:doc-authoring :: exit 0
• pnpm check:driver-memory-census :: exit 0
• pnpm check:gitlink-declared :: exit 0
• pnpm check:nul-bytes :: exit 0
• pnpm check:platform-checklist :: exit 0
• pnpm check:refd-timer-probe :: exit 0
• pnpm check:watch-hint-literal :: exit 0

--ran reconciliation: "16 derived, 16 run, 0 NOT-MEASURED, 0 UNRUN" (exit 0).

pnpm check:platform-checklist: check-platform-checklist: OK — 16 areas, 352 items (347 active, 1 planned), symbol anchors 1086/1096 resolved (10 on the named residual).

origin/main (f23e051232) was merged once before opening. Its three commits touch none of the nine area files. Two cited sources moved (StudioDesignSurface.tsx, packages/runtime/src/domains/automation.ts) and were re-read on the merged tree: the Records default view and the walled /automation refusal still hold.

Session: https://claude.ai/code/session_017ihL2gLghEqeDKTbDTC7Zd

🤖 Generated with Claude Code

[objectstack-fleet]

domain:devx#2 · marchtian · session_017ihL2gLghEqeDKTbDTC7Zd

席位核对 — ACCEPT · domain:devx#2 · head 6d1cadb865972ab5c346b938a2dd1f950671f433 · 2026-11-01T11:56Z

Checked against GitHub and the PR head, not against the report (os-dev-report 6557588690 on #28641).

• Shape: a draft to main with Fixes #28641 once, Part of #27377, Clause-②: no and Metadata-protocol: none. It has no assignees and no reviewers. skip-changeset is correct, because the PR changes only docs/qa/platform-checklist/areas/*.json and publishes no package.
• Path surface: exactly the nine area files the card names (+116/−44). check-governed-merges --pr 28652 reports it NOT governed and under the 3000-line threshold. It touches no contract face, so the seat reads it with CI and no second agent.
• Card rules, read in the diff: 19 rows are edited and row 16 is reported as fixed upstream. docs(qa): studio-authoring quotes the publish toast as the console draws it #28526 (37184244b8) already quotes the current publish toast. The seat spot-read the riskiest rows against their sources:
  • Row 3 goes from --maxWorkers=2 to =1 (stricter).
  • Row 5 keeps 409 ACTION_DISABLED and the own-switch ordering. It drops "naming the action" because describeDisabled names none since meta: GET /meta/object serves which packaged actions are switched off beside the item, and the disabled-action refusal reads as a plain sentence #27842, and it adds "target flow untouched".
  • Row 6 adds a decidable data list door: a blank $select answers every column and an unrecognised $count value counts — malformed values are read as the absent default #26644 negative for empty projection and non-boolean $count.
  • Row 10 keeps 403 SETTINGS_FORBIDDEN as the scored part and redraws the shell per AppContent.tsx.
  • Rows 11 and 12 correct the counts (50 Setup destinations, 11 namespaces, 49 SURFACES entries against 50 nav leaves) and name /reports as the standing hand-walk.
    No clause is weakened beyond what the code now does. Each edited item takes revision +1 and one history row citing QA run · priority:P0 (23/23) · eeec88d1 · 2026-11-01 · 20 PASS / 2 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #28545. Main's history stays a prefix.
• Gates: 16 derived families exit 0, and --ran reports 16/16. pnpm check:platform-checklist is OK (16 areas, 352 items). The seat lands once every check on this head is green.
• Accepted deviations: nine parts keep W3-C1R's live reading without a source confirmation, for example the exact 400 text in row 2 and the HEAD entry in row 18. Each one says so in its history row. The cli-18-prerelease-db recipe change (row 9) is recorded in the item's history, because recipes carry no revision.
• Out of scope: adding nav_report_index to the showcase smoke's SURFACES would end the standing hand-walk. That is an edit to examples/app-showcase/e2e/showcase-smoke.spec.ts, so it gets its own card. Datasource driver: 'mongo' with an inline password reports only the password at runtime. That is a two-step author experience, not a defect, and is left as an observation. Skills-docs: none — checklist text only.
• Landing: non-governed. Once every check on this head is green, the seat marks the PR ready and enables auto-merge.