docs(qa): unblock 4 fixture-blocked checklist items and re-point the clauses run 21845 found mis-asserted (#21891)

Closes #21851

Checklist-only change: five area files under
`docs/qa/platform-checklist/areas/`. There are no product, script or
`.changeset` edits, because `docs/qa/**` is not published. Follow-up run
#21845 built two fixtures, a wall-clock offset shim and a local OIDC
provider. They go into item text as recipes and are not committed as
code. Each revised item bumps `revision` and gets a `history` entry that
cites the run. Entries 1-10 cite #21845. Entry 11 cites the #21782
re-run, which is where its evidence comes from.

## Entry → item → what changed

| # | item | rev | change |
|---|---|---|---|
| 1 | `approvals.quorum-m-of-n` | 3 → 4 | `blocked` removed.
`fixtures.requires` gains the runtime fixture: Ada bound to `finance`
via `POST /api/v1/data/sys_user_position`, a third signed-up holder
bound to `legal`, `showcase_expense_signoff` disabled via `POST
/api/v1/automation/showcase_expense_signoff/toggle {"enabled":false}`
(otherwise `DUPLICATE_REQUEST`), and a fresh request (draft report + one
6000 line + PATCH `submitted`). The seed-gap knownGap is kept and marked
CLOSED-for-runs. Steps open a fresh request and add a repeat-actor probe
|
| 2 | `approvals.sla-escalation` | 2 → 3 | `blocked` removed.
`fixtures.requires` gains the offset-shim recipe
(`NODE_OPTIONS=--require`, `Date`/`Date.now` offset read from a file,
`Date.prototype.constructor` set to the wrapper, timers untouched).
Flows are registered with `POST /api/v1/automation`, one per action, and
no writable package is needed. The item names the 5-minute sweep
(`ESCALATION_SCAN_INTERVAL_MS`) and the boot catch-up sweep |
| 3 | `identity-auth.linked-accounts-social` | 2 → 3 | `blocked`
removed. `fixtures.requires` gains the local auth-code + PKCE OIDC
provider registered through `applyConfigPatch({oidcProviders:[…]})` from
a scratch app plugin (`auth:configure` fires too early), which must be
up before the first auth request. Step 2 links through the authenticated
`POST /api/v1/auth/link-social` and navigates to the returned URL. The
nav label is "Linked Accounts" (Account app, `nav_account_linked`). The
item no longer names the `sys_account` link action anywhere (see notes).
The unlink, mine-view and read-only clauses are unchanged |
| 4 | `records-forms.import-job-undo-cancel` | 2 → 3 | `blocked`
removed. The stock console already meets the client gate at console pin
`2e818d0b51ec`. The fixture runs objectui `import-console-undo.spec.ts`
with `IMPORT_CONSOLE_LIVE=1` from a scratch copy whose goto path is
`/_console/apps/{app}/{object}`. The API half names the
`/api/v1/data/import/jobs` routes. `revertedAt` is absent, not null,
until a job is reverted (acceptance[0], acceptance[3] and step 4) |
| 5 | `approvals.quorum-m-of-n` negative[0] | (rev 4) | Requires a
NON-PRIVILEGED repeat actor. An admin decision is the documented
override (#3424, `via_override:true`) and finalizes by design |
| 6 | `approvals.quorum-m-of-n` acceptance[2] | (rev 4) | Asserts that
the run goes paused → completed and the request is rejected. The reject
edge is not observable because end nodes log no step |
| 7 | `approvals.quorum-m-of-n` acceptance[3] (+ [4], step 9) | (rev 4)
| The inbox tab is "My Pending" (English console). The drawer tally is
the "Approvals — x of y" line, and the "(2 of 3)" subtitle is static
flow text |
| 8 | `cli.scaffold-first-run` step 2 /
`cli.scaffold-console-first-paint` step 1 | 2 → 3 / 2 → 3 | **Option
chosen: drop the trailing `npm install`.** The scaffolder installs
itself (pnpm when found, npm otherwise), and its exit code is now the
install evidence |
| 9 | `cli.scaffold-first-run` fixtures + acceptance[3] | (rev 3) |
Pre-release variant: pack to a localhost registry with no upstream for
`@objectstack/*` and `create-objectstack`, run the repo's bin, and prove
the candidate via lockfile integrity. The published path measures only
what is released. The "installed set" is unique skill names |
| 10 | `cli.scaffold-console-first-paint` acceptance[3] | (rev 3) |
States the limit: a blank scaffold ships no app or action, so the
action/nav half is not-applicable and never a FAIL. The record-create
half is still scored. Points to `studio-authoring.first-run-loop` and
says that it covers the app/nav half but not an action |
| 11 | `i18n.surface-matrix` / `i18n.studio-follows-app-locale` | 4 → 5
/ 3 → 4 | The switch steps say "use the avatar-menu language switcher
(it writes the user's locale); seeding browser storage alone is not a
language switch". The studio item's switch-back step uses the same
switcher |

