Repository navigation
qa(checklist): platform-core — 19 ledger edits from the 18.2.0 release sweep (#25807) #25845
Description
Filing gate: maintainer-directed task. Filed by the 18.2.0 release-assessment thread · session_01G3h9iZTpL8aCiXbfsp8H5u. ⛔ Not a claim, ⛔ not dispatched.
Maintainer's words (project thread, 2026-10-25, verbatim): 22:54Z 「约 300 条清单准确性问题：是不是应该开卡？」, then 22:55Z 「写issue，不派发」.
Parent: wave anchor #25807 (18.2.0 release test sweep). RUNNER's extraction obligation parks checklist-accuracy findings on the anchor; the maintainer asked for them as issues, so the wave's findings are split into one card per ledger file and the anchor links each card. This is not a release blocker, so it carries no target:v18.
Reader who acts: the lane owning docs/qa/platform-checklist/** (domain:devx). Dedupe (open and closed): no card holds these lines; the 18.0 precedent closed its accuracy rows on its anchor #24579.
Wanted
For each line below, edit docs/qa/platform-checklist/areas/platform-core.json: revise the item's text, bump its revision, and append a history entry citing the run record the line comes from. Keep pnpm check:platform-checklist green. A line that turns out to describe a product defect rather than stale text gets its own card instead of a ledger edit.
Findings (19)
From #25812 — priority:P0, 23 items, at 6679644a, pin b41ed7f68956
platform-core.boot-healthc2: deployment-policy unbound flows print as ℹ lines, not ⚠; the clause still describes ⚠.platform-core.nav-surfaces-render: the console-added "All reports" sidebar destination is outside both meta/app nav andSURFACES, so the served-vs-SURFACES diff cannot see it; step 1'stest:smokealso collects two other specs beside the pin.platform-core.builtin-apps-nav-render: marketplace knownGap names "Forbidden", the screen reads "HTTP 502 · fetch failed" (MARKETPLACE_PROXY_FAILED); step 6 namessys_approval_request/my_pendingfor Account Approvals, the served entry iscomponent/approvals/inbox; no clause covers a member opening Setup's url-type entries (they render inside the Showcase shell while the server refuses every namespace 403).platform-core.seed-integrity: the Specimen diff should name the canonical time form ("14:30" → "14:30:00"); step 2's baseline lists 9 of the 19 seeded datasets.platform-core.v18-boot-refusalsstep 1: productionos serve --preset minimalis refused earlier ("This stack mounts no auth…");os serve --dev --no-serveris the spelling that reaches the SecurityPlugin refusal.
From #25815 — release-18.2.0-tier1, 156 items, at 6679644a, pin b41ed7f68956 (clause labels: aK = acceptance[K], nK = negative[K])
platform-core.activation-ledger-registration-homea4: packages/spec/src/system/constants/platform-object-names.test.ts ('registers exactly the objects each package declares') ties PLATFORM_OBJECTS_BY_PACKAGE to the declaring sources and would pin the one-owner membership, but is not in the refplatform-core.activation-ledger-registration-homen2: platform-objects/src/plugin.test.ts asserts exactly one registering manifest; no pin drives a second registrant to observe the 'already owned by package' boot failureplatform-core.activation-ledger-row-contractn5/a4 (door half): packages/qa/dogfood/test/catalog-activation-door.dogfood.test.ts › 'a type with no switch is refused 400 by the door itself' and packages/runtime/src/domains/catalog-activation-door.test.ts (audience anchors 400, nothing written) exist and are not in this item's refplatform-core.activation-ledger-row-contracta2: the dogfood key-set reading proves the physical table lacks organization_id but not the step-7 refused INSERT / control INSERT pair the verify namesplatform-core.activation-ledger-row-contracta3: pins assert update-not-delete for the action (HTTP) and flow (store) kinds only; position/permission/sharing_rule re-enable rows are not covered hereplatform-core.lifecycle-retention-sweepref