[objectstack-fleet]

Refs #24579
Clause-②: no

Round 17 of the 18.0 sweep's wave anchor (claim 6303585734, PM loop round 32). It applies the ledger's remaining checklist-text findings: #24903's follow-through (PR #24967), round 16's carried findings (PR #24963's acceptance notes), PR #24982's pin findings after the console pin moved to objectui cf153eb2e535, round 14's widening candidates (PR #24857), and round 12's "showcase isolated" spellings (landing record 6287983829).

Only checklist text changes. 85 items in 10 area files each take one revision bump and one history row, and each row names its source and finding. There is no product code, test, pin, changeset text or RUNNER.md change, and no new item.

• Base e4d604efd3. origin/main 4fe3af9d7e is merged in 6c4b8526af. Its five commits touch no docs/qa/** path and none of the sources these edits cite.
• Every item, pin and objectui spec named below was re-read at the base, or at the console pin for objectui, before it was written. objectui was read with git show from a full scratch clone (--is-shallow-repository false).
• A scripted span editor made every edit. It is round 16's editor, unchanged, and it never re-serialises a file. For each area file it re-parses the result and asserts four things:
  • A1: the new document equals the old one with the declared ops applied.
  • A2: every other item and top-level key is value-equal.
  • A3: each edited item's changed paths lie inside its declared fields (array edits by exact index), plus revision and the one new history row.
  • A4: the text outside the edited items is byte-identical.
• A whole-branch check against the base agrees: 85 items changed, each with revision +1 and exactly one appended row, and no other path changed.
• The new history rows carry the placeholder ref #PENDING-24579R17, because a row's ref names this PR and the PR had no number yet. The next commit on this branch swaps in this PR's number and changes nothing else. The gates are re-run on that head, and the report comment on qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579 records them.

