QA run · release-18.3.0-w3-retest (13/13) · 6e11a929 · 2026-11-01 · 11 PASS / 0 PARTIAL / 2 FAIL / 0 BLOCKED / 0 NOT-RUN #28656

domain:devx#1 · sunhaolin · session_017xRBcRX4wwwVw5bEckffdp
Part of #27377 (wave 3, W3-RT — retest of the wave's fixed FAILs)

Dispatched by the PM session session_017xRBcVy4VXmkQjn2MGeaWk on the maintainer's instruction, verbatim: 「同意开 复测云卡片」. This run re-judges, live, the wave-3 FAILs whose fixes landed after c4c515ad (anchor §0.1, column "re-judged": no). It also takes the first live read of approvals.dynamic-approver-routing acceptance[3]'s snapshot leg (anchor comment 6539452860). Per checklist-test SKILL §5, this is trigger 2. The runner only tests.

Environment fingerprint

• Framework: 6e11a929e453e1f9a78a9eb7b311c46b2fa8d094 (main at 2026-11-01T10:15Z), detached. ui/ is the same tree. The tree was clean before and after (git status empty).
• Build:
  • pnpm install --frozen-lockfile, then pnpm build --concurrency=2 (10:38–10:47Z), then pnpm console:build --concurrency=2, which printed 72 successful (a cache hit plus a copy).
  • node scripts/check-dev-prereqs.mjs: 106 package artefacts present.
• Console: the served /_console/ entry index-rNiny7yV.js equals packages/console/dist/assets/index-rNiny7yV.js (byte-identical, sha256 a386a1fc…). Checked on every boot, which rules out a stale console bundle.
• App and boots: stock showcase. One compile boot brought examples/app-showcase/dist/objectstack.json current. Every item then booted from the tree:
  • with --no-compile --no-watch --seed-admin;
  • with OS_PORT and OS_STORAGE_LOCAL_ROOT exported;
  • each on its own port and its own file DB: ports 41711–41714, 41721–41724, 41731–41734 and 41741, DB file:/tmp/w3rt/ITEM/data.db;
  • stopped by process group afterwards.
  • The email item's declared-source reload leg booted from a scratch copy of the app.
• Fixtures: writable fixture packages were authored at runtime through POST /api/v1/packages on each item's own DB, with no tree edits.
• Personas:
  • the seeded admin;
  • members minted per RUNNER (invite then sign-up, or admin create-user);
  • the seeded demo personas Ada Auditor and Mei.
  • Each persona's identity was proved with GET /api/v1/auth/get-session before its cells, in one browser context per persona, signed in through the console form.
• Browser: Playwright chromium, headless, at most 3 browser runners at once.
• Runners:
  • four runner subagents (R1–R4, effort high) plus one independent RUNNER-rule-7 verifier for the P0 FAIL;
  • each subagent's verdicts were checked against its artefacts (network logs, DB rows, screenshots, pin output) before they were accepted.
• Clock: 2026-11-01, 10:37Z to 12:10Z, container timezone Etc/UTC.

Scope

Selector release-18.3.0-w3-retest: 13 item ids, each pinned at the revision node scripts/checklist-select.mjs ID --json reports at 6e11a929. No planned items.

Item verdicts and "fix holds?"

Per-clause verdicts (text oracle evidence)

studio-authoring.expression-editors · rev 7 · port 41711

studio-authoring.access-owd-and-suggestions · rev 4 · port 41712

studio-authoring.app-and-nav-properties · rev 4 · port 41721

studio-authoring.authored-page-slots-and-variables · rev 3 · port 41722

studio-authoring.dashboard-widget-and-filter-types · rev 4 · port 41723

studio-authoring.summary-field-authoring · rev 4 · port 41724

studio-authoring.held-edit-leave-guard · rev 4 · port 41714

integration-system.email-template-render · rev 11 · port 41733

studio-authoring.object-api-tab-curl · rev 2 · port 41713

approvals.account-app-entry · rev 7 · port 41731 (P0)

approvals.dynamic-approver-routing · rev 5 · port 41732

api-backend.formula-stdlib-matrix · rev 6 · port 41741

records-forms.field-history-tracking · rev 10 · port 41734

Reproduction rules for each fail

1. approvals.account-app-entry · acceptance[3] (stock showcase at 6e11a929, Console built in-repo):