is accurate on scope (a2 pinned half, a3, n0-n1; a0/a1/a4 live; a5 a source read)platform-core.lifecycle-retention-sweepa3: live sweep-line corroboration of the reaped count stays the run'splatform-core.lifecycle-retention-sweepn0: the unit proves the onlyWhen predicate reaches the reap filter/candidate read on a recording fake engine, not that real paused/running rows surviveplatform-core.metadata-authoring-roundtripref is accurate: package-first-authoring.dogfood.test.ts and studio-object-designer.spec.ts are declared as scoring no clause; studio-record-page.spec.ts scores a2 onlyplatform-core.metadata-registry-servinga0: the pin never checks the registered kinds against DEFAULT_METADATA_TYPE_REGISTRY (step 2's presence table); it asserts only dashboard/action/report entriesplatform-core.nav-surfaces-rendera0/n0/n1/n3 score only if the parent can runpnpm -C examples/app-showcase test:smoke(Playwright + a live showcase with a console); otherwise not-run (browser)platform-core.nav-surfaces-rendera1: nothing in the ref computes the served-nav vs SURFACES diff — the 'coverage is current' clause has no automationplatform-core.serve-composition-v18run note: serve-organization-record-page.e2e.test.ts is a *.e2e.test.ts file — it collects only under OS_TEST_TIERS=nightly; a run without it reports 0 tests for that file (a2 then not scored)platform-core.v18-boot-refusalsa3: scored from the pin by the clause's own fallback ('with no such boot run, this clause rests on authz-identity-objects-boot-refusal.test.ts — record which'); the run record must say the live steps[1] boot was not run.
Acceptance
- Every line above is either applied (item revised,
revisionbumped,historycites the record) or answered on this card with the reason it was not. pnpm check:platform-checklistis green.- The PR links this card and [sweep] v18.2.0 release test sweep #25807.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 26, 2026
Claim: PM loop round 1 · 2026-10-26T12:23Z
Session:
session_01Q4MDXRbEJCNdPAP4SiXwp9(devx seat 2) · card threadsession_01VoWrGZipReMqGbFdsvCLsXAccount:
os-steveBranch:
claude/project-thread-xn40qf(the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record; amended on spawn)Worktree:
objectstack-issue-25845Domain:
domain:devxSeat:
domain:devx#2(seat post #20163)File surface:
docs/qa/platform-checklist/areas/platform-core.jsononly (stop on breach; explain in the report)Container & model: M,
mode:thread,model: default tier (TIER_DEFAULT, from dispatch-gates --tier: no path-derived mandate),effort: highClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: none
Premise: holds (action surface
git log origin/mainon the file since filing: no commit; the dev re-reads each line against main first)Serial constraints cleared: own ledger file only; seat 1 holds #25835 / #25836 on other files; #26035 left the retired objectui pin wording in these files to these cards; no other
Claim:names this fileGenerated by Claude Code
objectstack-fleet commentedon Oct 26, 2026
os-dev-report
{ "issue": 25845, "status": "done", "branch": "claude/project-thread-xn40qf", "pr": "https://github.com/objectstack-ai/objectstack/pull/26119", "session": "session_01VoWrGZipReMqGbFdsvCLsX", "premise_still_valid": true, "summary": "All 19 card lines dispositioned in docs/qa/platform-checklist/areas/platform-core.json: 17 applied across 10 items, 2 were ref-is-accurate confirmations needing no edit (lifecycle-retention-sweep scope, metadata-authoring-roundtrip). Each touched item has its revision bumped and a history row citing its run record (#25812 or #25815). The file two retired objectui-pin prescriptions (boot-health acceptance[5] pnpm objectui:build, keyboard-shortcut-surface acceptance[2] .objectui-sha) now name pnpm console:build and the ui/ path (11 items revised in all). No line was a product defect. Mechanism assumption measured true: the file