Changes

finding	item	field	old → new	evidence read at e4d604efd3
#24903 (PR #24967): the repaired production-guard case	cli.dev-automigrate-policy	automated.ref; fixtures.knownGaps[2] removed	the production case "scores NOTHING (knownGaps[2])" → the case, beside its development control, scores acceptance[2] at the driver layer, partial; steps[3]'s production boot stays the live leg	sql-driver-schema-drift.test.ts (blob 1f2ed8c72ca2): under NODE_ENV=production with autoMigrate: 'safe', SqlDriver.initObjects over in-memory better-sqlite3 keeps a current_user column DEFAULT, still reports it safe / drop_column_default, and its stub logger's warning carries the stable prefix. The remedy after the em dash is unasserted, and no boot log is read. The guard is reconcileAndWarnDrift in sql-driver.ts.
PR #24963 (a): a P0 api clause's readonly half "scored from the pins"	records-forms.crud-roundtrip	acceptance[6] (clause, verify, evidence); automated removed; fixtures.knownGaps[1] added	"Score that half from the pins in automated, never as blocked(fixture) … no live run can stage it" → drive it at the clone door on a source row whose lead_score the run planted in its own file DB with node:sqlite, else blocked(fixture). The pins move to knownGaps[1] as evidence of their own layers, and automated goes, because no pin holds a full clause	protocol.readonly-insert.test.ts drives cloneData over a stub engine. engine-insert-static-readonly-strip.test.ts drives a real engine over a recording driver, with no HTTP. cloneData (protocol.ts) copies the source row whole into engine.insert and answers the engine's drop as droppedFields. lead_score is readonly with no defaultValue (contact.object.ts).
PR #24963 (b): automated.ref claims "acceptance[0]'s NARROWING half ONLY"	cli.datasource-introspect-codegen	automated removed; fixtures.knownGaps[3] added; knownGaps[2] and acceptance[0].verify re-pointed	a ref holding half a clause → no ref; the knownGap names each pin's layer and when automated may return (round 15's form)	remote-tables-twin.equivalence.test.ts: the real ExternalDatasourceService over a fake introspector, through the real HonoHttpServer (route layer). external-datasource-service.test.ts: the service. envelope-unwrap.test.ts: the CLI over a stubbed fetch. acceptance[0] scores the CLI's printed listing against a served datasource.
PR #24963 (c), anchor comment 6290946648: "a second signed-up user"	records-forms.record-discussion-mentions	personas[1], fixtures.knownGaps[0]	a second signed-up user, and the mention and bell clauses blocked(fixture) without one → a user the admin mints with POST /api/v1/auth/admin/create-user, which then changes its password; ⛔ never blocked(fixture) on the 403	audience-posture.ts resolveAudience: no auth.audience declared ⇒ invite_only, and an uninvited sign-up answers 403 SELF_REGISTRATION_CLOSED. admin-user-endpoints.ts runAdminCreateUser: mustChangePassword defaults true. steps[13] (revision 5) already uses this door.
PR #24982: a citation absent at both pins	approvals.record-page-decisions	source[2]; fixtures.knownGaps[0] added	RecordDetailView.approvalDecisionActions.test.tsx → objectui RecordDetailView.approvalDeclaredActions.test.tsx (blob 9519ae70f743), plus this repo's sys-approval-request.object.test.ts for the one-dialog half; the knownGap says that the rest of the item still describes the retired header buttons	objectui 99782f961 (objectui#3055) deleted the file and retired buildApprovalDecisionActions, moving the record page onto sys_approval_request's declared actions. It is an ancestor of 616df6598b42 and of cf153eb2e535 (exit 0, exit 0; control, cf153eb2e535 as an ancestor of 99782f961: exit 1).
PR #24982: a changed blob	automation.setup-packaged-automation-board	none; the ref is confirmed	unchanged	PackagedAutomationPage.test.tsx b321640a6100 → aeb3e5f94e38 (objectui#13185, objectui#13279). It still stubs fetch, and its new cases (the Activation cell's "Not running here", the clone result's next steps) widen the mocked half only. PackagedActionsSection.test.tsx is unchanged.
PR #24982: the current pin	records-forms.crud-roundtrip	acceptance[4].verify	console pin 616df6598b42 → cf153eb2e535	e2e/live/record-history-display.spec.ts is blob 7ebc45106cff at both pins
PR #24982: the current pin	studio-authoring.first-run-loop	acceptance[0].verify	.objectui-sha 616df6598b42 → cf153eb2e535	e2e/live/studio-object-designer.spec.ts is blob 58a7f1cbf024 at both pins. studio-pkg-chip, package-form-id-input and package-form-submit are still declared in app-shell's StudioDesignSurface.tsx and PackageFormDialog.tsx. Over the range, e2e/live/ changes only ci/backend.env.
PR #24857: widening candidate studio-editor	studio-authoring.record-page-roundtrip	automated.ref; acceptance[1].verify	"acceptance[0] ONLY … studio-editor.spec.ts … has never been in this ref" → plus e2e/live/studio-editor.spec.ts for acceptance[1], carrier-neutrally	"Add block opens a block-type picker with configurable block kinds" (blob 19f9cc131654) drives the live editor and asserts that the dialog offers Card, Section and Record details, which is acceptance[1]'s whole dom oracle. It edits a copy of showcase_project_workspace, an app page, but the picker offers one static catalogue whatever the page: AddBlockButton reads TYPES_BY_CATEGORY (objectui block-types.ts).
round 12: "showcase isolated" read as the posture	79 items in 9 area files	the one step that boots (steps[0], or steps[1] in three items)	"boot showcase isolated" → "boot the showcase on its own port and DB", and four context variants	below

The "showcase isolated" respelling

79 respelled, 0 left as the posture. Every non-history hit of "showcase isolated" was read in its item, and each names the dogfood §0 own-port boot. None is the isolated tenancy posture. The clearest case is access-security.activation-write-operator-gate steps[0], which read "boot showcase isolated; … PROVE the posture is single". The 80th hit is a history row (access-security.sharing-rules-widen history[3]), and it is left as history.

The spelling names the boot by what it is, in RUNNER.md's own words for it: the trap table's counter for shared-browser-tab is "own port/DB (skill §0)". One hit already named the canonical boot line, and it now says "RUNNER's canonical checklist boot", RUNNER.md's term for that invocation. The new spelling holds for every boot command the items use, os serve included (records-forms.encrypted-field-behavior).

old	new	hits
boot showcase isolated	boot the showcase on its own port and DB	66
boot showcase isolated against a file DB	boot the showcase on its own port against its own file DB	4
boot showcase isolated on …	boot the showcase on its own port and DB, on …	3
boot the showcase isolated	boot the showcase on its own port and DB	3
boot showcase isolated (own port + file DB per dogfood skill §0) and its comma twin	boot the showcase on its own port and file DB (dogfood skill §0)	2
boot the showcase isolated (RUNNER canonical boot line: own port, own file DB, --seed-admin)	boot the showcase with RUNNER's canonical checklist boot (own port, own file DB, --seed-admin)	1

By area: access-security 10, api-backend 13, approvals 17, automation 17, dashboards 1, integration-system 4, platform-core 1, records-forms 13, studio-authoring 3.

