docs(qa): wave-3 checklist accuracy slice S9 — the 20 W3-C1R findings at eeec88d1 (#27377)

domain:devx#1 · sunhaolin · session_017xRBcVy4VXmkQjn2MGeaWk

Filing gate: ④ a coordination child. This is a sub-issue of #27377, the v18.3.0 release test sweep anchor. RUNNER's extraction obligation closes checklist-accuracy findings on the anchor. Slices S1–S8 (#28349, #28351, #28352, #28338–#28342) and the held items (#28345 → #28551) have all landed. These 20 lines are what W3-C1R parked after them (anchor comment 6554042054, record #28545 at eeec88d1). The anchor cannot close until they are in the ledger (#27377 §2).
Business reason: the P0 smoke is the release's standing evidence. Each stale step below costs every future P0 run a hand-walk or a false finding (counts, codes and routes that moved since c4c515ad).
Reader: any domain:devx seat, one PR, following #27164's shape: revision +1, history kept as a prefix, one row citing #28545, and Part of #27377.
Dedupe (open AND closed): "wave-3 checklist accuracy slice" → S1–S8, all closed; none covers W3-C1R's lines.
⛔ Not a claim. ⛔ No product code.

Scope

Files: docs/qa/platform-checklist/areas/ — access-security (4), api-backend (2), ai (1), cli (2), platform-core (3), approvals (2), records-forms (1), studio-authoring (2), integration-system (3). No other file.

Re-verify each row against the current head before editing. A row that no longer holds is reported as fixed upstream. A clause is only made stronger or more precise, never weaker.

#	item	clause	finding (W3-C1R, verbatim)
1	`access-security.crud-permission-matrix`	steps[0] / steps[6]	stale: describes the set grant only as a system-context insert. Should say a live run uses admin POST /api/v1/data/sys_user_permission_set {user_id, permission_set} (201, effective) and POST /api/v1/data/sys_business_unit_member for the delegate
2	`access-security.owd-sharing-matrix`	steps[3]	stale: the project body names status 'planned' but not the required account lookup (project.object.ts required: true); without it the create answers 400 "Account is required". Should spell {name, status:'planned', account: a seeded account id}
3	`access-security.walled-environment-metadata-operator-only`	acceptance[0].verify	stale: prescribes --maxWorkers=2 against RUNNER's memory fact. Should say --maxWorkers=1, one package at a time
4	`access-security.walled-environment-metadata-operator-only`	steps[0]/[1] / acceptance[1]	missing: the title names _migrate-stored and POST /automation but no step drives them. Live they answer 403 FORBIDDEN and 403 PERMISSION_DENIED (dispatcher-wrapper). Should add both doors and name their codes
5	`api-backend.packaged-action-disabled-dispatch`	acceptance[6] (clause, verify)	stale since #27842: expects ACTION_DISABLED "naming showcase_bulk_reassign"; the body is {code, message, httpStatus} with the generic turned-off sentence naming no action (the live pin ignores the name too). Should say 409 ACTION_DISABLED with the turned-off sentence on the /actions/showcase_task/showcase_bulk_reassign route, target flow untouched
6	`api-backend.query-contract-matrix`	—	missing clause: the #26644 contract (empty projection / unrecognised $count → 400) has no acceptance or negative row, so its recheck rests on a dispatcher note. Should add a negative
7	`ai.mcp-stdio-fail-closed`	steps[7]	stale (stricter since #27692): revoking "as the admin" with the admin API key answers 403 "Changing an API key requires a signed-in session". Should say to revoke from the admin's signed-in session or the API Keys page