1. Boot: OS_PORT=PORT pnpm -C examples/app-showcase exec objectstack dev --ui --seed-admin --no-compile -p PORT -d file:/tmp/x/data.db.
2. As admin, POST /api/v1/auth/organization/invite-member {"email":"X","role":"member"}; then X POST /api/v1/auth/sign-up/email.
3. As admin, POST /api/v1/data/sys_user_position {"user_id":X_ID,"position":"contributor","organization_id":ORG}, and the same with "finance".
4. As X:
   • POST /api/v1/data/showcase_invoice {"name":"INV-1","account":ACTIVE_ACCOUNT_ID,"owner":"X"};
   • then PATCH /api/v1/data/showcase_invoice/ID {"status":"sent","issued_on":"2026-11-01"}.
   • This opens request AREQ with X pending.
5. Sign X in through the form. Open /_console/apps/com.objectstack.account/component/approvals/inbox, click the row's Request cell, then getByRole('button',{name:'Approve'}) → getByRole('button',{name:'Confirm'}).
6. Expected: decision_progress 0/2 → 1/2, X leaves pending_approvers, and an approve row appears in /approvals/requests/AREQ/actions.
7. Actual: POST /api/v1/actions/sys_approval_request/approval_approve {"recordId":"AREQ","params":{}} → 404 {"code":"RECORD_NOT_FOUND","message":"Record AREQ not found in sys_approval_request"}, and the request is unchanged.
8. Controls:
   • X POST /api/v1/approvals/requests/AREQ/approve {} → 200;
   • the admin on the action door → 200;
   • X GET /api/v1/data/sys_approval_request/AREQ → 403.
   • approval_reject, approval_comment and approval_request_info → 404 as well.
9. Mechanism: packages/runtime/src/domains/actions.ts loads the subject row in the caller's data scope (loadActionSubjectRecord), and refuseDeniedSubjectLoad answers 404 before the type:'api' forward.

2. studio-authoring.expression-editors · acceptance[2], [4], [6], negative[0]:

1. As admin, POST /api/v1/packages {"manifest":{"id":"com.qa.rone","name":"QA R1 Expr","version":"0.1.0","type":"app","namespace":"qee"}}.
2. PUT /api/v1/meta/object/qee_job?mode=draft&package=com.qa.rone, with number est_hours and formula f_formula {"type":"formula","expression":"record.est_hours * 1.1","returnType":"number"}.
3. PUT /api/v1/meta/permission/qee_job_editor?mode=draft&package=com.qa.rone, with objects.qee_job.allowRead and rowLevelSecurity: [{"name":"qee_probe_policy","object":"qee_job","operation":"select","using":"record.status == 'open'"}].
4. POST /api/v1/packages/com.qa.rone/publish-drafts.
5. Sign in through the form. Open /_console/studio/com.qa.rone/access?surface=permission:qee_job_editor, click [data-testid=perm-tab-rls], and type record.f_formula > 5 into USING.
6. Expected: an error-tier finding, and the save held with no PUT.
7. Actual:
   • at about 1.1 s the field reads "Valid CEL", with no perm-autosave-held;
   • at about 2.1 s, PUT …/permission/qee_job_editor?mode=draft… → 200 carrying "using":"record.f_formula > 5";
   • at about 2.6 s the field turns aria-invalid: "RLS using (INVALID_FIELD / 400): … 'f_formula', a virtual formula field".
   • Typing record.f_formula > 9 repeats the cycle.
   • POST …/permission/qee_job_editor/publish → 422 rls-predicate-unenforceable.
8. Mechanism: ui/…/metadata-admin/celAuthoring.ts rlsPredicateVerdict judges a one-clause stack that names no object, so the virtual-field branch cannot fire client-side. draftVerdict.ts serverHoldAt holds only after the server has judged that text.
9. This is the residual that PR fix(app-shell): a server error at an RLS clause's path holds the permission-set autosave #27612 documents as by design; parent Studio: an expression the engine refuses (RLS USING on a formula field, a null-unsafe validation predicate) keeps autosaving — the server verdict is shown on the field but never holds the save #27482 is still open.

