Skip to content

QA run · surface:mixed (86/86) · 316be321 · 2026-10-04 · 57 PASS / 5 PARTIAL / 24 FAIL / 0 BLOCKED / 0 NOT-RUN #21784

Closed
Closed
QA run · surface:mixed (86/86) · 316be321 · 2026-10-04 · 57 PASS / 5 PARTIAL / 24 FAIL / 0 BLOCKED / 0 NOT-RUN#21784
Labels
qa-run

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 5, 2026

17.7 pre-release verification, mixed half: every runnable surface:mixed item (API truth plus a console surface) against origin/main as it stood when the browser run started, with the Console built from the bumped pin (#21710). 17.7 is not cut yet; packages still read 17.6.0. The non-browser half is #21720 (subject 251a7dd4); the surface:browser record for this same subject is #21782. Text only: screenshots were consulted live as oracles and are not attached. The durable truth stays in docs/qa/platform-checklist/areas/.

Environment fingerprint

  • Framework (subject): objectstack-ai/objectstack 316be321 (fix(runtime)!: an app-authored body may not read the stored-metadata tables; it reaches them through the metadata API only (#21594) (#21660)), in a dedicated detached worktree; framework and console built, smoke boot health 200 / /_console 200. fix(metadata-core): the object-schema field mask also removes a denied field's references from the served document (ADR-0106 D1) #21743 (object-schema mask references) merged after this subject and is not in it.
  • Console: built from objectui pin 2e818d0b51ec (.objectui-sha, chore(objectui): bump the console pin to 2e818d0b51ec (carries objectui#11466, #11574, #11578, #11581 and #11583) #21710); every lane checked the dist stamp against the pin. Console source questions were read at that revision. For the "predates 17.6.0" notes the references are framework 617f25f8a (17.6.0) and objectui pin 31971ff1e.
  • Checklist: items, RUNNER.md and scripts/checklist-select.mjs from the subject tree; every item's revision is in the table and matches areas/*.json.
  • App / boots: examples/app-showcase, OS_PORT={p} objectstack dev [--ui] --seed-admin -p {p} -d file:/tmp/qa1770fe/{lane}/{item}.db, one file DB per item, per-lane port ranges 44701–45709 (egress proxy port 41333 excluded). Browser: Playwright on /opt/pw-browsers/chromium. Members minted by admin invite-member + sign-up/email (plus accept-invitation where an org-admin grade was needed) or admin/create-user; identity proved with GET /auth/get-session before each persona cell. Scratch fixtures were authored at runtime in the item's own DB or in a scratch copy of the showcase under /tmp (capability declarations, wall-posture boots, job / connector probes); nothing was written into the subject tree.
  • Deviations, stated:
    • Rate-limit re-run. Lanes FE15 and FE16 and verifier VF3 were interrupted once by an API rate limit (~18:06Z) and re-run from scratch on fresh DBs (r2) from 23:57Z. Only the re-runs count; the partial first outputs were discarded.
    • Midnight crossing. The FE15 and FE16 re-runs crossed UTC midnight; every date-window and retention expectation was derived from one recorded instant (lifecycle clock 2026-10-05T00:39:33Z; FE16 windows computed against 2026-10-05).
    • Non-default boots, per item: OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true (time-relative, trigger-type schedule leg, job-scheduled-run, notification-center), OS_LOG_LEVEL=info (hook lines, lifecycle sweep), NODE_ENV=production for the no-SMS phone-OTP variant, OS_AUTH_AUDIENCE_POSTURE=open for email verification, walled tenancy postures from a scratch copy. One 17.6.0 control boot (scratch DB) classified the field-reorder defect as pre-existing.
    • Extra repro boots. FE7 and FE12 re-reproduced their fails on second fresh-boot DBs. One FE13 boot shifted 45304 → 45305 (in range).
  • Execution: ten parallel runner subagents (FE7–FE16) and independent verifiers VF1–VF5 (RUNNER rule 7), Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-04 15:32Z – 2026-10-05 ~00:45Z. Concurrency was capped at three lanes (maintainer order), verifiers counted as lanes. Tier-1 pins that live in this repository were run first and are cited in the table; items whose automated.ref lives only in objectui were driven by hand.

Scope

node scripts/checklist-select.mjs surface:mixed --json → 86 runnable items, all 86 judged. Hidden as blocked (not run): identity-auth.linked-accounts-social, records-forms.import-job-undo-cancel. Two planned items matched and are recorded as planned (not driven, not in the title's counts): records-forms.picklist-shared-across-objects (rev 1), records-forms.picklist-org-append (rev 1).

