qa(checklist): two more package-authored QA recipes (qa-media-constraints, qa-feeds-disabled) answer 422 NAMESPACE_PREFIX at their first object save, and neither may declare the namespace qa

Filing gate ①: a finding with a named location, measured through a public door. Filed by domain:devx seat 1 (#6023, session session_01JQwxbaFpnMwgpCgneKe2qS) from the #26791 card thread (PR #26875, os-dev report 6451454918, out_of_scope_findings). ⛔ Not a claim.

Finding (measured on a fresh stock showcase boot at main `8eef9a8d`; re-read before acting)

docs/qa/platform-checklist/areas/attachments-storage.json, recipe qa-media-constraints, step 2: PUT /api/v1/meta/object/qa_media?package=com.objectstack.qa.media answers 422 NAMESPACE_PREFIX ("Rename it to media_qa_media").
docs/qa/platform-checklist/areas/records-forms.json, recipe qa-feeds-disabled, step 2: PUT /api/v1/meta/object/qa_nofeeds?package=com.objectstack.qa.feeds answers 422 NAMESPACE_PREFIX ("Rename it to feeds_qa_nofeeds").
Cause, as in qa(checklist): the attachments-storage qa-scratch-authz recipe authors un-prefixed objects, which a package save now refuses with 422 NAMESPACE_PREFIX #26791: each step-1 manifest declares no namespace, so the install derives one from the id's last segment (media, feeds), and the qa_-named objects do not carry it. A runner replaying either recipe literally provisions nothing and scores the opting-in items blocked(fixture).

Constraint

PR #26875 fixes qa-scratch-authz by declaring namespace: "qa" on com.objectstack.qa.attachments. A namespace has one owner, so if either recipe here also declares qa, installing two of them on one boot answers NAMESPACE_CONFLICT (registry.ts NAMESPACE_CONFLICT_CODE). These two need another namespace their names already carry, or a rename.

Wanted

Each recipe replayed once on a stock showcase boot (REST only) after the fix, recorded in its provenance; every later step and opting-in item names the objects consistently, each with revision +1 and a history row citing this card.
If co-installing two QA recipes on one boot is a supported run shape, say so in the recipe that might collide.

Size: S. Clause-②: no. Metadata-protocol: none. Lands after PR #26875 (attachments-storage.json is shared).

Generated by Claude Code

Triage: first grade — `tests` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T19:55Z

⛔ Not a claim, ⛔ not a dispatch.

p2: two more package-authored QA recipes (qa-media-constraints, qa-feeds-disabled) are refused with 422 NAMESPACE_PREFIX at their first object save. Prefix them as qa(checklist): the attachments-storage qa-scratch-authz recipe authors un-prefixed objects, which a package save now refuses with 422 NAMESPACE_PREFIX #26791 did, and bump the item revisions. Sweep the other recipes for the same shape in the same PR.

Generated by Claude Code

Claim: PM loop round 8 · 2026-10-27T19:56Z
Session: session_01JQwxbWktv4mkt4CV6quMSp (card thread cmsg_01U5RdnAAmkSQmZbqh6FtqZ8947HaMXTZWUhakq787UCbL, dispatched by seat session session_01JQwxbaFpnMwgpCgneKe2qS)
Account: os-warren (the seat's linked user; the card's assignee)
Branch: claude/project-thread-w4r8ig (the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-26876
Domain: domain:devx
Seat: domain:devx#1
File surface: docs/qa/platform-checklist/areas/attachments-storage.json (recipe qa-media-constraints and the items that opt into it) and docs/qa/platform-checklist/areas/records-forms.json (recipe qa-feeds-disabled and the items that opt into it). ⛔ No product change, no .github/** or .claude/** edit, no other recipe touched (stop on breach)
Container & model: S, mode:thread (Warren's 「opus 很多，并发5」, 2026-10-27), model: default (no path-derived mandate, default opus), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: found in the #26791 os-dev report 6451454918 (out_of_scope_findings, PR #26875); filed by this seat
Thread-read: none
Premise: holds on origin/main a51ba639c1 (PR #26875 merged) — qa-media-constraints step 1 installs com.objectstack.qa.media with no namespace and step 2 saves qa_media; qa-feeds-disabled installs com.objectstack.qa.feeds with no namespace and saves qa_nofeeds (read by the seat)
Serial constraints cleared: #26875 merged (it shared attachments-storage.json). No open PR edits either file. ⚠️ The #26573 card thread (branch claude/project-thread-jcuzjj, last slice in flight, no PR yet) will also edit records-forms.json, other items; whichever lands second merges origin/main and re-runs check-platform-checklist. No other devx seat is seated

