[objectstack-fleet]

Requested by 田騏 · project thread

Fixes #28345

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：按你对 5 处遗留项的裁决（全部 A）改了测试清单：28 条只写范围说明、无法判定的否定项挪进 source[]；Studio 顶栏「已保存」不算写入反馈；Studio 不能填 initialStates，该判据移出验收；批量全选超过 5000 条时横幅必须写明上限；组织管理员保存已锁定的设置应被拒。
• 为什么改：这些条目要么让测试员只能记「跳过」，要么判据和产品实际能力不符，要么缺一条权限边界的判据；不改，每轮巡检都会给出假的通过或假的失败。
• 风险与回滚：只动 5 个清单 JSON 文件，不碰产品代码、不进任何发布包；每个改动的条目 revision +1 并追加一行 history。回滚就是 revert 本 PR。
• 先看：docs/qa/platform-checklist/areas/records-forms.json 的 records-forms.bulk-select-all-matching 新增 acceptance[5]；platform-core.json 的 platform-core.settings-organization-isolation-and-platform-rung 新增 negative[0]；studio-authoring.json 的 validation-rules-authoring。
• 两分钟验证：在仓库根运行 pnpm check:platform-checklist，预期最后一行是 check-platform-checklist: OK — 16 areas, 352 items。
• 需要你做的：无，席位落地。

What changes

Ruling-ref: 6545938831

Five checklist area files, no product code. Every edited item bumps revision by one and appends exactly one history row, dated 2026-11-01, ref #28345, naming wave anchor #27377. Main's history stays an exact prefix of each item's history. This was checked structurally: each file was re-parsed and compared with the original object plus the intended edit.

① Scope-note negatives move out of negative[] (28 items). Each moved entry was its item's last negative, so no other negative index shifts. Each lands as the item's new last source[] row, the field sibling items already use for cross-refs (the #27651 precedent). A leading SCOPE: label now reads cross-ref:. The rest of each text is unchanged.

• studio-authoring.json: all 24 active items whose last negative began SCOPE:.
• platform-core.notification-center negative[3] (cross-ref:).
• access-security.permission-matrix-edit-loop negative[2] (cross-ref:).
• Same shape, different spelling: access-security.record-view-read-audit negative[2] (cross-ref access-security.audit-log-browser …). Its automated.ref called negative[2] a cross-reference, so that note now points at source[4].
• Same shape, different spelling: records-forms.import-transform-matrix negative[3] (cross-ref guard: …).

② ux-conventions.write-feedback acceptance[1].verify. The Studio top bar's save status ('Saved' / 「已保存」) names no item, so it is not write feedback. A Studio row passes only on a toast or inline text naming the item or package. A row whose only feedback is that status scores FAIL. The clause wording is unchanged.

③ studio-authoring.validation-rules-authoring. acceptance[3] no longer names invalid_initial_state, and steps[2] no longer asks for an initial state. A new fixtures.knownGaps[0] says why: Studio's Validations tab has no initialStates input, so the state can only be written through the API. ObjectValidationsPanel.tsx carries no initialStates at base 3718424. The insert-time code is still covered by records-forms.validation-rule-type-matrix variants[0]. This item's history merges its ① and ③ edits into one row.

④ records-forms.bulk-select-all-matching. Adds acceptance[5] (dom oracle), steps[7] (a cap leg of more than 5000 scratch rows through createMany, at most 200 per call) and fixtures.knownGaps[1]. The new clause: past HARD_CAP 5000, the cross-page offer, the all-selected line and the selected count name the cap, for example 「将处理前 5000 条」. They must never present the uncapped total as the set the action processes. The clause is an expected FAIL today. The product defect card is owed, and the seat files it. No existing clause changed.

⑤ platform-core.settings-organization-isolation-and-platform-rung. Adds the item's first negative[]. LOCKED means platform-locked. After steps[2]'s lock, A's organization administrator saving the same key again must be refused, with the value unchanged and the row still locked on re-read. A 2xx is a security FAIL. It is a walled leg, blocked(fixture) when unprovisioned, like acceptance[2] and [3]. steps[2] now drives it. The live measure the ruling asks for was run, and its result went to the seat thread.

Tests

Docs only: no package changed, so no build closure is owed and no package tests run. Local gates on head 5e7c1c9e, with each exit code captured before any pipe:

dispatch-gates --commands (16 families), every one run

0  node scripts/check-adr-links.mjs
0  node scripts/check-adr-links.mjs --self-test
0  node scripts/check-closing-keyword-parity.mjs
0  node scripts/check-closing-keyword-parity.mjs --self-test
0  node scripts/check-comment-mask-corpus.mjs
0  node scripts/ci/plan-test-core-shards.mjs --self-test
0  pnpm --filter @objectstack/lint run check:doc-formula-expressions
0  pnpm check:ci-filter-parity
0  pnpm check:cross-package-test-inputs
0  pnpm check:doc-authoring
0  pnpm check:driver-memory-census
0  pnpm check:gitlink-declared
0  pnpm check:nul-bytes
0  pnpm check:platform-checklist
0  pnpm check:refd-timer-probe
0  pnpm check:watch-hint-literal

--ran reconciliation: ✓ dispatch-gates --ran: 16 derived famil(ies) accounted for — 16 run, 0 NOT-MEASURED (a DERIVED zero — all 16 recorded an exit code and none of them is 3).

check-platform-checklist: OK — 16 areas, 352 items (347 active, 1 planned); coverage: 40 kinds mapped, 3 waived; traps: 19 documented, 19 in use; …

check-platform-checklist --changed-from origin/main: OK — 1 anchored file(s) in the change set, 1 anchor(s) judged, 0 lost.

Acceptance notes

• Left in negative[] on purpose, for the seat to rule on:
  • access-security.platform-owner-email-anchor negative[3] ("out of scope here …"). Its automated.ref cites it by index.
  • approvals.pending-count-surfaces negative[1]. It carries a tracked product defect, objectui#4074, which fits knownGaps rather than a cross-ref.
  • ux-conventions.disabled-control-reason negative[1] and ux-conventions.labels-over-machine-names negative[1]. These are carve-outs of their own criterion rather than pointers to a sibling item.
  • Two retired items: dashboards.report-schedule-dispatch-delivery negative[3] and access-security.packaged-permission-set-lifecycle negative[3]. A retired item never runs.
• The PM census figure of 38 counted every SCOPE: / cross-ref: string in the six files. The records-forms 7 and automation 3, and one of the dashboards 2, are already source[] rows, so there was nothing to move there.
• ② edits acceptance[1].verify only. acceptance[0] ("visible feedback") still lists "an inline status" without excluding the top bar.
• The studio-authoring.expression-editors mechanical fixes (vitest cwd, card refs, record.FORMULA_FIELD binding) are not taken. The census comment does not quote the exact text of its rows, so they stay with the seat's follow-up batch.

Verification

Each moved entry was diffed against its new source[] row: the same bytes apart from the SCOPE: → cross-ref: label. Every history row was checked: one #28345 row per item, equal to revision, citing #27377.

---

🤖 Generated with Claude Code

[objectstack-fleet]

domain:devx#2 · marchtian · session_017ihL2gLghEqeDKTbDTC7Zd

席位核对 — ACCEPT · domain:devx#2 · head 6da28884a6a8a9d0e6480d731532772c6f05d7b8 · 2026-11-01T06:06Z

Checked against GitHub and the PR head, not against the report (os-dev-report 6554058311 and delta 6554156977 on #28345).

• Shape: draft → main, Fixes #28345 once, Ruling-ref: 6545938831, no assignees or reviewers. skip-changeset is correct: docs/qa/platform-checklist/areas/*.json only, no published package.
• Path surface: six area files (+320/−138). check-governed-merges --pr 28551: NOT governed, under the 3000-line threshold.
• Ruling check (6545938831, A ×5), read in the diff: ① 30 scope-note negatives leave negative[] for source[] or knownGaps with their text unchanged, including notification-center neg[3] → source[6], platform-owner-email-anchor neg[3] → source[10] (its automated.ref index follows) and pending-count-surfaces neg[1] → knownGaps[1] (objectui#4074). No RUNNER special case. ② write-feedback acceptance[0] and [1] say the Studio top bar 「已保存」 is not write feedback; the convention's wording stands. ③ invalid_initial_state leaves validation-rules-authoring acceptance, and a knownGaps row says Studio has no initialStates input. ④ bulk-select-all-matching gains acceptance[5] pinning a banner that names the cap, with the product card grid: "select all matching" banner counts every match, but the bulk action processes only the first 5000 #28552. ⑤ the settings isolation item gains negative[0]: LOCKED = platform-locked, so an org admin's save must be refused. Each edited item takes revision +1 and one history row; main's history is kept as a prefix.
• Gates: 16 derived families exit 0 on the head, --ran 16/16; check:platform-checklist OK (16 areas, 352 items, 0 anchors lost). Every check-run on this head is green or skipped.
• Accepted deviations, and where the PR body is stale: the body predates the rework round. Read it with these corrections. The two "left in place" bullets for platform-owner-email-anchor and pending-count-surfaces are superseded, because both moved. The write-feedback acceptance[0] bullet is superseded, because that clause now carries the exclusion. ① covers 30 items, and ④'s card is grid: "select all matching" banner counts every match, but the bulk action processes only the first 5000 #28552. Left on purpose: the two ux-conventions carve-outs (they qualify their own criterion) and the two retired items. The expression-editors mechanical fixes were not taken, because the census quotes no confined text.
• Out of scope: a README or checklist-author closed-format note was dropped as unruled scope. ⑤'s follow-up stays with the seat and the maintainer.
• Landing: non-governed. The seat lands once every check on this head is green (standing rule: threads may merge their own PRs once CI is green).