docs(qa): checklist item for public-form withdrawal layering (17.7 security follow-up)

[objectstack-fleet]

Fixes #21932

Clause-②: no

What

This PR adds one checklist item, access-security.public-form-withdrawal-layers, to docs/qa/platform-checklist/areas/access-security.json. It sits right after access-security.public-form-intake. Its fields are rev 1, since: v17.7, P1, surface api. No other file changes.

This delivers the last two rows of #21932. The first five rows and both re-checks landed in PR #21943.

The #21835 / PR #21864 row: public-form withdrawal layering

The item is written against what PR #21864 landed on main. Its merge, 3c7785d4ab, is an ancestor of this branch's base 01e0f71a. Each rule on the card maps to a clause:

Card rule	Where in the item	Oracle	Code anchor
An env-wide withdrawal is not re-opened by an org overlay	acceptance[0]: both doors answer 404 FORM_NOT_FOUND and no row lands. acceptance[1]: an org-scoped save that would leave the form open answers 403 NOT_OVERRIDABLE	api	rest-server.ts#registerFormEndpoints, anonymous-form-intake.ts#anonymousFormIntakeWithdrawnIn, protocol.ts#anonymousFormIntakeReopenRefusal
Only an explicit false withdraws	acceptance[2]: with an absent allowAnonymous, or no publicLink, env-wide, the org save that opens the form is accepted and both doors serve it	api	anonymous-form-intake.ts#anonymousFormExplicitWithdrawals. Premise: protocol.ts#projectStorableViewBody
A package's shipped false withdraws	acceptance[4]	test	anonymousFormExplicitWithdrawals. Pins: protocol.org-scoped-write-refused.test.ts ('single: a package-shipped form') and anonymous-form-intake.test.ts
The env-wide definition may open a package-closed form	acceptance[5]	test	protocol.ts#envWideRawViewRows, with the same protocol pin
The ruled known limit is recorded as a known gap	fixtures.knownGaps[0], plus a negative saying it is not a FAIL	none	The doors match by served item name. The save check runs only from saveMetaItem and the draft promotion, never from rollbackMetaItem or revertCommit

acceptance[3] is the control pair, which the dogfood also pins:

• An organization can always withdraw the form for itself.
• A form open at both layers is served, and its row lands in the organization.

automated.ref leads with packages/qa/dogfood/test/showcase-public-form-withdrawal-layers.dogfood.test.ts. That dogfood covers acceptance[0], [1] and [3] end to end. The ref also names the rest, metadata-protocol and metadata-core unit pins.

The steps drive the stock showcase form, showcase_inquiry.contact at /forms/contact-us. The admin saves it at two scopes: env-wide, and in the Default Organization the doors read. Both doors are probed anonymously.

Where the code is narrower than the card's wording

Where they differ, the item follows the code:

• A package's shipped false. This holds only for an artifact the stack schema parsed (strict defineStack, the default). There the schema default enabled: false counts as an explicit false. An artifact loaded unparsed (strict: false, or a hand-built manifest) is judged as written, so a switch it omits is absent and withdraws nothing. acceptance[4] says so.
• Only an explicit false. The false must sit on a sharing that keeps a non-empty publicLink. A sharing with no link withdraws nothing, even with both switches false. acceptance[2] says so.
• A second documented limit. main carries "Known limit: packages and names" besides the ruled one. Cases where two packages ship the same view name are outside this item's fixture. The item points at that docs section as it reads at the run's commit, rather than restating it.

The #21867 / PR #21928 row

Confirmed on main with no change. The item is automation.paused-run-trigger-record-masked in docs/qa/platform-checklist/areas/automation.json, at rev 1, status: active. Its automated.ref is packages/qa/dogfood/test/flow-trigger-record-credential-mask.dogfood.test.ts, which is on disk. PR #21928 merged as 1f0469655f, an ancestor of this branch's base.

Overlap with #21934

#21934 is not addressed here. Its PR #21962 was an open, unmerged draft when this PR was opened, so the item is written against main as it stands.

• The ruled known limit does not depend on security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934. PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962 leaves the docs page's "Known limit." paragraph and the doors' name-based identity unchanged.
• The multi-package line holds either way. PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962 rewrites the "Known limit: packages and names" section. This item points at that section as it reads at the run's commit and names security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934, so its line stays true whether or not PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962 lands.
• The envWideRawViewRows note holds either way. It is scoped to "a form one package ships", which is true before and after PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962. That PR keeps the symbol and resolves it per package.
• No shared files. This PR touches only the checklist JSON. It changes neither content/docs/ui/public-data-collection.mdx nor any package source.

Tests

All results are at head 2d51effa.

• Derived gates. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 13 commands, the same 13 the dispatch named. All 13 exited 0, with each exit code captured before any pipe. The --ran reconciliation reads 13 derived, 13 run, 0 NOT-MEASURED, 0 UNRUN.
• Checklist gate. pnpm check:platform-checklist answered OK — 15 areas, 275 items (271 active, 2 planned) with 690/700 symbol anchors resolved. At the base 01e0f71a it read 274 items and 676/686. All 14 new anchors resolve, and the 10 that do not are the named [finding] the platform-checklist corpus resolves symbol anchors with its OWN rule, not the shared resolver — a permissive token match where the ruling says there is to be exactly one implementation #16898 residual.
• Formula gate. pnpm --filter @objectstack/lint run check:doc-formula-expressions first exited 3 (PREREQUISITE NOT MET, because formula and lint were unbuilt), so that run measured nothing. I built both under os-verify-lock (VERDICT command-exit 0), and the gate then exited 0.
• Not owed. No package source changed, so no build, test, typecheck or lint is owed. The cited test-case names were read from the test files on main. The pins themselves were not re-run here; they ran in CI on PR fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864 and PR fix(trigger-record-change)!: a record-change flow's trigger record carries the credential mask and omits internal fields #21928.

Acceptance notes

• coverage.json is untouched. The claim's file surface is areas/*.json, and the view kind is already mapped. Mapping the new item to view is optional, and is left to whoever next owns coverage.json.
• A stale clause in the sibling item. access-security.public-form-intake clause 7 says "republishing restores service" but does not name the scope of the republish. With layering, republishing in an organization over an env-wide withdrawal is refused with a 403. The new item covers that case. The old item is unchanged, with no revision bump, to keep this PR to the card's rows.
• No changeset. The diff touches only docs/qa/platform-checklist/areas/access-security.json, which no published package ships: the root package is private, and no package files entry names docs/qa. skip-changeset applies.

---

Generated by Claude Code