Disposition of each fail (SKILL §5)

• approvals.account-app-entry · acceptance[3]: product defect. It is a new door, not Approvals: a non-admin approver who opens an approval request from the Approvals inbox sees "You don't have access to Approval Request records" instead of the decision panel (regression from #27713) #28546: extracted as its own card, listed in the close-out comment.
• studio-authoring.expression-editors · acceptance[2], [4], [6], negative[0]: product defect, carried by the open card Studio: an expression the engine refuses (RLS USING on a formula field, a null-unsafe validation predicate) keeps autosaving — the server verdict is shown on the field but never holds the save #27482. That was a dedupe hit, so it is not re-extracted. Studio: an expression the engine refuses (RLS USING on a formula field, a null-unsafe validation predicate) keeps autosaving — the server verdict is shown on the field but never holds the save #27482 should not close on Studio: the Validations tab holds the autosave on a served CEL verdict at the rule's own path, as the RLS arm does (#27482 layer 2 of 2) #27644 alone. Its owner decides between:
  • an editor fix (the editor judges the formula-field probe with the object in scope, so the first save is held), or
  • a maintainer ruling that the once-per-new-text save is accepted. In that case acceptance[4]'s "no PUT issued" is reworded, and that is a ledger edit parked on the anchor.

Pins run (at 6e11a929, --maxWorkers=1, one package at a time)

• ui (jsdom), corroboration only except where noted:
  • metadata-admin CEL / hold suites: 8 files, 98 passed. celAuthoring.test.ts 40/40 scores expression-editors acceptance[7].
  • OWD panel: 3 files, 18 passed.
  • ObjectApiPanel.exampleBody-11803: 13/13.
  • Studio leave guards: 6 files, 30 passed.
• formula stdlib:
  • packages/formula option-label + cel-stdlib-drift: 12 passed (unit).
  • packages/metadata-protocol protocol.runtime-authoring-gate.test.ts: 222/222. Protocol over a stub engine, which is above acceptance[5]'s HTTP oracle, so acceptance[5] was scored live.
  • packages/lint runtime-gate.object-formula-writes: 11 passed.
  • packages/objectql engine-formula-fault-log: 6 passed (engine layer).
• email:
  • packages/qa/dogfood email-template-*.dogfood.test.ts: 3 files, 11 passed (engine + REST).
  • packages/rest email-send-door-bounds.test.ts: 36 passed (HTTP layer; pins acceptance[7]'s 501 leg).
  • packages/plugins/plugin-email send-template.test.ts: 20 passed (unit, below the api oracle, so driven live).
• field history:
  • plugin-audit lookup + option-label summary: 32 passed.
  • packages/qa/dogfood field-history-tracking-activity: 3 passed.
  • ui/e2e/live/record-history-display.spec.ts was scored by hand, not run. It needs the vite console on :5180.

Off-clause probes (RUNNER rule 8)

About 50 minutes across the 13 items, on the same boots and personas.

• Doors probed:
  • the RLS / CEL editors, the OWD panel and suggested-bindings doors;
  • the app nav and page-variable save doors, and the dashboard held-item doors;
  • the summary save and publish doors, and child writes after publish;
  • the cURL bodies over every field type;
  • the approvals decision and action doors, and the dynamic-approval outputs;
  • the email send door bounds, and template reads as a member;
  • the audit and activity reads as non-admins;
  • formula stdlib edge cases, with the live authoring door and tenant-timezone switching.
• Boundary classes: empty string, unknown or missing id, unknown field or object, wrong type, duplicates, draft against publish, bare against envelope predicates, select against write policies, admin against member against anonymous, and DST and extreme timezones.
• Findings: eight product defects, each extracted as its own card (listed in the close-out comment).
• Probe time per item fell short of the 10–15 min budget for several items. The per-item minutes are in the runner notes; this is stated plainly, not padded.

Fixture gaps and partial coverage

• studio-authoring.app-and-nav-properties acceptance[5]: the requiresObject cell has no Studio control (knownGaps[0]), so it was not judged. The other cells pass.
• studio-authoring.expression-editors: only the Studio package door was observable, not the environment door's disabled Save, as the clause allows on stock showcase.
• records-forms.field-history-tracking acceptance[4]: unit only, because the showcase has no tracked reference field.
• records-forms.field-history-tracking: record-history-display.spec.ts needs a vite console; it was hand-mirrored here.
• integration-system.email-template-render knownGaps[0]: no stock flow invokes sendTemplate, so a scratch type:'api' flow was used.

Checklist-accuracy findings are parked on the anchor #27377, not here.

Time

• Environment prep:
  • 11 min wall clock (cold install, build, console build, compile boot: 10:37–10:48Z);
  • about 35 runner-minutes of per-item boots and fixture authoring.
• Testing, probes included:
  • 80 min wall clock (10:48–12:08Z, four runners in parallel);
  • about 155 agent-minutes, plus 6 minutes for the rule-7 verifier.
• Ratio: about 1 : 7.3 by wall clock, and 1 : 3.4 by agent-minutes.

Generated by Claude Code