8	`cli.organization-ownership-ceremony`	acceptance[1]	wording: the literal plan-file-required appears only as the --json reason; the text run prints "✗ Refused: --apply executes only a plan you reviewed…". Should say which output carries it
9	`cli.organization-ownership-ceremony`	acceptance[5] / cli-18-prerelease-db recipe	time-dependent: as the dump ages, boot 2 resumes its two paused showcase_task_follow_up wait runs, which fail at notify (no assignee) and are replaced by run_run_ history rows; the 9→9 count holds but two pre-existing ids vanish. The recipe should say so
10	`platform-core.builtin-apps-nav-render`	negative[3]	stale since #27507: says the member's settings route renders inside the opening app shell; it now waits on Setup's access verdict and shows "You don't have access to this app" with no shell. Should say that, keeping 403 SETTINGS_FORBIDDEN on the wire as the scored part
11	`platform-core.builtin-apps-nav-render`	steps[5] / steps[4]	stale counts: this run read Setup 50 destinations and Account 8 (steps[5] says 48), and 11 settings namespaces (steps[4] lists 9; add sms and lifecycle)
12	`platform-core.nav-surfaces-render`	steps[0]/[2]	stale since #27525: the served showcase nav has 50 leaves including nav_report_index while SURFACES holds 49, so /reports is a hand-walk every run. Should add a Reports entry to SURFACES or name it as the standing hand-walk; boot-health's id diff now reads 51 including the separator
13	`approvals.account-app-entry`	steps[3]	missing: the account app is reached from the avatar menu's Profile item (/apps/com.objectstack.account/component/account/profile_card), not the app switcher, which offers only Showcase / Back to home / All apps. Should say so
14	`approvals.account-app-entry`	acceptance[0]	wording: asks the runner to run pnpm console:build itself. Should accept the dispatcher's build ready line plus the served-entry hash check
15	`records-forms.crud-roundtrip`	acceptance[4] / steps[5]	missing: at 1440 px the record page also has a top-level Activity tab (?related=timeline). Should name that door beside the panel header; the right-column panel can lag the update line until a fresh read
16	`studio-authoring.first-run-loop`	steps[3]	stale since #27830: the publish toast now reads "Published 1 item in this package" with "Members can use it once a permission set grants them access." and an Open Access action; "(one atomic release)" is gone
17	`studio-authoring.first-run-loop`	steps[2]	minor: Add field is on the Form tab (the object surface opens on Records after a navigation), and an option's stored value derives from its label ("In Repair" gives in_repair), so it must be overwritten to get wip
18	`integration-system.datasource-credential-refusal-matrix`	acceptance[6].verify	minor: the 405 now lists Allowed: DELETE, GET, HEAD, PATCH; the item's "GET, POST, PATCH, DELETE" mixes in the collection's POST
19	`integration-system.datasource-credential-refusal-matrix`	source / knownGaps	missing: two credential routes new since `c4c515a` are unnamed — the code-author env route OS_DATASOURCE_NAME_PASSWORD behind OS_DATASOURCE_ENV_CREDENTIALS (now appended to every refusal; CODE_DEFINED_CREDENTIAL_ROUTE, datasource-env-credential.ts) and the external.connector channel (ADR-0015 D7) with its three refusals
20	`integration-system.datasource-credential-refusal-matrix`	steps[0]	observation: at runtime driver 'mongo' with an inline password reports only config.password, while the build door names the driver refusal too. Should say which door names both