Generated by Claude Code

Claim: PM loop round 8 (supersedes claim 6452150747, written in a race with triage 6452130965 and naming none) · 2026-10-27T19:57Z
Session: session_01JQwxbWktv4mkt4CV6quMSp (card thread cmsg_01U5RdnAAmkSQmZbqh6FtqZ8947HaMXTZWUhakq787UCbL, dispatched by seat session session_01JQwxbaFpnMwgpCgneKe2qS)
Account: os-warren (the seat's linked user; the card's assignee)
Branch: claude/project-thread-w4r8ig (the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-26876
Domain: domain:devx
Seat: domain:devx#1
File surface: docs/qa/platform-checklist/areas/attachments-storage.json (recipe qa-media-constraints and the items that opt into it) and docs/qa/platform-checklist/areas/records-forms.json (recipe qa-feeds-disabled and the items that opt into it), plus, per triage 6452130965's sweep, any other recipe in docs/qa/platform-checklist/areas/*.json whose step-1 manifest leaves the namespace to derivation while its objects carry another prefix, with the items that opt into it. ⛔ No product change, no .github/** or .claude/** edit, no other recipe touched (stop on breach)
Container & model: S, mode:thread (Warren's 「opus 很多，并发5」, 2026-10-27), model: default (no path-derived mandate, default opus), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: found in the #26791 os-dev report 6451454918 (out_of_scope_findings, PR #26875); filed by this seat; triage 6452130965 graded p2 and asked for a sweep of the other recipes in the same PR. Its "prefix them as #26791 did" is read with the card's constraint: neither recipe may also declare qa (NAMESPACE_CONFLICT on co-install)
Thread-read: 6452150747
Premise: holds on origin/main a51ba639c1 (PR #26875 merged) — qa-media-constraints step 1 installs com.objectstack.qa.media with no namespace and step 2 saves qa_media; qa-feeds-disabled installs com.objectstack.qa.feeds with no namespace and saves qa_nofeeds (read by the seat)
Serial constraints cleared: #26875 merged (it shared attachments-storage.json). No open PR edits either file. ⚠️ The #26573 card thread (branch claude/project-thread-jcuzjj, last slice in flight, no PR yet) will also edit records-forms.json, other items; whichever lands second merges origin/main and re-runs check-platform-checklist. No other devx seat is seated

