QA run · release-18.1.0-manual-set (15/15) · 77392e90 · 2026-10-23 · 12 PASS / 2 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #25479

This record covers the 18.1.0 release sweep's manual non-P0 set, run on the same main head as the P0 manual re-test (QA run #25478). The set uses the sweep rule: the since:v18 items with no automated pin, plus the manual P1 items that the breaking commits since the last P0 sweep touched. Those commits cover cloud-managed sign-up and invite refusal, the REST /actions and MCP action channel, settings D9, metadata rollback and flow get_record limits, together with objectui's approval record page, CSV import and bulk confirmText. The set was named by hand rather than resolved by a single selector, and every item it names has a verdict (15/15).

Environment fingerprint

• framework 77392e901cce58316e803144971f2741ef049fc4. .objectui-sha is 5fef032b1ada5b86bad640637e7331e26ee5da6e.
• tree, console and container are the same as the P0 record. The console deviation applies here too: the console was built at the same pin from a sibling worktree at f0fdd45b, because pnpm objectui:build at the pin fails on this main (hourly full run: red on main (CI) #25438). The stamp equals the pin.
• boots: stock showcase, one port range and file DB per runner, with OS_PORT exported. platform-core.marketplace-install-local-lifecycle and cli.fresh-install-migrate-apply-first booted from a scratch copy under examples/, which was deleted afterwards. examples/app-showcase/.objectstack/installed-packages/ never existed.
• execution: three runner agents (CLI/API · identity/settings/studio · approvals/actions/UX). git status stayed clean.

Scope and verdicts

None of the 15 items carries an automated.ref, so every clause was driven live.

Derived: 12 PASS / 2 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN.

Per-clause evidence (one line per clause)

cli.fresh-install-migrate-apply-first

• A0 pass: os migrate apply --yes exits 0, reporting 107 tables. One adr-0131-organization-ownership birth marker exists (shape generation 1), and it is byte-identical after boot.
• A1 pass: os serve reports production, ready, with no DEGRADED line. Health and ready both return 200, and 0 refusal lines appear.

ai.mcp-run-action-exposure-gate

• A0 pass: unexposed showcase_mark_done is refused with the opt-in prescription, and the task is unchanged (admin and Mei).
• A1 pass: list_actions returns only showcase_portfolio_snapshot.
• A2 pass: the exposed action returns counts equal to REST totals.
• A3 pass: the TRUSTED audit line names the user.
• A4 pass: objectName:'sys_user' is refused by the system-object guard.

platform-core.marketplace-install-local-lifecycle

• A0 pass: boot A mounts the proxy (502 without egress) and boot B (OS_CLOUD_URL=off) answers 404 on catalog routes. The catalog branch then answers 503 without dialing out.
• A1 pass: runtime-config agrees.
• A2 pass: the CRM artifact installs and crm_app is served.
• A3 pass: members see the entry without installedBy or storageDir; anonymous gets 401.
• A4 pass: purge 28 → re-purge skipped 28 → restart durable → reseed 28.
• A5 pass: members get 403 and anonymous 401 on all four writes.
• A6 pass: uninstall withdraws objects (404) before and after a restart.

automation.flow-node-type-matrix

• A0 pass: the feed has 19 types, matching the palette.
• A1 pass: every type is exercised with a success step. http was exercised via a self-ping, since Slack egress is denied.
• A2 pass: screen, wait, approval, approval_revise, map and subflow each pause, then complete.
• A3 pass: 90 steps, 0 with an empty nodeType.
• A4 pass: loop-body, parallel-branch and try/catch regions are present.
• A5 pass: bogus_node is saved with a WARN naming unknownTypes, and the run fails with NO_EXECUTOR.

identity-auth.first-run-owner-bootstrap

• A0 pass: hasOwner goes from false to true.
• A1 pass: the wizard sign-up returns 200 under disableSignUp:true.
• A2 pass: the org is renamed to 测试组织🚀, and still has 1 row.
• A3 pass: a full reload lands on home.
• A4 pass: forged sign-ups get 400 EMAIL_PASSWORD_SIGN_UP_DISABLED / 403 SELF_REGISTRATION_CLOSED, with no row created.
• A5 pass: /setup shows no wizard for anonymous or the owner.

identity-auth.self-signup-gate

• A0 pass: invite_only is published.
• A1 pass: uninvited sign-up gets 403 SELF_REGISTRATION_CLOSED and no row.
• A2 pass: invited sign-up returns 200 and get-session works.
• A3 pass: on the disabled boot, /register redirects to login with no Sign up link.
• A4 pass: on the disabled boot, invited sign-up gets 400 and uninvited gets 403.

identity-auth.org-membership-team-management

• A0 pass: the org record page has the Members/Invitations/Teams tabs and row actions.
• A1 pass: the invite right follows the role (403 → admin 200 → member 403).
• A2 pass: off-vocabulary roles get 400 ROLE_NOT_FOUND.
• A3 pass: rename round-trips.
• A4 pass: remove-member returns 200, the old session gets 401 (organization_membership_ended), and re-sign-in gets 403 on the org.
• A5 pass: team members are recorded uniquely; a generic POST gets 405.
• A6 pass: a forger gets 403 on every management door, and state is unchanged.

identity-auth.self-service-profile-password

• A0 pass: a name change persists across a reload.
• A1 pass: the avatar goes presign → PUT → complete → update-user, and the image is a real /storage/files/ URL.
• A2 pass: removing the avatar nulls the image.
• A3 pass: the new password signs in and the old one gets 401.
• A4 pass: a wrong current password gets 400 INVALID_PASSWORD, and nothing changes.
• A5 pass: a no-password user sets an initial password, then signs in.

platform-core.settings-hub-roundtrip

• A0–A1 pass: the timezone PUT reaches me/localization, and a datetime renders +9h.
• A2 pass: an audit row is written.
• A3 pass: the override badge persists.
• A4–A5 pass: an env lock gets 409 SETTINGS_LOCKED and the UI shows a disabled "Locked by env".
• A6 pass: mail test reports honest failures.
• A7–A8 pass: secrets live in sys_secret and read back masked, with no plaintext anywhere.
• A9 pass: the env-locked secret is masked and refuses a PUT.
• A10 pass: an echoed mask is a no-op. This was proven with a fake SMTP AUTH that still carries the original value.
• A11 pass: anonymous gets 401, including with forged headers.
• A12 pass: all 11 namespaces serve.

studio-authoring.draft-publish-lifecycle

• A0 pass: a draft is invisible to runtime.
• A1–A2 pass: publish serves, and a staged draft does not leak.
• A3 pass: a stale OCC token gets 409 METADATA_CONFLICT.
• A4 pass: publish-drafts is atomic on refusal.
• A5 pass: a stray key gets 422 at draft save; a dangling dataset gets 422 at publish.
• A6 pass: the Studio draft indicator clears after publish.
• A7 pass: history is ordered.
• A8 pass: the diff names widgets only.
• A9 pass: rollback to v1 is served to Mei.
• A10–A11 pass: the audit actor is the authenticated admin, and X-Actor is ignored.

approvals.record-page-decisions

The surface is the showcase_project record page with the DeclaredActionsBar.

• A0 pass: the bar shows Approve, Reject, Reassign, Send back, Request info, Recall and Reply in order, with declared testids.
• A1 pass: Reject opens exactly 1 dialog; Confirm sends POST …/reject with the comment, 200.
• A2 pass: the reject and approve re-reads carry the comment, and the POST names the request id.
• A3 pass: the admin sees the record editable under manager_review and locked ("Locked for approval") under exec_review.
• A4 pass: the member's approvals read returns [], 0 actions render, and a forged approve gets 403. With the admin off the slate, only the Override variants render.
• N0 and N2 pass.
• N1 FAIL: on the same lockRecord:true request (exec_review), the step-9 member (a contributor who reads the project but is not on the slate) is offered inline edit: 12 double-click affordances, Edit enabled, no lock band. Saving answers PATCH /api/v1/data/showcase_project/ID {"health":"yellow"} → 409 RECORD_LOCKED. Reproduced on 3 fresh loads; the admin sees the lock on the same record. Extracted as its own card. Reproduction rule:
  1. As admin, mint a contributor member: invite-member, then sign-up, then POST /api/v1/data/sys_user_position {user_id, position:'contributor', organization_id}.
  2. As admin, PATCH /api/v1/data/showcase_project/ID {"budget":600000}.
  3. POST /api/v1/approvals/requests/MGR/approve. The new exec_review row reads lock_record:true.
  4. As the member, use a form sign-in and open /_console/apps/showcase_app/showcase_project/record/ID.
  5. Expected: no inline-edit affordance. Actual: Edit is enabled and fields are double-click editable; save → 409 RECORD_LOCKED.

approvals.decision-action-matrix

• A0–A8 pass: each action appends exactly one row. Approve and reject branches reach their terminal states. Revise returns a request that is then resubmitted as a new round, and the third revise auto-rejects. Recall is by the submitter only. Reassign, remind, request-info and comment leave state unchanged. Lock gets 409 RECORD_LOCKED under exec_review only.
• A9 blocked(fixture): no org-less request can be provisioned on stock (knownGaps[0]).
• Negatives held: revise at exec_review gets 400; a second remind gets 429 THROTTLED; a non-participant gets 403 on every door.

approvals.inbox-metadata-actions

The surface is the account-app inbox; rows open the served record page.

• A0 pass: a non-override approver gets the full page with the declared set.
• A1 pass: the submitter, approver and override sets differ as declared.
• A2 pass: the viewer flags predict the rendered set exactly.
• A3–A4 pass: approve and remind from the page land 200, and exactly one action row is appended each.
• QA run · priority:P0 (23/23) · e5f194ba · 2026-10-22 · 19 PASS / 3 PARTIAL / 1 FAIL / 0 BLOCKED / 0 NOT-RUN #25227's blank page does not reproduce.

records-forms.action-location-matrix

• A0 pass: all six hosts render their declared actions.
• A1 pass: no extra placements.
• A2 pass: bulk_reassign screen flow, quick_view modal, mark_done, log_time routed page, open_docs popup (egress-blocked target) and recalc_selection all work.
• A3 partial: the both-sides half passes (Mark Done vs Reopen). The fail-closed half is not consultable, because no throwing predicate ships on stock.
• A4: half (a) is blocked(fixture) (no locations-less packaged specimen); half (b) passes.

ux-conventions.write-feedback

• A0 pass: every landed write showed feedback paired with a server read. Covered: create, inline edit, bulk delete, kanban move, Mark Done, invite, approval decision, import, Studio autosave/publish/discard, and settings save.
• A1–A2 pass: messages name the subject, and declared messages are verbatim.
• A3 pass: a refused kanban move gives an error toast, the card reverts, and the live region announces the refusal with no "Moved" claim.
• A4 pass: a no-op edit sends no PATCH.
• A5 pass: background import Undo works (update and create modes).

Findings outside the clauses

Product defects are extracted at close-out; see the closing comment. Two runners independently observed one authorization-adjacent behavior on the approvals doors, low severity: detail withheld pending maintainer.

Low, not extracted:

• sys_setting_audit.old_hash is always null.
• A dev-seed audit row has a null actor.
• GET /approvals/requests/ID/actions answers 200 [] where GET /approvals/requests/ID answers 404 for a non-participant; nothing leaks.
• MCP run_action accepts undeclared params silently.
• OS_CLOUD_URL=off's catalog refusal says "not configured".
• admin/create-user answers membershipCreated:false while a member row exists.

Checklist-accuracy findings and fixture gaps (not extracted)

approvals:

• inbox-metadata-actions steps 2/3/6 and A0, and write-feedback variants[6], still say "drawer". Decisions are taken on the served record page.
• record-page-decisions: A3 names only the admin while negative[1] is unscoped. The bar offers Send back at exec_review, which the server refuses with 400: a predicate cannot see revise edges.
• decision-action-matrix: the approve branch logs exec_review as skipped.
• A fresh persona's positions appear only after re-reading get-session.

ux-conventions.write-feedback:

• knownGaps[3] and A5 "no stock surface offers Undo" are stale: background import offers Undo.
• A contributor sees only tasks whose assignee is their own email.
• A1 needs a ruling on object-only strings ("Task created successfully", "Settings saved").

records-forms.action-location-matrix:

• The related-list header renders list_toolbar actions.
• The Log Time page heading shows the machine name showcase_task.form.

platform-core.settings-hub-roundtrip:

• variants lists 10 namespaces against 11 elsewhere (lifecycle).
• The Mars/Phobos code is value_domain, not invalid_option.
• No stock user-scope namespace carries secrets.

studio-authoring.draft-publish-lifecycle:

• The code reads METADATA_CONFLICT in the body.
• The draft OCC token is the draft head's version.
• A stray key is now refused at draft save.
• diffShallow is top-level only.

cli.fresh-install-migrate-apply-first:

• The first serve adds a second sys_migration row (adr-0093-membership-backfill).
• The apply prints an expected-noise WARN about sys_metadata_activation.

automation.flow-node-type-matrix:

• clone needs both name and label.

identity-auth.self-signup-gate:

• The disabled-signup boot can be the bootstrap item's post-bootstrap boot.

Off-clause probe line (rule 8)

About 35 runner-minutes. Personas: admin, Mei, contributor and approver personas, a forger, a no-password user, and anonymous.

Doors and boundary classes:

• MCP run_action: empty, unknown and case-variant inputs.
• Automation runs: limit boundary values and unknown flow/run ids.
• install-local: double purge.
• Sign-up: six concurrent bootstrap sign-ups, which yielded exactly one owner.
• Rollback/diff: boundary values.
• Draft-peek params as Mei.
• Settings as a member.
• Role vocabulary.
• set-initial-password re-use.
• update-user email.
• Approvals POST family: unknown and empty ids and to, empty comment.

Found and extracted:

• rollback coerces toVersion;
• publish-drafts reports a false error-tier probe;
• reassign accepts a nonexistent principal;
• GET /automation/<unknown>/runs answers 200 [] where trigger answers 404 (in the unknown-resource family card).

Handover

None. Every item has a verdict.