Done when

All 20 rows are edited or reported as fixed upstream. pnpm check:platform-checklist is green. The PR lands, and #27377 §2's "not yet in the ledger" line is retired.

Generated by Claude Code

domain:devx#2 · marchtian · session_017ihL2gLghEqeDKTbDTC7Zd

Claim: PM loop round 2
Session: session_017ihL2gLghEqeDKTbDTC7Zd
Account: marchtian
Branch: claude/issue-28641-wave3-slice-s9
Worktree: objectstack-issue-28641
Domain: domain:devx
Seat: domain:devx#2
File surface: docs/qa/platform-checklist/areas/*.json, only the nine area files the card names and only the 20 rows it lists (no code, no RUNNER.md rule change)
Container & model: S/M checklist edits, mode:subagent, model: default tier, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: none
Premise: holds
Serial constraints cleared: none (no open PR touches docs/qa/platform-checklist/** at claim time)

Filed by domain:devx#1 (anchor #27377) with "Reader: any domain:devx seat"; the queue and level are that lane seat's own triage. #27377 itself stays with the devx#1 session. Each row is re-verified at the current head before it is edited. A row that no longer holds is reported as fixed upstream, and no clause is weakened.

domain:devx#2 · marchtian · session_017ihL2gLghEqeDKTbDTC7Zd
os-dev-report

{
 "issue": 28641,
 "status": "done",
 "branch": "claude/issue-28641-wave3-slice-s9",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/28652",
 "head": "6d1cadb865972ab5c346b938a2dd1f950671f433",
 "session": "session_017ihL2gLghEqeDKTbDTC7Zd",
 "premise_still_valid": true,
 "summary": "20 W3-C1R rows re-verified against source at 6b9c1ca991 (re-read on merged head 6d1cadb865 where main moved a cited file). 19 edited across 13 items in the nine named area files (revision +1, one history row citing #28545 and #28641, main's history an exact prefix); row 16 fixed upstream by revision 9 (#28526). One area-level recipe (cli-18-prerelease-db) gained knownGaps[3]. No clause weakened; docs only.",
 "row_counts": {
  "edited": 19,
  "fixed_upstream": 1,
  "total": 20
 },
 "rows": [
  {
   "row": 1,
   "item": "access-security.crud-permission-matrix",
   "clause": "steps[0], steps[6]",
   "outcome": "edited",
   "evidence": "sys-user-permission-set.object.ts apiMethods includes create; showcase-crud-persona-matrix.dogfood.test.ts inserts the grant + bu_field_ops membership; seed index.ts bu_field_ops",
   "w3c1r_only": "201 status and 'effective'"
  },
  {
   "row": 2,
   "item": "access-security.owd-sharing-matrix",
   "clause": "steps[3]",
   "outcome": "edited",
   "evidence": "project.object.ts account required: true",
   "w3c1r_only": "400 message text 'Account is required'"
  },
  {
   "row": 3,
   "item": "access-security.walled-environment-metadata-operator-only",
   "clause": "acceptance[0].verify",
   "outcome": "edited",
   "evidence": "RUNNER.md environment fact: Tier 1 vitest pins only at --maxWorkers=1"
  },
  {
   "row": 4,
   "item": "access-security.walled-environment-metadata-operator-only",
   "clause": "steps[1], acceptance[1]",
   "outcome": "edited",
   "evidence": "meta-migrate-stored-walled-refusal.test.ts 403 FORBIDDEN; automation-walled-definition-write.test.ts 403 PERMISSION_DENIED"
  },
  {
   "row": 5,
   "item": "api-backend.packaged-action-disabled-dispatch",
   "clause": "acceptance[6] clause+verify",
   "outcome": "edited",
   "evidence": "action-activation.ts describeDisabled ignores the name (describeTurnedOffPackagedItem); live pin expectDisabledSentence ignores _action"
  },
  {
   "row": 6,
   "item": "api-backend.query-contract-matrix",
   "clause": "negative[1] added",
   "outcome": "edited",
   "evidence": "protocol.ts projectionFieldsValue/countFlagValue; data-empty-projection-count-door.test.ts; runtime data-empty-projection-count.test.ts"
  },
  {
   "row": 7,
   "item": "ai.mcp-stdio-fail-closed",
   "clause": "steps[7]",
   "outcome": "edited",
   "evidence": "core/src/security/api-key-management-credential.ts API_KEY_MANAGEMENT_SESSION_REQUIRED_MESSAGE"
  },
  {
   "row": 8,
   "item": "cli.organization-ownership-ceremony",
   "clause": "acceptance[1]",
   "outcome": "edited",
   "evidence": "organization-ownership.ts refuse(): --json emits reason plan-file-required, text run printError('Refused: --apply executes only a plan you reviewed...')"
  },
  {
   "row": 9,
   "item": "cli.organization-ownership-ceremony + cli-18-prerelease-db recipe",
   "clause": "acceptance[5].verify, recipe knownGaps[3]",