## Notes on judgement calls

- **Entry 8, why "drop the step".** It is the least ambiguous of the
three options. It does not depend on the host's package manager, as
`pnpm install` would, and it keeps the published scaffold command and
the quick-start (which prescribes no install) unchanged, which
`--skip-install` would not. It is also what the published canary job in
`scaffold-e2e.yml` does: it scaffolds `@latest` and then runs
validate/build with no separate install.
- **Entry 3, the link action.** Per the claim, the item references only
the authenticated link door and never the `sys_account` link action. To
keep that true throughout, the provider-less clause (acceptance[3]), its
negative (negative[3]), the degradation step and the
`sys-account.object.ts` source note now say "the link affordance"
instead of naming the action. The clause meaning and indices are
unchanged, so the run's `Extracted:` lines still point at the same
clauses. #21849 remains open and owns that action.
- **Entry 4, the create path.** The card groups "create" under
`/api/v1/data/import/jobs`. The route ledger has create at `POST
/api/v1/data/:object/import/jobs` and everything else under
`/api/v1/data/import/jobs`, and the item states it that way.
- **Entry 7, the drawer half.** The drawer-tally wording landed on
acceptance[4] (the drawer-tally clause) and on the screenshot step.
acceptance[3] carries the inbox half.

## Validation (head `4f0fb3a8e0`)

- `pnpm check:platform-checklist` → exit 0: `OK — 15 areas, 270 items
(266 active, 2 planned) … symbol anchors: 657/667 resolved` (baseline on
`e864db56df`: 653/663; the 4 new anchors all resolve).
- `node scripts/pm/dispatch-gates.mjs --commands` derived 13 families.
All 13 ran to exit 0, and `--ran` reports `13 run, 0 NOT-MEASURED (a
DERIVED zero)`. `check:doc-formula-expressions` first exited 3
(PREREQUISITE NOT MET, unbuilt
`@objectstack/formula`/`@objectstack/lint`) and exited 0 after building
them.
- `node scripts/checklist-select.mjs` resolves each of the four
unblocked items as `1 runnable item(s)`.

## Acceptance notes (seen while editing, not changed here)

- `cli.scaffold-first-run` acceptance[1] still says "each of the six
templates" while `variants` is `["blank"]`. This is stale wording. The
person who next edits that item takes it on, and no card is filed.
- `i18n.surface-matrix` `variants` still reads "view empty states …
blocked(fixture): no showcase view authors one", although rev 4 made
that variant runnable. #21782 already raised this for the checklist
owner.
- Run #21845 noted that `pending_approvers` is not de-duplicated when
one person holds several routed positions, so the drawer's
eligible-approver count can read high before the first vote while the
tally stays correct. The run did not extract this, and it is not
asserted here.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01VDtqoecgES7ScQYGbFVDRv)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]