QA run · release-18.3.0-w3-manual-browser (54/55) · c4c515ad · 2026-10-29 · 44 PASS / 2 PARTIAL / 8 FAIL / 0 BLOCKED / 1 NOT-RUN #27441

domain:devx#1 · sunhaolin · session_017xRBcVkGJizGH7raJHhAvL
Part of #27377 (wave 3, W3-C3b)

QA run record for the 18.3.0 release-candidate sweep, card W3-C3b: the manual set on the browser and mixed surfaces, 55 items. Every clause was driven live in a real browser (Playwright chromium) plus its API half, against the Console built in-repo. Item-level verdicts are derived from the clause verdicts, never hand-assigned. Run under .claude/skills/checklist-test/SKILL.md and docs/qa/platform-checklist/RUNNER.md.

Environment fingerprint

• Framework: c4c515ad3cc342043a2b81b5a06a5793f79a23e8, detached and pinned; it never followed main. ui/ is the same commit, and the Console was built from it with pnpm console:build --concurrency=2 after pnpm install --frozen-lockfile and pnpm build --concurrency=2 (114/114 tasks, exit 0). The CLI reports 18.2.0 (workspace version, pre-Version-PR).
• Boot (per runner): a scratch copy of examples/app-showcase under /tmp/qa-w3c3b/RUNNER/app, with node_modules symlinked to the tree. Command: OS_PORT=PORT OS_STORAGE_LOCAL_ROOT=RUN/uploads OS_HOME=RUN/home setsid node packages/cli/bin/run.js dev --ui --seed-admin -p PORT -d file:RUN/data.db.
• Ports: 41101–41112 (one per runner), plus a local webhook receiver on 41116 and a fake SMTP capture on 41125. Every runner had its own file DB and browser context.
• Extra boots, each on the runner's own port and DB:
  • group-posture walled boots (OS_TENANCY_POSTURE=group OS_PLATFORM_OWNER_EMAIL OS_AUTH_MEMBERSHIP_POLICY=invite-only) for approvals.decision-action-matrix A9 and records-forms.record-discussion-mentions A9;
  • OS_AUTOMATION_SCHEDULED_WORK_ENABLED=1 for integration-system.job-scheduled-run;
  • a zero-user OS_DISABLE_SIGNUP=true --no-seed-admin boot for identity-auth.first-run-owner-bootstrap;
  • env-lock reboots (OS_LOCALIZATION_TIMEZONE, OS_MAIL_SMTP_PASSWORD) for platform-core.settings-hub-roundtrip;
  • a minimal examples/app-todo boot (no messaging) for integration-system.notify-inbox-delivery A3.
• Seed: --seed-admin (admin@objectos.ai), the stock showcase seed (com.example.showcase 132 rows), and the demo personas. Members were minted per RUNNER, by invite then sign-up or by admin create-user. Each persona's identity was proved with GET /api/v1/auth/get-session before its cells.
• Timestamps: environment prep started 2026-10-29T04:21Z, the build was green at 04:34Z, and the runs ended at 06:56Z.
• Execution: 12 runner subagents, at most 3 browser runners at a time, in staggered waves. The orchestrator spot-checked each verdict against its runner's transcript (decisive response strings) and checked every FAIL against source.
• Hygiene: after the run, git status is clean, examples/app-showcase/.objectstack does not exist, and no listener remains on any run port. The cli.scaffold leg's newcomer boot wrote /root/.objectstack/dev-crypto-key outside the repo; that is the default with no OS_HOME.
• Time: environment prep about 91 min (13 min install and build, 3 min canary, 75 min of runner boots and fixtures) against about 398 min of testing plus 76 min of off-clause probes, summed across runners. Prep to testing is about 1 : 4.4 (1 : 5.2 with probes).

Scope

Selector release-18.3.0-w3-manual-browser: the manual browser/mixed set of anchor #27377 §0, card W3-C3b. There are no planned items in the set. Each item's revision comes from node scripts/checklist-select.mjs ID --json at the subject:

access-security.capability-declaration-lifecycle r7 · access-security.permission-matrix-edit-loop r4 · access-security.public-form-intake r3 · access-security.record-access-explain r4 · api-backend.formula-stdlib-matrix r5 · approvals.decision-action-matrix r10 · approvals.inbox-metadata-actions r7 · approvals.per-group-signoff r10 · approvals.quorum-m-of-n r8 · approvals.record-page-decisions r4 · automation.flow-error-handling r6 · automation.flow-node-type-matrix r10 · automation.packaged-flow-clone-contract r9 · automation.rollup-summary-filter r7 · automation.setup-packaged-automation-board r10 · cli.scaffold-console-first-paint r7 · dashboards.chart-type-matrix r6 · dashboards.global-filters-rescope r5 · i18n.notification-localized-and-clears r5 · i18n.strict-translation-key-rejection r4 · i18n.surface-matrix r12 · identity-auth.api-key-ui-lifecycle r5 · identity-auth.first-run-owner-bootstrap r4 · identity-auth.self-service-profile-password r2 · integration-system.job-scheduled-run r5 · integration-system.notify-inbox-delivery r6 · integration-system.webhook-lifecycle r11 · platform-core.notification-center r3 · platform-core.package-lifecycle-enable-disable r2 · platform-core.settings-hub-roundtrip r6 · records-forms.action-location-matrix r16 · records-forms.field-group-visible-when r10 · records-forms.form-view-gallery r5 · records-forms.record-discussion-mentions r12 · search.console-global-search r5 · studio-authoring.access-facets-runtime r2 · studio-authoring.access-owd-and-suggestions r2 · studio-authoring.access-permission-set-lifecycle r2 · studio-authoring.api-written-keys-survive-studio-save r2 · studio-authoring.app-and-nav-properties r2 · studio-authoring.authored-page-slots-and-variables r1 · studio-authoring.authoring-validation-not-persisted r5 · studio-authoring.dashboard-widget-and-filter-types r2 · studio-authoring.doc-on-app-menu r8 · studio-authoring.draft-publish-lifecycle r9 · studio-authoring.expression-editors r7 · studio-authoring.flow-edge-type-authoring r2 · studio-authoring.held-edit-leave-guard r2 · studio-authoring.no-entry-property-matrix r2 · studio-authoring.packaged-automation-studio-lock r5 · studio-authoring.report-authoring-options r1 · studio-authoring.summary-field-authoring r2 · studio-authoring.uninstalled-package-refused r2 · studio-authoring.view-authoring-live r4 · ux-conventions.write-feedback r7

Clause ids: A# is acceptance[#] and N# is negative[#], both zero-based. Negatives that are only a scope or cross-reference note (no oracle) are scored pass as "note honoured": nothing was scored outside the item's stated scope. That reading is parked on the anchor as an accuracy finding.