item rev verdict evidence (server truth / browser / pin)
access-security.record-access-explain 2 PASS explain panel layers, verdict and contributors equal POST /security/explain for auditor (visible, vama_bypass) and plain member (invisible, sharing); GET twins agree; permission-zoo pin in 26/26
access-security.readonly-package-locks-studio 3 FAIL A3: POST /packages/com.example.showcase/duplicate → 422 DUPLICATE_SOURCE_NOT_A_BASE by design (#14451) — stale clause; A1 168/168 controls disabled, A2 403 NOT_OVERRIDABLE / ITEM_LOCKED, A4 byte-identical
access-security.fls-mask-and-strip 3 PASS contributor field-write 403 on budget, admin 200; liaison by-id / list / select strip budget keys, Financials section absent; pins 26/26. The known-open #21723 residue was observed and not scored (#21743 merged after this subject)
access-security.audit-log-browser 3 FAIL A1 / A5: the delete row is served to the admin, who now holds view_all_audit_log (7ebb543, #21296, after 17.6.0) — stale clause; withheld from a promoted org admin as intended; A2–A4, A6 pass (405 on POST/PATCH/DELETE)
access-security.owd-save-gate 3 PASS Studio panel + publish dialog refuse ext-wider OWD; active PUT 422 security-external-wider-than-internal; packaged widening 403 owd_widening_forbidden; object byte-identical
access-security.public-form-intake 2 PASS re-judged fresh after #21420 / #21473 / #21566 / #21580: four declared fields only, forged anchors / status / source dropped, anonymous /_console/f/contact-us submit 201, env and org withdrawals 404; corroboration pins 20/20 + 39/39
access-security.sharing-rule-authoring-ui 2 PASS POST /sharing/rules 201; criteria-less 400; share row source:rule = rule id; audience 404 → 200, outsider 403; delete 204 removes shares; Setup list 2 → 3 → 2
access-security.permission-matrix-edit-loop 3 FAIL A2: the console cannot save a writable permission set (two fail-closed lock shapes, product defect); the same edit via ?mode=draft + publish enforces (A3–A5 pass, off → on → off measured)
access-security.capability-declaration-lifecycle 3 PASS declaration lands with fallbacks; /actions dispatcher AND gate 200/403 for holder / member; REGRANT on an org clone; platform-name shadow refused with a named WARN; malformed declaration rejected at load
access-security.packaged-permission-set-lifecycle 1 FAIL A6: the Setup edit of a packaged set shows "You don't have permission to save this record." instead of the clone-path refusal (product defect); A1–A5 pass; lock pins 22/22
api-backend.formula-stdlib-matrix 1 FAIL A6 known expected-fail #3306 (unregistered sqrt saves 200, reads null, nothing logged); A1–A5 pass: 27/27 stdlib answers, reference-timezone day trio, sharp edges, live read path
approvals.decision-action-matrix 3 PARTIAL A10 blocked(fixture: no org-less request can be provisioned; pin #12769 6/6); one timeline row per decision, revise limit auto-rejects, lockRecord 409, throttle 429
approvals.dynamic-approver-routing 2 PASS Next Reviewers is a sys_user picker; empty outputs 400; stage-2 slate equals the picked ids in order; both co-sign runs complete
approvals.ooo-delegation-reroute 4 PASS delegation reroutes to B with an ooo_substitute row; B approves as themself (acted_as); expired window routes back; forged delegator 403
attachments-storage.download-authz-both-sides 3 PASS anonymous 401, member 403 (ATTACHMENT_DOWNLOAD_DENIED / FILE_DOWNLOAD_DENIED), owner and granted member 200; public_read flip 302 → bytes and back; panel copy mapped; pins 27 + 1 skip
automation.flow-run-step-nesting 4 FAIL A2: send_reminder nests under the guard_reminder try_catch (regionKind:'try'), which itself carries the loop-body tags (#13681 / #14394) — stale clause; A1, A3–A6 pass
automation.time-relative-trigger 2 PASS with OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true: bound-sweep log line, one run per matching task with trigger.type time_relative, non-matching rows never fire, both-modes descriptor 422
automation.rollup-summary-filter 3 FAIL A5: duplicate of the code showcase package refused 422 DUPLICATE_SOURCE_NOT_A_BASE (#14451) — stale clause; the visual filter editor proven on a scratch writable package; A1–A4 recompute exactly
automation.flow-node-type-matrix 3 FAIL A1 / A2: start / end are structural (no executor, no palette entry; end logs no step) — assertion defect; 20/21 variants executed; suspending types park and resume; unknown type late-bound
automation.trigger-type-matrix 1 FAIL A1: trigger.type records the launch event (manual for on-demand autolaunched and screen runs) — assertion defect; A2–A6, N1–N2 pass; trigger-conformance pin 2/2
automation.flow-error-handling 3 PASS try_catch catches, four retry attempts with ≥ 1+2+4 s backoff, task stamped sync_status=failed; unhandled trigger-fired failure logs the loud ERROR
automation.connector-dispatch-matrix 2 PASS registry lists rest / slack / declarative / MCP instances; rest, declarative and MCP dispatch outputs; unknown connector NODE_FAILURE naming the handler
automation.flow-runs-page-test-trigger 1 PASS runs-page trigger and resume round-trip; FlowRunner dialog over the page; dismiss leaves the "Continue run" banner
cli.scaffold-first-run 2 PASS published create-objectstack@latest (17.6.0): validate / build exit 0, os start ready 200, skills catalog 10/10 with no internal skills (measures the released scaffolder, not the unpublished 17.7 subject)
cli.scaffold-console-first-paint 2 PASS fresh scaffold: os dev --ui and npm run dev both serve /_console/ 200 (18469 B); seeded-admin sign-in → Home; Studio record create 201 (published 17.6.0 scaffolder)
dashboards.strict-widget-rejects-stray-keys 2 PASS 11 legacy keys + stray / wrong-layer keys 422 at widgets.0 with the prescription; nothing half-saved; corrected widget renders the dataset's counts
dashboards.dataset-report-authoring 1 PASS dataset-bound dashboard round-trips; summary / matrix / joined / chart reports equal the dataset aggregate per cell; joined block type refused 422; designer pin 3/3
dashboards.empty-null-bucket-boundaries 1 PASS empty window renders designed empty states and 0 KPIs equal to replayed queries; 3 month buckets; NULL group bucket 3; A6 single-datapoint (noted weak); parity pins green
dashboards.system-overview-live-counts 1 PASS Total Users 3 and Active Sessions 5 equal direct counts; gated tiles absent, not empty; member 403 on the setup app (A2 passes; its clause text is stale, see accuracy)
i18n.strict-translation-key-rejection 2 PASS 10 variants × 2 modes 422 with key echo and did-you-mean; spec builders throw the same; valid sibling never half-saved; zh-CN label renders in the console
identity-auth.auth-method-matrix 3 FAIL A4: production phone OTP without SMS → 500 empty body (product defect); A10 delete-user 404 by the 2026-08-12 ruling (stale clause); A1 SSO / device variants blocked(fixture); N3 blocked(dependency, objectui#4179); OIDC + 2FA pins green
identity-auth.invitation-scope-gates 3 FAIL A5: a plain member is offered Invite User / Add Member, the server refuses 403 (product gap, UI courtesy only); A1–A4, A6–A7, N1–N3 pass; delegated-admin pin green
identity-auth.admin-lifecycle-operations 6 PARTIAL A4–A6 blocked(dependency: ruled not-built, #9968 / #9969 — the admin gets the ruled 403); N3 not-run; ban, set-password, create-user, impersonation + banner, non-admin refusals pass; four admin pins green
identity-auth.session-list-revoke 2 PASS owner-scoped list (API = Account › Active Sessions); revoke-session kills exactly one; revoke-other keeps the caller; admin All tab with revoke metadata; sys_session 405 on writes
identity-auth.api-key-ui-lifecycle 1 PASS secret shown once (201 osk_…, never re-served); key authenticates as its owner; revoke / restore immediate; mine-view scoping; owner cannot rewrite key or prefix
identity-auth.self-service-profile-password 1 PASS rename persists; avatar is a real storage write and removal clears it; password change verifies current; wrong current 400; passwordless user gets set-initial (409 when already set)
identity-auth.org-membership-team-management 3 FAIL A5 / N2 authorization class, detail withheld pending maintainer (RUNNER rule 2); A7 / N1 UI half: a plain member sees Invite User / Add Member / Create Team, the server refuses 403 (product gap); A1–A4, A6 pass
identity-auth.teams-bu-membership 2 PASS team membership idempotent; BU tree nesting renders; BU placement widens and re-parenting narrows reads; non-admin refused on every door
identity-auth.oauth-app-consent-loop 2 PASS off boot fully dark; client secret shown once; consent screen; code → tokens; same-scope re-authorize skips consent; new scope forces it; deny leaves consents unchanged; cross-user consent reads refused
identity-auth.identity-import-wizard 2 PASS invite policy mails, temporary-password policy reveals once, both sign in; re-import updates 2 / creates 0; no plaintext one-time password in rows, audit, DB file or log; member 403
identity-auth.first-run-owner-bootstrap 1 PASS bootstrap-status false → true; wizard owner is platform_admin + org_owner on a sign-up-disabled boot; one org with the typed name; later forges refused at both doors
