QA run · platform-core (27/34) · 5b14b7f3 · 2026-10-19 · 21 PASS / 4 PARTIAL / 2 FAIL / 0 BLOCKED / 7 NOT-RUN #24557

QA run record for selector area:platform-core (bare area platform-core in the title for the roll-up), 18.0 release sweep, plan B (Tier 1 + Tier 2 driven, Tier 3 deferred). Text only — no screenshots; reproduction rules below.

Environment fingerprint

• framework: 5b14b7f3ad8e2e0786d228772f473d07b36b2477 (objectstack-ai/objectstack, pinned — no pull)
• console: vendored objectui build stamped 4016370af3c9c9dafec2bc5299afd8e8079701b8 (= .objectui-sha), built with pnpm objectui:build; objectui-only pins run in a checkout at that same sha
• app: examples/app-showcase, canonical boot OS_PORT=P objectstack dev --ui --seed-admin -p P -d file:RUN/data.db with per-item OS_HOME / OS_STORAGE_LOCAL_ROOT; package-installing items booted from a scratch copy outside the repo
• ports: each runner its own range (41100–42319), one file DB per item; seed: stock showcase (132 rows) + --seed-admin
• run window: 2026-10-19 12:26–13:45 UTC; host: 4 vCPU / 15 GB container shared by up to 7 parallel runners (load average peaked ~40; two boots timed out under load and were re-run serially — no verdict rests on a starved run)
• runner: one dispatching session + parallel runner sub-agents (not sequential); every persona identity proven server-side (GET /auth/get-session) before each cell

Scope

Selector area:platform-core → 34 runnable items (node scripts/checklist-select.mjs area:platform-core --json). No planned items; none hidden as blocked. The 4 unpinned P0 items (boot-health, seed-integrity, console-login, builtin-apps-nav-render) are also driven by the separate priority:P0 gate card — independent second judgement by design.

Tier 1 pin evidence: every file named in the area's automated.ref fields was run once, batched per package at the subject sha (RUNNER rule 6). Framework pins: 122 files, all green (cli 61 + nightly-tier e2e 2, core 72, metadata/-core/-protocol 393, objectql 274, platform-objects 44, plugin-audit 172, plugin-hono-server 38, plugin-security 192, plugin-sharing 69, dogfood 448 passed / 1 skipped [the attachments cross-tenant (g) dependency marker — scores no clause here], rest 86, runtime 291, service-automation 49, service-settings 117, service-storage 279, spec 42). A pin was cited only for the clauses it actually asserts; every clause it does not assert was driven live or is marked below.

Per-clause verdicts

by = runner; evidence is server truth (API / log / test output) in one line; UI clauses describe what the checked screenshot showed.

platform-core.boot-health (rev 7) — PASS

platform-core.seed-integrity (rev 3) — PASS

platform-core.console-login (rev 4) — PASS

platform-core.nav-surfaces-render (rev 6) — PASS

platform-core.metadata-registry-serving (rev 2) — PASS

platform-core.metadata-authoring-roundtrip (rev 3) — PASS

platform-core.builtin-apps-nav-render (rev 6) — PASS

platform-core.settings-hub-roundtrip (rev 4) — PASS

platform-core.package-lifecycle-enable-disable (rev 1) — FAIL

platform-core.notification-center (rev 2) — PASS

platform-core.docs-audience-gate (rev 1) — PARTIAL

platform-core.interrupted-migration-boot-report (rev 2) — PASS

platform-core.manifest-install-contract (rev 3) — PASS

platform-core.activation-ledger-registration-home (rev 5) — PASS

platform-core.activation-ledger-row-contract (rev 4) — PASS

platform-core.marketplace-install-local-lifecycle (rev 4) — PASS

platform-core.runtime-config-boot-read (rev 1) — PASS

platform-core.docs-portal-render (rev 2) — PASS

platform-core.url-overlay-contract (rev 1) — PASS

platform-core.home-admin-cluster-links (rev 3) — PASS

platform-core.lifecycle-retention-sweep (rev 4) — PASS

platform-core.seed-mode-matrix (rev 2) — PASS

platform-core.settings-audit-secret-fingerprint (rev 2) — PASS

platform-core.v18-boot-refusals (rev 1) — FAIL

platform-core.protocol-18-handshake-and-stored-replay (rev 1) — PARTIAL

platform-core.settings-organization-isolation-and-platform-rung (rev 1) — PARTIAL

platform-core.serve-composition-v18 (rev 1) — PARTIAL

Handoff — items not reached (NOT-RUN)

