[objectstack-fleet]

Fixes #33032
Fixes #33054
Fixes #33060
Fixes #33086
Fixes #33091

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:平台测试清单里 8 个条目的验收文字改成与产品现状一致(唯一键 409 现在报出字段、元数据开关路由数 4/14、内部字段测试文件新路径、os validate 的 controlled_by_parent 分支与新的 os lint 子句、Studio「未运行」原因的显示位置、非参与者伪造审批得 404、仍按部署唯一持有的类型从 webhook 改为 connector),每条都升了 revision 并补了 history 行。
• 为什么改:这些条目是产品对、清单文字落后,QA 每轮都会把它们误判为失败;不改产品行为。
• 风险与回滚:只改 docs/qa/platform-checklist/areas/ 下 6 个 JSON 文件,不发布、不进运行时;回滚即 revert 本 PR。
• 先看:areas/platform-core.json(bare-name 条目改指 connector,并改为按 NAMESPACE_SCOPED_BARE_NAME_TYPES 的补集取类型)、areas/cli.json(新增 acceptance[3] 的 os lint 子句)、areas/approvals.json(acceptance[4] 的 404/403 分界)。
• 两分钟验证:pnpm check:platform-checklist,预期最后一行 check-platform-checklist: OK — 16 areas, 427 items,symbol anchors 为 1635/1645 resolved。
• 需要你做的:无,席位落地。

What changes

One commit per card; every edited item bumps revision and appends a history row naming its card and the base it was read at (e540baf8).

Card	Item	Rev	What moved
#33032	records-forms.field-unique-enforcement	13 to 14	acceptance[0] and automated.ref: the bare unique: true collision names the field ('A record with this SKU already exists', field 'sku'), as 28a1527 made it
#33032	api-backend.error-sentences-and-unique-violation-wire-code	8 to 9	acceptance[2] and automated.ref: details exactly {developerMessage, field, object}, field = the duplicated column. This is also the trailing note on #33086, done once here
#33032	ai.mcp-read-file-pdf-word-extraction	2 (unchanged)	no edit: 29f9d3c (#33021) already landed r2 (60 ms budget, the zero-page shape as a fixture signal, showcase_invoice_line.receipt) after the reading the card came from
#33086	api-backend.rest-metadata-config-contract	9 to 10	maintenance removes 4 routes (adds POST {prefix}/_migrate-record-currency-codes), item removes 14 (adds GET {prefix}/:type/:ns/:name); steps[5] to [7], acceptance[2], two variant rows. The duty to enumerate each switch's radius from a route-table diff (the #15542 ruling) is kept
#33086	api-backend.second-object-exposure-and-internal-fields	3 to 4	automated.ref: the moved position pin packages/objectql/src/protocol-data-door-internal-field-positions.test.ts plus the delegation twin in packages/metadata-protocol
#33086	cli.validate-v18-authoring-verdicts	2 to 3	the cbp arm plants the shapes the parse refuses (no master_detail; two required ones, inline and through objectExtensions); the optional master is a control; the lint-only shape moves to a new os lint clause, acceptance[3]
#33054	studio-authoring.flow-status-matches-runtime	5 to 6	acceptance[1]: the rail and header title carry the worded unboundCause (else the reason), the reason verbatim is the Problems note's detail; negative[] untouched (ruling 6545938831 item ①)
#33060	approvals.record-page-decisions	5 to 6	acceptance[4] and steps[8]: a non-participant who cannot read the request gets 404 REQUEST_NOT_FOUND; 403 FORBIDDEN stays the answer to a reader with no slot
#33091	platform-core.bare-name-one-holder-refusal	3 to 4	acceptance[0] and [3] drive connector (the only covered type outside NAMESPACE_SCOPED_BARE_NAME_TYPES at this base); webhook joins the per-namespace leg with the requires: ['webhooks', 'realtime'] fixture note; the driven type is named as that list's complement

No product code, no changeset (nothing here is in any package's published files[]; skip-changeset rides the create). coverage.json and FOLLOW-UPS.md were not touched: the gate neither regenerated nor required them.

Tests

No test file changed. The judging gate and the derived local families, run at head 51098eec:

pnpm check:platform-checklist

check-platform-checklist: OK — 16 areas, 427 items (419 active, 3 planned); coverage: 40 kinds mapped, 4 waived; traps: 19 documented, 19 in use; provisioning: 10 area recipes, 18 item references resolved (5 area-qualified), 10/10 recipes referenced; ... symbol anchors: 1635/1645 resolved by symbol-anchors.mjs ... 10 on the named residual, 18 file floors held

At base e540baf8 the same gate read 1621/1631 resolved: the 14 new anchors this diff cites all resolve, and the residual stays 10.

derived families (node scripts/pm/dispatch-gates.mjs --commands, 16)

All 16 exit 0, each exit captured before any pipe: check-adr-links (+ --self-test), check-closing-keyword-parity (+ --self-test), check-comment-mask-corpus, plan-test-core-shards --self-test, @objectstack/lint check:doc-formula-expressions (exit 3 PREREQUISITE NOT MET on the first run, an unbuilt @objectstack/formula / @objectstack/lint; exit 0 after building those two under the verify lock), check:ci-filter-parity, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:platform-checklist, check:refd-timer-probe, check:watch-hint-literal. dispatch-gates --ran: 16 derived, 16 run, 0 NOT-MEASURED, 0 UNRUN.

Acceptance notes

• Two mechanism readings relayed with the dispatch were wrong at this base, and the edits follow what was measured. (1) The internal-field position pin moved in b388cfe (fix(objectql)!: the engine refuses evaluating an internal field for every caller but a system context #29003), read from the commit listing of both paths; bca2a51 (fix(plugin-security, lint): a refused controlled_by_parent write names no master to a writer who cannot read the master reference #32128) touches neither file. (2) tool is no longer held once per deployment: c747cf0 (feat(objectql, core, metadata)!: tool names held per namespace, and the metadata service keeps each package's tool in its own (package, name) slot (ADR-0150 child B) #33124) put it in NAMESPACE_SCOPED_BARE_NAME_TYPES after QA's control at 8e3d4a5, so the one covered type outside that list is connector, and Re-point platform-core.bare-name-one-holder-refusal acceptance[0] and [3] from webhook to tool: webhooks are held per namespace since #32577 #33091's item drives it.
• Read from source and pins, not driven live by this PR: the connector install refusal and cold-boot warning (held by the connector control cases of packages/objectql/src/registry-bare-name-one-holder-flow-family.test.ts), and the new os lint clause of the cli item (its rule's reach note in packages/lint/src/data-model-rules.ts and its unit pin). The os validate / os build exit 0 on the omitted-required shape is QA's live reading. The next QA run scores these.
• Re-point approvals.record-page-decisions acceptance[4]: a forged decision by a caller who cannot read the request answers 404 REQUEST_NOT_FOUND, not 403 FORBIDDEN #33060's sibling readings (not edited here, for the seat to carry). The approvals door answers 404 REQUEST_NOT_FOUND to anyone who cannot read the request (ApprovalService.refuseUnreadableRequest, asked by decide, recall, send back, resubmit, reassign, remind, request info and comment). Participants (submitter, current approver, past actor) and the override actor can read it.
  • approvals.request-page-reply-and-reader-visibility acceptance[1] (rev 5): stale. The org member, who is neither approver nor submitter on a showcase request, cannot read it (no showcase object declares enable.approvalsVisibleToReaders), so the comment POST answers 404 REQUEST_NOT_FOUND, not 403 FORBIDDEN.
  • approvals.quorum-m-of-n steps[4] (rev 9): half stale. The repeat-actor probe by Ada (a past actor, so a reader) answering 403 holds. "A user holding none of the routed positions is refused the same way" does not: that non-participant gets 404.
  • approvals.decision-action-matrix acceptance[6] (rev 10): under-specified. "Recall attempted by a non-submitter is FORBIDDEN" holds for a non-submitter who can read the request (a pending approver), but a non-participant gets 404. The clause names no persona. negative[2] (N2) is not stale: it judges acceptance, not the refusal code.
• api-backend.rest-metadata-config-contract: the item switch's describe() (packages/spec/src/api/rest-server.zod.ts) still omits GET /meta/:type/:ns/:name, though the mount table gates it. The maintenance describe() is current. checklist: re-point three api clauses that lag the product at 8e3d4a54 (QA 18.4.0 R2 part B, B-api slice) #33086 names this as its own QA card (card-B-api-5); this PR leaves the spec alone.

Verification

pnpm check:platform-checklist
node scripts/pm/dispatch-gates.mjs --commands    # 16 families, all run green at 51098eec

Session: session_017xRBcRZn9wGkMSrznVX4JS (seat domain:devx#2).

---

Generated by Claude Code

[objectstack-fleet]

domain:devx#2 · sunhaolin · session_017xRBcRZn9wGkMSrznVX4JS

席位核对 · ACCEPT · 2026-11-14T15:21Z · head 51098eec

席位意见：文字对齐产品，不改产品行为；可由席位落地（非受管面、+101/−51，未达人工合并阈值）。

Verdict: ACCEPT, checked against GitHub and origin/main e540baf8, not against the report (6879560259).