identity-auth.self-signup-gate 2 FAIL A4: the login card still links "Sign up" on an OS_DISABLE_SIGNUP boot (product defect, objectui; the server gate holds); A1–A3, A5 pass
identity-auth.email-verification-loop 2 FAIL A3: the console verify page POSTs and gets 404 (the route is GET-only); the mailed GET link verifies — product defect (objectui); A1, A2, A4–A6 pass
identity-auth.workspace-org-switch 1 FAIL A6: a forged set-active is refused 403 but clears the active org to none (vendor behaviour, fails closed) — assertion defect; A1–A5 pass on wall-posture scratch boots
integration-system.webhook-lifecycle 5 PASS materialized row; one delivery per record event; bulk envelope; header + HMAC + timeout; redeliver replays the signature byte-for-byte with its refusals; admin edits survive reboot; pins 1 + 14 + 8
integration-system.job-scheduled-run 3 PASS interval / cron(tz) / once jobs fire with run rows; retry backoff 1 s, 2 s; timeout status; missing handler WARN; build-time id / cron refusals; meta door 403, data door 405
integration-system.email-template-render 5 FAIL A6 / N1: a template saved through PUT /meta/email_template reverts to the package wording on the next boot (product defect); A1–A5, A7–A8 pass; materialization pin 2/2
integration-system.notify-inbox-delivery 2 PASS recipient-only inbox row with actionUrl; others empty; read / read-all with receipts; unregistered push refused loudly; schema pin 19/19
integration-system.notification-preference-suppression 1 PASS muted row suppresses inbox and delivery rows; unmute delivers; user row beats global; mandatory topic delivers despite a mute; template rendering applied
integration-system.datasource-credential-refusal-matrix 2 PARTIAL A2 / A7 blocked(environment: no Postgres / MySQL / Mongo to connect to); inline-credential doors refused at build and at runtime, every read door redacts, member 403, anonymous 401
integration-system.external-schema-browser-ui 1 FAIL A2 / A4 / A5 / N1 / N5: the console panel reads the un-unwrapped envelope — empty table list, no snapshot time, validation TypeError (product defect, objectui); A3: import under a new name answers 500 "no such table" and is lost on restart (product defect); A7 blocked(fixture)
platform-core.boot-health 6 PASS health 200 (57.7 s cold), ready 200, flow / seed summary with only the two policy-disabled schedule flows warned, 0 ERROR; nav objectNames equal the authored 12
platform-core.metadata-authoring-roundtrip 2 PASS draft in a writable package → _drafts → publish-drafts → served and rendered; read-only package 422; packaged object 403; invalid body 422 and not stored; pin 5/5
platform-core.settings-hub-roundtrip 3 PASS tenant timezone write re-buckets analytics; audit row; badges; env lock 409; secrets encrypted at rest and masked on read; mask echo is a no-op; 11 namespaces; settings pin 26/26
platform-core.package-lifecycle-enable-disable 1 PASS disable withdraws data / object / app, enable restores (rows 3 = 3); delete removes registry entries; commit + revert; code packages 422
platform-core.notification-center 1 PASS badge = 1 notification topic + 3 pending approvals; grouped row expands; one group mark-read POST; mark-all leaves approvals; state survives reload
platform-core.app-management-toggle 1 FAIL A6 / N1: the page has written through PUT / DELETE /meta/app since objectui 3b7d1cc6d7 (#4233 / #4300, before the 17.6.0 pin) — Disable / Set default on a code-package app answer 403 with an error toast — stale clause (VF5); A1–A5 pass
platform-core.interrupted-migration-boot-report 2 PASS second boot names the interrupted run and the resume command, changes nothing (journal byte-identical), silent once done; recovery pin 11/11
platform-core.lifecycle-retention-sweep 1 PASS sweep reaps the 5 terminal runs and keeps the 2 non-terminal; archive-pending retained; kill switch silences it; lifecycle classes match; pin 110/110 (clock recorded once at 00:39:33Z)
records-forms.field-type-matrix 2 FAIL A4 / N3 authorization class, detail withheld pending maintainer (RUNNER rule 2); A1–A3, A5–A7 pass: every zoo type renders its widget, objectui#11448 fixed (f_json round-trips as JSON); zoo pins 104/104
records-forms.conditional-rules-header 2 PASS requiredWhen / readonlyWhen / visibleWhen agree client and server (Issued On required on sent, tax_rate readonly on paid, Edit disabled and no Delete on paid)
records-forms.cascading-options 2 FAIL A3: the gate predicate names org_admin and the seeded admin is org_owner — invalid pairing; both sides hold for a real org admin and a member; A1, A2, A4, A5 pass
records-forms.action-param-widgets 2 PASS every param renders its widget with real accept / multiple attributes; bad option 400; required param blocks the dialog and the API; params pin green
records-forms.concurrent-edit-conflict 2 PASS stale If-Match 409 CONCURRENT_UPDATE; form and inline conflict dialogs; reload discards, overwrite retries with the 409's version; one shared inline PATCH
records-forms.object-hook-lifecycle 3 PASS defaults, trims, conditional info / warn lines (needs OS_LOG_LEVEL=info), abort hook 400 with no row, log-policy hook suppressed, runtime-faulting condition aborts, priority order
records-forms.field-type-constraints 1 PASS max_length / min / max / invalid_number / invalid_option / invalid_type / reference_not_found; autonumber and formula writes dropped; summary self-heals (A3 currency rounding gap recorded)
records-forms.cascading-multilevel-and-clear 1 FAIL A4: switching the invoice account keeps the old account's contact, and the mismatched pair saves (product defect, objectui); A1–A3, A5–A6 pass (A3 / A5 gaps recorded)
records-forms.encrypted-field-behavior 1 FAIL N1 authorization class, detail withheld pending maintainer (RUNNER rule 2); A1–A5, N2–N4 pass (ciphertext at rest, masked reads, sentinel PATCH keeps the handle; secret-fields pin green)
records-forms.field-group-visible-when 1 FAIL A1: runtime metadata serves the bare string as authored — assertion defect; A4: the form gates the group, the record detail page does not (product defect, objectui); A2, A3, A5 pass; N3 not-run
records-forms.field-history-tracking 1 PASS tracked change writes the old → new summary; untracked writes the generic summary; History tab and history op only on the tracked object; audit pins 30/30
search.pinyin-flag-both-sides 3 PASS ON: full pinyin, initials and hanzi hit display fields only; OFF: latin pinyin 0 hits and no product mention; roster differs by the one plugin; backfill on first boot
search.freshness-and-empty 1 PASS create / rename / delete visible to the next query within 0.3 s; same-save pinyin companion; no-hit 200 empty; designed empty state in the list
search.console-global-search 3 PASS ⌘K / Ctrl+K / header / deep links open the palette; searchAll hits grouped by object; Enter navigates; recents with 0 requests; member gets no hidden-row hit or count; /search page agrees
studio-authoring.first-run-loop 3 PASS wizard package → object → record → app in one boot; forged writes into the code package refused (422 / 403)
studio-authoring.object-designer-roundtrip 2 FAIL A1: a field reorder publishes as a silent no-op (200, same hash, draft dropped) — product defect, also on 17.6.0; picklist rename, API-name derivation and option trimming pass
studio-authoring.view-authoring-live 2 PASS draft invisible to end users; publish changes columns and form section in one boot; re-publish reorders headers
studio-authoring.record-page-roundtrip 3 PASS record page draft seeded from the default layout; Card block added and published; renders for admin and the auditor persona
studio-authoring.draft-publish-lifecycle 4 PASS draft / publish / stale If-Match 409 / publish-drafts / abort refusal / history / diff / rollback / audit actor (X-Actor ignored); designer pin 3/3
studio-authoring.authoring-validation-not-persisted 3 PASS invalid object and container view refused 422 with located issues; nothing persisted as active or draft; corrected bodies save
studio-authoring.expression-editors 2 PARTIAL A8 blocked(environment: the pin lives only in objectui); A1–A7 editor tiers, inferred types and test-run results equal the engine's verdicts
studio-authoring.permission-matrix-editor-ux 2 PASS matrix editor clauses pass; the permission-set lock (the product defect under permission-matrix-edit-loop) reproduced and was worked around
studio-authoring.custom-page-render-and-blocks 1 PASS custom page renders its blocks (condensed lane result)
studio-authoring.page-variables-and-actions 1 PASS page variables and actions behave as declared (condensed lane result)
studio-authoring.custom-page-source-tiers 1 PASS every source tier renders (condensed lane result; step 8 wording noted)
studio-authoring.metadata-diagnostics-sweep 1 PARTIAL A7 blocked(fixture); the other clauses pass (condensed lane result)
studio-authoring.doc-on-app-menu 1 PASS gated / open nav pruning per persona equals the API; claiming-book landing; outsider gets the refusal heading on all 8 gated routes (server 403); unknown doc 404
records-forms.picklist-shared-across-objects 1 planned not driven (status planned: no steps, no acceptance to consult)
records-forms.picklist-org-append 1 planned not driven (status planned: no steps, no acceptance to consult)