   "outcome": "edited",
   "evidence": "fixture-18.0.0-next.5/telemetry.sql: 9 sys_automation_run rows, 2 paused showcase_task_follow_up at hold (PT1M elapsed, assignee null); flows/index.ts TaskFollowUpFlow remind recipients",
   "w3c1r_only": "replacement by run_run_ history rows; two ids vanish on boot 2"
  },
  {
   "row": 10,
   "item": "platform-core.builtin-apps-nav-render",
   "clause": "negative[3]",
   "outcome": "edited",
   "evidence": "AppContent.tsx appSurfaceAwaitsVerdict + renderAppAccessDenied (above ConsoleLayout, no shell); settings-routes.ts SETTINGS_FORBIDDEN at /api/settings/:namespace"
  },
  {
   "row": 11,
   "item": "platform-core.builtin-apps-nav-render",
   "clause": "steps[4], steps[5]",
   "outcome": "edited",
   "evidence": "setup-nav.contributions.ts 10 nav_settings_* + settings-service-plugin.ts unwalled-only branding = 11",
   "w3c1r_only": "Setup 50 / Account 8 counts"
  },
  {
   "row": 12,
   "item": "platform-core.nav-surfaces-render",
   "clause": "steps[0], steps[2]",
   "outcome": "edited",
   "evidence": "apps/index.ts 50 leaves (25 page, 17 object, 5 report, 3 dashboard) + nav_sep_reports = 51; SURFACES 49 with no report index"
  },
  {
   "row": 13,
   "item": "approvals.account-app-entry",
   "clause": "steps[3]",
   "outcome": "edited",
   "evidence": "account.app.ts hidden: true; AppHeader.tsx Profile → /apps/account/component/account/profile_card; filterActiveApps drops hidden",
   "w3c1r_only": "landed URL under com.objectstack.account segment"
  },
  {
   "row": 14,
   "item": "approvals.account-app-entry",
   "clause": "acceptance[0], steps[0]",
   "outcome": "edited",
   "evidence": "RUNNER.md one-build-per-container fact; served-entry identity check added as a required leg",
   "w3c1r_only": "index-RFCp05oY.js cited as the example only"
  },
  {
   "row": 15,
   "item": "records-forms.crud-roundtrip",
   "clause": "steps[5], acceptance[4].verify",
   "outcome": "edited",
   "evidence": "plugin-detail RecordPageColumns.tsx tab row (Overview, Activity=timeline, panels)",
   "w3c1r_only": "right-column panel lag"
  },
  {
   "row": 16,
   "item": "studio-authoring.first-run-loop",
   "clause": "steps[3]",
   "outcome": "fixed upstream",
   "evidence": "revision 9 (#28526, commit 37184244b8, committed 2026-11-01T05:06Z after eeec88d1 04:17Z; ancestry: in HEAD exit 0, not ancestor of eeec88d1 exit 1 with control eeec88d1~3 exit 0) quotes 'Published N items in this package', the access hint and 'Open Access'; i18n studio/en.ts keys present"
  },
  {
   "row": 17,
   "item": "studio-authoring.first-run-loop",
   "clause": "steps[2]",
   "outcome": "edited",
   "evidence": "StudioDesignSurface.tsx viewMode default 'grid' (Records); OptionsEditor derives new row value via toFieldNameOrEmpty",
   "note": "Records grid add-column header also carries Add field; step names the Form tab and mentions the grid header"
  },
  {
   "row": 18,
   "item": "integration-system.datasource-credential-refusal-matrix",
   "clause": "acceptance[6].verify",
   "outcome": "edited",
   "evidence": "service-datasource admin-routes.ts: item route GET/PATCH/DELETE, POST is the collection's",
   "w3c1r_only": "HEAD in the Allow header (router form corroborated by package-routes.ts note)"
  },
  {
   "row": 19,
   "item": "integration-system.datasource-credential-refusal-matrix",
   "clause": "fixtures.knownGaps[5], source",
   "outcome": "edited",
   "evidence": "datasource-env-credential.ts; common.zod.ts CODE_DEFINED_CREDENTIAL_ROUTE; datasource.zod.ts; ADR-0015 D7 (three refusals). Public code/ADR text only, no repro detail"
  },
  {
   "row": 20,
   "item": "integration-system.datasource-credential-refusal-matrix",
   "clause": "steps[0]",
   "outcome": "edited",
   "evidence": "datasource-admin-service.ts assertValidConfig (driver contract, mongo resolves via retired alias) runs before assertValidRecord (full DatasourceSchema)",
   "w3c1r_only": "build door names both refusals"
  }
 ],
 "files_changed": [
  "docs/qa/platform-checklist/areas/access-security.json",
  "docs/qa/platform-checklist/areas/ai.json",
  "docs/qa/platform-checklist/areas/api-backend.json",
  "docs/qa/platform-checklist/areas/approvals.json",
  "docs/qa/platform-checklist/areas/cli.json",
  "docs/qa/platform-checklist/areas/integration-system.json",
  "docs/qa/platform-checklist/areas/platform-core.json",
  "docs/qa/platform-checklist/areas/records-forms.json",