1. Shape. Draft PR against main. Lines 1–5 of the body read Fixes #33032, Fixes #33054, Fixes #33060, Fixes #33086 and Fixes #33091, one per fold member, each merge meant to close its card. The other closing-keyword hits in the body point at closed or merged numbers only. There are five commits, one per card (549d5a6, ef78485, 5505803, c6c56d4, 51098ee). Clause-②: no and Metadata-protocol: none stand on their own lines. With none and no narrowing arm, no Skills-docs: line is owed. The path face from pulls/33273/files is six files, all under docs/qa/platform-checklist/areas/ (api-backend +31/−13, approvals +8/−7, cli +20/−7, platform-core +18/−12, records-forms +10/−4, studio-authoring +14/−8), inside the claimed surface. No governed path. skip-changeset fits a docs-only QA diff.
2. Premises, measured by the seat:
   • packages/core/src/package-scoped-resolution.ts at e540baf8: BARE_NAME_ONE_HOLDER_TYPES minus NAMESPACE_SCOPED_BARE_NAME_TYPES is connector alone, since tool joined the second list in c747cf0. So the bare-name item's move to connector, naming the list's complement, is right.
   • refuseUnreadableRequest is present in approval-service.ts (7 hits).
   • ai.mcp-read-file-pdf-word-extraction is already rev 2 with the 60 ms budget at base, so leaving it unedited is right.
   • Read in the diff: the approvals 404/403 split, and the platform-core history row that cites feat(plugin-webhooks)!: declared webhooks are held per namespace, each holder dispatched and switched as its own (ADR-0150 child B, webhook family 2/3) #32577 and feat(objectql, core, metadata)!: tool names held per namespace, and the metadata service keeps each package's tool in its own (package, name) slot (ADR-0150 child B) #33124.
3. Gates. Check-runs on 51098eec at this comment: 14 success, 23 skipped, 0 failed, 8 in progress (Test Core 1–3/8, the five Lint jobs, both Type Check jobs). Landing waits until every check is green or an expected skip. Locally the dev ran 16 of 16 derived families, check:platform-checklist exit 0, dispatch-gates --ran 0 UNRUN. Those runs are local and are not counted for CI.
4. Accepted deviations.
   • The seat's own corrections, owned here. The dispatch's Zone 2 claimed tool was still one holder per deployment, and that bca2a51 moved the internal-field pin. Both were wrong at base. The claim's Premise: line also listed read-file rev 2 as stale, and it was already fixed by qa(checklist): correct five assertion defects from the 18.4.0 acceptance #33021. The dev measured and re-pointed correctly.
   • The pin-move commit b388cfe (fix(objectql)!: the engine refuses evaluating an internal field for every caller but a system context #29003) comes from the dev's REST commit listing. The seat's clone is shallow, so the seat did not re-measure it.
   • The connector and os lint legs were read from source and unit pins, not driven live; the Acceptance notes say so. The next QA run on these items is the live check.
   • The commit trailers follow AGENTS.md.
5. Out of scope.
   • The three approvals siblings (request-page-reply A1, quorum S4, decision-action-matrix A6) were not edited here → filed checklist: re-point three approvals clauses that still expect 403 where a non-reader gets 404 REQUEST_NOT_FOUND (sibling half of #33060) #33275, a sub-issue of Re-point approvals.record-page-decisions acceptance[4]: a forged decision by a caller who cannot read the request answers 404 REQUEST_NOT_FOUND, not 403 FORBIDDEN #33060, p2.
   • The item describe() lag in rest-server.zod.ts → carrier: qa#3's card-B-api-5, as named in checklist: re-point three api clauses that lag the product at 8e3d4a54 (QA 18.4.0 R2 part B, B-api slice) #33086's body (domain:spec). The seat files nothing here.
6. Landing. Once every check is green, one relay stroke: pr_ready + automerge_enable. Merging closes the five cards; the seat then clears pm:dispatched and follows the PR to MERGED.

[objectstack-fleet]

domain:devx#2 · sunhaolin · session_017xRBcRZn9wGkMSrznVX4JS

Landing · 2026-11-14T15:30Z · head 51098eec

• Gates at this head: every check-run is green or an expected skip: 28 success, 23 skipped, 0 failed, 0 running. Lint & Repo Gates and TypeScript Type Check both read success.
• K: 1 first-parent commit on main since the PR base d4fbb4db, under the 15 that would require merging main first. No generated files are in the diff.
• Verdict on record: ACCEPT 6879625279, same head. Non-governed, +101/−51.
• Stroke: pr_ready + automerge_enable. The merge closes checklist: re-point two api clauses to the shape #32935 landed, and fix the read-file CPU-budget step (QA 18.4.0 R2 api slice) #33032, Re-point studio-authoring.flow-status-matches-runtime acceptance[1]: a known "not running" cause is worded in the rail and header titles, and the platform reason is the Problems note's detail #33054, Re-point approvals.record-page-decisions acceptance[4]: a forged decision by a caller who cannot read the request answers 404 REQUEST_NOT_FOUND, not 403 FORBIDDEN #33060, checklist: re-point three api clauses that lag the product at 8e3d4a54 (QA 18.4.0 R2 part B, B-api slice) #33086 and Re-point platform-core.bare-name-one-holder-refusal acceptance[0] and [3] from webhook to tool: webhooks are held per namespace since #32577 #33091. The seat follows this PR to MERGED and then clears pm:dispatched on all five.