Totals: 57 PASS / 5 PARTIAL / 24 FAIL / 0 BLOCKED / 0 NOT-RUN (plus 2 planned). Of the 24 fails, 14 carry a product defect (12 distinct defects in the open, two authorization-class defects withheld), 9 are checklist clauses whose assertion is wrong, stale or paired with the wrong persona, and 1 is a known expected-fail. Every fail was re-derived by an independent verifier; where a verifier changed a disposition, the verifier's is recorded (VF4 re-classed readonly-package-locks-studio A3 from assertion defect to stale clause; VF5 confirmed app-management-toggle A6 / N1 stale).

Fails — reproduction rules and dispositions

Product defects

access-security.permission-matrix-edit-loop A2 {m05} — the console cannot save a permission set an admin is entitled to edit (fails closed).

  • (1) POST /api/v1/packages {"manifest":{"id":"com.fe7.perm2","name":"P2","version":"0.1.0","type":"app"}} → 201; PUT /api/v1/meta/permission/perm2_c6?package=com.fe7.perm2 {"name":"perm2_c6","label":"x","objects":{"showcase_task":{"allowRead":true}}} → 200 twice; GET /api/v1/meta/permission; repeat the PUT → 403 NOT_OVERRIDABLE "… declared by package 'com.fe7.perm2' and is locked" (draft PUTs too). Any Studio page load issues that list read, so a Studio visit locks every set in the package.
  • (2) POST /api/v1/data/sys_permission_set {name:'fe7_orgset2',…}; GET /meta/permission/fe7_orgset2?layers=true serves the env projection as the code layer with no provenance; /_console/apps/setup/metadata/permission/fe7_orgset2 shows "Locked: a code package provides this permission set" while the server says editable:true and a plain PUT answers 200. The same lock reaches a "Clone to customize" clone.
  • Root cause (VF2): the list read hydrates the overlay with _packageId (protocol.ts:9223, :17108, :8819) and declaredPackageIdOf (packaged-permission-set-lock.ts:150-161) ignores the row's org provenance; the projection echo is served as the code layer (permission-set-projection.ts:737-741, protocol.ts:10036-10049), which objectui PermissionMatrixEditor.tsx:174-183 reads as artifact-backed.
  • Predates 17.6.0. Verifier VF2: CONFIRMED, P2. Related, not the same: [finding] lock family, package axis: a read naming a package serves that package's row and reports its lock, while the _lock gate's overlay read selects without a package #21761.

access-security.packaged-permission-set-lifecycle A6 {m06} — Setup → Permission Sets → Showcase Contributor → Edit → change Description → Update: PATCH /api/v1/data/sys_permission_set/{id} → 403 NOT_OVERRIDABLE "… Clone it instead (the "Clone" action …)" with no userMessage; banner and toast read "You don't have permission to save this record." Expected: the clone-path sentence.

identity-auth.auth-method-matrix A4 {m03} — boot NODE_ENV=production OS_AUTH_PHONE_NUMBER_ENABLED=true with no SMS provider; POST /api/v1/auth/phone-number/send-otp {"phoneNumber":"+15551230002"}. Expected a 4xx naming NOT_SUPPORTED; actual 500, empty body (the code appears only in the log). /auth/config correctly withholds phoneNumberOtp.

identity-auth.invitation-scope-gates A5 / identity-auth.org-membership-team-management A7 + N1 (UI half) {gap-invite-affordance} — a plain member (invited, accepted, GET /meta/app = [showcase_app, account]) who types /_console/apps/setup/sys_invitation gets "Invite User" with a working dialog (Owner / Admin / Delegated Admin / Member); on /_console/apps/setup/sys_organization/record/{orgId} the Teams tab offers "Create Team". Confirm → 403 from the server, which holds every gate. UI courtesy only, not an authorization hole.

  • Root cause (FE8, VF1): invite_user (and the org-management actions) in packages/platform-objects/src/identity/sys-invitation.object.ts, sys-member.object.ts, sys-user.object.ts are gated only by requiresFeature:'organization'; the platform cannot express the gate, because membership grades are not on the capability channel (ADR-0108) — a platform gap.
  • Predates 17.6.0. Verifier VF1: CONFIRMED, low.

identity-auth.self-signup-gate A4 {o-signup-link} — boot OS_DISABLE_SIGNUP=true (/auth/config emailPassword.disableSignUp:true); open /_console/login in a fresh context. Expected no register link; actual "Don't have an account? Sign up" → /_console/register (3 contexts, 2 boots). The /register bounce and the server gate hold.

  • Root cause (VF1): objectui LoginPage.tsx:299 passes registerUrl={signUpDisabled ? undefined : registerUrl} and packages/auth/src/LoginForm.tsx:147 defaults registerUrl = '/register', so undefined restores the link.
  • Predates 17.6.0. Verifier VF1: CONFIRMED, low. Owner: objectui.

identity-auth.email-verification-loop A3 {o-verify-email} — open posture; sign up; read the token from sys_email.body_text; POST /api/v1/auth/verify-email {"token":…} → 404, and /_console/verify-email?token={valid} renders "Verification failed: 404" with the account still unverified. The mailed GET /api/v1/auth/verify-email?token=… link verifies (302, then emailVerified:true).