is unchanged between run sha 6679644a and base 9753d163.", "tests": "docs-only, no package touched: no unit/typecheck owed. Re-read evidence: seed counts re-derived by loading examples/app-showcase/src/data/seed/index.ts ShowcaseSeedData via tsx after pnpm --filter @objectstack/spec build (19 datasets, 132 rows, equal to #25812). No ablation (ledger text only).", "gates": "local at head 06816ae9: pnpm check:platform-checklist exit 0 (OK, 16 areas, 329 items; symbol anchors 988/998, two new anchors resolve); dispatch-gates --commands --repo objectstack-ai/objectstack derived 13 families, all exit 0 (check:doc-formula-expressions first exit 3 PREREQUISITE, green after turbo build of @objectstack/formula and @objectstack/lint); --ran: 13 derived, 13 run, 0 NOT-MEASURED, 0 UNRUN (derived zero). CI check-runs on PR 26119: in_progress at report time, not re-run locally.", "dogfood_battery": "n/a: no ! in the PR title and Clause-② no without the (narrowing) arm", "mcp_calls": "0", "api_writes": "2: (1) relay pr_create, one POST /repos/objectstack-ai/objectstack/dispatches executed as POST pulls + POST issues/26119/assignees + POST issues/26119/labels (run 40325455884 success, body read back 8891/8891 bytes identical, draft true, labels [skip-changeset], assignees [os-steve]); (2) this os-dev-report comment via post-stamped. git push x2 (not REST).", "line_budget": "n/a: no skills/** path; diff +106 / -39 in 1 file", "files_changed": [ "docs/qa/platform-checklist/areas/platform-core.json" ], "deviations": [ "PR body lines 1-2 are the harness attribution block, so Fixes #25845 is line 3, not line 1", "the harness asks for a review request to os-steve after pr_create; not made: the dispatch forbids any GitHub MCP write and no relay op was sent for it", "origin/main merged into the branch (06816ae9) before pr_create because dispatch-gates reported a stale tree; no conflict, no checklist file moved on main", "commit trailer is the AGENTS.md model-free pair, not the harness model-named Co-Authored-By", "the primary checkout was detached so the worktree objectstack-issue-25845 could hold the harness-pinned branch" ], "open_questions": [], "out_of_scope_findings": [ "carrier: devx seat · platform-core.activation-ledger-row-contract scope wall omits webhook: CATALOG_ACTIVATION_SUBJECTS (packages/runtime/src/domains/catalog-activation.ts) admits position, permission, sharing_rule and webhook, and catalog-activation-door.test.ts has a declared-webhook describe; the item five-value set, variants and negative[5] predate it, and the item own knownGaps say a new legitimate writer needs a revision. Stale ledger text, not a defect; noted in PR Acceptance notes. dedupe words: activation ledger webhook scope wall, catalog activation webhook, metadata_type webhook", "carrier: devx seat (fits #26035 docs slice) · after the ui/ import, text that calls objectui pins objectui-repo-only / not runnable here is stale: url-overlay-contract knownGaps[0], boot-health source[4] and [5], and RUNNER.md objectui-only automated.ref fact; the pins exist under ui/ (ui/apps/console/src/components/FormPage.recordObject.test.tsx, ui/e2e/console-boot-indicator.spec.ts). Left because RUNNER.md is outside this file surface. dedupe words: objectui-repo-only, not pin-evidenced, objectui-pin fact", "carrier: none · about 20 at-the-console-pin provenance phrases remain in non-history text; they record where a reading was taken, not a prescription. Acceptance notes only" ] }Generated by Claude Code
docs(qa): platform-core checklist — webhook scope wall, ui/ pin paths (…
docs(qa): platform-core checklist — home-admin-cluster pins under ui/ (…
objectstack-fleet commentedon Oct 26, 2026
devx seat 2 · review: ACCEPT → PR #26119 comment 6417049192 (after two patch rounds). Landing: ready + merge queue once every check on the reviewed head is green or skipped.
Generated by Claude Code