Items left alone, with reasons

• integration-system.datasource-admin-lifecycle (PR docs(qa): 18.0 sweep anchor round 16 — QA round 4's remaining checklist findings and round 15's carried rule-6 texts #24963 (d)): neither pin is added, because neither holds its clause's whole oracle at that clause's layer.
  • admin-routes-auth-guard.test.ts drives all 11 routes three times on one real HonoHttpServer mount: anonymous 401 UNAUTHENTICATED, unentitled 403 PERMISSION_DENIED naming the capability, entitled success, and the service method never called on a refusal. But its auth service is a double (createSessionAuthService), and its grants come from an engine double (createGrantsEngine, "the RBAC tables resolveAuthzContext reads, as a minimal engine double"). acceptance[1] is an api clause on a booted server, so the pin holds its route-layer half only. The ref's sentence "Neither drives the capability floor … drive os dev for every api clause" stays true of the two pins it names.
  • datasource-route-ledger.conformance.test.ts enumerates the registrar against a capturing mock IHttpServer and compares the result with DATASOURCE_ROUTE_LEDGER. That is acceptance[8]'s ledger half, which its verify already cites. The 404 RESOURCE_NOT_FOUND half is never driven, so it holds no whole clause.
• records-forms.master-detail-atomic-save (PR docs(qa): 18.0 sweep anchor round 14 — drop the eleven automated.stale markers objectui 0b36ffa repaired, re-read at the console pin 616df6598b42 #24857's form-view-subforms candidate): no widening. At cf153eb2e535 (blob 9485f378abd7) the spec drives the stock New Invoice dialog with ONE line. It records only /api/v1/batch requests, reads batches[0] and never counts them. It asserts the parent op, a {$ref: 0} child, the auto-filled description and unit price, and the computed amount in the payload, and it re-reads nothing. So it misses acceptance[0]'s "one batch, not N writes" and two lines, acceptance[5]'s stored-row read, and acceptance[1] and [2] entirely. The ref keeps acceptance[4].
• automation.setup-packaged-automation-board automated.ref: confirmed, as the table says. The item's revision bump is its steps[0] respelling, and its history row records the confirmation.
• Not this round, as the dispatch says: a fresh-install item for os migrate apply on an empty database writes no organization-ownership birth marker, so the fresh install's first os serve is refused as a 17.x / 18.0 pre-release database #24827's order and the live generation-0 refusal; the liveness row of auth.emailAndPassword.resetPasswordTokenExpiresIn; the fixture gaps of QA run · upgrade:ceremony (9/9) · 307ce4c4 · 2026-10-20 · 6 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #24838 and QA run · t2:24681-touched (28/28) · 307ce4c4 · 2026-10-20 · 12 PASS / 16 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #24841.

PM hypotheses, measured

1. "Round 14's two widening candidates still widen nothing." Half holds. form-view-subforms.spec.ts widens nothing (above). studio-editor.spec.ts asserts acceptance[1] of studio-authoring.record-page-roundtrip whole at its layer, so that ref widens.
2. "Fewer than five of the ~80 'isolated' hits are the posture." This holds: 0 of 79.

Acceptance notes

• Some edits were located beyond the dispatch's field list, inside items it names:
  • approvals.record-page-decisions fixtures.knownGaps[0]. Once source[2] names the declared-actions test, the steps and clauses contradict it. They describe buildApprovalDecisionActions (approve_request / reject_request in record_header, ordered -100 / -99, behind a client-side canDecide). At cf153eb2e535 the record page renders sys_approval_request's declared actions through DeclaredActionsBar above the page body: approval_approve, approval_reject and the other levers at record_section, gated by the server's viewer block. The knownGap says so, and no step or clause was rewritten. Re-deriving them is the anchor's call. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.
  • records-forms.crud-roundtrip: automated is removed under round 15's rule, the same reading the dispatch names for (b). acceptance[6].evidence names the planted-row evidence.
  • cli.datasource-introspect-codegen: knownGaps[2] and acceptance[0].verify said "the pins in automated", and now point at knownGaps[3].
• automation.setup-packaged-automation-board steps[3] reads "confirm every switch reads On … 31 On / 1 Off". At cf153eb2e535 the Activation cell reads "Not running here", with the switch still checked, for a flow the engine left unarmed (objectui#13159, packagedFlows.ts activationReading). On a default boot the engine reports a deployment-policy unboundCause for showcase_scheduled_digest and showcase_task_due_reminder (RUNNER.md, the scheduled-work entry). The switch reading still holds, but a count of the cell's "On" badges will not. Noted, not applied, because the dispatch scoped this item to its ref. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.
• Outside this round's spelling, 65 other non-history texts contain "isolated". Of these, 41 are the posture, 2 are other senses ("owner-isolated", "the isolated env"), and 22 name the own-port boot or its DB in other words: "an isolated boot on a file DB", "discard the isolated DB", "a dogfood-§0 isolated boot". Those 22 sit in 17 items: access-security.platform-owner-email-anchor, automation.connector-dispatch-matrix, automation.packaged-flow-subflow-disable-refusal, automation.packaged-flow-clone-contract, platform-core.boot-health, platform-core.seed-integrity, platform-core.interrupted-migration-boot-report, platform-core.manifest-install-contract, platform-core.activation-ledger-registration-home, platform-core.activation-ledger-row-contract, platform-core.marketplace-install-local-lifecycle, platform-core.runtime-config-boot-read, platform-core.lifecycle-retention-sweep, platform-core.seed-mode-matrix, records-forms.field-group-visible-when, records-forms.field-unique-enforcement and studio-authoring.metadata-diagnostics-sweep. The same reading risk applies. They are outside the claim's file surface, which names the "showcase isolated" spelling, so they are untouched. Carrier: qa(checklist): 18.0 release sweep anchor at 5b14b7f3 — re-point 5 red-row clauses + the wave's checklist-accuracy findings, fixture gaps and not-run handover (18 records) #24579.
• The dispatch's records-forms.record-page-roundtrip is studio-authoring.record-page-roundtrip: no records-forms item has that id, and PR docs(qa): 18.0 sweep anchor round 14 — drop the eleven automated.stale markers objectui 0b36ffa repaired, re-read at the console pin 616df6598b42 #24857's note names the studio-authoring one.
• The crud-roundtrip planting recipe and its expected answers (droppedFields naming lead_score with reason readonly, and the clone carrying no lead_score) are derived from source and were not replayed. The verify says so.
• The objectui specs were read, not run. Their verdicts at cf153eb2e535 are NOT MEASURED.

Gates

The derived list is node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. It is computed on the actual change set: 10 paths against merge base 4fe3af9d7, at head 6c4b8526af. It gives 13 commands. Each one ran at that head with its exit code captured before any pipe, and each exited 0:

node scripts/check-ci-filter-parity.mjs · node scripts/check-closing-keyword-parity.mjs · node scripts/check-closing-keyword-parity.mjs --self-test · node scripts/check-comment-mask-corpus.mjs · pnpm --filter @objectstack/lint run check:doc-formula-expressions · pnpm check:cross-package-test-inputs · pnpm check:doc-authoring · pnpm check:driver-memory-census · pnpm check:gitlink-declared · pnpm check:nul-bytes · pnpm check:platform-checklist · pnpm check:refd-timer-probe · pnpm check:watch-hint-literal

The first run of check:doc-formula-expressions refused with exit 3, a prerequisite: @objectstack/formula and @objectstack/lint were not built. Both were built under the shared verify lock (VERDICT command-exit 0, held 101 s, waited 0 s), and the rerun exited 0. The --ran reconciliation reads "13 derived, 13 run, 0 NOT-MEASURED, 0 UNRUN".

No per-PR CI job runs pnpm check:platform-checklist, so this local reading is its evidence:

reading	base e4d604efd3	head 6c4b8526af
items	16 areas, 328 items (323 active, 1 planned)	16 areas, 328 items (323 active, 1 planned)
line citations	0 survive across 21 swept documents	0 survive across 21 swept documents
symbol anchors	975/985 against 433 cited sources, 10 on the named residual (#16898), 18 file floors held	975/985 against 433 cited sources, 10 on the named residual (#16898), 18 file floors held

The new texts add no symbol anchor and no line citation.

git merge-tree --write-tree origin/main HEAD exited 0 against 4fe3af9d7e. No open PR touches docs/qa/platform-checklist/. All 14 open PRs' file lists were read over REST; the three with more than 100 files were read page by page, at 349, 367 and 206 files, each equal to its changed_files. So there was no second merge-tree to run.

There is no ablation, because no tested behaviour changed. skip-changeset was re-measured: docs/qa/** appears in none of the 73 non-private manifests' files[] (86 tracked package.json files), and the repo root is private.

---

Generated by Claude Code

[objectstack-fleet]

Seat review

ACCEPT · domain:devx seat 1 · os-warren · session_01FM29ZqLTrnPNXxijioZwMp · 2026-10-20T23:48Z · head fc6d8f5628 · card #24579, round 17 (claim 6303585734)

• Form. Draft, base main. The first line is Refs #24579, then Clause-②: no. Assignee os-warren; labels size/l, skip-changeset. node scripts/pm/check-governed-merges.mjs --pr 25003 → NOT governed. git merge-tree against main 4fe3af9d7e is clean, and no other open PR touches docs/qa/platform-checklist/.

• Ledger invariants, parsed, merge base 4fe3af9d7e vs head.

  • 10 area files, 85 items. Each has exactly one revision bump and one appended history row with ref: "#25003".
  • No item is added, removed or reordered, and no top-level key changes. RUNNER.md is untouched.

• The respelling, checked by the seat. The seat compared every non-history string of every edited item at base and head:

  • 79 occurrences of isolated leave edited strings, and all 79 are the "showcase isolated" spelling of the own-port boot;
  • 0 removals reach a posture text.

  The new spelling, "boot the showcase on its own port and DB", names the boot and not a posture. The one hit that named the canonical boot line keeps RUNNER's own term.

• The findings, read.

  • cli.dev-automigrate-policy: driver-sql test: "is force-disabled under NODE_ENV=production (warns, does not alter)" stages needs_confirm relax_not_null, which auto-reconcile never applies anyway — it passes with the production guard deleted and asserts no warning #24903's repaired case is back in the ref. It scores acceptance[2] at the driver layer, partial, with the production boot still its live leg, and knownGaps[2] is gone.
  • records-forms.crud-roundtrip acceptance[6]: the readonly half is now driven at the clone door on a row planted in the run's own file DB, else blocked(fixture), with the two pins as evidence at their own layers. automated is removed, by round 15's rule.
  • cli.datasource-introspect-codegen: automated is removed, with a knownGaps line naming each pin's layer.
  • records-forms.record-discussion-mentions: the second user comes from admin create-user, because a stock showcase is invite_only.
  • integration-system.datasource-admin-lifecycle: neither pin is added. One drives the routes over an auth double, the other enumerates the registrar over a mock, so each holds half a clause. This is rightly not applied.
  • The pin findings of PR chore(console): move the objectui pin 616df6598b42 → cf153eb2e535, past objectui's stored_expression toast row (objectui#13233), so PR #24778 can land #24982:
    • approvals.record-page-decisions source[2] is re-pointed from the deleted objectui test to RecordDetailView.approvalDeclaredActions.test.tsx, with a knownGap;
    • the packaged-automation ref is confirmed;
    • the two current-pin mentions now name cf153eb2e535.
  • The widening candidates: studio-editor.spec.ts's "Add block opens a block-type picker" asserts studio-authoring.record-page-roundtrip acceptance[1] whole, so that ref widens. form-view-subforms widens nothing.

• Deviations accepted. These are the edits inside named items that keep each item consistent with its own edit, plus the item-id correction for record-page-roundtrip. The PR body cites the gates at 6c4b8526af; the dev re-ran all 13 at the final head with the same result.

• Gates.

  • The seat ran node scripts/check-platform-checklist.mjs at the head. Exit 0: 16 areas, 328 items (323 active, 1 planned), line citations: 0 survive across 21 swept documents, symbol anchors: 975/985 resolved, 18 file floors held.
  • The dev's dispatch-gates union is 13 derived, 13 run, all exit 0; --ran reconciles.
  • Check-runs at fc6d8f5628: 40, 31 success, 9 skipped, 0 failing or pending. node scripts/pm/check-expected-skips.mjs --pr 25003 → OK. No review, no comment.

• Carried (the dev's out-of-scope findings):

  • approvals.record-page-decisions: its steps and clauses still describe the record header's hand-written Approve/Reject, which objectui#3055 retired before both pins. The item needs re-deriving against DeclaredActionsBar.
  • automation.setup-packaged-automation-board steps[3]: the "31 On / 1 Off" count no longer holds, because objectui#13159 shows "Not running here" for an unarmed flow.
  • 22 other non-history texts in 17 items name the own-port boot or its DB with "isolated" in other words.

This seat readies the PR and queues it with auto-merge.

---

Generated by Claude Code