  • Root cause (VF1): objectui apps/console/src/pages/auth/VerifyEmailPage.tsx:47-62 POSTs; better-auth 1.7.3 declares /verify-email GET-only (and the route ledger lists only GET). The clause also names the non-existent POST variant (see accuracy).
  • Predates 17.6.0 (better-auth 1.7.3 at both). Verifier VF1: CONFIRMED, low. Owner: objectui.

studio-authoring.object-designer-roundtrip A1 {m04} — PUT /api/v1/meta/object/{ns}_order_probe?mode=draft&package={pkg} with fields:{alpha,beta}, publish; PUT again with fields:{beta,alpha} (?state=draft reads beta, alpha); POST …/publish → 200 "Published draft" with the same version hash; GET → alpha, beta. The designer's drag-reorder takes the same path (2 UI repros, 2 API repros).

  • Root cause (VF2, FE10): the content hash is key-order-insensitive (canonicalize.ts:8), so SysMetadataRepository.put() skips an equal hash and promoteDraft drops the draft (sys-metadata-repository.ts:537, :620, :886), although field order is meaningful (object.zod.ts:1080-1084).
  • Predates 17.6.0 (reproduced on a 17.6.0 617f25f8a control boot). Verifier VF2: CONFIRMED, P2.

records-forms.cascading-multilevel-and-clear A4 {o-cascade-lookup} — /_console/apps/com.example.showcase/showcase_invoice → New → Account Northwind → Contact "Prospect 18" (a Northwind contact) → switch Account to Contoso (pick, or remove the chip then pick) → Status Draft → Create. Expected the contact to clear; actual the chip stays and the API reads account:{Contoso}, contact:{a Northwind contact} (the server gate checks existence only). Candidate requests are correctly account-scoped (26 vs 2).

  • Root cause (VF3): objectui components/src/renderers/form/form.tsx:1982-2045 — the only cascade-clear effect skips non-option widgets (no lookup in CASCADE_OPTION_WIDGET_TYPES, :2004); fields/src/widgets/LookupField.tsx:640-654 only re-scopes the query.
  • Predates 17.6.0 by code. Verifier VF3: CONFIRMED by code, P2. Owner: objectui.

records-forms.field-group-visible-when A4 {o-detail-visiblewhen} — scratch object with a fieldGroups[] "Pro details" group, visibleWhen on kind == 'pro' (both bare and envelope forms); rows with kind=basic and kind=pro; open /_console/apps/com.example.showcase/qa_group_gate4/record/{id}. Expected the section hidden for basic; actual it renders for both. The form now gates it live (the clause was authored as an expected-fail; the form half is fixed at this pin).

  • Root cause (VF2): objectui plugin-detail buildDefaultPageSchema.ts:717-729 — the detail synthesis does not apply the group predicate.
  • Predates 17.6.0. Verifier VF2: CONFIRMED, P2. Owner: objectui.

integration-system.email-template-render A6 / N1 {m01} — boot; GET /data/sys_email_template (showcase_task_done_email) → subject ✅ Task done: {{title}}, customized:false; PUT /api/v1/meta/email_template/showcase_task_done_email {subject:'ADMIN reworded: {{title}}',…} → 200, the row renders the new subject but stays customized:false; restart on the same DB → GET /meta still serves the overlay while the sending row reverts to the package wording (N1: the two disagree). Control: a data-door PATCH stamps customized:true and survives.

  • Root cause (VF3): plugins/plugin-email/src/bootstrap-declared-email-templates.ts:153-170 (readDeclared reads the package registry, not the overlay) + :209-227 (the metadata door leaves customized:false, so the :211 guard does not protect it).
  • Predates 17.6.0 (file identical at 617f25f8a). Verifier VF3: CONFIRMED (two fresh DBs), P2.

integration-system.external-schema-browser-ui A2 / A4 / A5 / N1 / N5 {o-ext-panel} — /_console/apps/setup/metadata/datasource/showcase_external: the browser receives GET …/external/tables → {"success":true,"data":{"tables":[customers(7), orders(7)]}} and renders "No remote tables found" (A2 / N1); "Refresh catalog" → 200 with data.catalog.snapshotAt, no timestamp renders (A4); Validation → Run validation → 200 {success,data:{ok,results:[2]}}, panel shows "Preview failed to render — Cannot read properties of undefined (reading 'length')" (A5 / N5).

  • Root cause (VF3): objectui packages/app-shell/src/views/metadata-admin/external/api.ts:133 jsonOrThrow returns the raw body and callers read data.tables / data.catalog / {ok,results} without unwrapping the sendOk envelope.
  • Predates 17.6.0 (api.ts unchanged since the 17.6.0 pin; server envelope present at 617f25f8a). Verifier VF3: CONFIRMED (two loads), P2. Owner: objectui.

integration-system.external-schema-browser-ui A3 {m02} — POST /api/v1/datasources/showcase_external/external/tables/customers/import {"name":"ext_cust"} → 201; GET /api/v1/data/ext_cust → 500 DATABASE_ERROR ("no such table: ext_cust"); importing under the remote name works by coincidence; after a restart the imported object is gone (404). Control: the same definition via PUT /api/v1/meta/object/{name} is queryable.

  • Root cause (VF3): services/service-datasource/src/plugin.ts:99-101 persistObject only calls metadata.register('object', …) — no engine re-sync / external-object registration, and no persistence.
  • Predates 17.6.0. Verifier VF3: CONFIRMED (twice), P2.

Authorization class (withheld)

  • records-forms.field-type-matrix A4 / N3 and records-forms.encrypted-field-behavior N1 {m07} — authorization class. Detail withheld pending maintainer (RUNNER rule 2). Verifier: CONFIRMED.
  • identity-auth.org-membership-team-management A5 / N2 {m08} — authorization class. Detail withheld pending maintainer (RUNNER rule 2). Verifier: CONFIRMED.
  • platform-core.settings-hub-roundtrip, outside the item's clauses {m10} — authorization class. Detail withheld pending maintainer (RUNNER rule 2).

Checklist clauses (no product defect)