Derived item verdicts

44 PASS / 2 PARTIAL / 8 FAIL / 0 BLOCKED / 1 NOT-RUN (54 of 55 judged).

• FAIL (8): api-backend.formula-stdlib-matrix, studio-authoring.expression-editors, studio-authoring.access-owd-and-suggestions, studio-authoring.app-and-nav-properties, studio-authoring.authored-page-slots-and-variables, studio-authoring.dashboard-widget-and-filter-types, studio-authoring.summary-field-authoring, studio-authoring.held-edit-leave-guard
• PARTIAL (2): automation.setup-packaged-automation-board (A5 blocked fixture), integration-system.webhook-lifecycle (A2 blocked dependency QA run · surface:mixed (90/90) · 36b2889c · 2026-10-12 · 72 PASS / 10 PARTIAL / 8 FAIL / 0 BLOCKED / 0 NOT-RUN #23166, A4 blocked fixture)
• NOT-RUN (1): studio-authoring.no-entry-property-matrix (handover below)
• PASS (44): every other item.

Retest items (anchor §4)

Per-clause verdicts (text oracle evidence)

access-security.capability-declaration-lifecycle r7 — PASS

• A0 pass: GET /api/v1/meta/capability/showcase.export_data 200 matches defineCapability (scope org, _provenance package); /api/v1/data/sys_capability 404 OBJECT_NOT_FOUND.
• A1 pass: the held action answers 200 for a showcase_ops holder and 403 for a non-holder ("requires capability [showcase.export_data]"). Clone withdraw → 403, restore → 200. The missing/and/empty cross-checks hold.
• A2 pass: a scratch copy shadowing manage_platform_settings is refused at boot ("Security catalog name conflict", exit 1); the runtime PUT → 403 NOT_OVERRIDABLE.
• A3 pass: scope 'galaxy' fails os validate with exit 1 (capabilities.2.scope: Invalid value 'galaxy'); runtime create → 403 NOT_CREATABLE.
• N0 pass: no runtime capability write answered 2xx.
• N1 pass: no fail-open for non-holders.
• N2 pass: a withdrawn grant is not cached (403 at once).
• N3 pass: no over-block (holder 200, empty set 200 for all).
• N4 pass: not scored off /data/:obj/:id/actions (404 ENDPOINT_NOT_FOUND).

access-security.permission-matrix-edit-loop r4 — PASS

• A0 pass: a set without delete → member DELETE 403 PERMISSION_DENIED.
• A1 pass: console tick + Save → PUT /api/v1/meta/permission/qa_matrix_s 200 state active (POST …/publish → 404 NO_DRAFT).
• A2 pass: the member's DELETE → 200 and the row is gone (404).
• A3 pass: untick + Save → 403 again.
• A4 pass: assign/unassign S2 gives 403 → 200 → 403.
• A5 pass: a fresh editor shows D unchecked, matching the published allowDelete:false.
• N0 pass: every flip was matched by a PUT and a live change.
• N1 pass: a draft does not grant (403) until publish (200).
• N2 pass: cross-reference note honoured.
• FLS variant: budget write went 403 → 200.

access-security.public-form-intake r3 — PASS

• A0 pass: anonymous GET /api/v1/forms/contact-us exposes 4 fields only.
• A1 pass: forged owner_id/organization_id/created_by are ignored (201; owner null, deployment org).
• A2 pass: status/source are forced to new/web.
• A3 pass: the row persisted with the submitted values.
• A4 pass: /forms/contact-us/lookup/owner_id → 404.
• A5 pass: the console form submits 201 and shows the thank-you panel.
• A6 pass: allowAnonymous:false → 404 FORM_NOT_FOUND.
• N0 pass: no forged anchor landed.
• N1 pass: a __proto__ body has no effect.

access-security.record-access-explain r4 — PASS

• Pin packages/qa/dogfood/test/showcase-permission-zoo.dogfood.test.ts: 12 passed. It reaches the engine layer only, so the HTTP leg was driven live.
• A0 pass: the Studio "Explain access" panel renders the verdict and the full pipeline.
• A1 pass: live POST /api/v1/security/explain for the auditor → visible, decidedBy vama_bypass.
• A2 pass: explain matches the persona's own GET (200 vs 404 RECORD_NOT_FOUND).
• A3 pass: member → visible:false decidedBy sharing; no EXPLAIN_FAILED.
• A4 pass: the panel's request body and response are identical to the API call.
• N0 pass: it explains the target, not the caller.

api-backend.formula-stdlib-matrix r5 — FAIL

• A0 fail (stale spec): a 52-row known-answer matrix against the built packages/formula/dist had 0 failures. The clause says "exactly 29 … docs match"; the registry now holds 30 (validate.ts:1257 "30 added by registerStdLib"; formulas.mdx:203 documents label(record.f)).
• A1 pass: today()/daysFromNow/daysAgo/isoDate honour the tz; an unknown tz does not throw.
• A2 pass: addMonths month-end, floor/ceil of negatives, joinNonEmpty, coalesce, min/max.
• A3 pass: float division 12.345, integer 7/2=3.
• A4 pass: stock formulas and scratch formulas read-your-write (ADA-LOVELACE, 28).
• A5 pass: sqrt is refused 422 expression-invalid at the active, draft-publish and publish-drafts doors.
• N0 pass: dist path resolved.
• N1 pass: UTC midnight of the zone's day.
• N2 pass: no 2xx for an unregistered function.