Tier 3 deferred by the 18.0 release-sweep plan (plan B: P2 items without an automated.ref are not driven this wave):

• platform-core.shell-nav-personalization (P2, browser, rev 4) — not-run
• platform-core.app-management-toggle (P2, mixed, rev 3) — not-run
• platform-core.packaged-object-extend-only (P2, api, rev 2) — not-run
• platform-core.marketplace-console-honesty (P2, browser, rev 5) — not-run
• platform-core.keyboard-shortcut-surface (P2, browser, rev 4) — not-run
• platform-core.theme-mode-persistence (P2, browser, rev 2) — not-run
• platform-core.console-installability-indicators (P2, browser, rev 1) — not-run

Reproduction rules for each FAIL

platform-core.package-lifecycle-enable-disable · acceptance[5] — product defect (objectui console)

Clause: after disable, the package's nav is gone and a stale deep link lands on a named not-found inside the shell, never a dead page. Nav-absent half passes; the deep-link half fails. Reproduced 2/2 by the first runner and 2/2 by an independent RUNNER rule 7 verifier on a fresh boot (traps ruled out: 60 s settle with silent network after 1.1 s; console stamp = pin; direct navigation, no clicks on the failing surface).

1. Boot showcase (objectstack dev --ui --seed-admin); POST /api/v1/auth/sign-in/email {"email":"admin@objectos.ai","password":"admin123"} → bearer.
2. POST /api/v1/packages {"manifest":{"id":"com.qa.probe","name":"QA Probe","version":"0.1.0","type":"app","namespace":"qaprobe"}} → 201.
3. PUT /api/v1/meta/object/qaprobe_widget?mode=draft&package=com.qa.probe {"name":"qaprobe_widget","label":"QA Widget","sharingModel":"public_read_write","fields":{"name":{"type":"text"}}} → 200; POST /api/v1/packages/com.qa.probe/publish-drafts {} → 200; GET /api/v1/meta/object/qaprobe_widget → 200.
4. PATCH /api/v1/packages/com.qa.probe/disable {} → 200 status:disabled. GET /api/v1/meta/object/qaprobe_widget → 404 {"error":"Object 'qaprobe_widget' belongs to a disabled package…","code":"OBJECT_PACKAGE_DISABLED"}.
5. Sign in through /_console/login, open /_console/apps/showcase_app/qaprobe_widget.
   • expected: Showcase shell with a named not-found / package-disabled state.
   • actual: full-page "ObjectOS · Opening your console…" splash, still present at 60 s; network shows two 404 OBJECT_PACKAGE_DISABLED, then nothing.
   • control: /_console/apps/showcase_app/no_such_object_xyz → 404 RESOURCE_NOT_FOUND → named "Object Not Found" inside the shell.

Discriminator (verifier, Playwright response rewrite, status kept 404): wrapped body with the SAME code still hangs; flat or wrapped body with code RESOURCE_NOT_FOUND renders the named not-found. The code value decides, not the envelope. Mechanism (objectui at the pin and on objectui main 61ed5ad alike): isMetaItemAbsentError (data-objectstack) recognises only RESOURCE_NOT_FOUND, so the by-name scope read is classed failed; fetchScopeName drops it without re-render; the first-paint gate in AppContent.tsx never settles. Secondary framework observation (not the cause): the RestServer /meta/object/:name refusal is the flat {error, code} shape without the object key /data carries, while the runtime dispatcher answers the wrapped envelope — both are live ADR-0112 shapes; the #7557 changelog example shows only the wrapped one.

platform-core.v18-boot-refusals · acceptance[2] — assertion defect (not a product break)

Clause: "the refused boot did not alter the database", oracle build, checksum before == after.

1. Build a real v17 database: npm @objectstack/cli@17.7.0, os init, os dev --seed-admin -d file:v17.db, create 3 records, stop (sha256 de915b8f…, 69 tables, 66 rows).
2. Copy it; from examples/app-showcase run OS_DATABASE_URL=file:COPY OS_SECRET_KEY=64-hex objectstack serve -p PORT.
3. Result 3/3: rc=1 before listening, refusal names the 7 tables still carrying organization_id and os migrate organization-ownership (acceptance[1] pass). sha256 after ba74b704… ≠ before — expected by the clause: equal.
4. Row-level diff (pristine vs after, each table on its original columns): 0 tables differ, 66/66 rows identical, no new table holds a row, no column dropped. The change is the engine's additive schema sync (41 empty tables, __search columns, indexes). A 17.7.0 boot of the refused copy still serves the 3 original rows.

§5 disposition: assertion defect. The declared contract is row-level: runtime CHANGELOG ("judges … after the engine's schema sync (the column the rewrite step waits for is still added) … A refused boot leaves every row as it found it"), the guard's header, and the kernel pin that asserts the additive tables exist and hold no rows. negative[0] (served or half-migrated v17 DB) holds. Owed: re-point acceptance[2] to a row-level oracle (routed to the wave anchor, see below). acceptance[3] is blocked(fixture): the step's services:{auth:false} is not a real stack key.

RUNNER rule 7 (P0 fails / release-blocking findings)

• platform-core.v18-boot-refusals acceptance[2] (P0): independent agent re-derived from the captured evidence alone — FAIL against the clause as written, PASS against the declared contract — then re-ran on a realistic 17.7.0 database (3/3). Agreement: assertion defect, not release-blocking.
• platform-core.package-lifecycle-enable-disable acceptance[5] (P1, user-visible): independent agent re-derived FAIL from the evidence alone and reproduced 2/2; it corrected the first runner's causal story (code value, not envelope shape). Product defect in objectui; not a data or security issue.

Partial items — what was not proven

• docs-audience-gate acceptance[2]: the unknown-future-audience-shape fail-closed branch is unreachable live (a save with an unknown shape is refused 422) and has no test; only the source line evidences it.
• protocol-18-handshake-and-stored-replay acceptance[3]: blocked(fixture) — no ^18 artifact built before a retirement exists in this checkout.
• settings-organization-isolation-and-platform-rung acceptance[2], [3]: blocked(environment) — 18.0 refuses OS_TENANCY_POSTURE=isolated at boot (NOT_IMPLEMENTED, single only); pins pass.
• serve-composition-v18 acceptance[5]: blocked(environment) — needs an unbuilt console, i.e. removing the shared tree's console dist.

Checklist-accuracy findings / fixture gaps (for the wave anchor card — not extracted)

• v18-boot-refusals: re-point acceptance[2] to a row-level oracle (above); step 2 services:{auth:false} is not a stack key; the literal ORGANIZATION_OWNERSHIP_MIGRATION_REQUIRED is only on error.code, never printed.
• package-lifecycle-enable-disable: the step should say an object needs sharingModel and a view viewKind before publish accepts them.
• builtin-apps-nav-render steps[5]: 45 Setup destinations → this boot serves 42 (matches source minus gates); Configuration / Advanced (Setup) and Developer (Account) groups render collapsed — a sidebar walk must expand them.
• home-admin-cluster-links acceptance[3]: the Help menu also lists Keyboard shortcuts and About, not "documentation only".
• settings-hub-roundtrip: invalid-timezone code is value_domain, not invalid_option; no stock namespace is user-scoped, so the multi-scope secret walk cannot run as written.
• notification-center: console polls sys_inbox_message / sys_notification_receipt through the data API, not GET /notifications?view=mine; the Approvals tab is a count + "View approvals" link, not a list (scored pass on the count match — reword).
• docs-audience-gate: knownGaps[0] half stale (showcase ships a public book); acceptance[3] "lesser persona's tree ⊂ admin's" is wrong for permission-set books (a non-holder admin sees less than a holder) — reword to holder vs non-holder. Missing test: unknown audience shape denies.
• runtime-config-boot-read steps[1]: logoUrl / faviconUrl / brandColor appear only when configured.
• manifest-install-contract: knownGaps[3] and negative[2] say NamespaceConflictError has no code — stale; it carries NAMESPACE_CONFLICT / 422.
• marketplace-install-local-lifecycle: step 3 typo install./examples; "fresh sign-up" must be admin create-user (invite-only posture); on showcase the cloud arm comes from host config, not the CLI.
• activation-ledger-row-contract: the catalog door now also accepts sharing_rule — a fifth ledger writer; the four-value variants are stale.
• serve-composition-v18: examples/app-crm no longer declares a datasourceMapping.
• settings-organization-isolation-and-platform-rung / walled legs generally: the isolated-posture fixture cannot boot on 18.0 — knownGap should say live legs wait for the walled release.
• url-overlay-contract: useUrlOverlay.test.tsx asserts no history behaviour (replace semantics evidenced only by hand); step 5 "breadcrumb" is now an inline back link.
• metadata-authoring-roundtrip: objectui studio-record-page.spec.ts red (stale, as noted); studio-object-designer.spec.ts F1 (targets the not-loaded studio app) and F4 (new select-options rule) are red too, contrary to the item's note; acceptance[2] hand-driven instead.
• RUNNER env fact: showcase resolves @playwright/test 1.63.0, not 1.62.1.
• fixture: marketplace browse needs egress to the cloud catalog (502 MARKETPLACE_PROXY_FAILED here) — knownGap, not scored.

Observations (not clause verdicts)

• Seed replay rewrites 5 unchanged showcase rows on every restart (updated_at bumped; counts and ids unchanged) — extracted as a product defect at close-out.
• A list view bound to an object outside the writing package's dependency closure is accepted with unknown columns fields on active PUT and draft→publish (observed while driving metadata authoring; no clause asserts it) — extracted at close-out.
• console-login: after a server-side sign-out, in-app navigation without reload does not auto-redirect (data pages show "Sign in required"); not scored by the item.
• builtin-apps: a member's user record shows both "Unban User" and "Ban User".
• seed-mode-matrix: with two rows sharing the match key, upsert matched the most recently created one; replace mode inserts without clearing (posture recorded, not scored as scoped deletion).
• docs-portal: in-body cross-links inside the app-scoped docs viewer leave the app for global /docs.

Timing

Wave-level (one shared build for all three area runs): environment preparation 20 min wall (12:26 → 12:46 UTC: pnpm install 25 s, pnpm build 7m45s, console build 19 min incl. one re-run after a concurrent-build race in @objectstack/lint DTS), of which the API/unit lane was ready after 9 min; testing ~70 min wall (12:35 → 13:45) across parallel runners. Environment : testing ≈ 1 : 3.5 wall. Inside the runners, per-item boot/wait time summed ~55 min of agent time vs ~300 min of driving. This area: Tier 1 batch ~14 min (shared), Tier 2 drivers 4 parallel groups.

Derived item verdicts

• PASS (21): platform-core.boot-health, platform-core.seed-integrity, platform-core.console-login, platform-core.nav-surfaces-render, platform-core.builtin-apps-nav-render, platform-core.metadata-registry-serving, platform-core.metadata-authoring-roundtrip, platform-core.interrupted-migration-boot-report, platform-core.activation-ledger-registration-home, platform-core.activation-ledger-row-contract, platform-core.url-overlay-contract, platform-core.lifecycle-retention-sweep, platform-core.settings-audit-secret-fingerprint, platform-core.settings-hub-roundtrip, platform-core.notification-center, platform-core.manifest-install-contract, platform-core.marketplace-install-local-lifecycle, platform-core.runtime-config-boot-read, platform-core.docs-portal-render, platform-core.home-admin-cluster-links, platform-core.seed-mode-matrix
• PARTIAL (4): platform-core.docs-audience-gate, platform-core.protocol-18-handshake-and-stored-replay, platform-core.settings-organization-isolation-and-platform-rung, platform-core.serve-composition-v18
• FAIL (2): platform-core.v18-boot-refusals, platform-core.package-lifecycle-enable-disable
• NOT-RUN (7): Tier 3 deferred, listed above

Generated by Claude Code