item · clause disposition what holds instead source
access-security.readonly-package-locks-studio A3 stale clause (VF4; lane: assertion) duplicating a code package is refused 422 DUPLICATE_SOURCE_NOT_A_BASE by design; a writable base from POST /packages takes the same PUT (200), so the gate keys on writability requireDuplicableSource (#14451), before 17.5.0
access-security.audit-log-browser A1 / A5 stale clause the admin holds view_all_audit_log by default and is served the delete row; a non-holder (promoted org admin) gets 0 delete rows; page and API agree for the same principal 7ebb543164 (#21296, fixes #21260) — after 17.6.0
identity-auth.auth-method-matrix A10 (delete-user half) stale clause POST /auth/delete-user is deliberately unwired (ledger disposition disabled) and answers 404 to every caller; change-email holds auth-route-ledger.ts:148-157, ruling 2026-08-12 (#7735)
identity-auth.workspace-org-switch A6 assertion defect the forged set-active is refused 403 USER_IS_NOT_A_MEMBER_OF_THE_ORGANIZATION and the foreign org never becomes active, but better-auth clears the active org to none before throwing (fails closed) better-auth 1.7.3 crud-org.mjs setActive; route unwrapped (auth-route-ledger.ts:274)
records-forms.cascading-options A3 invalid pairing the option predicate is 'org_admin' in current_user.positions; the seeded admin is org_owner. An invited org admin sees and persists restricted, a member neither sees nor submits it cascading-select.object.ts:100; eval-user.zod.ts:201-205
records-forms.field-group-visible-when A1 assertion defect the schema parse normalizes the bare string to the envelope (batch20 pin), but the meta API serves runtime-authored bodies as authored protocol.ts:1344,1652 (ADR-0005 appendix (c))
automation.flow-run-step-nesting A2 stale clause send_reminder carries {parentNodeId:'guard_reminder', regionKind:'try'}; guard_reminder carries the loop-body tags with iteration 0..2 showcase flow index.ts:910-926 (#13681 / #14394), before 17.6.0
automation.rollup-summary-filter A5 stale clause duplicate of the code package refused (#14451); the filter is settable in Studio on a scratch writable base package and persists packages.ts:479 ff.
automation.flow-node-type-matrix A1 / A2 assertion defect start / end are structural: no executor, no palette entry; start logs a step, end returns before logging — proven by the run completing flow.zod.ts:72 FLOW_STRUCTURAL_NODE_TYPES
automation.trigger-type-matrix A1 assertion defect trigger.type records the launch event (context.event ?? 'manual'), not Flow.type; the flow name identifies the kind engine.ts:1175-1190 (#7533)
platform-core.app-management-toggle A6 / N1 stale clause (VF5) the page writes through PUT / DELETE /meta/app/{name}: Disable / Set default on a code-package app → 403 NOT_OVERRIDABLE with an error toast, /meta/app unchanged; on a writable app the effect is real objectui 3b7d1cc6d7 (#4233 / #4300, 2026-08-11), before the 17.6.0 pin

Known expected-fail (not re-filed)

Partial-coverage gaps (named, not dropped)

  • identity-auth.admin-lifecycle-operations A4–A6 — blocked(dependency): set-role / revoke-user-sessions / remove-user are ruled not-built (impersonate_user and set_user_role still 403 every platform admin — neither route is safely raw-mountable, and each blocks for a different reason #9968 / finding: seven better-auth /admin/ routes refuse platform admins and have no ObjectStack consumer — decide whether they are capability or just vendor surface #9969); the admin gets the ruled 403. N3 not-run (the route refuses the admin by design).
  • studio-authoring.expression-editors A8 — blocked(environment): celAuthoring.test.ts lives only in objectui and no checkout at the pin was runnable.
  • studio-authoring.metadata-diagnostics-sweep A7 — blocked(fixture).
  • integration-system.datasource-credential-refusal-matrix A2 / A7 — blocked(environment): no Postgres / MySQL / Mongo to prove "connects".
  • approvals.decision-action-matrix A10 — blocked(fixture): no org-less request can be provisioned (even an api-hook approval is org-stamped); the pin covers the mechanism.
  • Blocked legs inside failing items: identity-auth.auth-method-matrix A1 SSO / device variants (no switch on the dev → serve path) and N3 (objectui#4179, no magic-link / passkey UI); integration-system.external-schema-browser-ui A7 (needs an unwired boot); records-forms.field-group-visible-when N3 not-run.
  • Pin-only by necessity: records-forms.encrypted-field-behavior A4 (an unwired-crypto boot refuses to start).
  • cli.scaffold-first-run and cli.scaffold-console-first-paint prove the published create-objectstack 17.6.0, not the unpublished 17.7 subject.

Fixed since the last run

Candidates — not verified, not extracted

Seen by a runner outside the clauses, low severity or possibly by design; listed so they are not lost:

  • AppManagementPage: Delete on a code-package app toasts "deleted" for a reset:false no-op (VF5, objectui, unverified live); on a writable app Enable writes a live row outside the package (no ?package=, no draft) and Delete removes only that row while the toast says "deleted".
  • A deep link to a disabled package's app renders an out-of-shell "App not available — try again in a moment".
  • describeInterruptedRun joins its parts with a bare space (run-on warning text); os migrate resume logs an ERROR about unbound federated objects.
  • A partial-body PUT /meta/object/{packaged} answers 422 DESTRUCTIVE_CHANGE before the overlay gate's 403 (still refused).
  • The time-relative start panel flags every timeRelative field "Kept, not in effect" on a live, bound sweep (objectui flow-node-config.ts showWhen).
  • An unprefixed runtime object saves 200 at the active door but publish-drafts later refuses NAMESPACE_PREFIX inside a 200 outcome:"refused"; the console shows only "Action failed".
  • A failed parallel run records only the container failure; neither branch's steps are logged ([Decision] A failed try_catch try-region produces no step at all — after a caught failure an operator cannot tell what failed, how many attempts ran, or which node threw #7546 shape).
  • Webhooks on the stock single posture: bulk events carry no organization, so an org-stamped bulk subscription never fires; the shipped org-less showcase_task_changed row refuses per-record events once flipped active (loud, not silent).
  • POST /notifications/read with an unknown id answers readCount:1 and plants an orphan receipt for the caller.
  • A recipient with no locale walks ['en'] for sys_notification_template, so an en-US row is never picked (seen once).
  • An aggregate over a credential field is refused (fail-closed) as a generic 500; a runtime hook-condition abort is a generic 500 too.
  • The Action Param Gallery dialog is taller than the viewport with no scroll; Confirm is unreachable at 1440×1000 (second sighting, also in QA run · surface:browser (61/61) · 316be321 · 2026-10-04 · 38 PASS / 8 PARTIAL / 15 FAIL / 0 BLOCKED / 0 NOT-RUN #21782).
  • On create, droppedFields omits a replaced autonumber; a later Specimen PATCH hit 409 RECORD_LOCKED from an approval of unclear origin.
  • The OAuth consent page names the app by raw client_id (objectui OAuthConsentPage.tsx:68 calls a route that 404s); the open-posture boot logs TEMPLATE_NOT_FOUND for a boot-time verification mail; the workspace switcher label still names an org after a refused set-active.
  • The impersonation banner names the admin by raw user id; the delegated_admin's invite picker offers roles the server always refuses.
  • The RLS editor treats a non-pushdownable USING as an advisory warning while publish refuses it rls-predicate-unenforceable; a permission-set clone row carries created_by / organization_id null; the Studio records-grid create dialog renders half-width.
  • Metadata diagnostics: ?type=views stats key plural; GET /meta/book/{missing}/tree 200 empty vs doc 404; a 422 publish is logged as an unhandled error; deleting a draft-only page answers a misleading 200 and a faulted draft reads _diagnostics.valid:true; the permission editor Save is clipped at 640 px; the HTML page editor logs a pageerror.
  • capability_platform_name_refused WARN logged five times in one boot.
  • Five authorization-class observations, withheld pending maintainer (RUNNER rule 2).