  "docs/qa/platform-checklist/areas/studio-authoring.json"
 ],
 "line_budget": "160 changed lines (+116 / -44, 9 files) vs the 3000 human-merge threshold: under",
 "tests": "docs only: no package touched, so no build closure (1) and no package suite (2) owed. pnpm check:platform-checklist exit 0 at 6d1cadb865: 'check-platform-checklist: OK — 16 areas, 352 items (347 active, 1 planned)'",
 "gates": {
  "derived_at": "6d1cadb865",
  "commands": [
   "node scripts/check-adr-links.mjs :: exit 0",
   "node scripts/check-adr-links.mjs --self-test :: exit 0",
   "node scripts/check-closing-keyword-parity.mjs :: exit 0",
   "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
   "node scripts/check-comment-mask-corpus.mjs :: exit 0",
   "node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0",
   "pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 3 (prerequisite refusal, formula/lint dist absent) → exit 0 after turbo build of @objectstack/formula + @objectstack/lint under os-verify-lock (VERDICT command-exit 0)",
   "pnpm check:ci-filter-parity :: exit 0",
   "pnpm check:cross-package-test-inputs :: exit 0",
   "pnpm check:doc-authoring :: exit 0",
   "pnpm check:driver-memory-census :: exit 0",
   "pnpm check:gitlink-declared :: exit 0",
   "pnpm check:nul-bytes :: exit 0",
   "pnpm check:platform-checklist :: exit 0",
   "pnpm check:refd-timer-probe :: exit 0",
   "pnpm check:watch-hint-literal :: exit 0"
  ],
  "ran_reconciliation": "Run reconciliation — 16 derived, 16 run, 0 NOT-MEASURED, 0 UNRUN (exit 0)",
  "ci": "in_progress at report time; PR check-runs not awaited (os-dev contract)"
 },
 "dogfood_battery": "n/a — no '!' in the PR title and no (narrowing) arm",
 "deviations": [
  "PR body ends with the order's '🤖 Generated with [Claude Code]' line, with the session URL on the line above it, instead of AGENTS.md's session-URL footer form (order-directed)",
  "an area-level recipe (cli.json fixtures.cli-18-prerelease-db.knownGaps[3]) was edited for row 9; recipes carry no revision/history, so the change is recorded in cli.organization-ownership-ceremony's revision 8 history row",
  "the first commit's message body mentions QA run #28545 in prose (no Fixes/Refs trailer; trailer pair model-free, check:commit-card-trailers green on push)"
 ],
 "mcp_calls": "0",
 "api_writes": "2 — relay stroke fw-20261101T115331Z-e5fa6a (pr_create: POST /repos/objectstack-ai/objectstack/pulls + POST /issues/28652/labels skip-changeset; run 41303891087 success, body read back identical 9242 bytes) + this os-dev-report comment via post-stamped.mjs (POST /issues/28641/comments). git push x3 (not REST).",
 "open_questions": [],
 "out_of_scope_findings": [
  "class: none (coverage gap, not a/b/c) · carrier: seat · examples/app-showcase/e2e/showcase-smoke.spec.ts SURFACES lacks a Reports index entry (nav_report_index, /reports) — 49 entries vs 50 served showcase_app leaves; the checklist now names it the standing hand-walk (platform-core.nav-surfaces-render revision 9). Adding the entry closes the hand-walk. dedupe: showcase-smoke SURFACES reports index, nav_report_index smoke",
  "class: none (observation) · carrier: none · POST /api/v1/datasources with driver 'mongo' plus an inline password reports only config.password (driver contract judged first via the retired alias), so an author meets the driver-retirement refusal only on a second attempt; both doors still refuse. noted, not filed"
 ]
}

domain:devx#2 · marchtian · session_017ihL2gLghEqeDKTbDTC7Zd

Landed · 2026-11-01T12:13Z · PR #28652 merged as 0b6a52e8a0 (reviewed head 6d1cadb865, seat record ACCEPT 6557606595). All 20 W3-C1R rows from #28545 are now in the ledger: 19 edited, and row 16 already fixed upstream by #28526. For #27377 §2, the anchor's "not yet in the ledger" line for these rows can be retired. The SURFACES follow-up for row 12 is #28653. pm:dispatched is removed in this stroke.

Navigation Menu

Repository navigation

docs(qa): wave-3 checklist accuracy slice S9 — the 20 W3-C1R findings at eeec88d1 (#27377) #28641

Scope

Done when

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(qa): wave-3 checklist accuracy slice S9 — the 20 W3-C1R findings at eeec88d1 (#27377) #28641

Description

Scope

Done when

Activity

objectstack-fleet commented on Nov 1, 2026

objectstack-fleet commented on Nov 1, 2026

objectstack-fleet commented on Nov 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions