QA run · api-backend (22/27) · 5b14b7f3 · 2026-10-19 · 20 PASS / 1 PARTIAL / 1 FAIL / 0 BLOCKED / 5 NOT-RUN #24541

Run record for the 18.0 release QA wave (dispatch session session_01CfRDy7SuTfUqaTu2AEH2Hi; maintainer-approved plan B: Tier 1 + Tier 2, Tier 3 deferred). Runner session session_016CErRJhdMYZdRg4pe8iQfD. Protocol: .claude/skills/checklist-test/SKILL.md + docs/qa/platform-checklist/RUNNER.md.

Environment fingerprint

• framework: 5b14b7f3ad8e2e0786d228772f473d07b36b2477 (pinned; pnpm install --frozen-lockfile + pnpm build, 76/76 tasks green)
• .objectui-sha: 4016370af3c9c9dafec2bc5299afd8e8079701b8; console built with pnpm objectui:build (shallow clone into .cache/objectui-4016370af3c9), packages/console/dist/.objectui-sha matches, pnpm check:console-sha green
• resolver: node scripts/checklist-select.mjs area:api-backend --json → 27 runnable · 0 blocked hidden · 0 planned
• app: showcase · boot OS_PORT=P objectstack dev --ui --seed-admin -p P -d file:…/ITEM.db · per-runner port range and per-item file DB · seeded admin + demo personas; staged configs only in scratch copies of the app
• browser: Playwright on /opt/pw-browsers/chromium, headless, one context per persona
• timestamp: 2026-10-19 (UTC) · execution: parallel fan-out, one sub-agent runner per item group:
  • A1: ports [41300,41301,41302] · env 3 min / test 12 min
  • A2: ports [41310] · env 3 min / test 9 min
  • A3: ports [41360,41361] · env 3 min / test 13 min
  • A4: ports [41370,41371,41372] · env 9 min / test 15 min

Scope

Selector area:api-backend · 27 runnable item(s) (revision = the one each verdict is valid for):

• api-backend.batch-transactional-discovery r5 · P1 · api · Tier 2 → pass (runner A1)
• api-backend.formula-gates r2 · P1 · build · Tier 2 → pass (runner A2)
• api-backend.enforce-or-remove-authoring-gates r4 · P1 · build · Tier 2 → pass (runner A2)
• api-backend.server-timing-admin-gated r4 · P2 · api · Tier 3 → not-run
• api-backend.query-contract-matrix r3 · P0 · api · Tier 1 → pass (runner A3)
• api-backend.error-envelope-ledger r4 · P1 · api · Tier 2 → pass (runner A1)
• api-backend.bulk-write-contract r2 · P1 · api · Tier 1 → pass (runner A3)
• api-backend.route-ledger-live-parity r4 · P2 · api · Tier 3 → not-run
• api-backend.declarative-endpoint-execution r3 · P1 · api · Tier 1 → pass (runner A3)
• api-backend.package-rest-lifecycle r3 · P2 · api · Tier 3 → not-run
• api-backend.api-console-discovery-execute r2 · P2 · browser · Tier 3 → not-run
• api-backend.filter-comparand-conformance r3 · P1 · api · Tier 2 → pass (runner A1)
• api-backend.date-range-preset-matrix r2 · P2 · api · Tier 3 → not-run
• api-backend.retired-def-refusal r2 · P1 · build · Tier 2 → pass (runner A2)
• api-backend.packaged-action-disabled-dispatch r3 · P0 · api · Tier 1 → pass (runner A3)
• api-backend.action-activation-door-contract r2 · P2 · api · Tier 1 → pass (runner A4)
• api-backend.aggregate-contract-matrix r2 · P1 · api · Tier 2 → partial (runner A1)
• api-backend.formula-stdlib-matrix r2 · P1 · mixed · Tier 2 → pass (runner A2)
• api-backend.api-methods-verb-gate r1 · P1 · api · Tier 2 → pass (runner A1)
• api-backend.rest-crud-config-contract r2 · P2 · api · Tier 1 → pass (runner A4)
• api-backend.rest-batch-config-contract r2 · P2 · api · Tier 1 → pass (runner A4)
• api-backend.rest-metadata-config-contract r4 · P1 · api · Tier 1 → pass (runner A4)
• api-backend.rest-route-generation-tombstones r1 · P2 · build · Tier 1 → pass (runner A4)
• api-backend.second-object-exposure-and-internal-fields r1 · P1 · api · Tier 1 → pass (runner A3)
• api-backend.data-request-shape-and-query-arity r1 · P1 · api · Tier 1 → pass (runner A3)
• api-backend.meta-read-doors-v18 r1 · P2 · api · Tier 1 → pass (runner A4)
• api-backend.error-sentences-and-unique-violation-wire-code r1 · P2 · api · Tier 1 → fail (runner A4)

Per-clause verdicts

Reproduction rules (fails)

• api-backend.error-sentences-and-unique-violation-wire-code acceptance[2] — disposition: assertion-defect · the product matches its pinned contract (dispatcher-unique-violation-wire-code.test.ts: details carry field only when the driver names a single column; a tenancy-scoped composite unique names none), the clause over-claims. Per this wave's plan (no checklist edits, no anchor cards from runners) the test-fix is parked on the wave anchor via the Checklist-accuracy section below for the dispatch session to collect; no product card.
  • repro: scratch app: object showcase_a4_unique {code: text unique:true}; script action showcase_a4_dup (perRecord) whose body does ctx.api.object('showcase_a4_unique').insert({code:'DUP-A4'}); POST /api/v1/data/showcase_a4_unique {code:'DUP-A4'} → 201; POST /api/v1/actions/showcase_a4_unique/showcase_a4_dup {recordId:‹id›} → 409
  • expected vs actual: clause expects details naming the field; actual details = {developerMessage, object}, no field. The pin dispatcher-unique-violation-wire-code.test.ts asserts exactly this key set for an engine write ('The driver names no single column: the index is the tenancy-scoped composite' → ['developerMessage','object']) and adds field only when DuplicateRecordError states a column. Product matches its pinned contract; the clause over-claims.
  • mechanism: packages/runtime/src/dispatcher-unique-violation-wire-code.test.ts:195-201 (key set without field) vs :207-211 (field only for a named-column throw)

Derived item verdicts

20 pass · 1 partial · 1 fail · 0 blocked · 5 not-run (of 27).

Tier 1 pin runs (RUNNER rule 6, one vitest batch per package, all at the subject sha):

• packages/metadata-protocol: 4 files, 77 passed (relation-condition-target-exposure, expand-target-exposure, data-door-internal-field-positions, app-package-id-key)
• packages/runtime: 12 files, 296 passed (action-activation-dispatch, action-activation-posture-gate, data-write-request-gate, data-delete-expected-version, dispatcher-query-arity, packages-write-flag-arity, data-conflict-caller-visibility, dispatcher-unique-violation-wire-code, endpoint-executor, meta-object-sortability-caller-fls, meta-app-package-id-key, meta-package-all-fold)
• packages/objectql: 3 files, 202 passed (engine incl. [Security: $expand bypasses RLS/FLS on the referenced object (data leak on lookups) #2850], engine-filter-array-lowering, internal-field-positions)
• packages/rest: 9 files, 742 passed (request-schema-gate.conformance, rest-sub-config-parse-not-cast, rest-config-mount-table.pin, rest-batch-size-cap, rest-write-route-hook-refusal-sentence.ledger, rest-hook-script-fault-envelope, meta-object-sortability-caller-fls, rest-server-meta-member-selector, rest-server-meta-door-closed-sets)
• packages/spec: 1 file, 48 passed (api/apis-publish-gates)
• packages/services/service-storage: 1 file, 18 passed (storage-routes.server-fault-withheld)
• packages/qa/dogfood: 5 files, 57 passed (declarative-endpoint-policy, action-params-contract, owner-anchor-and-bulk-writes, packaged-activation-ledger-reach, showcase-declarative-endpoints) — first attempt was OOM-killed (exit 137, container memory cap) and re-run with --maxWorkers=1; the re-run is the evidence

Partial / gap notes:

• api-backend.aggregate-contract-matrix: negative[2] (driver pushdown vs in-memory bucket labels agree under a non-UTC zone) not-run — the timezone lever was not exercised; everything else passed
• api-backend.error-sentences-and-unique-violation-wire-code: acceptance[1] blocked(fixture) — a package cannot author a hook on sys_sharing_rule (compile refuses), so the VALIDATION_ERROR rows rest on the ledger pin only; the /data-family probe on a scratch object returned the hook sentence verbatim with the pinned code-less 400

Handover — items with no verdict this run

• api-backend.server-timing-admin-gated r4 · P2 · api — Tier 3 deferred by the 18.0 release-sweep plan
• api-backend.route-ledger-live-parity r4 · P2 · api — Tier 3 deferred by the 18.0 release-sweep plan
• api-backend.package-rest-lifecycle r3 · P2 · api — Tier 3 deferred by the 18.0 release-sweep plan
• api-backend.api-console-discovery-execute r2 · P2 · browser — Tier 3 deferred by the 18.0 release-sweep plan
• api-backend.date-range-preset-matrix r2 · P2 · api — Tier 3 deferred by the 18.0 release-sweep plan

Checklist-accuracy findings / fixture gaps

Recorded for the wave anchor (collected by the dispatch session); not extracted, no checklist edit in this run.

Checklist accuracy:

• api-backend.error-envelope-ledger · acceptance[3] · HttpStatusErrorCodeMap is a status→floor-code map (400→VALIDATION_ERROR, 404→RESOURCE_NOT_FOUND …), not a code→status map; OBJECT_NOT_FOUND/RECORD_NOT_FOUND/VALIDATION_FAILED etc. have no entry in it, so the clause can only be judged by code family (ErrorHttpStatusMap category). Name the oracle the clause actually means
• api-backend.aggregate-contract-matrix · step 6 · 'aggregations as a non-array → the shape refusal with the worked example': on POST /data/:object/query the request schema answers first (400 VALIDATION_FAILED fields[query.aggregations] 'Invalid input: expected array, received object'), so protocol.ts's worked-example message (~line 13960) is not reached on this door — the same spec: FilterConditionSchema (the save-time door) admits a non-boolean $null / $exists flag, so a stored dataset or widget filter carrying one saves clean and is refused 400 on every query face #20116 door posture filter-comparand-conformance rev 3 records. Step text should name the door or expect the schema refusal
• api-backend.api-methods-verb-gate · fixtures · scratch-object legs need OS_METADATA_WRITABLE=object on the boot and the object body needs sharingModel (author-time lint security-owd-unset 422 otherwise); the item says only 'runtime metadata authoring'. Non-array apiMethods is refused 422 by Zod at PUT, so the fail-closed arm of acceptance[2] is reachable only via the local resolver, not live
• api-backend.api-methods-verb-gate · step 7 · the cross-object /batch 405 names 'bulk' (the gate the route checks) not 'update'; the step's expectation is unspecific, recorded for the next runner
• api-backend.batch-transactional-discovery · step 4 · an invoice missing required fields fails pre-write validation, so it may not exercise a real transaction rollback; a mid-batch runtime failure (update on a nonexistent id after a create) proves the rollback more directly — consider naming it
• api-backend.formula-stdlib-matrix · acceptance[2]/step 3 · 'coalesce falls back on null/undefined ONLY' — undefined is not observable through CEL: a record key whose value is undefined faults 'No such key' before coalesce runs; the clause is effectively null-only from the authoring surface
• api-backend.enforce-or-remove-authoring-gates · step 2 · a 'view' filter is the array shape [{field,operator,value}], not a FilterCondition; the stored-$regex leg is only meaningful on a widget/report filter (used ops-dashboard widget filter)
• api-backend.retired-def-refusal · step 5 · manifest.loading's carrier has no runtime metadata-write door at all (package/manifest/plugin are 'not a metadata type'); step could say so like it does for code-only agent
• api-backend.second-object-exposure-and-internal-fields · step 1 · the literal probe filter=[["t_ref.name","=","x"]] is a DOTTED path and answers 400 INVALID_FIELD (prescribing the nested form), not the exposure refusal; the nested-relation spelling that reaches the exposure gate is filter={"t_ref":{"name":"x"}} / where {t_ref:{name:x}}
• api-backend.second-object-exposure-and-internal-fields · acceptance[1] · clause says the refusal names 'where.t_ref'; both GET and POST doors locate it as 'filter.t_ref'
• api-backend.bulk-write-contract · step 4 / acceptance[2] · updateMany stops at the first failed row by default, so a single batch [nonexistent, foreign] reports the foreign id NOT_ATTEMPTED, not RECORD_NOT_FOUND; the step must send the ids in separate calls or with options.continueOnError:true to observe the no-existence-oracle parity
• api-backend.query-contract-matrix · observation · list GET accepts $expand while single-record GET /data/:object/:id refuses $expand (400 VALIDATION_ERROR, 'Supported parameters: expand, select') with a different envelope ({error:{code,message}} vs flat {error,code}) — not an item claim, A repeated ?filter= answers two different error codes depending on which data route received it #8001-family residual
• api-backend.query-contract-matrix · observation · POST /query body sort:'name' (bare string) → 400 VALIDATION_FAILED query.sort; only the array spelling is served — not an item claim
• api-backend.declarative-endpoint-execution · observation · the stack-schema refusal text reads 'Only object_operation and flow endpoints execute in 17.x' on the 18.0 subject (packages/spec/src/api/endpoint-publish-gate.ts:371) — stale version wording; dogfood pin title '[E8(#5040 执行器):验收 —— showcase 端点回迁 /apps/showcase/… + RED-first e2e + 真实 boot 探针 + 升级文档安全复核 #5112] GET /meta/api returns both restored declarations' while the showcase declares three
• api-backend.packaged-action-disabled-dispatch · observation · POST /auth/admin/create-user answered membershipCreated:false, yet the user operated in the Default Organization (stamped organization_id on writes) — no clause affected
• api-backend.rest-crud-config-contract · knownGaps[1] + automated.ref · 'the MOUNT half has no permanent pin' is stale: packages/rest/src/rest-config-mount-table.pin.test.ts ([finding] The MOUNT half of every RestServerConfig switch is unpinned — the tests assert what a switch normalizes to, never that the route leaves the table #15544) pins every crud.operations.* radius as an exact route-set diff (24/24 ✓ at 5b14b7f) — add it to automated.ref
• api-backend.rest-batch-config-contract · knownGaps[1] + automated.ref · same: the mount pin covers batch.enableBatchEndpoint, operations.*Many and the protocol-member conjunct (§2) — add it to automated.ref
• api-backend.rest-metadata-config-contract · acceptance[4]/step 9 · enableCache carve-outs are now SEVEN: a ?member= (memberScoped, [finding] email_template: a Studio save of the same template in a second locale replaces the first locale's overlay at the next boot (sys_metadata keeps one overlay row per type and name) #22877) read also bypasses getMetaItemCached (packages/rest/src/meta-item-read-routes.ts:672-673)
• api-backend.rest-metadata-config-contract · personas[1] · still says 'cannot read every field of showcase_account'; rev 4 moved the fixture to showcase_project/client_liaison
• api-backend.meta-read-doors-v18 · step 5 / acceptance[4] · step names showcase_task, but stock FLS only exists on showcase_project (showcase_client_liaison); and the contract is that the hidden field is ABSENT from sortability (pin: 'sortability never offers the unreadable field'), not 'marked unsortable'
• api-backend.error-sentences-and-unique-violation-wire-code · fixtures/step 1/acceptance[1] · a package hook on sys_sharing_rule is refused at compile ("Hook … references object 'sys_sharing_rule' which is not defined in objects"); the /data door answers a hook refusal 400 with NO code by pinned design ('the refusal envelope carries no code when the hook declared none'); VALIDATION_ERROR applies only to the re-dressed hand-built rows (REFUSED_400 in the ledger pin)
• api-backend.error-sentences-and-unique-violation-wire-code · acceptance[2] · 'details naming the field' over-claims: details carry field only when the driver names a single column; an engine write against a tenancy-scoped composite unique index answers details {developerMessage, object} (dispatcher-unique-violation-wire-code.test.ts:195-211)
• api-backend.error-sentences-and-unique-violation-wire-code · fixtures · 'pnpm dev -- --fresh -p PORT' boot spelling vs RUNNER canonical boot; also a scratch object needs sharingModel or the author-time rule security-owd-unset refuses compile
• api-backend.action-activation-door-contract · acceptance[4] · the metadata-plane-degraded 503 arm (actions.ts:212-221) is named in the clause but is neither stock-reachable nor covered by any pin in automated.ref
• api-backend.rest-crud-config-contract · acceptance[2] · the harness can only show 'no handler'; the switched-off op's live wire answer is unobservable ([finding] No shipped boot path authors RestServerConfig at all — os serve fixes it and the dev plugin passes none, so every live crud / metadata / batch key is embedder-only #15543) and the composed server's hono dispatcher catch-all also serves /data routes — the clause's dispatcher-vs-hono-route trap is not discharged by a RestServer-only table

Fixture gaps:

• api-backend.aggregate-contract-matrix · stock showcase_account has no row with null annual_revenue (needed for count-'*' vs count-field) and no Sat/Sun or year-boundary ISO-week pair — 3 rows seeded at run time
• api-backend.filter-comparand-conformance · showcase_field_zoo has only 2 rows — answer sets are discriminating but thin
• api-backend.query-contract-matrix · acceptance[4] needs a contributor-bound member owning an invoice WITH a contact; no seeded user holds the contributor position and no seeded invoice carries a contact (all 12 contact:null). Provisioned at runtime: admin create-user + sys_user_position{position:'contributor'} (search:qa-contributor-bound-member) + member-created invoice with owner=self, account=Contoso, contact=Carl Fox
• api-backend.packaged-action-disabled-dispatch · acceptance[3] both-persona variant used the same runtime-provisioned contributor member
• api-backend.error-sentences-and-unique-violation-wire-code · no package-authorable hook can reach a hand-built nested-envelope write row (sharing rules / approvals / suggested bindings) — the VALIDATION_ERROR half is pin-only
• api-backend.action-activation-door-contract · ambiguity / 501 / 503 arms still pin-only (no colliding scratch package authored this run)

Incidental product finding (outside any clause)

• Seen while driving api-backend.error-sentences-and-unique-violation-wire-code acceptance[3] (forced storage fault), independently re-verified on a healthy stock boot: POST /api/v1/storage/upload/complete commits a file record (status committed) for bytes that were never stored; the signed download then answers 500. Extracted as its own defect card at close-out (see the close-out comment).