Generated by Claude Code

Activity

  1. objectstack-fleet
    added
    qa-run
    on Oct 5, 2026

  2. objectstack-fleet commented on Oct 5, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 5, 2026
    ContributorAuthor

    Close-out

    Every fail has a disposition re-derived by an independent verifier (RUNNER rule 7):

    Extracted: #21785 · integration-system.email-template-render · acceptance[5]
Extracted: #21785 · integration-system.email-template-render · negative[0]
Extracted: #21788 · integration-system.external-schema-browser-ui · acceptance[2]
Extracted: #21793 · identity-auth.auth-method-matrix · acceptance[3]
Extracted: #21790 · studio-authoring.object-designer-roundtrip · acceptance[0]
Extracted: #21789 · access-security.permission-matrix-edit-loop · acceptance[1]
Extracted: #21794 · access-security.packaged-permission-set-lifecycle · acceptance[5]
Extracted: #21787 · records-forms.field-type-matrix · acceptance[3]
Extracted: #21787 · records-forms.field-type-matrix · negative[2]
Extracted: #21787 · records-forms.encrypted-field-behavior · negative[0]
Extracted: #21791 · identity-auth.org-membership-team-management · acceptance[4]
Extracted: #21791 · identity-auth.org-membership-team-management · negative[1]
Extracted: #21792 · platform-core.settings-hub-roundtrip · outside the item's clauses
Extracted: objectstack-ai/objectui#11628 · integration-system.external-schema-browser-ui · acceptance[1]
Extracted: objectstack-ai/objectui#11628 · integration-system.external-schema-browser-ui · acceptance[3]
Extracted: objectstack-ai/objectui#11628 · integration-system.external-schema-browser-ui · acceptance[4]
Extracted: objectstack-ai/objectui#11628 · integration-system.external-schema-browser-ui · negative[0]
Extracted: objectstack-ai/objectui#11628 · integration-system.external-schema-browser-ui · negative[4]
Extracted: objectstack-ai/objectui#11630 · records-forms.field-group-visible-when · acceptance[3]
Extracted: objectstack-ai/objectui#11633 · identity-auth.email-verification-loop · acceptance[2]
Extracted: objectstack-ai/objectui#11634 · identity-auth.self-signup-gate · acceptance[3]
Extracted: objectstack-ai/objectui#11631 · records-forms.cascading-multilevel-and-clear · acceptance[3]
Extracted: #21795 · identity-auth.invitation-scope-gates · acceptance[4]
Extracted: #21795 · identity-auth.org-membership-team-management · acceptance[6]
Extracted: #21795 · identity-auth.org-membership-team-management · negative[0]
Parked-on: #21797 · access-security.readonly-package-locks-studio · acceptance[2]
Parked-on: #21797 · access-security.audit-log-browser · acceptance[0]
Parked-on: #21797 · access-security.audit-log-browser · acceptance[4]
Parked-on: #21797 · identity-auth.auth-method-matrix · acceptance[9]
Parked-on: #21797 · identity-auth.workspace-org-switch · acceptance[5]
Parked-on: #21797 · records-forms.cascading-options · acceptance[2]
Parked-on: #21797 · records-forms.field-group-visible-when · acceptance[0]
Parked-on: #21797 · automation.flow-run-step-nesting · acceptance[1]
Parked-on: #21797 · automation.rollup-summary-filter · acceptance[4]
Parked-on: #21797 · automation.flow-node-type-matrix · acceptance[0]
Parked-on: #21797 · automation.flow-node-type-matrix · acceptance[1]
Parked-on: #21797 · automation.trigger-type-matrix · acceptance[0]
Parked-on: #21797 · platform-core.app-management-toggle · acceptance[5]
Parked-on: #21797 · platform-core.app-management-toggle · negative[0]

    Known expected-fail, not re-filed: api-backend.formula-stdlib-matrix acceptance[5] (#3306 class).

    Product defects

    card from severity (verifier) owner note
    #21785 email-template-render A6 / N1 P2 objectstack a /meta email-template save reverts on the next boot
    #21788 external-schema-browser-ui A3 P2 objectstack import under a new name: 500 "no such table", lost on restart
    #21793 auth-method-matrix A4 P3 objectstack no-SMS phone OTP → 500 empty body in production
    #21790 object-designer-roundtrip A1 P2 objectstack reorder-only publish is a silent no-op (also on 17.6.0)
    #21789 permission-matrix-edit-loop A2 P2, fails closed objectstack (+ objectui reader) writable / org-owned permission sets read and enforced as code-locked
    #21794 packaged-permission-set-lifecycle A6 P3 objectstack lock refusal has no userMessage; console shows generic text
    #21787 field-type-matrix A4 / N3, encrypted-field-behavior N1 P1 / high, authorization objectstack detail withheld pending maintainer (RUNNER rule 2)
    #21791 org-membership-team-management A5 / N2 medium, authorization objectstack detail withheld pending maintainer (RUNNER rule 2)
    #21792 found in settings-hub-roundtrip authorization objectstack detail withheld pending maintainer (RUNNER rule 2)
    objectstack-ai/objectui#11628 external-schema-browser-ui A2 / A4 / A5 / N1 / N5 P2 objectui external panel does not unwrap the {success,data} envelope
    objectstack-ai/objectui#11630 field-group-visible-when A4 P2 objectui record detail ignores field-group visibleWhen
    objectstack-ai/objectui#11631 cascading-multilevel-and-clear A4 P2 objectui dependent lookup not cleared on parent change
    objectstack-ai/objectui#11633 email-verification-loop A3 low objectui verify page POSTs to a GET-only route
    objectstack-ai/objectui#11634 self-signup-gate A4 low objectui sign-up link shown when sign-up is disabled
    #21795 invitation-scope-gates A5, org-membership A7 / N1 low, UI courtesy objectstack (platform gap) invite / team actions offered to members the server refuses

    None is a 17.7 regression: every defect above reproduces against code unchanged since 17.6.0 (617f25f8a / objectui 31971ff1e) or earlier. No open duplicate was found (nearest closed: #7733, #20107, #19397, #6039).

    Checklist-accuracy findings (no fail attached; for the checklist owner)