Generated by Claude Code

os-dev-report

{
  "issue": 26876,
  "status": "done",
  "branch": "claude/project-thread-w4r8ig",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26907",
  "session": "session_01JQwxbWktv4mkt4CV6quMSp",
  "premise_still_valid": true,
  "summary": "Both recipes could not take 'qa' (owned by qa-scratch-authz's com.objectstack.qa.attachments since #26875), and 'qa' is the only namespace their object names already carried, so each now declares its own namespace and its object is renamed on the qa_X -> qaNS_X rule (the qasub precedent): qa-media-constraints declares 'qamedia' (qa_media -> qamedia_media), qa-feeds-disabled declares 'qafeeds' (qa_nofeeds -> qafeeds_nofeeds). Each step 1 expect says why the namespace is declared, why not 'qa', and that the QA packages co-install on one boot as a supported run shape; provenance records the replay; the stale 'NOT yet proven by a live run' gap of qa-media-constraints now points at its two live proofs. Opting-in items: attachments-storage.field-accept-maxsize-server-enforced 5->6, records-forms.record-discussion-mentions 8->9, each with a history row citing #26876. Sweep (triage 6452130965) of all 8 area recipes: only these two had the shape (qa-flow-status-doors saves flows, which the prefix judge does not ask; qa-second-packaged-caller declares qasub; three install nothing); the table is in the PR body. Folded at the seat's request: records-forms.field-group-visible-when steps[1] now names com.objectstack.qa.group with namespace 'qagroup', qa_group_gate -> qagroup_group_gate at its 4 live mentions (the rev-3 history row stays as written), 7->8 with a history row.",
  "tests": "No code changed. Full turbo build 118/118 at main a51ba639, then REST-only replays on fresh stock showcase boots (pnpm dev -- --fresh -p PORT, no env posture), each recipe body read from the file and sent literally. As written: media and feeds step 1 201 with derived namespaces 'media'/'feeds', step 2 422 NAMESPACE_PREFIX each; the field-group carrier under com.objectstack.qa.group 422 NAMESPACE_PREFIX (derived 'group'). Fixed, all co-installed on one boot with qa-scratch-authz steps 1-4 and qa-flow-status-doors steps 1-3: every install 201 echoing its declared namespace, every object/flow save 200; a second package declaring 'qa' 422 NAMESPACE_CONFLICT; qamedia_media reads back poster accept/maxSize and doc accept as authored; a comment on a qafeeds_nofeeds record 403 FEEDS_DISABLED; qagroup_group_gate reads back visibleWhen as the bare string and highlightFields ['kind'], the visibleOn draft 422 INVALID_METADATA (fieldGroups.0 unrecognized_keys), a record POST 201; every teardown DELETE 200 and the objects then 404. The field-group replay ran on two fresh boots with identical answers.",
  "gates": "Local, head 58186e8d (main 6090bb73 merged in): dispatch-gates --commands derived 16, all exit 0: node scripts/check-adr-links.mjs :: exit 0; node scripts/check-adr-links.mjs --self-test :: exit 0; node scripts/check-closing-keyword-parity.mjs :: exit 0; node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0; node scripts/check-comment-mask-corpus.mjs :: exit 0; node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0; pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0; pnpm check:ci-filter-parity :: exit 0; pnpm check:cross-package-test-inputs :: exit 0; pnpm check:doc-authoring :: exit 0; pnpm check:driver-memory-census :: exit 0; pnpm check:gitlink-declared :: exit 0; pnpm check:nul-bytes :: exit 0; pnpm check:platform-checklist :: exit 0; pnpm check:refd-timer-probe :: exit 0; pnpm check:watch-hint-literal :: exit 0. --ran reconciliation: 16 derived, 16 run, 0 NOT-MEASURED. CI on 58186e8d: green (26 success, 13 skipped), per the seat's read.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 — fleet-write relay pr_create (PR 26907, draft, assignee os-warren, label skip-changeset; 10208 bytes sent = stored), and this os-dev-report comment via post-stamped. git push x2 (not REST).",
  "body_amendments": [
    "Acceptance notes, first bullet: replace the out-of-scope qa_group_gate finding with: records-forms.field-group-visible-when was folded in at the seat's request (steps[1] declares namespace 'qagroup' under com.objectstack.qa.group; qa_group_gate -> qagroup_group_gate in knownGaps[0], steps[1], steps[5], acceptance[0].verify; revision 7 -> 8), replayed on two fresh boots: as written 422 NAMESPACE_PREFIX, fixed 201/200 beside the qa, qamedia and qafeeds packages with no collision.",
    "What changes, opting-in items: add a third bullet for records-forms.field-group-visible-when (7 -> 8) as above.",
    "Recipe sweep: add a line after the table that the inline item carrier of field-group-visible-when, which reuses the qa-feeds-disabled pattern, had the same shape and is fixed here.",
    "Verification: 'Local gates on head 40d6c4fa (main c4a4aefc)' -> 'Local gates on head 58186e8d (main 6090bb73)'; the gate list is unchanged (16, all exit 0)."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed: PR #26908 (card #26573) also bumps records-forms.record-discussion-mentions 8 -> 9; whichever lands second renumbers its row and the item revision to 10 and re-runs check-platform-checklist (this PR will, if #26908 lands first)",
    "carrier: none · noted, not filed: packages/rest/src/rest-declared-client-refusal-log.test.ts mocks an object named qa_media; it is a unit stand-in that never reads the recipe, left as is"
  ]
}

Generated by Claude Code

ACCEPT → PR #26907 comment 6454459523 · auto-merge armed · 2026-10-27T21:51Z

Landed: the three QA scratch packages declare their own namespaces (qamedia, qafeeds, qagroup) via PR #26907, merged as 8bbdb0b462 · 2026-10-27T22:10Z

Navigation Menu

Repository navigation

qa(checklist): two more package-authored QA recipes (qa-media-constraints, qa-feeds-disabled) answer 422 NAMESPACE_PREFIX at their first object save, and neither may declare the namespace qa #26876

Finding (measured on a fresh stock showcase boot at main `8eef9a8d`; re-read before acting)

Constraint

Wanted

Triage: first grade — `tests` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T19:55Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

qa(checklist): two more package-authored QA recipes (qa-media-constraints, qa-feeds-disabled) answer 422 NAMESPACE_PREFIX at their first object save, and neither may declare the namespace qa #26876

Description

Finding (measured on a fresh stock showcase boot at main 8eef9a8d; re-read before acting)

Constraint

Wanted

Activity

objectstack-fleet commented on Oct 27, 2026

Triage: first grade — tests · priority:p2 · domain:devx · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-27T19:55Z

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

objectstack-fleet commented on Oct 27, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Finding (measured on a fresh stock showcase boot at main `8eef9a8d`; re-read before acting)

Triage: first grade — `tests` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-27T19:55Z