approvals.decision-action-matrix r10 — PASS

• A0 pass: every verb (approve, reject, reassign, revise, resubmit, recall, remind, request-info, comment) appended exactly one action row naming actor and kind.
• A1 pass: approve and reject finalize, and the run completes.
• A2 pass: revise → 200 returned, resumed:true.
• A3 pass: resubmit opens a new pending sibling; a non-submitter → 403.
• A4 pass: the returned sibling stays returned.
• A5 pass: the third revise → autoRejected.
• A6 pass: recall by a non-submitter → 403; by the submitter → 200.
• A7 pass: reassign/remind/request-info/comment change no status.
• A8 pass: PATCH under lock_record true → 409 RECORD_LOCKED; under false → 200.
• A9 pass: on the group boot, org A → 404 REQUEST_NOT_FOUND / approve 500 READ_BACK_FAILED (write kept); org B → 200 approved.
• N0 pass: revise at exec_review → 400 "has no 'revise' out-edge".
• N1 pass: a repeat remind → 429 THROTTLED.
• N2 pass: wrong actors → 403, no row.

approvals.inbox-metadata-actions r7 — PASS

• A0 pass: the request page lists the declared actions.
• A1 pass: viewer flags gate Send reminder/Recall/Override*.
• A2 pass: the flags predict the rendered sets.
• A3 pass: approve click → POST /approve 200; remind click → a remind row.
• A4 pass: one row per action.
• N0 pass: can_act=false never sees a plain Approve.

approvals.per-group-signoff r10 — PASS

• A0 pass: slate admin[manager] + Ada[finance], 0/1 each.
• A1 pass: after the manager approves, pending_approvers=[Ada].
• A2 pass: the chips match the API at each pending stage.
• A3 pass: approved, and the run completed.
• A4 pass: two approve rows from distinct actors.
• A5 pass: actorId impersonation → 403.
• N0 pass: unanimous finalizes on one approve.
• N1 pass: a non-group member → 403.

approvals.quorum-m-of-n r8 — PASS

• A0 pass: need 1, one approve finalizes.
• A1 pass: 1/2 → approved.
• A2 pass: a reject finalizes; a later approve → 409.
• A3 pass: slate emptied; inbox count 2→1.
• A4 pass: tally "1 of 2 / 2 eligible approvers" equals the API.
• N0 pass: a repeat approve → 403, tally unchanged.
• N1 pass: the clamp is recorded as contrast only.

approvals.record-page-decisions r4 — PASS

• A0 pass: the bar renders Approve/Reject/Reassign/Send back/Request info/Recall/Reply from the viewer flags.
• A1 pass: one Reject dialog, one POST.
• A2 pass: POSTs go to request ids; the comment lands on the row.
• A3 pass: lock_record true shows a disabled Edit and "Locked for approval"; false shows live affordances.
• A4 pass: a member's forged approve → 403; the off-slate admin gets Override*.
• N0 pass: one dialog, one POST.
• N1 pass: RETEST console: a non-participant reader is offered inline edit on a record whose pending approval locks it (lockRecord: true), and the save answers 409 RECORD_LOCKED #25934 holds (table above).
• N2 pass: the member renders zero actions.

automation.flow-error-handling r6 — PASS

• A0 pass: the resilient_sync run completed and the try_catch step succeeded.
• A1 pass: four http failures (regionKind try) come before the catch step.
• A2 pass: retryAttempt 0–3 with backoff 1s/2s/4s.
• A3 pass: sync_status=failed and sync_error set.
• A4 pass: the unhandled probe run reads failed with its error.
• A5 pass: the Studio Runs panel shows TRY and CATCH groups.
• A6 pass: server.log shows ERROR "Trigger-fired run … failed".
• N0 pass: the unhandled run is failed with an error.
• N1 pass: a try region that succeeds has no catch step.
• N2 pass: full forensic trace.
• N3 pass: container status not filed.

automation.flow-node-type-matrix r10 — PASS

• A0 pass: /api/v1/automation/actions lists 19 descriptors, the same as the palette.
• A1 pass: one successful step per node type. http succeeded via a scratch self-ping; the showcase http steps lack egress (environment).
• A2 pass: screen/wait/approval/map/approval_revise/subflow each go paused → completed.
• A3 pass: no empty nodeType across all runs of 36 flows.
• A4 pass: loop/parallel/try regionKind tags present.
• A5 pass: bogus_node is stored, logs WARN unknownTypes, trigger → 400 FLOW_FAILED, run fails NO_EXECUTOR.
• N0 pass: not silent.

automation.packaged-flow-clone-contract r9 — PASS

• A0 pass: missing name/label → 400 with per-field details.
• A1 pass: the key diff is name/label/status only, with no ancestry key.
• A2 pass: both flows fire; the notice is verbatim.
• A3 pass: 409 / 404 / 400 pattern.
• A4 pass: subflow refs are not re-pointed.
• A5 pass: PUT edit persists.
• A6 pass: the clone survives a cold restart, is listed in ~org Studio, and fires.
• N0–N2 pass.
• N3 pass: anonymous → 401; member → 403 manage_metadata.

automation.rollup-summary-filter r7 — PASS

• A0 pass: six roll-ups equal recomputation.
• A1 pass: a status flip moves only approved/rejected.
• A2 pass: a billable flip moves only reimbursable.
• A3 pass: deleting a line recomputes.
• A4 pass: Studio summary-filter edit, draft → publish-drafts, live filter {status:open}.
• N0 pass.

automation.setup-packaged-automation-board r10 — PARTIAL

• Pins: ui PackagedAutomationPage*.test.tsx (47 passed, component layer) and platform-objects nav (4 passed, unit). No clause was scored from them.
• A0 pass: the Setup nav entry is served and clicked through.
• A1 pass: 32 rows = packaged flows; switches = _status.
• A2 pass: toggle persists; activation row actor = admin (RETEST automation: switching off a packaged flow or a packaged action writes the activation-ledger row and its audit row with a null actor, so nothing records which admin did it #26474).
• A3 pass: Clone only on flows.
• A4 pass: no lineage text.
• A5 blocked (fixture, knownGaps[2]: no stock member can open the Setup app). The admin half (409 DELETE_RESTRICTED alert verbatim) and the member's API 403 manage_metadata were both observed.
• A6 pass: clone dialog validation and success notice.
• A7 pass: member posture is the 403 app gate.
• N0–N2 pass.

cli.scaffold-console-first-paint r7 — PASS

Scaffolded with the workspace create-objectstack 18.2.0 at the subject; the sandbox policy refused npx create-objectstack@latest. It ran against the published @objectstack/*@18.2.0 dependency set, so the candidate console was not exercised (parked).

• A0 pass: os validate exit 0.
• A1 pass: os dev --ui → /_console/ 200, login then home.
• A2 pass: bare dev serves the same 200 and the same asset.
• A3 pass: dev admin sign-in and record create 201, read back.
• N0–N4 pass.

dashboards.chart-type-matrix r6 — PASS

• A0 pass: all 18 gallery widgets drew, 0 alerts.
• A1 pass: mark counts equal the API buckets (bar 5, column 4, pie 5, donut 4, funnel 5, radar 4; line/area 2 month buckets — thin seed).
• A2 pass: combo dual axis.
• A3 pass: treemap/sankey/scatter each draw their own geometry.
• A4 pass: kpi/gauge/solid-gauge/bullet synonyms all read "10 Tasks".
• A5 pass: pivot cells equal the API.
• A6 pass: pin examples/app-showcase/test/coverage.test.ts, 13 passed (declaration layer).
• A7 pass: compareTo 7 vs 3 "↑133%" plus a dashed series.
• A8 pass: pin packages/spec/src/ui/dashboard-compareto.test.ts, 17 passed.
• N0–N2 pass.

dashboards.global-filters-rescope r5 — PASS

• A0 pass: region EMEA re-issues 9 dataset queries with the mapped fields.
• A1 pass: custom window bounds.
• A2 pass: the opted-out KPI makes 0 re-queries and stays at 14.
• A3 pass: tiles equal the data API.
• A4 pass: NULL signed_on excluded.
• A5 pass: status picker.
• A6 pass: Studio filterBindings authored, published, and driving the reload.
• A7 pass: Reset only when dirty.
• A8 pass: label vs value; optionsFrom server GROUP BY is complete.
• N0–N3 pass.

i18n.notification-localized-and-clears r5 — PASS

• A0 pass: the zh recipient's bell entry equals the flow title, with no raw {{ }}.
• A1 pass: lands on the zh record page.
• A2 pass: POST /api/v1/notifications/read 200, unreadCount 1→0.
• A3 pass: survives reload.
• A4 pass: same title per recipient.
• N0 pass: read door 200.
• N1 pass.
• N2 pass: a notifications translation key → 422 retired dialect.

i18n.strict-translation-key-rejection r4 — PASS

• A0 pass: 10 retired/unknown keys → 422, each echoing the key and its surface.
• A1 pass: the bundle door throws the same.
• A2 pass: did-you-mean helpText→help and label→title.
• A3 pass: replacement guidance per key.
• A4 pass: rejected saves store nothing.
• A5 pass: the corrected save renders "任务QA".
• N0 pass: 13/13 rejected.
• N1 pass. The locale-shape retest result is in the table above.

i18n.surface-matrix r12 — PASS

• Pins (from ui/): page-header-action-i18n + record-quick-actions.actionText-i18n, 7 passed (jsdom component layer); the fix pin FormPage.optionLabelLocale-26452, 2 passed.
• A0 pass: every surface variant renders zh (nav, headers, options, form, action toast, empty state, sections, dashboard, pages, settings, Studio, sys_ object, relative dates, feed).
• A1 pass: keys cited from the served tree.
• A2 pass: EN fallback, no dotted keys.
• A3 pass: options in 3 places.
• A4 pass: the header is 100% zh.
• A5 pass: action toast live; confirm copy from the pins (no stock confirmText specimen).
• A6 pass: /i18n/locales enveloped, exactly [en, zh-CN].
• A7 pass: translations tree.
• A8 pass: /labels equals the header.
• A9 pass: unknown locale → empty 200.
• A10 pass: sys_activity localized per reader.
• N0–N3 pass.

identity-auth.api-key-ui-lifecycle r5 — PASS

• A0 pass: UI mint POST /api/v1/keys 201 shown once; rows carry the prefix only.
• A1 pass: key reads equal the owner's row set (6 vs admin 12).
• A2 pass: revoke → 403 API_KEY_REVOKED.
• A3 pass: restore → 200.
• A4 pass: another member's view is empty; forged by-id → 404.
• A5 pass: the dialog and list show no raw key.
• N0–N3 pass.

identity-auth.first-run-owner-bootstrap r4 — PASS

• A0 pass: anonymous bootstrap-status hasOwner false→true.
• A1 pass: wizard sign-up 200 on an OS_DISABLE_SIGNUP boot.
• A2 pass: org renamed via update (CJK "测试组织", slug kept, no create).
• A3 pass: full-document exit to home with apps.
• A4 pass: post-bootstrap forged sign-ups → 400 EMAIL_PASSWORD_SIGN_UP_DISABLED / 403 SELF_REGISTRATION_CLOSED, no user rows.
• A5 pass: /_console/setup shows no wizard.
• N0–N4 pass.

identity-auth.self-service-profile-password r2 — PASS

• A0 pass: name persists (update-user 200, get-session, reload).
• A1 pass: avatar presigned → PUT → complete → update-user with a storage URL served 200 image/png.
• A2 pass: remove → initials.
• A3 pass: change-password 200; the new password signs in, the old one → 401.
• A4 pass: wrong current password → 400 INVALID_PASSWORD.
• A5 pass: a passwordless user gets a set-initial form without a current field, 200.
• N0–N3 pass.

integration-system.job-scheduled-run r5 — PASS

On the scheduled-work boot.

• A0 pass: interval/once/cron (Asia/Shanghai 13:36 = 05:36Z) produce sys_job_run success plus side-effect rows.
• A1 pass: sys_job counters.
• A2 pass: retry makes 3 attempts with 1s/2s backoff; no policy gives 1 attempt.
• A3 pass: status 'timeout' "timed out after 1000ms".
• A4 pass: WARN handler-not-found and DEBUG disabled skip lines, no rows.
• A5 pass: compile refuses job.id and a stray cron (exit 2); PUT /meta/job → 403 NOT_CREATABLE.
• N0 pass.
• N1 pass.

integration-system.notify-inbox-delivery r6 — PASS

• A0 pass: the assignee's GET /api/v1/notifications holds the task.assigned row.
• A1 pass: a third member sees nothing; by id → 404.
• A2 pass: mark-read per receipt, and read/all.
• A3 pass: anonymous → 401; no-messaging boot → 501 NOT_IMPLEMENTED.
• A4 pass: push channel refused with WARN, 0 delivery rows.
• N0 pass.
• N1 pass.

integration-system.webhook-lifecycle r11 — PARTIAL

• A0 pass: a declared hook writes no sys_webhook row; activation door 200, unknown → 404.
• A1 pass: create/update/delete give one delivery each to the local receiver.
• A2 blocked (dependency QA run · surface:mixed (90/90) · 36b2889c · 2026-10-12 · 72 PASS / 10 PARTIAL / 8 FAIL / 0 BLOCKED / 0 NOT-RUN #23166): a flow multi-write data.records.updated names no organization and is refused.
• A3 pass: custom headers, HMAC verified, timeout 2000ms.
• A4 blocked (fixture: the cross-org 404 arm needs a walled boot). Every other arm passed: redeliver gives a byte-identical signature; anonymous 401; 400; 404; 409 DELIVERY_NOT_ELIGIBLE / DELIVERY_NEVER_SENT.
• A5 pass: an undelete trigger fails compile.
• A6 pass: activation survives reboot.
• N0 pass: retry → dead.
• N1 pass: unknown trigger logs WARN.
• N2 pass: connector.webhooks/triggers fail compile.

platform-core.notification-center r3 — PASS

• A0 pass: badge 5 = 2 groups + 3 approvals from 13 rows.
• A1 pass: three tabs.
• A2 pass: group pills ×10 and ×3 expand.
• A3 pass: group mark-read is one POST with ids[3]; badge 5→4.
• A4 pass: mark all read.
• A5 pass: approvals tab → my_pending 3.
• A6 pass: survives reload.
• N0–N2 pass.
• N3 pass: cross-reference note honoured.

platform-core.package-lifecycle-enable-disable r2 — PASS

• A0 pass: disable → data 404 OBJECT_PACKAGE_DISABLED, meta 404, app gone.
• A1 pass: enable restores.
• A2 pass: delete removes registry and persisted metadata.
• A3 pass: the commits list grows per publish.
• A4 pass: revert restores the prior published shape.
• A5 pass: tile gone; stale deep-links show a named not-found.
• A6 pass: read-only package → 422 WRITABLE_PACKAGE_REQUIRED.
• A7 pass: rows survive.
• N0–N3 pass.

platform-core.settings-hub-roundtrip r6 — PASS

• A0 pass: PUT localization, re-read cascade.
• A1 pass: /auth/me/localization and the rendered datetime shift +9h.
• A2 pass: audit row with actor and SHA-256 hashes (RETEST service-settings: sys_setting_audit.old_hash is never written (hard-coded null) and new_hash for a non-secret value is an FNV-32 digest, while both columns declare "SHA-256 of the … value" #26465).
• A3 pass: source badge Tenant.
• A4 pass: env lock → 409 SETTINGS_LOCKED.
• A5 pass: locked input disabled.
• A6 pass: mail test ok:false without a transport; ok:true only with a real host.
• A7 pass: secrets in sys_secret, aes-256-gcm.
• A8 pass: mask "••••••••". The user-scope chain is not walkable on stock, as steps[9] notes.
• A9 pass: env-locked secret.
• A10 pass: an echoed mask is a no-op; a new value rotates; the transport uses the plaintext.
• A11 pass: anonymous 401.
• A12 pass: 11 namespaces.
• N0–N7 pass.

records-forms.action-location-matrix r16 — PASS

• A0 pass: every location renders its declared actions.
• A1 pass: none outside them.
• A2 pass: each location dispatches (bulk_reassign wizard resume 200; mark_done 200 done:true; recalc 1→88).
• A3 pass: the visible predicate gates; a throwing one fails closed.
• A4 pass: no-locations and [] render nowhere.
• N0–N2 pass.

records-forms.field-group-visible-when r10 — PASS

• A0 pass: bare string and envelope → 200, normalized.
• A1 pass: visibleOn → 422 unrecognized_keys.
• A2 pass: passthrough pin.
• A3 pass: form and detail gate live in both spellings.
• A4 pass: hidden-section values survive save.
• N0 pass.
• N1 pass.
• N2 pass: RETEST object door: fieldGroups[].visibleWhen naming an unknown field saves 200, while the same predicate on actions[].visible or fields.*.visibleWhen is refused 422 #26646 holds; a runtime fault fails closed.
• N3 pass.

records-forms.form-view-gallery r5 — PASS

• A0 pass: simple/tabbed/wizard/drawer/modal render. The split leg is stale: type split is refused 422 by spec 18.3.0 (ADR-0050); parked.
• A1 pass: one POST 201.
• A2 pass: conditional Notes.
• A3 pass: only edited fields PATCHed.
• A4 pass: tab and wizard state kept.
• N0 pass: empty required blocks Next.
• N1 pass.

records-forms.record-discussion-mentions r12 — PASS

• A0 pass: one comment row.
• A1 pass: stable id, no duplicate.
• A2 pass: oldest-first on Project Detail.
• A3 pass: mention notifies; click marks read.
• A4 pass: non-mentioned user gets nothing.
• A5 pass: FEEDS_DISABLED 403 on create.
• A6 pass: FEEDS_DISABLED 403 on re-thread.
• A7 pass: filter modes.
• A8 pass: custom milestone.
• A9 pass: withheld cannot_read_source on both the single and walled boots.
• N0–N6 pass.

search.console-global-search r5 — PASS

• A0 pass: Ctrl/Meta+K, header button and ?palette=1/?cmdk=1 open one overlay.
• A1 pass: a single GET /api/v1/search.
• A2 pass: pinyin/hanzi hits grouped.
• A3 pass: Enter navigates.
• A4 pass: empty input shows recents with no request.
• A5 pass: the contributor gets 0 invoice hits.
• A6 pass: /search page and empty state.
• N0–N4 pass.

studio-authoring.access-facets-runtime r2 — PASS

• A0 pass: capability chip → action 200, removed → 403 "missing [showcase.restricted_ops]". A declared capability was used because qa_cap cannot be declared at runtime.
• A1 pass: RLS rules; test dialog Allowed/Denied.
• A2 pass: member reads scoped; write check 403.
• A3 pass: tabPermissions keyed by the whole app name.
• A4 pass: the hidden app is omitted from /me/apps, the launcher and the switcher.
• N0 pass.
• N1 pass.

studio-authoring.access-owd-and-suggestions r2 — FAIL

• A0 pass: the OWD panel sends one PUT per changed object.
• A1 fail: a controlled_by_parent save on a master_detail child → 409 DESTRUCTIVE_CHANGE, with no force path in the panel.
• A2 pass: Everyone grant/revoke 403→200→403.
• A3 pass: dismiss.
• N0 pass.
• N1 pass.

studio-authoring.access-permission-set-lifecycle r2 — PASS

• A0 pass: New set derives the identifier and creates a draft.
• A1 pass: a duplicate identifier is refused in the dialog with no PUT.
• A2 pass: rail search.
• A3 pass: read-only package chip; matrix disabled.
• A4 pass: forged PUT → 403 ITEM_LOCKED / 422 WRITABLE_PACKAGE_REQUIRED.
• N0 pass.
• N1 pass.

studio-authoring.api-written-keys-survive-studio-save r2 — PASS

• A0 pass: across six variants a Studio PUT changes only the edited key.
• A1 pass: API-written keys are present in every Studio PUT.
• A2 pass: they are live after publish-drafts.
• N0 pass.

studio-authoring.app-and-nav-properties r2 — FAIL

• A0 pass: branding, areas and context selector render.
• A1 pass: viewName, recordId+edit, filters and badge entries work.
• A2 pass: an entry whose requiresObject is missing is absent.
• A3 fail: a bare-string visible "'org_owner' in current_user.positions" hides the entry from the admin too. The console logs "Unexpected token "i" at position 12"; the envelope control works.
• A4 pass: the hidden app is reachable and omitted from the switcher.
• A5 pass: inspector controls autosave.
• N0 pass.
• N1 pass.

studio-authoring.authored-page-slots-and-variables r1 — FAIL

• A0 pass: slot overrides render.
• A1 fail: the array-variable block with visibleWhen "size(page.items) > 0" is absent while items=["a"] (console '"size" is not a function'); the envelope control renders.
• A2 pass: live re-evaluation.
• N0 fail: same as A1.
• N1 pass.

studio-authoring.authoring-validation-not-persisted r5 — PASS

• A0 pass: a field without type → 422 with issues.
• A1 pass: a container-shaped view → 422 with the Wrap remedy.
• A2 pass: nothing persisted.
• A3 pass: the Setup Source tab shows a located red banner.
• A4 pass: the corrected shapes save 200.
• N0–N2 pass.

studio-authoring.dashboard-widget-and-filter-types r2 — FAIL

• A0 pass: all 20 chart types render. 1 was authored in Studio and 19 through the API.
• A1 pass: the Add menu and the Type picker both list the same 20.
• A2 pass: five filter types render.
• A3 pass: each filter re-queries with runtimeFilter; an unbound widget makes no query.
• A4 fail: Global Filters "Add item" autosaves {} → 422 globalFilters.N.field, and the next edit is lost.
• N0 pass.
• N1 pass.

studio-authoring.doc-on-app-menu r8 — PASS

• A0 pass: /meta/app nav is pruned per reader; the outsider's book tree → 403.
• A1 pass: menus match the API.
• A2 pass: lands in the claiming book.
• A3 pass: gated routes show the lock heading with a server 403; unknown → 404 not found.
• N0–N4 pass.

studio-authoring.draft-publish-lifecycle r9 — PASS

• A0 pass: a draft is not served (404).
• A1 pass: publish serves it.
• A2 pass: a staged draft does not leak.
• A3 pass: stale If-Match → 409.
• A4 pass: publish-drafts is atomic (refuse NAMESPACE_PREFIX, then publish 3).
• A5 pass: a stray key is refused 422 at save.
• A6 pass: Studio pill counts.
• A7 pass: history.
• A8 pass: diff, plus RETEST metadata-protocol: GET /meta/:type/:name/diff answers 200 for a version that does not exist — "no change" or "everything removed" — while rollback refuses the same version 404 VERSION_NOT_FOUND #26462.
• A9 pass: rollback.
• A10 pass: audit actor.
• A11 pass: X-Actor is ignored.
• N0–N4 pass.

studio-authoring.expression-editors r7 — FAIL

• A0 pass: result-type inference matches the engine.
• A1 pass: returnType is written for the edited field only.
• A2 fail: on the formula-field RLS probe the editor says "Valid CEL" while the engine says rls-predicate-unenforceable. 7/8 other probes match.
• A3 pass: root completions.
• A4 fail: the formula-field predicate autosaves; the server verdict appears after save.
• A5 pass: the test-run dialog.
• A6 fail: parity table 7/8.
• A7 pass: pin celAuthoring.test.ts, 40/40 (jsdom).
• N0 fail: same as A4.
• N1 pass: parse-fault saves are held.
• N2 pass.

studio-authoring.flow-edge-type-authoring r2 — PASS

• A0 pass: the inspector writes conditional/fault/back; Normal omits the key.
• A1 pass: condition, label and isDefault.
• A2 pass: publish is identical.
• A3 pass: the inspector shows the server CEL error.
• A4 pass: publish-drafts refused expression-invalid; live unchanged.
• N0 pass: loopback → 422.
• N1 pass.

studio-authoring.held-edit-leave-guard r2 — FAIL

• A0 pass: in-app departures confirm on every held or dirty pillar and on no clean one.
• A1 fail: an Interfaces nav rename followed by a reload raises no beforeunload, and the rename is lost.
• A2 pass: Stay keeps the edit and the autosave carries it.
• A3 pass: Leave writes nothing.
• N0–N2 pass.

studio-authoring.no-entry-property-matrix r2 — NOT-RUN

15 of about 45 variant rows were measured, and all held: stored byte-equal, served after publish, and took effect (append-only POST 403, ownership org, audit false, autonumber, notNull 400, internal omitted, mask, restrict 409, multiple lookup, flow success/error messages, retry 2, view.form buttons; unknown datasource → 422). No clause was judged over its full variant set. Handover below.

studio-authoring.packaged-automation-studio-lock r5 — PASS

• A0 pass: zero /meta writes across select, drag and fill on the read-only showcase.
• A1 pass: flow md5 identical; forged PUT → 403 ITEM_LOCKED / NOT_OVERRIDABLE.
• A2 pass: the header switch is disabled with its described reason.
• A3 pass: inspector controls are disabled.
• N0–N2 pass.

studio-authoring.report-authoring-options r1 — PASS

• A0 pass: tabular, summary, matrix and joined render.
• A1 pass: the dataset query (north, desc) equals the rendered order.
• A2 pass: joined+chart → 422 at path chart; a block without dataset → 422.
• N0 pass.
• N1 pass.

studio-authoring.summary-field-authoring r2 — FAIL

• A0 fail: Add field type Rollup autosaves {type:summary} with no summaryOperations (no held line).
• A1 fail: the Sum child-field picker offers text, datetime and lookup fields.
• A2 pass: completed rollups go live.
• A3 pass: count/sum recompute (5/150 → 4/230).
• N0 fail: same as A0.
• N1 pass.

studio-authoring.uninstalled-package-refused r2 — PASS

• A0 pass: a flow draft into the uninstalled package → 422 WRITABLE_PACKAGE_REQUIRED.
• A1 pass: object/dashboard/page drafts and active saves → 422, read-backs 404.
• A2 pass: publish-drafts → 404.
• A3 pass: Studio shows "Package not found"; an unknown pillar shows "does not exist".
• N0 pass.
• N1 pass.

studio-authoring.view-authoring-live r4 — PASS

• A0 pass: view draft 200.
• A1 pass: the draft is not served.
• A2 pass: publish changes the list and form with no restart.
• A3 pass: meta views.
• A4 pass: a re-draft stays invisible until re-publish.
• N0 pass.
• N1 pass.

ux-conventions.write-feedback r7 — PASS

• A0 pass: all 15 write surfaces give feedback.
• A1 pass: each names the record or a count.
• A2 pass: declared successMessage holes render (RETEST app-showcase: record-action success messages name no record ("Task marked done.") — fails the write-feedback naming rule (ruling C on #25849); the runner fills {{ }} holes, so the copy can name the record #26459/app-shell: the full-page record form (/new, /edit route) still toasts "Task updated successfully" — #26172's fix covered AppContent's dialog paths only; RecordFormPage passes the object label alone #26461).
• A3 pass: refusals: required-empty sends no POST; member → 403 error toast.
• A4 pass: a no-op makes no write.
• A5 pass: import undo for create and update.
• N0–N2 pass.

Reproduction rule for every fail

R-1 · api-backend.formula-stdlib-matrix · A0 (stale spec, product correct)

1. grep -n registerFunction packages/formula/src/stdlib.ts: 29 chained bare-callables, plus label at ~L460 (bindOptionLabel).
2. packages/formula/src/validate.ts:1257 reads "30 added by registerStdLib".
3. content/docs/data-modeling/formulas.mdx:203 documents label(record.f).
4. ExpressionEngine.evaluate({dialect:'cel',source:"label(record.kind)"}, {record:{kind:'clean'},optionLabels:{kind:{clean:'Clean'}}}) → "Clean".
   Expected (clause): 29. Actual: 30, with registry and docs agreeing.

R-2 · studio-authoring.expression-editors · A2 / A4 / A6 / N0 (stale spec against the #26858 ruling)

1. POST /api/v1/packages {"id":"com.qa.rten","name":"QA R10","version":"0.1.0","type":"app","namespace":"qar"}.
2. PUT /api/v1/meta/object/qar_job?package=com.qa.rten with sharingModel public_read_write, number est_hours, and formula f_formula {type:"formula",expression:"record.est_hours * 1.1"}.
3. PUT /api/v1/meta/permission/qar_job_editor?package=com.qa.rten with objects.qar_job allowRead and rowLevelSecurity [{name:"qar_probe_policy",object:"qar_job",operation:"select",using:"record.status == 'open'"}].
4. Form sign-in → /_console/studio/com.qa.rten/access → QAR Job Editor → Row-level security.
5. Fill USING with record.f_formula > 5.
   Expected (clause): error-tier lint and save held. Actual: "Valid CEL" for about 1.5s, then a draft PUT, then the server INVALID_FIELD verdict at the field. Publish → 422 rls-predicate-unenforceable. Reproduced twice.

R-3 · studio-authoring.access-owd-and-suggestions · A1 (product defect)

1. POST /api/v1/packages {"manifest":{"id":"com.qa.rnine","name":"QA R9","version":"0.1.0","type":"app","namespace":"qnine"}}.
2. PUT /api/v1/meta/object/qnine_project?mode=draft&package=com.qa.rnine with {sharingModel:"private",fields:{name:{type:"text"}}}.
3. PUT /api/v1/meta/object/qnine_step?mode=draft&package=com.qa.rnine with {sharingModel:"private",fields:{name:{type:"text"},project:{type:"master_detail",reference:"qnine_project"}}}.
4. POST /api/v1/packages/com.qa.rnine/publish-drafts.
5. /_console/studio/com.qa.rnine/access → Record sharing (OWD) → QN Step → "Controlled by parent" → Save.
   Expected: the draft saves. Actual: PUT …/qnine_step?mode=draft&package=com.qa.rnine&surface=studio → 409 DESTRUCTIVE_CHANGE "re-submit with ?force=true"; the panel has no force control and the row stays Unsaved. Reproduced twice.

R-4 · studio-authoring.app-and-nav-properties · A3 (product defect)

1. PUT /api/v1/meta/app/APP?mode=draft&package=PKG with a nav entry {"type":"object","id":"nav_admin_only","label":"Admin Only Entry","objectName":"qnine_note","visible":"'org_owner' in current_user.positions"}, then publish.
2. As admin (get-session positions include org_owner), open the app.
   Expected: the entry is shown to the admin. Actual: hidden from everyone; console "A visibility predicate could not be evaluated … Unexpected token "i" at position 12". The envelope {"dialect":"cel","source":…} is shown to the admin and hidden from the member. Reproduced three times.

R-5 · studio-authoring.authored-page-slots-and-variables · A1 / N0 (product defect)

1. PUT /api/v1/meta/page/qnine_vars_page2?mode=draft&package=PKG with {"type":"app","variables":[{"name":"items","type":"array","defaultValue":["a"]}],"regions":[{"name":"main","components":[{"type":"element:text","id":"b_items","visibleWhen":"size(page.items) > 0","properties":{"content":"VAR-ITEMS array nonempty"}}]}]}, then publish.
2. Open /_console/apps/PKG/page/qnine_vars_page2.
   Expected: the text renders. Actual: it is absent; console '"size" is not a function'. The envelope control renders it. Reproduced twice.

R-6 · studio-authoring.dashboard-widget-and-filter-types · A4 (product defect)

1. /_console/studio/PKG/interfaces → dashboard → Properties → Filters → Global Filters → "Add item" (the last one).
2. Leave it empty and edit the dashboard Label.
   Expected: the empty item is held and the label persists. Actual: PUT …/dashboard/NAME?mode=draft&package=PKG&surface=studio with globalFilters[N]={} → 422 "globalFilters.N.field [invalid_type]"; the label PUT is also 422 and the label is lost after reload. Reproduced three times.

R-7 · studio-authoring.summary-field-authoring · A0 / A1 / N0 (product defect)

1. Use a writable package with a parent object and a child object (master_detail), the child having number amount and text name and memo.
2. /_console/studio/PKG/data → parent → Form → Add field → "Child Count", type Rollup → Create.
3. Child object = child, Aggregation = Sum → open the child-field picker.
   Expected: the unconfigured rollup is held with no PUT, and the Sum picker offers numeric fields only. Actual: PUT …/object/PARENT?mode=draft&package=PKG&surface=studio 200 {type:"summary"} with no summaryOperations; the picker lists text, datetime and lookup fields. Reproduced twice.

R-8 · studio-authoring.held-edit-leave-guard · A1 (product defect)

1. Use a writable package with an app whose navigation has a dashboard entry "QA Dash".
2. /_console/studio/PKG/interfaces → "Edit" → double-click "QA Dash" → type "QA Dash Lost" → reload.
   Expected: a beforeunload prompt, as every other held pillar raises. Actual: no prompt; dispatchEvent(new Event('beforeunload',{cancelable:true})) leaves defaultPrevented false, and the rename is lost (0 PUTs). In-app departures in the same state do confirm. Reproduced twice plus four timing cells.

Fixture gaps, partial coverage and handover

• automation.setup-packaged-automation-board · A5: no stock member persona can open the Setup app (knownGaps[2], third measurement). The member in-page alert is unobservable; the admin half and the member API 403 were observed.
• integration-system.webhook-lifecycle · A2: blocked on QA run · surface:mixed (90/90) · 36b2889c · 2026-10-12 · 72 PASS / 10 PARTIAL / 8 FAIL / 0 BLOCKED / 0 NOT-RUN #23166 (flow multi-writes carry no organizationId).
• integration-system.webhook-lifecycle · A4: the cross-organization deliveryId 404 arm needs a walled boot with a second org. The parked-row arm (DELIVERY_NEVER_SENT) was made by corrupting a sys_secret ciphertext in the run's own DB; there is no shipped recipe.
• integration-system.webhook-lifecycle · N1: a drifted-triggers row can only be made by a DB edit.
• cli.scaffold-console-first-paint: the pre-release registry variant was not provisioned, so the candidate console (vs published 18.2.0) was not exercised.
• platform-core.settings-hub-roundtrip · A8 / A10: no stock user-scope secret, and no read-only getNamespace door (a local fake SMTP capture was the in-process consumer).
• i18n.surface-matrix · A5: no stock action with confirmText (knownGaps[3]); the confirm copy was scored from pins at the jsdom layer.
• studio-authoring.access-facets-runtime · A0: qa_cap cannot be declared at runtime (403 NOT_CREATABLE); the declared showcase.restricted_ops was used.
• dashboards.global-filters-rescope · A8: no stock optionsFrom filter (a scratch one was added). A3: the EMEA 90-day invoice total is 0, so it was scored on counts.
• automation.flow-node-type-matrix · A1 http: the showcase http steps have no egress here; success was proven on a scratch self-ping.
• HANDOVER (not-run): studio-authoring.no-entry-property-matrix. About 30 variant rows remain: member-persona rows (field requiredPermissions, fileAccessDelegate, defaultRowScope), showcase_external datasource rows, view.list and field-widget rendering rows, permission positions, dashboard requiredPermissions, and dataset nullLabel.

Off-clause probes (RUNNER rule 8)

About 76 minutes in total across 12 runners, on the same boots and as the same personas.

Doors probed:

• approvals decision, actions and reassign routes
• sys_comment and notification doors
• security explain
• the actions dispatcher
• capability and grant doors
• public forms
• packages lifecycle, commits and publish-drafts
• settings
• search
• the dataset query
• metadata save, diff, history, audit and rollback
• translations and i18n
• notifications read
• webhooks redeliver and activation
• job and connector compiles
• keys
• auth password and profile
• clone and toggle doors
• Studio array editors

Boundary classes tried: empty string, missing id, unknown id, whitespace, wrong type, non-JSON body, inverted window, out-of-range limit, opposite posture (member on admin doors, draft vs active, walled vs single), and readers outside the asserted scope (third members, anonymous, cross-org).

Findings extracted as cards are listed in the close-out comment. Observations not filed, judged below the filing gate or by design:

• POST …/%20/approve 404 with an empty message;
• recalc on an unknown id answers 400 FLOW_FAILED rather than 404;
• mentioning a nonexistent user logs reason cannot_read_thread;
• an If-Match carrying the published version with no draft row → 409 "current is null";
• an edge typed conditional with no condition publishes with an advisory only;
• /meta/book/UNKNOWN/tree 200 empty vs /meta/doc/UNKNOWN 404;
• DELETE of an empty package reports data.success true and persisted.success false;
• search limit=0 clamps to 1 with totalHits 1;
• tabPermissions {"":"hidden"} is accepted;
• a lookup global filter without optionsFrom shows only "All";
• discard-drafts ignores an unknown body key;
• the "Send back" lever is offered at exec_review, where the showcase flow documents the 400 as its designed answer.

Two probe findings were authentication/authorization-shaped. They are withheld under the maintainer ruling of 2026-10-29 and handed to the dispatching PM session; nothing about them appears on GitHub.

Generated by Claude Code