    1. access-security: readonly-package-locks-studio A2's code set omits NOT_OVERRIDABLE (what a bare PUT /meta/object/{packaged} answers; ITEM_LOCKED only with ?package=). audit-log-browser rev 2's "no Action dropdown" is false (AuditLogPage has Action / Object / Actor / date filters). public-form-intake step 6's anonymous path is /_console/f/contact-us (/_console/forms/:name is the authenticated form). sharing-rule-authoring-ui knownGap: two seeded rules, one on showcase_contact. capability-declaration-lifecycle REGRANT must run on a clone (the packaged set is locked, Studio save of a package-declared permission set forks it into a silent, undiscoverable overlay #11513); surface is the /actions dispatcher. fls-mask-and-strip step 6: the stock showcase_client_liaison already serves the readable:false set; budget_remaining is on no form or layout. permission-matrix-edit-loop step 1: use member-owned tasks (RLS decides admin-owned ones); the Studio Access matrix is package-scoped.
    2. identity-auth: auth-method-matrix: phone-OTP-without-SMS is reachable only under NODE_ENV=production; device / OIDC-provider variants have no boot switch; discovery is also served under /api/v1/auth. admin-lifecycle A4–A6 assert ruled-not-built routes (impersonate_user and set_user_role still 403 every platform admin — neither route is safely raw-mountable, and each blocks for a different reason #9968 / finding: seven better-auth /admin/ routes refuse platform admins and have no ObjectStack consumer — decide whether they are capability or just vendor surface #9969) and step 2 list-users is 403 by the same ruling. session-list-revoke step 4 needs the raw session.token, and the cross-user list is the "All" tab. api-key surface is Account › Developer › Connect an Agent; showcase_task does not discriminate RLS, use sys_user. invitation step 7: cancel as admin (delegated_admin holds only invitation:["create"]). org-membership step 6: the nav label is static. email-verification A3 / step 4: the mailed link is the API GET (callbackURL=/ lands on the server root), there is no POST variant. workspace-org-switch A4 holds only on isolated (group reads span orgs by design); wall postures need @objectstack/organizations, OS_PLATFORM_OWNER_EMAIL and OS_AUTH_MEMBERSHIP_POLICY. self-signup / first-run: the audience gate answers before the toggle; only an invited forge reaches EMAIL_PASSWORD_SIGN_UP_DISABLED. oauth-consent: web clients need an https non-loopback redirect. identity-import: the auto-invite mail uses the password-reset template. A role-admin invitation needs accept-invitation to grant org_admin.
    3. studio-authoring: object-designer step 4: the empty-row banner is the select-needs-options rule (feat(spec)!: FieldSchema refuses a select / radio with neither options nor picklist #21390). record-page step 1: type defaults to list; no "Layout" section. lifecycle: history versions count draft saves (published revisions are 2 and 4), the diff is shallow, toVersion:1 is the draft-create, stray keys are refused at draft save, the code is METADATA_CONFLICT. validation A2: a flat body gets the "names no viewKind" prescription. expression fixture quantity * unit_price infers unknown. metadata-diagnostics A2 lock comes via servedLockState (c43a8ae, fix(metadata-protocol)!: the ADR-0010 _lock gate refuses on a host-config kernel too, and the diagnostics locked count reads the item envelope derivation (#21694) #21715); A1 registry 27 vs /meta/types 34. custom-page-source-tiers step 8; doc-on-app-menu slug URLs and duplicated sidebar DOM.
    4. records-forms: object-hook-lifecycle: hooks list at /meta/hook (not /meta/types/hook), A3 needs OS_LOG_LEVEL=info, A8's log text is [hook] handler failed (onError=log; suppressing), A9 needs a runtime-faulting condition and the client sees a generic 500. field-type-constraints: f_currency has currencyConfig:{currencyMode:'fixed',defaultCurrency:'USD'}; invoice lines need product. field-group-visible-when knownGaps stale (both adapters copy visibleWhen at the pin). concurrent-edit A2 / A3: the form dialog has no Reload. field-history N1 is ambiguous against the always-on audit History tab. cascading-options persona: invite an org admin.
    5. automation: scheduled work is off by default (OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true). flow-runs-page step 6: filling new_assignee suppresses the pause (MCP run_action on a screen flow dead-ends: the screen pauses even when every input is bound, and list_actions never surfaces flow input variables #15705); the selector lists flow names. formula step 3: joinNonEmpty([...]) literal fails to type-check, isBlank(" ") is false. connector registry: unlisted showcase_status_openapi, no baseUrl exposed. showcase_fan_out_notify needs Slack egress.
    6. integration-system / approvals: job-scheduled-run: the enabled:false skip line is DEBUG. webhook-lifecycle: the shipped org-less row cannot deliver; lastStatusCode is response_code; redeliver answers enveloped. email-template-render: no HTTP door for sendTemplate (use a notify node), fromOverride is an object, raw send answers {id,status,messageId}. external-schema: columnCount is 7 (not 5); detail route /_console/apps/setup/metadata/datasource/{name}. ooo-delegation step 4: /trigger cannot open an approval (use a type:'api' hook flow). decision-action-matrix knownGap (org-null requests) stale; inbox filter ?approverId=; throttle 429 THROTTLED. notify-inbox: push dead-letter is a WARN only. preference-suppression: members get 403 on preferences.
    7. platform-core / cli: metadata-authoring step 2: a plain PUT publishes live; drafts need ?mode=draft&package= (body packageId ignored). package-lifecycle: runtime objects need the namespace prefix. settings-hub: invalid timezone answers value_domain; no user-scoped namespace exists. lifecycle-retention: knownGaps[1] stale (TelemetryDatasource is live on stock; seed the telemetry DB), an idle sweep still logs ~0 rows reaped, the line is INFO. cli scaffold items: the trailing npm install fails on a pnpm-installed scaffold (drop it or use pnpm), and both items measure the published scaffolder.
    8. dashboards / search / i18n: system-overview A2 stale (the Active Sessions widget filters active sessions since System Overview board mislabels two tiles: "Total Users" is really users created in the last 7 days, and "Active Sessions" counts every session #7531) and step 6 has two security tiles. console-global-search A1: ⌘K toggles; step 6 has no "Open full search" entry. i18n strict-translation A4 cites ADR-0049, not 清空剩余 6 条 authorWarn 死键 —— book ×2 / job.id / translation.validationMessages / app.homePageId / app.areas[].order（ADR-0049，v17 限时） #4667; item names must be snake_case (qa_zh_cn + locale:"zh-CN"). empty-null step 6 should name the groupBy:["signed_on"] query.

    Environment notes are in the record body. Fixture gaps closed out through the wave's anchor card.

    Generated by Claude Code

  3. baozhoutao
    added a commit that references this issue on Oct 5, 2026

    docs(qa): re-point platform-core checklist clauses the 17.7 console r…

    cf57c7b

  4. objectstack-fleet commented on Oct 6, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 6, 2026
    ContributorAuthor

    Close-out complete: the last fail is extracted, and the blocked partial gaps are parked. The record closes completed

    Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T17:07Z. The maintainer approved clearing the open qa-run records' close-out debt: 「同意，动手」. ⛔ No verdict on this record is changed.

    Extracted: #22019 · api-backend.formula-stdlib-matrix · acceptance[5]
    Parked-on: #22017 · identity-auth.admin-lifecycle-operations · A4–A6 blocked(dependency, ruled not-built)
    Parked-on: #22017 · studio-authoring.expression-editors · A8 blocked(environment)
    Parked-on: #22017 · studio-authoring.metadata-diagnostics-sweep · A7 blocked(fixture)
    Parked-on: #22017 · integration-system.datasource-credential-refusal-matrix · A2 / A7 blocked(environment)
    Parked-on: #22017 · approvals.decision-action-matrix · A10 blocked(fixture)
    Parked-on: #22017 · identity-auth.auth-method-matrix · A1 SSO / device variants, N3
    Parked-on: #22017 · integration-system.external-schema-browser-ui · A7 needs an unwired boot
    Parked-on: #22017 · records-forms.encrypted-field-behavior · A4 pin-only of necessity

  5. objectstack-fleet
    closed this as completedon Oct 6, 2026
  6. akarma-synetal
    added 2 commits that reference this issue on Oct 7, 2026

    docs(qa): re-point 25 platform-checklist clauses the 17.7 pre-release…

    18c7dfd

    docs(qa): park the 24 partial-coverage gaps of the 17.7 pre-release r…

    47f6355
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    qa-run

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions