docs(qa): two checklist carriers still require the retired `sys_account.issuer` — `identity-auth.json`'s `link_social` VERIFY is an oracle that now fails a healthy system

[os-try-charles]

Path: P1 | identity-auth | 那条路验证步「放行对的」被假失败破坏

PLACEHOLDER

Two more carriers in docs/qa/platform-checklist/** still require or cite sys_account.issuer, a column retired by #17440 — and one of them is an acceptance oracle, so it fails a correctly working system.

Filed by the domain:devx execution PM seat (session session_017ef78bLdybu3AffehKkhfk) as the discharge of two out_of_scope_findings from #17453 / PR #19213, which fixed the same rot inside areas/approvals.json and deliberately did not widen to these. ⛔ Not graded, no domain:* — that is triage's. Expected landing point: docs/qa/** ⇒ domain:devx.

Measured on origin/main 0046a41b4

1. docs/qa/platform-checklist/areas/identity-auth.json — the link_social item, an ORACLE that now fails a healthy system

line	what it says
:1118 (a step)	「confirm a sys_account row now exists for that provider in the caller's mine-view (provider_id = the provider, user_id = the caller, issuer stamped)」
:1127 (its acceptance verify)	「… shows a new row with provider_id = the provider and user_id = the caller; issuer is stamped」

⚠️ This is the sharper of the two: :1127 is what a runner judges the platform against. sys_account.issuer retired with #17440, so nothing stamps it any more — ⇒ a run of this item on a correctly working build records a false negative, and the item's own text tells the runner that is the right answer.

⭐ Corroborating evidence that the field really is gone, from the same tree: packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts:133-138 asserts the column ABSENT, with the message 「sys_account.issuer retired with better-auth 1.7.3 — nothing should still be writing it」. ⇒ One QA artefact asserts the field must not exist while another requires it to be stamped.

2. docs/qa/platform-checklist/FOLLOW-UPS.md:151 — a falsified closing evidence line

| "a second signed-up (non-admin) user in seeds" | both demo personas get a better-auth credential account at boot (seed-approval-demo.ts → ensureCredentialAccount), issuer derived from the dev admin's own row | approvals.per-group-signoff, approvals.viewer-gating-submitter-side … |

That clause is the exact one PR #19213 just withdrew from the three approvals.json items this row points at. The seed derives and stamps nothing now: seed-approval-demo.ts:362-370 records that 1.7.3 rolled the model back and 「the derivation, its failure branch and the whole class of silent lockout behind it are gone」.

⇒ The follow-up ledger now cites, as closed evidence, a mechanism that no longer exists — pointing at three items whose own text says the opposite.

⛔ What is NOT claimed, measured so nobody widens this

areas/approvals.json still returns 2 hits for 「issuer derived from the dev admin」 on this tree, and ⛔ neither is a defect: both sit inside history entries (:90, revision 5 — the append-only past-tense record PR #19213 correctly left alone; and :730, revision 4 — the entry that PR added, quoting the clause in order to record that it was withdrawn). ⚠️ A sweep that greps this phrase repo-wide will hit them; they are the correct steady state. ⛔ Do not "fix" history.

What a fix looks like (⛔ not prescribed)

Item 1 is the one with a cost today: a runner following it records a false negative. Its repair is plausibly the same shape PR #19213 used — keep the reason, drop the dead requirement, anchor on packages/spec/src/migrations/entries/semantic/18.sys-account-issuer-retired.ts where a durable citation is wanted — and it must move the verify clause, not only the step. Item 2 is a ledger line. ⛔ This card prescribes neither, and ⛔ does not ask for any code to change.

⚠️ Whoever takes it: areas/approvals.json is a zero-headroom surface for check:platform-checklist (its bad-citation floor stood at 37/37 when PR #19213 landed without moving it — structurally, because the citations involved are BARE paths and never path#symbol anchors). ⛔ Re-measure before assuming identity-auth.json behaves the same way.

Refs: #17453 · PR #19213 · #17440 · #9308

---

Generated by Claude Code